Is it possible to assign an action/method on a type to multiply action groups


#1

Is it possible to assign an action/method on a type to one than one action group?

e.g.:
type SomeType {
@action(group=‘someActionGroup’ ||'someOtherActionGroup")
myFunction: function(functionParameter: boolean)

as you can see here, it indicates that it should be able to have more than one action group.


#2

One option would be to create an AdminGroup that has as children the list of your groups that you want to assign to this method.

    {
      "id": "CombinedGroup",
      "name": "CombinedGroup",
      "groups" : [
        {"id" : "someActionGroup"},
        {"id" : "someOtherActionGroup"}
      ],
      "roles": [
        // additional roles
      ]
    }

Then

type SomeType {
  @action(group=‘CombinedGroup’)
  myFunction: function(functionParameter: boolean)
}

#3

Thank you. This option, I am aware of. But can I have more than one action group on the method itself?


#4

I don’t think it’s possible to specify an expression as a value for the group as this one is used to identify one actionCondition group (e.g. read, monitor, cluster-admin).

However the condition part of an ActionCondition accepts any arbitrary expression (you may investigate how to use if for your use case), e.g.

{
    "id" : "SomeRole",
    "name" : "SomeRole",
    "permissions": [
        "allow:SomeType::myFunction"
    ],
    "actionConditions" : [ 
      "SomeType::myFunction:(1 == 1)"
    ]
}

#5

I see. So in the case, do you mean that if I have
{
“id” : “SomeRole”,
“name” : “SomeRole”,
“permissions”: [
“allow:SomeType::myFunction”
],
“actionConditions” : [
“SomeType::myFunction:(1 == 1)”
]
}
[while someRole doesn’t belong to the ‘someActionGroup’]
plus

type SomeType {
@action(group=‘someActionGroup’)
myFunction: function(functionParameter: boolean)

I can achieve the same goal without creating the combinedGroup?


#6

ActionConditions have the following shape:

typeName:actionGroup:action:condition

So in your case use the last part condition to control the access with an expression that uses current user or type SomeType attributes. E.g.

SomeType:someActionGroup:myFunction:(someField.SomePath.finalField == 'some-value')

#7

What I meant was if I have defined as follow in Role:

{
     “id” : "ARole”,
     “name” : “ARole”,
      “permissions”: [
      “allow:SomeType::myFunction”
       ],
   “actionConditions” : [
      “SomeType::myFunction:(1 == 1)”
      ]
}

this “ARole” belongs to “AAdminGroup”. My ultimate goal is to have myFunction being used by two different groups. so if on the function itself I have the decoration of

    type SomeType {
    @action(group=‘BActionGroup’)
    myFunction: function(functionParameter: boolean)

Would this be able to enable the two different groups? I assume the answer is no… Is that right? Then I think the suggestion you initially gave was THE ONLY option for multiply action groups on the same function?


#8

No as the function will belong to one action group, you cannot combine two action groups but you can combine the conditions.


#9

Be wary here, as the groups field in the AdminGroup type refer to other AdminGroup’s, not ActionGroups.

An Action Group is a group of actions (or methods) that have been instantiated on the same or different .c3typ files that make it easier to assign permissions: You can allow or deny a list of actions in one line in a Permission (defined in a Role) by referencing the Action Group (c3ShowType("Ann.Action")).

The use case that @yunyun.ni is referring to is trying to map one action to multiple Action Groups because those action groups will be mapped to different Roles and the Action Groups are not complimentary.

An AdminGroup is a collection of Role’s (or other AdminGroup’s) Permissions that define the access permissions that a user will experience if they are assigned that given AdminGroup.