Declarative Security ds.xml viewRequiresRole and Velocity expressions supported?

[Blama]

Hi Isomorphic,

could you elaborate a bit on this excerpt from the Quick Start Guide?

Declarative Security (requires attribute)
Similar to requiresRole and requiresAuthentication, the requires attribute allows an arbitrary Velocity expression to restrict access control

For my mail sending I'm injecting an "$options" object in my SQLDataSource subclass. Depending on the options I then show or hide fields in the html template.
I tried the same with viewRequiresRole for a field in my .ds.xml, but it seems that my code like viewRequiresRole="#{if}($options.isShowA)aGrantTheUserHasForSure#{else}false#{end}" is interpreted as text - as no role with that text exists, the field is canView:false as result. Also introducing Velocity-syntax errors did not result in server exceptions.
So my question is: Does the DataSourceLoader also have the Velocity variables at hand I inject in SQLDataSource? It would need them in order to evaluate that viewRequiresRoles shown above.

My use case is that I could handle system settings that way without having to assign or not-assign a role to all users.

Thank you & Best regards
Blama

[Isomorphic]

That excerpt describes DataSource.requires not viewRequiresRole. The requires attribute does support a velocity expression but the *RequiresRole attributes do not. Perhaps you want to use the DataSourceField.viewRequires attribute with a true/false velocity expression instead.

The template will be evaluated on fetch, not in the DataSourceLoader.

[Blama]

Hi Isomorphic,

thanks for the fast answer. Now that I read the viewRequires-docs, I can see that here the "return type" is "VelocityExpression", while it is "String" for viewRequiresRole.
I did not look there before because I remembered reading "Declarative Security + velocity" in the QSG...

Yes, it looks like viewRequires does exactly what I need.
Actually, it also hints directly to my use case:

In addition to the normal context variables available to Velocity expressions in Smart GWT, expressions you write for field-level requires clauses - viewRequires, editRequires, initRequires and updateRequires - can reference two additional variables: $fieldName and $dsName. These are the names of the dataSource and field currently undergoing requires checks. They are helpful because they allow you to write a generic checker function that can be used to handle requires checks for multiple fields and dataSources.

Related: I noticed that if I have a limited "outputs", joins in SQL are not generated if they are not needed because the includeFrom-field is not in "outputs".
I strongly assume that this is also the case for fields with a result of viewRequires="false". If so - amazing.

Thank you & Best regards
Blama