Restricting Individual Record Access

While the security system described so far makes it easy to enable or disable access to specific types of data, we haven't described a way to restrict access to a particular record or list. We can do this using the filter option in a permission under a role.

There are three fields at the bottom of the permission that let you apply filters.

Once you specify a filter, the options above that (regarding how to apply the permission) are ignored. Instead the permission just applies a filter to the given list whenever it is viewed, updated or deleted. This means the user will not be able to access any records that fall outside of that filter.

The Filter Field will be the name of the field in the type (as defined in Field at the top). Then you would enter in either the Filter Value or the Filter Expression.

The Filter Value is just a hard-coded value to filter by. Just enter in the text of the value.If the value is a boolean, it would be either True or False (not Yes or No). If the value starts with an exclamation mark (!) then it means the filter will be NOT equal to the given value.

The Filter Expression can be either any field in the User record (eg. UserID or Department), or a few other built-in functions:

  • * - A star means that the filter field's value must be a link to the currently logged-in user.

  • Today() - means the value of today's date.

For example let's say we wanted to create a security role that stopped users from viewing anything except their own user record. We can do this by creating a role with a filter set.

The name of the role could be 'My User Only'. We would set the 'Allow/Deny' to be 'Allow' and not set any of the commands (ie. Create, Update etc.). Instead we just set the Filter Field to be 'UserID'. We leave the Filter Value and put a Filter Expression of 'UserID'. This tells the system to use the currently-logged-in user's ID instead of a hard value. Any field name in the User record type can be entered here, and it will use that value of the currently logged in user's User record.

After creating this role, publish and then select that role in the user with which you'll be testing (This is discussed in the next section).

Next, login as that user. You should now only be able to see your own user record and nobody else's. The same will apply for any reports that you run. Whenever a query is made to the Users list, it will enforce the specified filter. If you attempt to run a script that modifies another user record, that operation will fail saying it cannot find any other records to update.