I thought I was trying to make a very basic change on our incident_task table, namely: it should not be possible to create or edit incident tasks if the parent incident is state: closed or canceled.
To that end, I went to the incident_task table and first tried editing the existing ACLs that control write and create based off of role: itil. I used the condition builder to dot-walk to Incident fields and added Condition: Incident.State | is not one of | Closed, Canceled
However, this had the unintended effect of preventing the creation and editing of any incident tasks, at all? Even open, active incidents.
2nd try: I removed the conditions from the itil ACLs. Then, I went to incident_task table and added two entirely new ACLs, one for write and one for create. They simply set the condition for write and create to Incident.State | is not one of | Closed, Canceled
But that's still not working? Now, the result is that I can still edit and create incident tasks on closed incidents, even with that ACL running.
3rd try: I went for the inverse. 2 ACLs, write and create, condition: Incident.State | is one of | New, Open, On Hold
But I can still create and edit incident tasks on closed incidents.
Can anyone please tell me what I'm doing wrong?
Yes, that would cause an issue.
As I mentioned above and specifically called out about the "incident" field...if the "incident" field is not filled in with the related incident record number...then how will the system know if the user should have access to it or not as you're dot-walking to it in your ACL and so it's not filled in?
You're dot-walking to the incident_task.incident.incident_state in your ACLs, but per what you're showing...it would need to be incident_task.parent.incident_state
OR...
You need to switch the related list showing on your incident records to be Incident Task -> Incident...instead of Incident Task -> Parent:
Please mark reply as Helpful/Correct, if applicable. Thanks!
Yes, that would cause an issue.
As I mentioned above and specifically called out about the "incident" field...if the "incident" field is not filled in with the related incident record number...then how will the system know if the user should have access to it or not as you're dot-walking to it in your ACL and so it's not filled in?
You're dot-walking to the incident_task.incident.incident_state in your ACLs, but per what you're showing...it would need to be incident_task.parent.incident_state
OR...
You need to switch the related list showing on your incident records to be Incident Task -> Incident...instead of Incident Task -> Parent:
Please mark reply as Helpful/Correct, if applicable. Thanks!
