CAP: Data Masking

[alicegavanelli]

Hi Experts,

In order to hidden an entity’s property, I have created an artifact HANA table with data MASK.

I exposed this entity in my CDS model with @cds.persistence.exists

Everythins woks but when I do GET call by oData, this field is not hidden.

Checking in SQL console on the HDI container, the selected field is correcty hiden.

Maybe MASK functionality is not managed by CAP.

Is It planned to implemented it in the fucture?

I have try this workaround cause event .ON and .AFTER doesn’t works.

Thank you in advance

Alice

[vLeonkev]

Hi Alice,

This is a database feature and it should depend on the user and its privileges.

Possibly you used a different user, you can try to select the CURRENT_USER in both cases and validate that?

Best,

Vladislav

[alicegavanelli]

Hi vladislav.leonkev,

We are testing with a user that connect to CAP via oData, in anonimous access.

CAP cds manages DB connection into HANA HDI CONTAINER.

Container has two defualt user, one for user administrator and one for application.

I cannot change the user to connect.

Cap decides the user to logon to hdi conteiner.

Maybe in SQL console CAP use administrator user insted of application one.

Best,

Alice

[vLeonkev]

Hi Alice,

You can get the application user via CDS:

entity E {id:Integer;};
entity V2 as select from E {$user.id};

Best,

Vladislav

[alicegavanelli]

Hi Vladislav,

I've tryed your example but I get this error:

 Element "WispinService.V2.id" does not have a type: Elements of ODATA entities must have a type (in entity:"WispinService.V2"/element:"id")

............
>>>> Model
entity E {id:Integer;};

............
>>>> Serivice
  @Capabilities: { Insertable:true, Updatable:true, Deletable:true }
  entity V2 as select from wispinUsers.E {$user.id};

How ever, I'm sorry but I don't understand you solution. Please could you explain better or send me a documentation?

Best

Alice

[vLeonkev]

Hi Alice,

I tried it from scratch and it worked without any additional user permissions.

Here the model I used:

db/src/.hdiconfig - same as gen/db/src/.hdiconfig (generated after the first cds build command)

db/src/SERV_T.hdbtable

COLUMN TABLE SERV_T (
  ID integer,
  S nvarchar(100),
  primary key ( ID )
)

db/src/SERV_V.hdbview

VIEW SERV_V AS SELECT ID,S FROM SERV_T
WITH MASK (S USING 'XXXX-XXXX-XXXX-XXXX')

srv/serv.cds

service SERV {

@cds.persistence.exists
entity T {
  key ID:Integer;
  S:String(100);
};

@cds.persistence.exists
entity V {
  key ID:Integer;
  S:String(100);
};

Build and deploy the project, write some data into the table T, and read from view V the masked data via the OData service:

.... "S": "XXXX-XXXX-XXXX-XXXX" ....

Reading from T returns the original data that I wrote.

Regards,

Vladislav