Writing policies: Methods of "#resource"

UAA
,
1

I would like to write my own policies, e.g. for “Document Read”. I have the following questions:

  1. Regarding the documentation, com.mgmtp.a12.dataservices.document.DataServicesDocument is referenced as #resource. But according to JavaDoc
    GetA12 Login
    it has no methods of its own. For example, it has no “getCreatedBy” for using “.createdBy”. Is it perhaps the ModelEntity class?
    How do I find out the full range of methods that I can use in the policy definition?

  2. How can I test a “#resource” in policies to see whether it is derived from the document model ‘Example_DM’?

  3. By the way: the documentation “A12 Data Services” refers to
    “aggregated Javadoc for all Data Services artifacts” to
    GetA12 Login
    …but that looks crumply. Is there a better way to read this?

2

Hi @joachim-veiled-grove

  1. The JavaDoc there does not show all the methods of com.mgmtp.a12.dataservices.document.DataServicesDocument. I guess it appears to only include the intrinsic methods of the class, and those generated by Lombok annotations are omitted. To explore this further, you can locate the Java file named DataServicesDocument.java within the Data Services JAR file. From that, you will find that it uses the @Data annotation from Lombok, which automatically generates getters and setters for the class.
  2. If you want a policy to be applied only to the Example_DM document model, you should include your condition check in the target field of that policy, e.g:
    "target": "#resource instanceof T(com.mgmtp.a12.dataservices.document.DataServicesDocument) && #resource.modelName == 'Example_DM'"
    If you want to debug the #resource, you might need to use print and then check it in the logs. Please take a look at this GetA12 Doc
  3. This is my first encounter with it. Honestly, I frequently prefer to directly examine the Java file within the Data Services JAR archive.
4

Thank you very much for your help!!

Sorry, but where can I get the offical source of DataServicesDocument.java (without decompiling it)? Remember that I am not an MGM-employee…

5

You can view the source at the GetA12 Artifactory.

6

Great! I didn’t know that. Thank you very much.

7

Thank you again,your restriction mentioned above just works.

An additional question: Is there an out-of-the-box possibility to go further and restrict it according to a certain field value?

Suppose the mentioned ‘Example_DM’ has a group ‘PhysicalProperties’ and it contains a string field “Color”.

How can you extend the query to ask for fields, such as

“target”: “#resource instanceof T(com.mgmtp.a12.dataservices.document.DataServicesDocument)
&& #resource.modelName == ‘Example_DM’
&& #resource.PhysicalProperties.Color == ‘green’”

?
(My own attempts here have so far been unsuccessful)

If there is no out-of-the-box option: What would be a small recipe to get ahead in java?

Thank you very much

8

Hi,
The #resource in this context refers to an instance of the DataServicesDocument class. Within this class, there exists a field named kernelDocument of type IDocument. To access specific document field values, such as PhysicalProperties.Color in your case, you can utilize the following syntax: #resource.kernelDocument.PhysicalProperties.Color == 'green'.

From this GetA12 Doc, you can see that target field is a quick expression used for filtering out the policy. Depending on your specific requirements, it’s essential to carefully choose whether to apply the aforementioned filter in the target or rules field.

Just additional information: If you intend to apply the filter in the repository policy - a distinct policy type, it’s advisable to refer to this GetA12 Doc for guidance. When using it for Document List, keep in mind that the base model is referenced as #resource. In this context, the target field would be: “target”: “#resource == 'Example_DM'" while the templates field would be specified as: "'PhysicalProperties.Color:green'".

9

Thanks for this valuable information, also the tip about the repository policy (which I would have written next).
I will try that now…

10

Thanks again for your help.
The specified syntax did not work right away. Maybe I did not emphasize this well enough: I’m looking for an out-of-the-box solution i.e. without writing a line of Java (if that works, otherwise I can do that too).

The class of kernelDocument leads to DocumentImpl which does not have the property “PhysicalProperties” (as far as I understand the system). So I ended up with the expression:

    "#resource.kernelDocument.getEntityInstancesAtOrBelowPath('/Example/PhysicalProperties/Color).get(0).getValue().get() == 'green'"

That works so far! But is there perhaps a simpler expression or a convenience function?

