VTB - Assignee cannot access their task unless a member of board

J_ Greene · ‎08-20-2020

I've created a freeform VTB and assigned a task to a user; however, I don't want that user to be a member of the board (just a task assignee). The user gets the notification that they have been assigned a task, however, they cannot access that task.

As an example, when they go to 'My Work' they do not see the assigned task until they are made a VTB member.

Seems counter intuitive that VTBTaskSecurity would restrict access to a task for an Assignee unless they had permission to the Card (which requires board membership)

This doesn't appear to be expected behavior.

Thoughts on best approach?

J_ Greene · ‎08-24-2020

Close - this was my initial approach, however, it doesn't satisfy the requirement fully. While the task is available on the 'My Work' list, the details of the task(s) are not accessible.

The following resolve the issue:

ACL = vtb_task (read)

answer = VTBTaskSecurity.canRead(current.sys_id)||current.assigned_to == gs.getUserID();

ACL = vtb_task (write)

answer = VTBTaskSecurity.canWrite(current.sys_id)||current.assigned_to == gs.getUserID();

ACL = vtb_task.* (read)

answer = VTBTaskSecurity.canRead(current.sys_id)||current.assigned_to == gs.getUserID();

ACL = vtb_task.* (write)

answer = VTBTaskSecurity.canWrite(current.sys_id)||current.assigned_to == gs.getUserID();

View solution in original post

Ashley Snyder1 · ‎08-20-2020

Freeform boards use Private/Personal Tasks I believe, and do not reflect a task such as 'sc_task' in My Work by default.

https://docs.servicenow.com/bundle/orlando-servicenow-platform/page/use/visual-task-boards/concept/c...

Here's a community blog that discusses more:

https://community.servicenow.com/community?id=community_question&sys_id=58ca836ddb5cdbc01dcaf3231f96...

"If the board is created by the user, he will be able to directly see the vtb_task records.

If the board is not created by user, but he comes in as collaborator and adds task, he will not be able to see the vtb_task record"

Willem · ‎08-20-2020

Hi,

It is. There is an ACL on the vtb_task table calling a script include with the following:

return this.isBoardMemberOf(boardRecord.sys_id);

So you need to be a member in order to see the vtb task

Willem · ‎08-20-2020

The Security rule (ACL):

That script include checks access on the VTB card:

Which contains the "return this.isBoardMemberOf(boardRecord.sys_id);"

Ashley Snyder1 · ‎08-20-2020

Makes sense, by default the task is a "Private Task" only visible to you, the creator of the board and the task, unless, you allow someone else to view your board and therefore the tasks on it. Which has less impact, changing the ACL for all Freeform boards in the future, or giving that particular user permission to view the board?