Is there a way of improving the script (changing permissions)

Hello,

I am attempting to write a script so that a lead from the engineering team can run a script to limit access to the engineering team and give access to IV&V. below is my logic and was wondering I should modify any for security and performance reasons. Also is there a way/trick so that the lead engineer can run the script without having full access (RMCDA)?

Thank you,
Jim
  

Module m
m = current
 
User currUser = null
string Uname = null
 
AccessRec ar
  
currUser = find()
Uname = currUser.name
 
if (Uname != "constance.walker")
{
    ack "Only the constance.walker user can run this script"
        halt
}     
 
for ar in all m do 
{
        if (Uname != "constance.walker")
        {unset(m, username(ar))} 
}
 
Permission all = read|create|modify|delete|control
        
set(m, all, "benny.buscato") // Set UserGroup/User 
set(m, read|modify, "IV&V Engineer") // Set UserGroup/User 
set(m, read, "Application Engineer") // (R)
set(m, read, null) // Everyone else (R)
        
unset(m, Uname)

SystemAdmin - Wed Jan 11 13:24:49 EST 2012

Re: Is there a way of improving the script (changing permissions)
llandale - Wed Jan 11 15:06:46 EST 2012

You must have "R" and "A" access to modify the access to something. So "RA" is sufficient but historically such folks have "RMCDA" access.

Check if the current user has the rights and the power (module open Edit):
  • canControl(mod)

To make sure the module is not inherited, add:
  • specific(mod)

It feels wrong to me to want to remove your own "A" access to the module so I wonder about your last line "unset".

It feels better to me to avoid user specific accesses to something, unless you need to stop the destructive power of a particular individual; and if so you should have some Admin group and see if the current user is a member of it.

-Louie

Haven't done it yet but I figure to provide Database admins "RA" access to everything. This stops them, meaning me, from fat fingering a fatal mistake and destroying something, such as running my "PurgeAll.dxl" script. If I NEED to change something I can use my universal "A" rights to add myself to the appropriate group that has RMCD access, then remove myself afterwards.

Re: Is there a way of improving the script (changing permissions)
SystemAdmin - Wed Jan 11 16:57:51 EST 2012

llandale - Wed Jan 11 15:06:46 EST 2012
You must have "R" and "A" access to modify the access to something. So "RA" is sufficient but historically such folks have "RMCDA" access.

Check if the current user has the rights and the power (module open Edit):

  • canControl(mod)

To make sure the module is not inherited, add:
  • specific(mod)

It feels wrong to me to want to remove your own "A" access to the module so I wonder about your last line "unset".

It feels better to me to avoid user specific accesses to something, unless you need to stop the destructive power of a particular individual; and if so you should have some Admin group and see if the current user is a member of it.

-Louie

Haven't done it yet but I figure to provide Database admins "RA" access to everything. This stops them, meaning me, from fat fingering a fatal mistake and destroying something, such as running my "PurgeAll.dxl" script. If I NEED to change something I can use my universal "A" rights to add myself to the appropriate group that has RMCD access, then remove myself afterwards.

I add your suggested code. for the last "unset" I want access removed for all engineers including the lead when it is handed off to the IV&V group. I don't believe you can just have "RA" access inless you know of a trick to set that level of permissions.
-Jim
  

Module m
m = current
 
User currUser = null
string Uname = null
string err = null
string HN = "???????????" // Hainan Database ID
 
AccessRec ar
  
currUser = find()
Uname = currUser.name
 
if(Uname != "constance.walker" && Uname != "benny.buscato" && HN == getDatabaseIdentifier())
{
    ack "Only the constance.walker user can run this script and/or not must be run against the Hainan Database"
        halt
}     
 
if(Uname == "constance.walker")
{
        if(canControl(m))
        {
                specific(m) 
                
                for ar in all m do 
                {
                        if (!isDefault( ar ) && username(ar) != "constance.walker")
                        {err = unset(m, username(ar))
                        if (!null err){infoBox(err)}} 
                }
 
