CDS Access Control (DCL) : Autorisations granulaires

@EndUserText.label: 'Access Control pour les commandes"
@MappingRole: true
define role ZI_Order {
  grant select on ZI_Order
  where ( CompanyCode ) = aspect pfcg_auth( Z_BUKRS, BUKRS, ACTVT = '03' );
}

@EndUserText.label: 'Sales Order Access"
@MappingRole: true
define role ZI_SalesOrder {
  grant select on ZI_SalesOrder
  where ( SalesOrganization ) =
    aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' );
}

aspect pfcg_auth(
  <ObjetAutorisation>,
  <ChampDansObjet>,
  <Activité> = '<Valeur>"
)

@MappingRole: true
define role ZI_Material {
  grant select on ZI_Material
  where ( Plant, MaterialType ) =
    aspect pfcg_auth( M_MATE_WRK, WERKS, MTART, ACTVT = '03' );
}

define role ZI_PurchaseOrder {
  grant select on ZI_PurchaseOrder
  where ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' )
    and ( PurchasingOrganization ) = aspect pfcg_auth( M_BEST_EKO, EKORG, ACTVT = '03' );
}

define role ZI_Document {
  grant select on ZI_Document
  where ( DocumentType ) = aspect pfcg_auth( Z_DOCTYPE, BSART, ACTVT = '03' )
     or ( DocumentType ) = 'PUBLIC';
}

define role ZI_Order {
  grant select on ZI_Order
  where (
    ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' )
    and ( ( SalesOrg ) = aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' )
          or Status = 'RELEASED' )
  );
}

@AccessControl.authorizationCheck: #CHECK
define view entity ZI_OrderItem
  as select from zorder_item
  association [1..1] to ZI_Order as _Order
    on $projection.OrderID = _Order.OrderID
{
  key OrderID,
  key ItemNumber,
  Material,
  Quantity,
  _Order
}

define role ZI_OrderItem {
  grant select on ZI_OrderItem
  where ( _Order.CompanyCode ) =
    aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

define role ZI_OrderItemSchedule {
  grant select on ZI_OrderItemSchedule
  where ( _OrderItem._Order.CompanyCode ) =
    aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

@EndUserText.label: 'User Country Aspect"
define abstract entity ZA_UserCountry
{
  Country : land1;
}

define role ZI_Customer {
  grant select on ZI_Customer
  where Country = aspect ZA_UserCountry.Country;
}

define role ZC_SalesOrder {
  grant select on ZC_SalesOrder
  where inherits_all;
}

define role ZI_Employee {
  grant select on ZI_Employee
  where PersonnelArea IN
    aspect pfcg_auth( PLOG, PERSA, ACTVT = '03' )
    or EmployeeID = $session.user;
}

define role ZI_PersonalData {
  grant select on ZI_PersonalData
  where CreatedBy = $session.user
     or Visibility = 'PUBLIC';
}

@AccessControl.authorizationCheck: #CHECK
define view entity ZI_SalesOrder
  as select from zsalesorder
{
  key SalesOrderID,
  SalesOrganization,
  Customer,
  NetAmount
}

" Avec accès privilégié (DCL est ignorée)
SELECT * FROM zi_salesorder
  WITH PRIVILEGED ACCESS
  INTO TABLE @DATA(lt_orders).

" Accès normal (DCL est appliquée)
SELECT * FROM zi_salesorder
  INTO TABLE @DATA(lt_orders_filtered).

ZC_SalesOrder (Projection)
    ↓ Vérifie sa propre DCL (peut utiliser inherit)
ZI_SalesOrder (Interface View)
    ↓ Vérifie sa propre DCL
ZSALESORDER (Table)

-- Interface View : Vérification complète des autorisations
define role ZI_SalesOrder {
  grant select on ZI_SalesOrder
  where ( SalesOrg ) = aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' );
}

-- Projection View : Hérite de l'Interface View
define role ZC_SalesOrder {
  grant select on ZC_SalesOrder
  where inherits_all;
}

METHOD get_sales_orders.
  " Vérifier manuellement l'autorisation
  AUTHORITY-CHECK OBJECT 'V_VBAK_VKO"
    ID 'VKORG' FIELD lv_sales_org
    ID 'ACTVT' FIELD '03'.

  IF sy-subrc <> 0.
    RAISE EXCEPTION TYPE cx_no_authority.
  ENDIF.

  " Puis lire les données
  SELECT * FROM zsalesorder
    WHERE vkorg = @lv_sales_org
    INTO TABLE @rt_orders.
ENDMETHOD.

METHOD get_sales_orders.
  " DCL vérifie automatiquement - seules les données autorisées sont retournées
  SELECT * FROM zi_salesorder
    INTO TABLE @rt_orders.
ENDMETHOD.

" Afficher le SQL généré avec les conditions DCL
DATA(lo_sql) = cl_sql_statement=>create_for_cds_entity(
  iv_cds_entity = 'ZI_SALESORDER' ).

DATA(lv_sql) = lo_sql->get_native_sql( ).

-- Bon : Champ avec index
define role ZI_Order {
  grant select on ZI_Order
  where ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

-- Mauvais : Expressions complexes sans index
define role ZI_Order {
  grant select on ZI_Order
  where SUBSTRING( OrderNumber, 1, 2 ) = 'AB';
}

-- Performance : Préférer les chemins courts
where _Order.CompanyCode = ...

-- Moins performant : Chemins profonds
where _OrderItem._Order._Customer._Country.Region = ...

define role ZI_MyDocuments {
  grant select on ZI_MyDocuments
  where CreatedBy = $session.user
     or AssignedTo = $session.user;
}

define role ZI_Announcement {
  grant select on ZI_Announcement
  where Visibility = 'PUBLIC"
     or ( Visibility = 'PRIVATE' and Owner = $session.user );
}

define role ZI_Campaign {
  grant select on ZI_Campaign
  where ValidFrom <= $session.system_date
    and ValidTo >= $session.system_date;
}