Hi Dongyu Zhai,

You should never rely only on client code for security. Even if you do something on the client side, be sure to repeat those protections on the server side. Or consider having 2 different screens that are accessed by different roles.

Cheers,
Tiago Simões

Hi Dongyu, 

to my knowledge you will not be able to access these roles natively. 

You could make a Local Entity that synchronizes with server roles. 

Based on this Local Entity you could do your checks.

Hi Dongyu

Dongyu Zhai wrote:

Your code is wrong, check the API you referred too, use $roles.NameOfTheRole instead of $roles.$parameters.RoleName

So if you have a role defined named Employee then use $roles.Employee 

Regards,

Daniel

Hi,

In that case try and create and input parameter to your JavaScript widget called for example dynamicrole and on the widget assign the value '"$roles.Admin"

then the code in the JavaScript should br

$parameters.HasRole = $public.Security.checkIfCurrentUserHasRole(eval{$parameters.dynamicrole));

Regards,

Daniel

I wrote $public.Security.checkIfCurrentUserHasRole(eval($parameters.dynamicrole))

I will try and get it working in your attachment

Hi,

I tested my logic in the module you attached.

This is what I found, the $roles predefined object is empty:

I tested by simulating that the predefined object is has a property called Admin by in the console execute $roles.Admin = ""     Then reexecuted my code, and it did work.

But the real problem seems to then why the $roles property is not filled, they way the official OutSystems documentation describes.

Also alternatively to passing to the complete string $roles.Admin you could just pass the role name like "Admin"

In the javascript node input parameter,  then the code can than be done without eval() function like:

$public.Security.checkIfCurrentUserHasRole($roles[parameters.dynamicrole])

Regards,

Daniel

Hi Daniel,

I have tried your solution

It still returns false although I have granted the role

As I said for reason i dont understand $roles is not populated. My suggestions to dynamically test role will however work if $roles would have been properly populated according to OutSystems documentation.

The role is created on the client:

All roles are stored in local stores which you can access in chrome console:

localStorage.getItem("$OS_Users$RolesInfo"), and the last entry in this comma seperated is the admin role

Remains the question why $roles is not filled? Maybe someone from OutSystems can answer this.

I checked mobile app and there is also never $roles filled. I will talk to some co-workers tomorrow about it, maybe they know.

Noted, many thanks for your help

Your welcome, hope to get an answer to why the $roles predefined object is not filled

Was there an answer to this problem?

Hi everyone, I came across the same issue, trying to have the roles checked dynamically on a client action.

There's something fishy going on with the $roles setter/getter, but simply calling the getter for each existing role will populate the $roles.

 Client Action JS:

//Calling the getters for responsible and user roles, this correctly initiates the $roles container.

$roles.Bookings_Responsible;

$roles.Bookings_User;

$parameters.HasRole = $public.Security.checkIfCurrentUserHasRole($roles[$parameters.Role]);

It is also possible to init these values on the initialize of each screen that is going to use the role check.

Hi everyone, sorry late to the party with this.

I have been having the same issue, I applied the Javascript yet as described above the $roles was never populated.

I found the issue was caused by having the 'Anonymous' role checked in the screen (unfortunately this is required due to the nature of the app). Anyway when I unticked the Anonymous role the logic works client side to check the user has the role.

This also happens when checking the role server side using the FetchFromOtherDataSources too.

Obviously the user role cannot be checked if anonymous as their isnt a UserId to check against..

So for everyone who has had this issue, maybe a simple thing but first thing to check is the anonymous role check.

Im also having this issue. It appears like a bug to me and is disappointing that Outsystems has not addressed this. 

Hello,

The checkIfCurrentUserHasRole works for me in the users tenant. When I switch Tenant it doesn't work anymore, although both users have the same role:

If anybody has a suggestion about that, it would be much appreciated.

Regards.