Lesson 15: The Map Widget and Restricting Access to Data

As a System Admin or Shop Owner, I want to see farmer locations on a map.

Lesson Outcomes

By the end of this lesson you should:

• Know how to use the Map widget
• Now how to restrict which data a user is allowed to see by using the @Restrict object annotation

Scenario

Suppose we want to enable System Admin and Shop Owners to see the location of farmers, but with different requirements for the two user roles viewing the data:

• System Admins should be allowed to see the locations of all farmers.
• Shop Owners should be allowed to see the locations of all farmers except those residing in the state of Inland, for the state government of Inland has decreed that private location data about its residents should no longer be available to persons below the level of Tutorial System Admin.

Placing Restriction Rules on Objects

Instead of effecting viewing restrictions in presenter function logic, it may seem the safer option to mark the persistent object itself as restricted in a particular way. We do this by adding the @Restrict annotation to the object. According to the requirements mentioned in the Scenario section, the Farmer object needs to be changed as follows:

@Restrict("System Admin", all())
@Restrict("Shop Owner", notEquals(state, STATES.Inland))
@Role("Farmer")
persistent object Farmer {...}

Note that the role for which to restrict is specified using the role name, and not the object name.

The above says that System Admins will be allowed to see all Farmers, but Shop Owners will only be able to see Farmers whose state is not "Inland". The second argument for the @Restrict annotation can be any of the Selector built-in functions (see Appendix C: Quick Reference), or combination thereof, used in the same way as you would when reading from the persistence layer.

You will have noticed that objects were, throughout the tutorial thus far, universally visible without adding an all() restriction anywhere. Indeed, the first line in the snippet above is completely redundant and can be safely removed.

Testing the New Restriction Using the Map Widget

Create a view accessible to System Admins as well as Shop Owners. Place on it a map widget by adding the following to the view:

<map latitudeAttribute="latitude" longituteAttribute="longitude"
		refreshIntervalSeconds="30">
	<collectionSource function="getFarmers"/>
	<markerTitle value="getMarkerTitle"/>
	<markerIcon value="getImageFileName"/>
	<markerDesc value="getMarkerDescription"/>
</map> 

The above says the map will be populated using a collection returned by getFarmers, and that an object from this collection has latitude and longitude attributes that should be used to determine its placement on the map. The refreshIntervalSeconds attribute is optional.

string getMarkerTitle(Farmer farmer) {
   return String:concat(farmer.firstName, " ", farmer.lastName);
}
string getMarkerDescription(Farmer farmer) {
   return farmer.farmAddress;
}
string getMarkerIcon(Farmer farmer) {
   return null;
}
Farmer[] getFarmers() {
   return Farmer:equals(deleted, false);
}

Note that, while the markerIcon child element is required, we can have its value as null to fall back to the default pin icon. Clicking on the pin opens a pop-up bearing the specified title and description.

Create some farmers residing in the Inland state, and some others residing in any of the other states. Also be sure to invite yourself as a Shop Owner. If you navigate to your new view as a System Admin, you should now see all the farmers on the map, but switch to using your app as a Shop Owner and look at the map again, and you should only see those not from the state of Inland.

As System Admin:

As Shop Owner: