Entitlements

AdapTable enables developers to manage permissions, i.e. which Adaptable Functions are available in the UI for which users and in which form.

This is done through the Entitlements section of Predefined Config.

How Entitlements Work

Entitlements operate at the AdaptableFunction Level.

Each Adaptable Function has 3 potential AccessLevel values:

  • Full - Fully visible and editable

  • Hidden - Completely hidden from the user - does not appear in any menus, toolbars, tool panels etc.

  • ReadOnly - Visible allowing users to access items provided in Predefined Configuration (e.g. Conditional Style or Export) but not to create their own

Default Access Level

By default every AdaptableFunction has the Entitlement of Full.

However this behaviour can be changed through setting the DefaultAccessLevel property.

For instance, it can be set to 'Hidden' and then only AdaptableFunctions explicity permissioned in Entitlements will be available.

tip

If the DefaultAccessLevel is set to 'Hidden', make sure to enable the Dashboard for access to Toolbars and Functions Dropdown.

Setting Entitlements

There are 2 ways to provide Entitlements in Predefined Config:

  1. 'Hard-coded' List

  2. Custom JavaScript Function

Using FunctionEntitlements

This is the most straightforward way to set Entitlements - simply provide a list through the the FunctionEntitlements property of Entitlements Predefined Config:

export default {
// Set 2 ReadOnly Entitlements**: Export and Layout.
// Users can access existing layouts and reports but cannot add / edit / delete their own
// Set 2 Hidden Entitlements**: Percent Bar and Query.
// These AdaptableFunctions wont be available in any menus
// Nor will any associated Toolbars and Tool Panel elements.
Entitlements: {
FunctionEntitlements: [
{
FunctionName: 'PercentBar',
AccessLevel: 'Hidden',
},
{
FunctionName: 'Query',
AccessLevel: 'Hidden',
},
{
FunctionName: 'Layout',
AccessLevel: 'ReadOnly',
},
{
FunctionName: 'Export',
AccessLevel: 'ReadOnly',
},
],
},
} as PredefinedConfig;

Using EntitlementLookUpFunction

An alternative to a hardcoded list is to provide an implementation of the EntitlementLookUpFunction.

tip

This function will be called each time an Entitlement is checked allowing developers to store entitlements on a remote permission server that can update in real time.

As with all instances where a JavaScript function needs to be provided to AdapTable, this is done in 2 steps:

note

Predefined Config is stored as JSON so cannot include JavaScript functions (as they cannot be stringifed)

  1. Provide a custom, named EntitlementLookUpFunction implementation in the User Functions section of Adaptable Options.

  2. Reference that function by name in the Entitlements section of Predefined Config.

// Predefined Config
export default {
// Set the Default Access Level to be 'Full' (for any Functions not explicitly entitled)
// Provide the name of the EntitlementLookUpFunction to use
Entitlements: {
DefaultAccessLevel: 'Full',
EntitlementLookUpFunction: 'serverLookUp',
},
},
} as PredefinedConfig;
// Adaptable Options
const adaptableOptions: AdaptableOptions = {
// Set all Ediiting Functions to be Hidden (e.g. we have a ReadOnly grid)
// Permission Search Functions based on the results from an Entitlements Server we call.
userFunctions: [
{
name: 'EntitlementLookUpFunction',
type: 'serverLookUp',
handler(functionName: AdaptableFunctionName, user: string, adaptableId: string) {
switch (funcName) {
case 'BulkUpdate':
case 'CellValidation':
case 'PlusMinus':
case 'SmartEdit':
case 'Shortcut':
return 'Hidden';
case 'Query':
case 'Filter':
case 'DataSource':
case 'QuickSearch':
return getPermissionServerResult(funcName, userName, adaptableId);
}
},
],

Additional Rules

Some AdapTable Functions require additional conditions for it to be available in addition to setting the Entitlement.

These are usually supplied in Predefined Config or Adaptable Options. These include:

  • Team Sharing: the enableTeamSharing property must be set to true in TeamSharingOptions

  • glue42: the glue42 Predefined Config must contain the glue42 object

  • ipushpull: the ipushpull Predefined Config must contain the ipushpull object

Entitlements Scope

Entitlements work at the UI Level only.

This means that AdapTable will ensure that end users cannot see or access - throughout the AdapTable UI - elements like menus, toolbars, popups etc. in Functions to which they are not entitled.

However the Adaptable Api does not take notice of Entitlements, so anything that is managed programatically through code will ignore the User's entitlements.

tip

To ensure that the Adaptable Api is not called for functions to which the user has no access, wrap those calls inside relevant EntitlementApi methods

if (entitlementApi.isFunctionFullEntitlement('Layout')){
layoutApi.doSomething....
}

Overriding Entitlements

Entitlements in AdapTable work at the Adaptable Function level.

However, sometimes a use case demands that while the Function has a 'Full' entitlement (i.e. it is editable), one particular object must be ReadOnly (i.e. cannot be deleted).

The IsReadOnly property of AdaptableObject is designed for precisely this reason, and it will overrride the 'Full' Entitlement in the Adaptable Function.

warning

There is no property for the opposite use case - where the Function's Entitlement is 'ReadOnly' but one AdaptTable object should be 'Full'

More Information