                Permission all = read|create|modify|delete|control
                        
                err = set(m, all, "benny.buscato") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = set(m, read|modify, "IV&V Engineer") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = set(m, read, "Application Engineer") // (R)
                if (!null err){infoBox(err)}
                err = set(m, read, null) // Everyone else (R)
                if (!null err){infoBox(err)}
                        
                err = unset(m, Uname)
                if (!null err){infoBox(err)}
                
                save(m)
        }
        
} else if(Uname == "benny.buscato")
{
        if(canControl(m))
        {
                specific(m) 
                
                for ar in all m do 
                {
                        if (!isDefault( ar ) && username(ar) != "benny.buscato")
                        {err = unset(m, username(ar))
                        if (!null err){infoBox(err)}} 
                }
 
                Permission all = read|create|modify|delete|control
                        
                err = set(m, all, "constance.walker") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                 
                err = set(m, read|create, "Application Engineer") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = setImplied(m, modify|delete) // Propagate access rights (RCMD)
                if (!null err){infoBox(err)}
                 
                err = set(m, read, "IV&V Engineer") // (R)
                if (!null err){infoBox(err)}
                        
                err = unset(m, Uname)
                if (!null err){infoBox(err)}
                
                save(m)
                
        }
        
} else 
{ 
        // For future code!
}

Re: Is there a way of improving the script (changing permissions)
llandale - Wed Jan 11 17:45:02 EST 2012

SystemAdmin - Wed Jan 11 16:57:51 EST 2012

I add your suggested code. for the last "unset" I want access removed for all engineers including the lead when it is handed off to the IV&V group. I don't believe you can just have "RA" access inless you know of a trick to set that level of permissions.
-Jim
  

Module m
m = current
 
User currUser = null
string Uname = null
string err = null
string HN = "???????????" // Hainan Database ID
 
AccessRec ar
  
currUser = find()
Uname = currUser.name
 
if(Uname != "constance.walker" && Uname != "benny.buscato" && HN == getDatabaseIdentifier())
{
    ack "Only the constance.walker user can run this script and/or not must be run against the Hainan Database"
        halt
}     
 
if(Uname == "constance.walker")
{
        if(canControl(m))
        {
                specific(m) 
                
                for ar in all m do 
                {
                        if (!isDefault( ar ) && username(ar) != "constance.walker")
                        {err = unset(m, username(ar))
                        if (!null err){infoBox(err)}} 
                }
 
                Permission all = read|create|modify|delete|control
                        
                err = set(m, all, "benny.buscato") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = set(m, read|modify, "IV&V Engineer") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = set(m, read, "Application Engineer") // (R)
                if (!null err){infoBox(err)}
                err = set(m, read, null) // Everyone else (R)
                if (!null err){infoBox(err)}
                        
                err = unset(m, Uname)
                if (!null err){infoBox(err)}
                
                save(m)
        }
        
} else if(Uname == "benny.buscato")
{
        if(canControl(m))
        {
                specific(m) 
                
                for ar in all m do 
                {
                        if (!isDefault( ar ) && username(ar) != "benny.buscato")
                        {err = unset(m, username(ar))
                        if (!null err){infoBox(err)}} 
                }
 
                Permission all = read|create|modify|delete|control
                        
                err = set(m, all, "constance.walker") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                 
                err = set(m, read|create, "Application Engineer") // Set UserGroup/User 
                if (!null err){infoBox(err)}
                err = setImplied(m, modify|delete) // Propagate access rights (RCMD)
                if (!null err){infoBox(err)}
                 
                err = set(m, read, "IV&V Engineer") // (R)
                if (!null err){infoBox(err)}
                        
                err = unset(m, Uname)
                if (!null err){infoBox(err)}
                
                save(m)
                
        }
        
} else 
{ 
        // For future code!
}

Thought they allowed RA, see its RMCA (you can suppress delete rights).

Your first "if" doesn't look right. The way its written the script will run if it's constance or benny in that database, or anybody at all in any other database.

