Insert / remove tag on custom table through a catalog.

[1_DipikaD]

Hi All,

Need to insert and remove Tag from a custom table via requesting a catalog . I have created variables named subdivisions(reference - select name of subdivisions), action(selectbox - none, add, remove), Tag (string). While user submit the request the the value in tag variable should be get inserted / removed as per action on subdivisions table for that particular record. Few OOB ACLs restricting to create and write records on label_entry and label table . I have tried the below script include and Run script on workflow but couldn't get the expected result . I have tried the same on Incident it's working fine but one issue is it's getting impersonated automatically to admin . I have added that line to impersonate admin in script include because admin has access to create new records on label_entry table. 

Could you please suggest a better way to achieve it ? I have attached script include and run script for your reference .

Script Include :-

var SubdivisionsTagService = Class.create();

SubdivisionsTagService.prototype = {

initialize: function() {},

applyOrRemoveTag: function(subdivisionsSysId, tagName, action) {

if (!tagName || !action || !subdivisionsSysId || action === 'none') {

gs.error("Invalid or missing input(s): tagName, action, subdivisionsSysId.");

return "Invalid inputs";

}

var originalUser = gs.getUserID();

gs.getSession().impersonate('admin'); // elevate for ACLs

try {

var subGR = new GlideRecord('u_subdivisions');

if (!subGR.get(subdivisionsSysId)) {

gs.error("Subdivision not found: " + subdivisionsSysId);

return "Subdivision not found";

}

// Find or create the tag

var tagGR = new GlideRecord('label');

tagGR.addQuery('name', tagName);

tagGR.addQuery('table', 'u_subdivisions');

tagGR.query();

var tagID;

if (tagGR.next()) {

tagID = tagGR.sys_id;

} else if (action === 'Add') {

tagGR.initialize();

tagGR.name = tagName;

tagGR.table = 'u_subdivisions';

tagID = tagGR.insert();

gs.info("Created new tag: " + tagName);

} else {

gs.error("Tag not found and action is not Add");

return "Tag missing";

}

// Tag logic

if (action === 'Add') {

var leCheck = new GlideRecord('label_entry');

leCheck.addQuery('label', tagID);

leCheck.addQuery('table', 'u_subdivisions');

leCheck.addQuery('table_key', subdivisionsSysId);

leCheck.query();

if (!leCheck.hasNext()) {

var le = new GlideRecord('label_entry');

le.initialize();

le.label = tagID;

le.table = 'u_subdivisions';

le.table_key = subdivisionsSysId;

le.insert();

gs.info("Tag added to Subdivision: " + subdivisionsSysId);

return "Tag added";

} else {

return "Tag already exists";

}

} else if (action === 'Remove') {

var leDel = new GlideRecord('label_entry');

leDel.addQuery('label', tagID);

leDel.addQuery('table', 'u_subdivisions');

leDel.addQuery('table_key', subdivisionsSysId);

leDel.query();

while (leDel.next()) {

leDel.deleteRecord();

}

gs.info("Tag removed from Subdivision: " + subdivisionsSysId);

return "Tag removed";

}

return "Unknown action";

} finally {

gs.getSession().setUserID(originalUser);

}

},

type: 'SubdivisionsTagService'

};

Run script :-

(function execute() {

var tagName = workflow.inputs.tag;

var action = workflow.inputs.action;

var subdivisionsSysId = workflow.inputs.subdivisions;

gs.info("Workflow Inputs → Tag: " + tagName + ", Action: " + action + ", Subdivision: " + subdivisionsSysId);

var svc = new SubdivisionsTagService();

var result = svc.applyOrRemoveTag(subdivisionsSysId, tagName, action);

gs.info("SubdivisionsTagService Result: " + result);

})();

[Nilesh Pol]

@1_DipikaD Evaluate the existing ACLs on the label and label_entry tables. You might need to create custom ACLs that allow specific roles or users to perform create and write operations on these tables without requiring admin impersonation.

OR 

use below modified version of your script that avoids impersonation and relies on proper ACL configuration:

var SubdivisionsTagService = Class.create();
SubdivisionsTagService.prototype = {
initialize: function() {},

applyOrRemoveTag: function(subdivisionsSysId, tagName, action) {
if (!tagName || !action || !subdivisionsSysId || action === 'none') {
gs.error("Invalid or missing input(s): tagName, action, subdivisionsSysId.");
return "Invalid inputs";
}

var subGR = new GlideRecord('u_subdivisions');
if (!subGR.get(subdivisionsSysId)) {
gs.error("Subdivision not found: " + subdivisionsSysId);
return "Subdivision not found";
}

// Find or create the tag
var tagGR = new GlideRecord('label');
tagGR.addQuery('name', tagName);
tagGR.addQuery('table', 'u_subdivisions');
tagGR.query();

var tagID;
if (tagGR.next()) {
tagID = tagGR.sys_id;
} else if (action === 'Add') {
tagGR.initialize();
tagGR.name = tagName;
tagGR.table = 'u_subdivisions';
tagID = tagGR.insert();
gs.info("Created new tag: " + tagName);
} else {
gs.error("Tag not found and action is not Add");
return "Tag missing";
}

// Tag logic
if (action === 'Add') {
var leCheck = new GlideRecord('label_entry');
leCheck.addQuery('label', tagID);
leCheck.addQuery('table', 'u_subdivisions');
leCheck.addQuery('table_key', subdivisionsSysId);
leCheck.query();
if (!leCheck.hasNext()) {
var le = new GlideRecord('label_entry');
le.initialize();
le.label = tagID;
le.table = 'u_subdivisions';
le.table_key = subdivisionsSysId;
le.insert();
gs.info("Tag added to Subdivision: " + subdivisionsSysId);
return "Tag added";
} else {
return "Tag already exists";
}

} else if (action === 'Remove') {
var leDel = new GlideRecord('label_entry');
leDel.addQuery('label', tagID);
leDel.addQuery('table', 'u_subdivisions');
leDel.addQuery('table_key', subdivisionsSysId);
leDel.query();
while (leDel.next()) {
leDel.deleteRecord();
}
gs.info("Tag removed from Subdivision: " + subdivisionsSysId);
return "Tag removed";
}

return "Unknown action";
},

type: 'SubdivisionsTagService'
};

Run Script:

(function execute() {
var tagName = workflow.inputs.tag;
var action = workflow.inputs.action;
var subdivisionsSysId = workflow.inputs.subdivisions;

gs.info("Workflow Inputs → Tag: " + tagName + ", Action: " + action + ", Subdivision: " + subdivisionsSysId);

var svc = new SubdivisionsTagService();
var result = svc.applyOrRemoveTag(subdivisionsSysId, tagName, action);
gs.info("SubdivisionsTagService Result: " + result);
})();

[1_DipikaD]

@Nilesh Pol 

Hi,

I have admin access and admin override is true for the ACLs still not able to create tags and label entries .Could you please suggest if there is any other way to achieve this ?

[Nilesh Pol]

@1_DipikaD verify with debug security rules so that you will get clear understanding of where it is stopping.

also ensures, are there any business rules are stopping to creating a tags/label entry.

[Ankur Bawiskar]

@1_DipikaD 

if you are using GlideRecord then ACLs won't come into picture.