API Documentation

Classes

Permission

Represents a security permission in the system. Mapped internally to a Servoy security group which must be defined.

Role

Security role which can have user members and can be granted permissions.

Session

Security application session created by a User which starts when the user logs in and ends when the user logs out.

Tenant

Tenant account which is used to segregate all data. Users and Roles belong to a Tenant.

User

Application user account associated with a Tenant. Security Permissions are granted to users through their Role membership.

Functions

changeExternalDBTransactionSupportFlag(mustSupportExternalTransactions)

Use this method to change the behavior of the svySecurity module with respect to DB transactions.

If the flag is set to false (default) then when saving or deleting security-related records if an external DB transaction is detected the operation will fail. If the flag is set to true then when saving or deleting security-related records the module will start/commit a DB transaction only if an external DB transaction is not detected. On exceptions any DB transaction will be rolled back regardless if it is started internally or externally (exceptions will be propagated to the external transaction so callers will be able to react on them accordingly)

cloneTenant(tenantToClone, name, [makeSlave])Tenant

Creates and returns a new tenant with the specified name as a clone of the given tenant. The names of tenants must be unique in the system. The cloned tenant has the same roles and role permissions as the original. When makeSlave is true, the newly created clone will be a slave of the tenant to clone, inheriting all role / permission changes made to the master. WARNING: Cannot call this function when logged in as an user.

consumeAccessToken(token)User

Consumes a secure-access token and returns the user associated with the token if a valid match was found. Tokens may be used only once to identify a user. Subsequent calls to consume the same token will fail. Secure-access tokens are created with generateAccessToken

createTenant(name)Tenant

Creates and returns a new tenant with the specified name. The names of tenants must be unique in the system.

deleteTenant(tenant)Boolean

Immediately and permanently deletes the specified tenant and all records associated with it, including all users and roles. Tenant will not be deleted if it has users with active sessions. If the deleted tenant is a Master tenant and is a slave of another master tenant, this operation will replace the master tenant of it's direct slaves with the master of the tenant that is deleted; If the delated tenant is a Master tenant and has no Master tenant, this operation will remove the master from all it's direct slaves.

getActiveSessions()[ 'Array' ].<Session>

Gets all active sessions for the application.

getPermission(name)Permission

Gets a permission by its unique permission name.

getPermissions()[ 'Array' ].<Permission>

Gets all permissions available in this application.

getRole(roleName, [tenantName])Role

Gets a role by the specified role name and tenant name. If tenant name is not specified will use the tenant of the user currently logged in the application, if available.

getSession()Session

Gets the current user session or null if no session initialized (no user is currently logged in).

getSessionCount()Number

Gets the number of all unique sessions which have ever been initialized in the application. This includes both active sessions (for users currently logged in the application) and inactive sessions (sessions from the past which have already been closed).

getTenant([name])Tenant

Gets a tenant by its unique tenant name. If tenant name is not specified then will return the tenant of the currently logged in user. If tenant name is not specified and no user is currently logged in then will return null.

getTenants()[ 'Array' ].<Tenant>

Gets all tenants in the system.

getUser([userName], [tenantName])User

Gets a user by the specified username and tenant name. If username is not specified will return the user currently logged in the application, if available.

getUsers()[ 'Array' ].<User>

Gets all users in the system.

getVersion()String

Gets the version of this module

login(user, [userUid], [permissionsToApply])Boolean

Logs in the specified user and initializes a new Session for it. The login request will not be successful if the user account or the parent tenant account is locked and the lock has not expired yet. The login request will not be successful also if no permissions have been granted to the specified user. This method internally calls the standard Servoy security.login().

logout()

Logs the current user out of the application and closes the associated Session. This method internally calls security.logout() to end the Servoy client session.

syncPermissions([forcePermissionRemoval])

Utility to sync permission records to the internal, design-time Servoy Security Groups. This should be called on solution import or on startup This action will create new permission records.

NOTE: This action will not delete permissions which have been removed from internal security. Design-time groups should never be renamed. They will be seen only as an ADD and will lose their tie to roles.

Permission

Represents a security permission in the system. Mapped internally to a Servoy security group which must be defined.


permission.addRole(role) ⇒ Permission

Grants this permission to the specified role. The permission will be granted to all users that are members of the specified role. If the tenant of this permission is a master tenant, the role will also be added to the same permission for all the slaves of this permission tenant. You cannot grant permission to role of a master tenant when logged in as an user. You cannot grant permission to role of a slave tenant at anytime.

Returns: Permission - This permission for call-chaining support. Throws an exception when permission cannot be granted.

ParamTypeDescription

role

The role object to which the permission should be granted.

permission.getDisplayName() ⇒ String

Gets the display name of this permission. The display name can be set using setDisplayName.

Returns: String - The display name of the permission. Can be null.

permission.getName() ⇒ String

Gets the name of this permission. The permission name is unique in the system and matches a Servoy security group name.

Returns: String - The name of the permission.

permission.getRoles() ⇒ [ 'Array' ].<Role>

Gets all the roles to which this permission is granted.

Returns: [ 'Array' ].<Role> - An array with all roles to which this permission is granted or an empty array if the permission has not been granted to any role.

permission.getUsers() ⇒ [ 'Array' ].<User>

Gets all users whom this permission is granted to via the users' role membership.

Returns: [ 'Array' ].<User> - An array with all users whom this permission is granted to or an empty array if no user has this permission.

permission.hasRole(role) ⇒ Boolean

Checks if this permission is granted to the specified role.

Returns: Boolean - True if this permission is granted to the specified role.

ParamTypeDescription

role

Role | String

The role object or the name of the role to check.

permission.removeRole(role) ⇒ Permission

Removes this permission from the specified role. The permission will no longer be granted to all users that are members of the specified role. If the tenant of this permission is a master tenant, the role will also be removed from the same permission for all the slaves of this permission tenant. You cannot remove permission from role of a master tenant when logged in as an user. You cannot remove permission from role of a slave tenant at anytime.

Returns: Permission - This permission for call-chaining support. Throws an exception when permission cannot be removed.

ParamTypeDescription

role

Role | String

The role object or the name of the role to remove.

permission.setDisplayName([displayName]) ⇒ Permission

Sets the display name of this permission.

Returns: Permission - This permission for call-chaining support.

ParamTypeDescription

[displayName]

String

The display name to use.

new Permission(record)

Permission objects cannot be created through the API. They are created automatically when the scope is loaded. Use getPermission or getPermissions to get permission objects. Creating permission objects with the new operator is reserved for internal use only.

ParamType

record

[ 'JSRecord' ].<permissions>


Role

Security role which can have user members and can be granted permissions.

role.addPermission(permission) ⇒ Role

Grants the specified permission to this role. Any users that are members of this role will be granted the permission. If the tenant of this role is a master tenant, the permission will also be added to the same role in all slaves of this role tenant. You cannot grant permission to role of a master tenant when logged in as an user. You cannot grant permission to role of a slave tenant at anytime.

Returns: Role - This role for call-chaining support.

ParamTypeDescription

permission

Permission | String

The permission object or name of permission to add.\ Throws an exception when permission cannot be grant.

role.addUser(user) ⇒ Role

Adds the specified user as member of this role. All permissions granted to this role will be granted to the user.

Returns: Role - This role for call-chaining support.

ParamTypeDescription

user

User | String

The user object or username of user to add. The user must be associated with the tenant of this role.

role.getDisplayName() ⇒ String

Gets the display name of this role.

Returns: String - The display name of this role. Can be null.

role.getName() ⇒ String

Gets the name of this role. The role name is unique to the associated tenant.

Returns: String - The role name.

role.getPermissions() ⇒ [ 'Array' ].<Permission>

Gets all the permissions granted to this role.

Returns: [ 'Array' ].<Permission> - An array with all permissions granted to this role or an empty array if no permissions are granted.

role.getTenant() ⇒ Tenant

Gets the tenant which this role belongs to.

Returns: Tenant - The tenant which this role belongs to.

role.getUsers() ⇒ [ 'Array' ].<User>

Gets all the users who are members of this role.

Returns: [ 'Array' ].<User> - An array with all users who are members of this role or an empty array if the role has no members.

role.hasPermission(permission) ⇒ Boolean

Checks if the specified permission is granted to this role.

Returns: Boolean - True if the specified permission is granted to this role.

ParamTypeDescription

permission

Permission | String

The permission object or name of permission to check.

role.hasUser(user) ⇒ Boolean

Checks if the specified user is a member of this role.

Returns: Boolean - True if the specified user is a member of this role.

ParamTypeDescription

user

User | String

The user object or username of user to check. The user must be associated with the tenant of this role.

role.removePermission(permission) ⇒ Role

Removes the specified permission from this role. The permission will no longer be granted to all users that are members of this role. If the tenant of this role is a master tenant, the permission will also be removed from the same role in all slaves of this role tenant. You cannot remove permission from role of a master tenant when logged in as an user. You cannot remove permission from role of a slave tenant at anytime.

Returns: Role - This role for call-chaining support. Throws an exception when permission cannot be removed.

ParamTypeDescription

permission

Permission | String

The permission object or name of permission to remove.

role.removeUser(user) ⇒ Role

Removes the specified user from the members of this role. All permissions granted to this role will no longer be granted to the user.

Returns: Role - This role for call-chaining support.

ParamTypeDescription

user

User | String

The user object or username of user to remove.

role.setDisplayName(displayName) ⇒ Role

Sets the display name of this role. If the tenant of this role is a master tenant, the displayName will be set to the same role in all slaves of this role tenant. You cannot set the display name to role of a master tenant when logged in as an user. You cannot set the display name to role of a slave tenant at anytime.

Returns: Role - This role for call-chaining support. throws an exception if the displayName cannot be changed

ParamTypeDescription

displayName

String

The display name to use.

new Role(record)

Use createRole to create role objects. Creating role objects with the new operator is reserved for internal use only.

ParamType

record

[ 'JSRecord' ].<roles>


Session

Security application session created by a User which starts when the user logs in and ends when the user logs out.

session.getDuration() ⇒ Number

Gets the session duration in milliseconds (as updated in the database)

Returns: Number - The Servoy Client ID associated with the session.

Note: The session duration is updated on each "client ping" which by default is once per minute

session.getEnd() ⇒ Date

Gets the end datetime of this session. Can be null if the session is still active or if the session has not been properly closed. The session end date/time is set by logout.

Returns: Date - The end date/time of this session.

session.getID() ⇒ String

Gets the internal unique ID of this session. This matches the Servoy Client ID as seen in the Servoy App Server admin page.

Returns: String - The internal unique ID of this session.

session.getIPAddress() ⇒ String

Gets the client IP address of the session.

Returns: String - The client IP address of the session.

session.getServoyClientID() ⇒ String

Gets the Servoy Client ID associated with the session (as shown on the Servoy app server admin page).

Returns: String - The Servoy Client ID associated with the session.

Note: Multiple user sessions can have the same Servoy Client ID if the client is not closed between different logins (for NG/Web clients this requires complete closing of the browser and not just a tab).

session.getSolutionName() ⇒ String

Gets the name of the Servoy solution that was accessed by this session

session.getStart() ⇒ Date

Gets the start date/time of this session. The session start date/time is set by login.

Returns: Date - The start date/time of this session.

session.getTenant() ⇒ Tenant

Gets the tenant associated with this session. Returns null if the tenant has been deleted. In such cases use getTenantName as it will be preserved even if the tenant account is deleted.

session.getTenantName() ⇒ String

Gets the name of the tenant associated with this session. It will be available even if the associated tenant account is deleted.

Returns: String - The name of the tenant associated with this session.

session.getUser() ⇒ User

Gets the user who created this session. Returns null if the user account has been deleted. In such cases use getUserName as it will be preserved even if the user account is deleted.

Returns: User - The user who created this session or null if the user account has been deleted.

session.getUserAgentString() ⇒ String

Gets the client user agent string of the session. The user agent string will be null if the session was not browser-based.

Returns: String - The client user agent string of this session. Can be null.

session.getUserName() ⇒ String

The username of the user associated with this session. It will be available even if the associated user account is deleted.

Returns: String - The username of the user who created this session.

session.isAbandoned() ⇒ Boolean

Indicates if this session was abandoned and closed due to inactivity and was not closed by logout.

Returns: Boolean - True if this session was not terminated/closed normally, but has timed out due to inactivity.

session.isActive() ⇒ Boolean

Indicates if this session is still active.

Returns: Boolean - True if the session has not been terminated and has not been inactive for longer than the session inactivity timeout period.

session.isTerminated() ⇒ Boolean

Indicates if this session was terminated/closed using logout or closed due to inactivity.

Returns: Boolean - True if the session was terminated/closed normally or by timeout from inactivity.

new Session(record)

Session objects cannot be created through the API. They are created automatically when a user is logged in. Use getSession to get the current session or getActiveSessions to get all active sessions. Creating session objects with the new operator is reserved for internal use only.

ParamType

record

[ 'JSRecord' ].<sessions>


Tenant

Tenant account which is used to segregate all data. Users and Roles belong to a Tenant.

tenant.createRole(name) ⇒ Role

Creates a role associated with this tenant using the specified role name. If this is a Master Tenant the created role will be added to all slaves of this Tenant. Cannot create role for a master tenant when logged in as an user.

Returns: Role - The role which was created. If the role name is not unique to this tenant.

ParamTypeDescription

name

String

The name of the role to be created. Must be unique to this tenant.

tenant.createSlave(name) ⇒ Tenant

Creates a slave of this tenant with the given name. Modifications to roles and permissions of this tenant will be propagated to all of its slaves.

WARNING: Cannot call this function when logged in as an user.

Returns: Tenant - slave The slave that has been created

ParamTypeDescription

name

String

The name of the tenant. Must be unique and no longer than 50 characters. Throws an exception if this function is called when logged in as an user.

tenant.createUser(userName, [password]) ⇒ User

Creates a user with the specified user name.

Returns: User - The user which was created. If the user name is not specified or is not unique.

Note: If password is not specified the user account will be created with a blank password. Use setPassword to set or change the user password.

ParamTypeDescription

userName

String

Must be unique in system.

[password]

String

The password to use for the new user.

tenant.deleteRole(role) ⇒ Tenant

Deletes the specified role from this tenant. All associated permissions and grants to users are removed immediately. Users with active sessions will be affected, but design-time security (CRUD, UI) will not be affected until next log-in.

If this is a Master Tenant the deleted role will be deleted also for all slaves of this Tenant. Cannot delete role of a master tenant when logged in as an user.

Returns: Tenant - This tenant for call-chaining support.

ParamTypeDescription

role

Role | String

The role object or name of role to be deleted. The role must be associated with this tenant. throws an exception if the role cannot be deleted.

tenant.deleteUser(user) ⇒ Boolean

Immediately and permanently deletes the specified user and all security-related records associated with it. The user will not be deleted if it has active sessions.

Returns: Boolean - True if the user is deleted, otherwise false.

Note: USE WITH CAUTION! There is no undo for this operation.

ParamTypeDescription

user

User | String

The user object or the username of the user to be deleted. The specified user must be associated with this tenant.

tenant.getActiveSessions() ⇒ [ 'Array' ].<Session>

Gets the active sessions for users associated with this tenant. This includes any sessions from any device and any location for users associated with this tenant.

Returns: [ 'Array' ].<Session> - An array with all active sessions for users associated with this tenant or an empty array if the are no active sessions.

Note: Any unterminated sessions are deemed to be active when they have not been idle for more than a set timeout period.

tenant.getDisplayName() ⇒ String

Gets the display name of this tenant. The display name can be set using setDisplayName.