  • if(Uname != "constance.walker" && Uname != "benny.buscato" && HN == getDatabaseIdentifier())
  • If the script may only run on that database use this:
    • if((Uname != "constance.walker" && Uname != "benny.buscato") || HN != getDatabaseIdentifier())
  • If the script must never run on that one database, use this:
    • if((Uname != "constance.walker" && Uname != "benny.buscato") || HN == getDatabaseIdentifier())
  • I find these easier to read but that's just me:
    • if((Uname != "constance.walker" and Uname != "benny.buscato") or HN != getDatabaseIdentifier())
    • if((Uname != "constance.walker" and Uname != "benny.buscato") or HN == getDatabaseIdentifier())

I would promote canControl:

  • if (!canControl(m)) ack; halt

"specific" returns an error as well. err=specific(mod); if (!null err) {ack; halt}

I don't think you want "all" access records, just the specific ones since you figure to delete them and you cannot delete inherited access rights. Use "all" perhaps in access reports or searches. It won't run any differently unless the "specific" gives an error, but its a little easier for the next dude to grasp.

If we write the following function (even though only two lines) and then call it, see how much easier the rest of the code is to read and therefore to maintain: 

void    SetModAccess(Module m, Permission psn, string NameUser)
{     string err = set(m, psn, NameUser) // Set UserGroup/User 
        if (!null err) 
           errorBox(err)
}     // end SetModAccess()


If you put these lines at the top of the file and fill in whatever comments you like, then the dxl is eligible to be included in various menus:

 

  • //
  • /*
  • */


Next time around consider the notion of a "Project Admins" group for each project, with full access to everthing in the project. That will make sense when you have such a person who is not also editing things.

-Louie

 

Re: Is there a way of improving the script (changing permissions)
SystemAdmin - Wed Jan 11 18:20:54 EST 2012

llandale - Wed Jan 11 17:45:02 EST 2012

Thought they allowed RA, see its RMCA (you can suppress delete rights).

Your first "if" doesn't look right. The way its written the script will run if it's constance or benny in that database, or anybody at all in any other database.

  • if(Uname != "constance.walker" && Uname != "benny.buscato" && HN == getDatabaseIdentifier())
  • If the script may only run on that database use this:
    • if((Uname != "constance.walker" && Uname != "benny.buscato") || HN != getDatabaseIdentifier())
  • If the script must never run on that one database, use this:
    • if((Uname != "constance.walker" && Uname != "benny.buscato") || HN == getDatabaseIdentifier())
  • I find these easier to read but that's just me:
    • if((Uname != "constance.walker" and Uname != "benny.buscato") or HN != getDatabaseIdentifier())
    • if((Uname != "constance.walker" and Uname != "benny.buscato") or HN == getDatabaseIdentifier())

I would promote canControl:

  • if (!canControl(m)) ack; halt

"specific" returns an error as well. err=specific(mod); if (!null err) {ack; halt}

I don't think you want "all" access records, just the specific ones since you figure to delete them and you cannot delete inherited access rights. Use "all" perhaps in access reports or searches. It won't run any differently unless the "specific" gives an error, but its a little easier for the next dude to grasp.

If we write the following function (even though only two lines) and then call it, see how much easier the rest of the code is to read and therefore to maintain: 

void    SetModAccess(Module m, Permission psn, string NameUser)
{     string err = set(m, psn, NameUser) // Set UserGroup/User 
        if (!null err) 
           errorBox(err)
}     // end SetModAccess()


If you put these lines at the top of the file and fill in whatever comments you like, then the dxl is eligible to be included in various menus:

 

  • //
  • /*
  • */


Next time around consider the notion of a "Project Admins" group for each project, with full access to everthing in the project. That will make sense when you have such a person who is not also editing things.

-Louie

 

Hello,

"Thought they allowed RA, see its RMCA (you can suppress delete rights)." I don't see how you can do this using DXL. I can do it within DOORS GUI. Am I just missing something in the DXL manaul?

Thank you,
Jim

Re: Is there a way of improving the script (changing permissions)
llandale - Wed Jan 11 18:30:44 EST 2012

SystemAdmin - Wed Jan 11 18:20:54 EST 2012
Hello,

"Thought they allowed RA, see its RMCA (you can suppress delete rights)." I don't see how you can do this using DXL. I can do it within DOORS GUI. Am I just missing something in the DXL manaul?

Thank you,
Jim

This gives the current object "RMCA" access for "Everyone else" 

Object o = current
specific(o)
set(o, control, "")


So I learned someone new as well.
-Louie