Regarding the repository policy: The specified solution has not worked so far.
Here I have
created the following rule:

“repositoryPolicies”: [ {
“name”: “Document List filted by color”,
“description”: “filter”,
“target”: “hasAccessRight(‘DOCUMENT_LIST’) && #resource == ‘Example_DM’”,
“templates”: [
“‘Example.PhysicalProperties.Color:green’”
]
}

This leads to the following log:

2024-01-23T18:03:00.179+01:00 DEBUG 19184 — [0.1-8082-exec-9] c.m.a.d.s.i.AbstractSearchService : Search query: {model: Example_DM, metaDataFilters: [“model_name:Example_DM”], filterSpec: {“fulltext”:“”,“filters”:[“Example.PhysicalProperties.Color:green”],“lang”:“”}, sortSpec: , pagespec: {“offset”:0,“limit”:10}}
2024-01-23T18:03:00.185+01:00 INFO 19184 — [0.1-8082-exec-9] org.apache.solr.core.SolrCore.Request : webapp=null path=/select params={} hits=0 status=0 QTime=1

…so : nothing was found. What could be the reason? Is the Syntax rule actually correct (e.g. upper and lower case)?
Do you have to configure Solr accordingly first?
Or is it something else?

Tank you very much indeed,
best regards,
Joachim

11

Apologies for any confusion caused. Based on your earlier statement: 'Example_DM' has a group ‘PhysicalProperties’ and it contains a string field “Color”, I initially assumed that ‘PhysicalProperties’ was the base group in your document model. However, after seeing your path in the above comment as /Example/PhysicalProperties/Color, it became clear that Example is the correct base group.
To clarify, for an out-of-the-box solution, the accurate syntax would be: #resource.kernelDocument.Example.PhysicalProperties.Color == 'green'.

Regarding the repository policy, I see it’s correct and no issues are detected in your logs. Please note that only Example documents with the Color field set to green (case sensitive) are displayed in the overview. Maybe you can try to remove the hasAccessRight(‘DOCUMENT_LIST’) part to see if it works as expected first.

About the property config, I just use mgmtp.a12.dataservices.search.analysis.fullText.ngrams.enabled=true but this is for configuring the full-text search. So I think you don’t need to have any special config for Solr to make it work.

Hope it helps!

12

Thank you very much for the effort and the feedback.

  1. Regarding the “policies”: I had already tried all of these, as well as numerous variants, but unfortunately without success.
    To make this transparent to you, I have now chosen a way to make the problem reducible:
    a) I have taken the naked project template “202306.4.0”. Here there is only one DataModel (‘Person-document’) with one test person (“Johny”).
    Here I have only added some more test persons and enabeld the debugging by the line
logging.level.com.mgmtp.a12.uaa.authorization.security.spel=DEBUG

b) Then I varied the existing childAuthorization-json (see below) and saw what the result was . As a test position, I have set myself the goal of only allowing documents to be readable if the first name (“Person.PersonalData.FirstName”) is “Johny”
b.1) if I understood your suggestion correctly , the first policy could replaced by

    {
      "name": "Document Read By User Created",
      "description": "test",
      "target": "hasAccessRight('DOCUMENT_READ')",
      "rules": [
        "#resource.kernelDocument.Person.PersonalData.FirstName == 'Johny'"
      ]
    },

…and it should work. However, here is the output:

2024-01-24 13:57:33,712 [27.0.0.1-8082-exec-9][DEBUG][.security.spel.internal.SpelRuleExecutor][u:admin] - ...Expression #resource.kernelDocument.Person.PersonalData.FirstName == 'Johny' execution failed context[1398330454]. EL1008E: Property or field 'Person' cannot be found on object of type 'com.mgmtp.a12.kernel.md.document.internal.service.impl.DocumentImpl' - maybe not public or not valid?

Can you reproduce this?
I find the error message at least understandable, because the properties do not exist in DocumentImpl.

d) with my variant it works; however, I find the method confusing as I mentioned yesterday and the question is whether there is an easier way.

    {
      "name": "Document Read By User Created",
      "description": "test",
      "target": "hasAccessRight('DOCUMENT_READ')",
      "rules": [
        "#resource.kernelDocument.getEntityInstancesAtOrBelowPath('/Person/PersonalData/FirstName').get(0).getValue().get() == 'Johny'"
      ]
    },
  1. to the “repositoryPolicies”: Here it works with the filtering by the template
        "'Person.PersonalData.FirstName:Johny'"

Thank you very much!
So the problem with my document model lies somewhere on my side.
Is there by any chance a way to ask Solr directly queries so that I can debug what is indexed? I know a Solr web interface from other none-A12-projects…

Many thanks and best regards, Joachim Weinhart

13

I have replicated the issue and encountered the same error you described. Upon thorough investigation, I discovered that the project template “202306.4.0” is missing the uaa-authorization-a12-extension dependency, resulting in the error. According to the documentation provided by this GetA12 doc, it is recommended to include the uaa-authorization-a12-extension dependency to resolve this issue.
It should work now :slight_smile: