Determining the user's net rights

In order to determine the net rights of the user, you need both the inherited right (if it exists) and the principal right that was retrieved in the previous section. The next code segment completes the function started above:

        //The GetNetRight method returns an associative array.

        //See the myReturn function for details.

        result = GetNetRight(Right.ID);

        // Use the shortcuts described in the myReturn function to assess

        // whether the net right is determined by an inherited or explicit right.

        if (result["Explicit"] == 0) {

            NotSpecified = "checked=true";

        } else if (result["Explicit"] == 2) {

            Denied = "checked=true";

        } else if (result["Explicit"] == 1) {

            Granted = "checked=true";

        } else {

            throw "Could not determine the right's state."

        }

        // Determine the state of any right that can be inherited.

        switch (result["Inherited"]) {

            case 0:

                InheritState = "(Not Specified)";

                break;

            case 1:

                InheritState = "(Granted)";

                break;

            case 2:

                InheritState = "(Denied)";

                break;

        }

        HTML += "<TD>" + InheritState + "</TD>";

        if (result["Inherited"] == 2) {

            // You cannot explicitly grant a right that is denied by inheritance.

            HTML += "<TD><input type='radio' disabled name='"+Right.ID+"' value='granted' "+Granted+"></TD>";

        } else {

            HTML += "<TD><input type='radio' name='"+Right.ID+"' value='granted' "+Granted+"></TD>";

        }

        // You can always explicitly deny a right.

        HTML += "<TD><input type='radio' name='"+Right.ID+"' value='denied' "+Denied+"></TD>";

        // You can always remove explicit settings.

        HTML += "<TD><input type='radio' name='"+Right.ID+"' value='notspecified' "+NotSpecified+"></TD>";

        if (result["NetRight"] == 0) {

            Net = "Denied";

        } else {

            Net = "Granted";

        }

        HTML += "<TD>" + Net + "</TD>";

        HTML += "<TD>" + Right.Description + "</TD></TR>";

    }

    HTML += "</TABLE>";

    return HTML;    

}

This code uses GetNetRight, which is integral to this example, to determine whether or not the right is actually granted to the user. The function is listed below. It takes the ID of the right as its only parameter. It uses the table from Inheritance of rights and the flow chart from To retrieve the rights for a user to determine the net and final right for the user/group on the object.

function GetNetRight(RightID) {

        // This function returns an associative array whose keys are created in

        // the function called "myReturn".

        try {

            PrincipalRight = ExplicitRights.Item("#" + RightID);

        } catch(e) {

            PrincipalRight = null;

        }

        try {

            InheritedRight = InheritedRights.Item("#" + RightID);

        } catch(e) {

            InheritedRight = null;

        }

        // The following tests cover every combination and

        // return the appropriate values in an associative array.

        // See the myReturn function for a description of the array.

        if (PrincipalRight == null) {

            if (InheritedRight == null) return (myReturn(0,0,0));

            if (InheritedRight.Granted == true) return (myReturn(1,1,0));

        }

        if (InheritedRight == null) {

            if (PrincipalRight.Granted == false) return (myReturn(0,0,2));

            if (PrincipalRight.Granted == true) return (myReturn(1,0,1));

        }

        // If denied by inheritance, the right is always denied.

        if (InheritedRight.Granted == false) {

            if (PrincipalRight == null) return (myReturn(0,2,0));

            if (PrincipalRight.Granted == true) return (myReturn(0,2,1));

            if (PrincipalRight.Granted == false) return (myReturn(0,2,2));

        }

        if (InheritedRight.Granted == true) {

            if (PrincipalRight.Granted == true) return (myReturn(1,1,1));

            if (PrincipalRight.Granted == false) return (myReturn(0,1,2));

        }

        throw "Error calculating the effective right.";

}

Note:    To quickly determine a user's effective rights, AnyPrincipal's Rights collection can be used. The drawback, however, is that no information regarding inherited or explicit rights are returned.

Go to the next section: Retrieving roles.