Kitto.AccessControl

Defines the base access controller and related classes and services. Access control allows the creation of EW applications that restrict access to resources (such as GUI elements) for certain users.

TKAccessController class

Abstract base access controller. An access controller tells if and how a user (identified by a string Id) is allowed to access a resource (identified by a URI).

Only one access controller may be active at any one time.

Applications wanting to use a custom access control policy should create and register an access controller, and then make it active in Config.yaml.

function GetAccessGrantValue(const AUserId, AResourceURI, AMode: string;

Returns the access grant value for the specified resource, mode and user.

This methods tells if the user can access the resource in the specified mode, and how the access is granted. Generally, the return value would be a Boolean, but - depending on the mode - it can be anything.

See the access control documentation for information about how to construct a resource URI, where to get the user Id and what modes are available.

function IsAccessGranted(const AUserId, AResourceURI, AMode: string): Boolean;

Shortcut for GetAccessGrantValue for Boolean values. Returns True if a value is granted and it equals ACV_TRUE.

procedure CheckAccessGranted(const AUserId, AResourceURI, AMode: string);

Calls IsAccessGranted and raises an "access denied" exception if the return value is not True.

class function IsStandardMode(const AMode: string): Boolean;

Returns True if the specified access mode is a standard mode, that is one of the ACM_* constants (except ACM_ALL).

class function ModeMatches(const AMode, AModeList: string): Boolean;

Returns True if AMode is one of the modes in AModeList, a comma-separated list as stored in a permission row (ACCESS_MODES). Each entry is trimmed and compared case-insensitively: the old substring test (Pos('VIEW,', ...)) matched a mode that is only the suffix of another ('VIEW' inside 'PREVIEW,...') and missed entries written with a space after the comma ('VIEW, RUN').

procedure Init;

Called by the system after setting all config values.

EKAccessDeniedError class

Exception raised when access to a certain resource is deniend.

TKAccessControllerRegistry class

This class holds a list of registered access controller classes.

class destructor Destroy;

Frees the singleton registry instance.

procedure RegisterClass(const AId: string;

Adds an access controller class to the registry.

TKAccessControllerFactory class

Uses the registry to create access controllers by class Id.

class destructor Destroy;

Frees the singleton factory instance.

function CreateObject(const AClassId: string): TKAccessController;

Creates and returns an instance of the access controller class identified by AClassId. Raises an exception if said class is not registered.

TKNullAccessController class

The Null access controller always grants access. It is used by default.