Property Permission For Changes checking BigDecimal Values written from backend service

Hi there,

We’re integrating Property Permission in our Q2B portals and have a strange issue where the diff is available even though users haven’t changed anything in Document Data.

Steps to reproduce:

@PreAuthorize("hasUAAPropertyPermission(#event.persistedDocument,#event.updatedDocument )")
	@DataServicesEventListener
	public void beforeUpdateEvent(final DocumentBeforeUpdateEvent event) {}

When accessing an existing document, the user clicks on the save button w/o changing anything but UAA detects the updatedDocument has been changed but not really, see images below:
Debugging at com.mgmtp.a12.uaa.authorization.security.PropertyChangesChecker.

Updated document & Persisted document:

Diff:

Why? => The field was modified by a backend task.

Do we need to restrict the BigDecimal value like that? because number w/o decimal come from BAP client library.

Versions:

# A12 versions
a12BaseVersion=27.1.0
a12UaaVersion=7.5.1
a12KernelVersion=28.5.1
a12FormEngineVersion=36.7.2
a12DataServicesVersion=36.3.7

Best regards!

Moin @nhat-round-cloud,

this is a known issue, there’s already an Overall A12 Bug Ticket created for this: A12-16545

Kind regards,
Jan

The underlying issue is, that the front-end handles decimal values by using JSON.stringify. This leads to all numbers in the format “600.00” to be 600. This value is then send to the server and during the authorization check this is detected as a change as 600 != “600.00”.

Therefore, the property authorization is checked.

The Bug Ticket shall address this issue. As a workaround for now, you could add the respective field to the “WRITE” fields section of your authorization definition file.

Hi @jan-static-daemon ,
Thanks for the quick response!

Looking forward to the fixes!

Regards!