Sample
User (user_id:28358) with profile “Sales” (group_id:473) can’t see Employees:
Principal routine to check permissions
create function acs_permission__permission_p(int4,int4,varchar) returns bool as '
declare
permission_p__object_id alias for $1;
permission_p__party_id alias for $2;
permission_p__privilege alias for $3;
exists_p boolean;
begin
return exists (select 1
from
acs_permissions p,
party_approved_member_map m,
acs_object_context_index c,
acs_privilege_descendant_map h
where
p.object_id = c.ancestor_id
and h.descendant = permission_p__privilege
and c.object_id = permission_p__object_id
and m.member_id = permission_p__party_id
and p.privilege = h.privilege
and p.grantee_id = m.party_id);
end;' language 'plpgsql';
Check pre-condition:
a) Check existence of privilige “View users”
b) Check User Matrix: Sale should be allowed to see Employees
Digging in’
a) Check permission:
select im_object_permission_p(463, 28358, ‘view_users’);
returns ‘f’
b) Check if member is (approved) member of “Sales”
select * from group_approved_member_map where member_id = 28358 and group_id = 473;
group_id | member_id | rel_id | container_id | rel_type
----------+-----------+--------+--------------+----------------
473 | 28358 | 35900 | 473 | membership_rel
(1 row)
c) Check for corresponding entry in “party_approved_member_map”
select m.* from party_approved_member_map m where m.member_id = 28358;
party_id | member_id | tag
----------+-----------+-------
473 | 28358 | 35900
-2 | 28358 | 35900
438 | 28358 | 35900
28358 | 28358 | 0
-2 | 28358 | 28359
438 | 28358 | 28359
-1 | 28358 | 28359
463 | 28358 | 28361
-2 | 28358 | 28361
438 | 28358 | 28361
-1 | 28358 | 28361
-1 | 28358 | 35900
(12 rows)
d) Check acs_privilege_descendant_map
select m.* from acs_permissions p, party_approved_member_map m where m.member_id = 28358 and m.oid = 463; tbc.
Debugging Stored Procedures
create or replace function workflow_case__add_task_assignment(int4,int4,bool) returns int4 as '
declare
add_task_assignment__task_id alias for $1;
add_task_assignment__party_id alias for $2;
add_task_assignment__permanent_p alias for $3;
v_count integer;
v_workflow_key wf_workflows.workflow_key%TYPE;
v_context_key wf_contexts.context_key%TYPE;
v_case_id wf_cases.case_id%TYPE;
v_role_key wf_roles.role_key%TYPE;
v_transition_key wf_transitions.transition_key%TYPE;
v_notification_callback wf_context_transition_info.notification_callback%TYPE;
v_notification_custom_arg wf_context_transition_info.notification_custom_arg%TYPE;
callback_rec record;
v_assigned_user record;
begin
-- get some needed information
RAISE NOTICE ''KHD: workflow_case__add_task_assignment: enter'';
select ta.case_id, ta.workflow_key, ta.transition_key, tr.role_key, c.context_key
into v_case_id, v_workflow_key, v_transition_key, v_role_key, v_context_key
from wf_tasks ta, wf_transitions tr, wf_cases c
where ta.task_id = add_task_assignment__task_id
and tr.workflow_key = ta.workflow_key
and tr.transition_key = ta.transition_key
and c.case_id = ta.case_id;
-- make the same assignment as a manual assignment
IF add_task_assignment__permanent_p = ''t'' and v_role_key is not null THEN
/* We do this up-front, because
* even though the user already had a task assignment,
* he might not have a case assignment.
*/
perform workflow_case__add_manual_assignment (
v_case_id,
v_role_key,
add_task_assignment__party_id
);
end if;
-- check that we do not hit the unique constraint
select count(*) into v_count
from wf_task_assignments
where task_id = add_task_assignment__task_id
and party_id = add_task_assignment__party_id;
if v_count > 0 then
return null;
end if;
-- get callback information
select notification_callback,
notification_custom_arg into callback_rec
from wf_context_transition_info
where context_key = v_context_key
and workflow_key = v_workflow_key
and transition_key = v_transition_key;
RAISE NOTICE ''KHD: workflow_case__add_task_assignment -> notification_callback is %: '', callback_rec;
if FOUND then
v_notification_callback := callback_rec.notification_callback;
v_notification_custom_arg := callback_rec.notification_custom_arg;
else
v_notification_callback := null;
v_notification_custom_arg := null;
end if;
-- notify any new assignees
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> add_task_assignment__task_id is %: '', add_task_assignment__task_id;
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> add_task_assignment__party_id is %: '', add_task_assignment__party_id;
for v_assigned_user in
select distinct u.user_id
from users u
where u.user_id not in (
select distinct u2.user_id
from wf_task_assignments tasgn2,
party_approved_member_map m2,
users u2
where tasgn2.task_id = add_task_assignment__task_id
and m2.party_id = tasgn2.party_id
and u2.user_id = m2.member_id)
and exists (
select 1
from party_approved_member_map m
where m.member_id = u.user_id
and m.party_id = add_task_assignment__party_id
)
LOOP
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> add_task_assignment__task_id: %: '', add_task_assignment__task_id;
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> v_assigned_user.user_id: %: '', v_assigned_user.user_id;
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> v_notification_callback: %: '', v_notification_callback;
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> v_notification_custom_arg: %: '', v_notification_custom_arg;
PERFORM workflow_case__notify_assignee (
add_task_assignment__task_id,
v_assigned_user.user_id,
v_notification_callback,
v_notification_custom_arg
);
RAISE NOTICE ''KHD: workflow_case__add_task_assignment-> CALLED workflow_case__notify_assignee: %: '', v_assigned_user.user_id;
end loop;
-- do the insert
insert into wf_task_assignments (
task_id,
party_id
) values (
add_task_assignment__task_id,
add_task_assignment__party_id
);
return 0;
end;' language 'plpgsql';
