Trigger to restrict changing object based on attribute value

I'm not a big fan of triggers (in any application, not just DOORS), but I think that is the only way to implement the following:

Prevent users in a user group from modifying objects which have an attribute set, e.g. users in customer_group_a cannot modify objects which have attribute customer = b.

If there is no other way to do this, what would the trigger code look like?

Many thanks,
Ken.
mcnairk - Fri Sep 25 09:45:56 EDT 2009

Re: Trigger to restrict changing object based on attribute value
Peter_Albert - Fri Sep 25 09:53:05 EDT 2009

If you want to avoid triggers, you could write an on-demand script which loops through the module and sets object-level access rights based on the customer attribute value (Read for all, edit for customer_group_b). When you edit this attribute, you run the script and all is fine.

Regards,

Peter

Re: Trigger to restrict changing object based on attribute value
llandale - Mon Sep 28 15:56:24 EDT 2009

Albert is right, it looks like it might be a 'rights' solution.

But perhaps you are trying to use a group to DENY access; that is: folks in group A cannot write to the object, even when they belong to another group that can.

The trigger would be a pre-save-attribute trigger. It gets the object about to be modified, and if that object's Customer attr-value, and if its 'b' then it opens group A's definition to find if the current user is therein. Problem is, typical folks cannot see the groups nor the group's memberships, so they cannot make use of a trigger that does.

If I were doing this, I'd probably write my own on-demand script to manage 'Deny Access Rights' groups. It would have its own interface and its own 'groups', where each such group is implemented as user-defined User 'attributes' or properties; where the confusing documentation is part of the 'Group and user management' section, look for 'user properties' or 'user defined properties'. The trigger, then would check the attr value and if set, would check to see if the current user was a member of the group associated with that attribute. If so, it would deny the pre-trigger via 'set(trigPreConFail)' with a message, and the attribute wouldn't save.

  • Louie