Hello all,
So, the solution was to create a "workflow_viewer" role. I have to assign the "workflow_publisher" role ONLY to allow access to the Workflow Editor. A ServiceNow group will be assigned both roles and Users who want View Only access to the Workflow Editor will be added to the group.
I have also added an ACL to the wf_workflow_activity table. This allows users to see the Workflow Activity, explore nodes along the workflow and see any code/logic inside.
On the "workflow_editor_welcome" UI page, the "New Workflow" button is hidden when the user has both "workflow_publisher" AND "workflow_viewer" roles.
Otherwise, the "New Workflow" button is shown, as intended.
JELLY CODE:
<g:evaluate var="jvar_value" jelly="true">
var show = 'false';
if(gs.hasRole('workflow_publisher')) {
if(gs.hasRole('workflow_viewer')) {
show = 'false';
} else {
show = 'true';
}
}
if(gs.hasRole('admin')) {
show = 'true';
}
if(gs.hasRole('workflow_admin')) {
show = 'true';
}
if(gs.hasRole('workflow_creator')) {
show = 'true';
}
if(gs.hasRole('activity_creator')) {
show = 'true';
}
show;
</g:evaluate>
<j:if test="${jvar_value == 'true'}">
<a id="new-workflow-btn" role="button" class="btn btn-primary new-btn" onClick="top.workflowIDE.newWorkflow()" tabindex="0">${gs.getMessage("New Workflow")}</a>
</j:if>
Users with BOTH roles are thus able to navigate to the Workflow Editor and browse workflows, but unable to checkout/edit AND create new workflows.
Thus, read-only access to the Workflow Editor done!
