CDS annotations: @Capabilities.InsertRestrictions with permissions

[gregorw]

Hi,

I want to restrict the creation of entities in my CDS service. Only users who are assigned to the 'create' scope should be able to insert a new record. I want the '+' Button in the ListView to be disabled or invisible.

I annotated my entity as follows (according to this documentation https://github.com/oasis-tcs/odata-vocabularies/blob/master/vocabularies/Org.OData.Capabilities.V1.m...😞

entity BusinessPartnerGroup @(
    Capabilities:{
        InsertRestrictions:{Insertable: true, Permissions:[{Scopes:[{Scope:'create'}]}]},
        UpdateRestrictions:{Updatable: true},
        DeleteRestrictions:{Deletable: false}},
    restrict:[...])as projection on ds.BusinessPartnerGroup {

In the UI the '+' Button is visible although the user is not assigned to the 'create' scope. Here is an excerpt of the request scopes which I analyzed with debugger.

req.attr.scopes
(8) ['read', 'approve', 'openid', 'any', 'authenticated-user', 'identified-user', 'openid', 'openid']
0:'read'
1:'approve'
2:'openid'
3:'any'
4:'authenticated-user'
5:'identified-user'
6:'openid'
7:'openid'
length:

What is the "SchemeName" in the PermissionType good for? I know an OAuth GrantType, an Authentication scheme and an OData Schema. Which one do I have to use here, if any?

Thanks in advance
Helmut

[gregorw]

I've created an SAP Incident 401125 / 2020 regarding this topic. And I expect some help from SAP as the SAP Fiori Design Guidelines at https://experience.sap.com/fiori-design-web/list-report-floorplan-sap-fiori-element/ define the following:

“Hide actions that cannot be used at all (for example, because the user has no authorization).”

[htammen]

Thank you gregorw. Let's hope that they will answer fast.

[SamB]

Hi gregorw, did support get back to you with a fix? I'd be interested in knowing if/how it was resolved as I'm facing the same issue.

[WouterLemaire]

I'm having the same behavior using restrict. In case someone does not have access I don't want them to see the button. Now they see the button, click on it and get an error message.

gregorw do you have the public note number?

[gregorw]

In the SAP Incident 401125 / 2020 that I've raided I got only directed to the page: What's New in SAPUI5 1.76 with the section:

• Path Support for Insert Restriction

  We now provide dynamic value support for Capabilities.InsertRestriction/Insert by path evaluation in List Reports and Object Pages. For more information, see Defining and Adapting Sections.

[Ben]

Hi Helmut

I had a similar problem and I temporarily solved it with following workaround: I created a separate CDS service for those entities and then restricted read/write on Service level..