Declarative attribute security using custom properties
In various embodiments, application development tools can allow developers to control whether or not an attribute of a view object is displayed by declaratively associating a data security privilege with the attribute. Associating a data security privilege with the attribute can be done by adding a specially named custom property on the view object attribute. Modifications to a base class can provide any necessary support to retrieve the privilege and determine whether a current user is allowed to view the attribute for the current record/row. If the user is authorized to view the attribute for the current record/row, then the attribute value is returned and displayed. Otherwise, redacting information, such as “*****” can be returned and displayed.
1. A computer-implemented method for developing applications, the method comprising:
at a computer system having a processor and a memory:
defining a view object of an application development framework that presents data stored in datasources according to a predetermined view in applications built on the datasources using the application development framework, and storing the view object in the memory;
receiving information mapping each of a plurality of attributes of the view object to data stored in at least one datasource of the datasources;
configuring attribute security with respect to at least two attributes of the plurality of attributes of the view object at least in part by:
receiving expressions that restrict output in the applications of the data mapped to the at least two attributes of the plurality of attributes of the view object in the predetermined view, wherein a first expression of the expressions corresponds to a first role and a first privilege of an identified user, and a second expression of the expressions corresponds to a second role and a second privilege of the identified user; and
defining a first security property and a second security property of the at least two attributes, and storing values for the first security property and the second security property in a table of properties defined for the view object;
generating an application with the application development framework based at least in part on the view object;
responsive to a request corresponding to the view object, and based at least in part on the first security property and the second security property and the values stored in the table of properties defined for the view object, restricting access, allowed to the identified user according to the first role, to first data mapped to the at least two attributes of the view object, and restricting output, via the application, of second data mapped to the at least two attributes of the view object in the predetermined view according to the second role so that data corresponding to the at least two attributes is excluded from a record and/or a row that is output;
wherein each attribute of the plurality of attributes corresponds to one or both of a respective field of the record and a respective column of the row.
2. The method of claim 1 , further comprising:
receiving information adding a predetermined named property designated by the application development framework for attribute-based security.
3. The method of claim 2 , wherein the receiving the information adding the predetermined named property comprises receiving input from the identified user interacting with one or more graphical user interfaces associated with the application development framework, the one or more graphical user interfaces configured to enable users to add non-preexisting properties to attributes specified by view object of the application development framework.
4. The method of claim 1 , wherein the receiving the expressions comprises receiving a reference to one or more business objects stored in the at least one datasource as entity objects.
5. The method of claim 1 , further comprising:
generating the view object as a component of the application wherein an eXtensible Markup Language (XML) file definition is generated for the view object.
6. A non-transitory, computer-readable medium storing computer-executable code for developing applications that provide data security when executed by one or more processors associated with one or more computer systems, the non-transitory, computer-readable medium comprising:
code configured to define a view object of an application development framework that presents data stored in datasources according to a predetermined view in applications built on the datasources using the application development framework, and store the view object in memory;
code configured to receive information mapping each of a plurality of attributes of the view object to data stored in at least one datasource of the datasources;
code to configure attribute security with respect to at least two attributes of the view object at least in part by:
receiving expressions that restrict output in the applications of the data mapped to the at least two attributes of the plurality of attributes of the view object in the predetermined view, wherein a first expression of the expressions corresponds to a first role and a first privilege of an identified user, and a second expression of the expressions corresponds to a second role and a second privilege of the identified user; and
defining a first security property and a second security property of the at least two attributes, and storing values for the first security property and the second security property in a table of properties defined for the view object;
code configured to generate an application with the application development framework based at least in part on the view object;
code configured to, responsive to a request corresponding to the view object, and based at least in part on the first security property and the second security property and the values stored in the table of the properties defined for the view object, restricting access, allowed to the identified user according to the first role, to first data mapped to the at least two attributes of the view object, and restrict output, via the application, of second data mapped to the at least two attributes of the view object in the predetermined view according to the second role so that data corresponding to the at least two attributes is excluded from a record and/or a row that is output;
wherein each attribute of the plurality of attributes corresponds to one or both of a respective field of the record and a respective column of the row.
7. The non-transitory, computer-readable medium of claim 6 , further comprising:
code configured to receive information adding a predetermined named property designated by the application development framework for attribute-based security.
8. The non-transitory, computer-readable medium of claim 7 , wherein the code configured to receive the information adding the predetermined named property comprises code configured to receive from the identified user interacting with one or more graphical user interfaces associated with the application development framework, the one or more graphical user interfaces configured to enable users to add non-preexisting properties to attributes specified by view object of the application development framework.
9. The non-transitory, computer-readable medium of claim 6 , wherein the code configured to receive the expressions comprises code configured to receive a reference to one or more business objects stored in the at least one datasource as entity objects.
10. The non-transitory, computer-readable storage medium of claim 6 , further comprising:
code configured to generate the view object as a component of the application wherein an eXtensible Markup Language (XML) file definition is generated for the view object.