we have an attribute status, which have values like 'Active', 'Blocked', 'Inactive'
Another Boolean attribute named permit.
we have 2 roles , role_active and role_blocked.
role_active means the user will be able to change the status value only when status is 'Active'
role_blocked means the user will be able to change the status value only when status is 'Blocked'
Below is the metadata security used for this
"uri": "configuration/entityTypes/XYZ",
"permissions": [
{
"role": role_blocked
"filter": "equals (attributes.Status,'Blocked')",
"access": [
"READ",
"UPDATE"
]
},
{
"role": role_blocked
"access": [
"READ"
]
}
Also the same user should be only change the value of permit attribute from true to false only.
If the value of permit is false, it should not allow to change the value of permit.
By using below security and after assigning role_blocked ,role_permit to same user, it is not working for that user
"uri": "configuration/entityTypes/XYZ",
"permissions": [
{
"role": role_blocked
"filter": "equals (attributes.Status,'Blocked')",
"access": [
"READ",
"UPDATE"
]
},
{
"role": role_blocked
"access": [
"READ"
]
},
"role": role_permit
"filter": "equals (attributes.permit,'true')",
"access": [
"READ",
"UPDATE"
]
},
"role": role_permit
"access": [
"READ"
]
}
when status is blocked and permit is false, it is allowing to update permit from false to true
because role_blocked has already update permission
------------------------------
Rahul Raveendran
Cognizant
------------------------------