Returns: String - The display name of this tenant. Can be null if a display name is not set.

tenant.getLockExpiration() ⇒ Date

Gets the expiration date/time of the lock created by lock. The lock will remain in place until it expires or it is removed using unlock.

Returns: Date - The date/time when the lock expires. Can be null. The date/time is using the Servoy application server timezone.

tenant.getLockReason() ⇒ String

Gets the reason for the account lock created by lock.

Returns: String - The lock reason. Can be null.

tenant.getName() ⇒ String

Gets the name of this tenant. Tenant names are unique in the system and are specified when the tenant is created.

Returns: String - The name of this tenant.

tenant.getRole(name) ⇒ Role

Gets a role by name unique to this tenant.

Returns: Role - The matching role, or null if a role with the specified name and associated with this tenant is not found.

ParamTypeDescription

name

String

The name of the role to get.

tenant.getRoles() ⇒ [ 'Array' ].<Role>

Gets the roles associated with this tenant.

Returns: [ 'Array' ].<Role> - An array with the roles associated with this tenant or an empty array if the tenant has no roles.

tenant.getSessionCount() ⇒ Number

Gets the number of all unique sessions which have ever been initialized in the system by users associated with this tenant. This includes both active sessions (for users currently logged in the application) and inactive sessions (sessions from the past which have already been terminated).

Returns: Number - The number of all sessions (active and inactive) for users associated with this tenant.

tenant.getSlaves() ⇒ [ 'Array' ].<Tenant>

Gets all slaves of this tenant When recursive is true, all slaves of this tenant's slaves are included WARNING: Cannot call this function when logged in as an user.

Throws an exception if this function is called when logged in as an user.

Returns: [ 'Array' ].<Tenant> - slaves Array of tenants that have this tenant as their master

tenant.getUser(userName) ⇒ User

Gets the user (associated with this tenant) specified by the username.

Returns: User - The matching user or null if a user with the specified username and associated with this tenant is not found.

ParamTypeDescription

userName

String

The username of the user.

tenant.getUsers() ⇒ [ 'Array' ].<User>

Gets all users for this tenant.

Returns: [ 'Array' ].<User> - An array with all users associated with this tenant or an empty array if the tenant has no users.

tenant.isLocked() ⇒ Boolean

Indicates if the tenant account is locked using lock.

Returns: Boolean - True if the tenant account is currently locked and the lock has not expired.

tenant.isMasterTenant() ⇒ Boolean

Returns true if this Tenant is a master (template) tenant WARNING: When the user is already logged, can call this function only for the tenant of the logged user; cannot call this function for other tenants when logged in as an user.

Returns: Boolean - isMasterTenant Whether this tenant is a master to other tenants

Throws an exception when logged in as an user and called for another tenant than the tenant of the logged user.

tenant.isSlaveTenant() ⇒ Boolean

Returns true if this Tenant is a slave tenant

Returns: Boolean - isMasterTenant Whether this tenant is a master to other tenants

tenant.lock([reason], [duration]) ⇒ Tenant

Locks the tenant account preventing its users from logging in. The lock will remain in place until it expires (if a duration was specified) or it is removed using {Tenant#unlock}. Users with active sessions will be unaffected until subsequent login attempts. Can be called even if the tenant is already locked. In such cases the lock reason and duration will be reset.

Returns: Tenant - This tenant for call-chaining support.

ParamTypeDescription

[reason]

String

The reason for the lock.

[duration]

Number

The duration of the lock (in milliseconds). If no duration specified, the lock will remain until {Tenant#unlock} is called.

tenant.setDisplayName(displayName) ⇒ Tenant

Sets the display name of this tenant.

Returns: Tenant - This tenant for call-chaining support.

ParamTypeDescription

displayName

String

The display name to use.

tenant.unlock() ⇒ Tenant

Removes the lock on the tenant account which is created by lock. Can be safely called even if the tenant is not locked.

Returns: