mpe_accesscheck.sas

Go to the documentation of this file.

/**
  @file
  @brief Checks group access level for a table or library
  @details In order for a user to be able to EDIT or APPROVE a table they must
    be in a group that has been granted access to that table in the
    MPE_SECURITY table.  Alternatively, they may be in the &mpeadmins
    group (which has full access to everything).
 
  @param [in] base_table The base table to check for
  @param [in] user= The user for which the access level should be returned. If
    not provided, the mf_user() result is used instead.
  @param [in] access_level= (APPROVE) access_level (per MPE_SECURITY) reqd.
    Valid values:
      @li EDIT
      @li APPROVE
      @li VIEW
  @param [in] cntl_lib_var= (MPELIB) The name of a global macro variable that
    contains the libref in which the MPE_SECURITY table is stored
  @param [out] outds= (MED_ACCESSCHECK) Output WORK table containing all the
    groups for which the user is granted the particular ACCESS_LEVEL.
 
  <h4> SAS Macros </h4>
  @li mp_abort.sas
  @li mf_getuniquename.sas
  @li mf_getuser.sas
  @li mpe_validatecol.sas
  @li mpe_getgroups.sas
 
  <h4> Related Macros </h4>
  @li mpe_accesscheck.test.sas
 
  @version 9.2
  @author 4GL Apps Ltd
  @copyright 4GL Apps Ltd.  This code may only be used within Data Controller
    and may not be re-distributed or re-sold without the express permission of
    4GL Apps Ltd.
**/
 
%macro mpe_accesscheck(
    base_table
    ,outds=med_accesscheck /* WORK table to contain access details */
    ,user= /* metadata user to check for */
    ,access_level=APPROVE
    ,cntl_lib_var=MPELIB
  );
 
  %if &user= %then %let user=%mf_getuser();
 
  %mp_abort(
    iftrue=(%index(&outds,.)>0 and %upcase(%scan(&outds,1,.)) ne WORK)
    ,mac=mpe_accesscheck
    ,msg=%str(outds should be a WORK table)
  )
 
  /**
    * Validate inputs before they reach executable code.  base_table is
    * interpolated into a SQL where clause (and callers may pass raw request
    * input), so it must be a well-formed LIBREF.DATASET (or the
    * LIBREF.CATALOGNAME-FC form of a format catalog) and access_level must
    * be one of the known levels - anything else aborts before the query is
    * built.  Values are read with symget (never re-resolved) and scanned in
    * a data step so no macro content in the input can execute.
    */
  %local is_libds is_level;
  %let is_libds=0;
  %let is_level=0;
  data _null_;
    length _bt $64 _lvl $16;
    _bt=symget('base_table');
    _lvl=upcase(symget('access_level'));
    %mpe_validatecol(_bt,LIBDS,is_libds)
    if is_libds=0 then do;
      call symputx('is_libds',0,'l');
      putlog 'ERR' 'OR: Invalid base_table:' _bt;
      stop;
    end;
    if _lvl not in ('EDIT','APPROVE','VIEW','SIGNOFF','AUDIT') then do;
      call symputx('is_level',0,'l');
      putlog 'ERR' 'OR: Invalid access_level:' _lvl;
      stop;
    end;
    /* escape any embedded quotes so the value cannot break out of the
      * double-quoted SQL literals below (defence in depth - the LIBDS
      * check above already rejects quotes) */
    _bt=tranwrd(_bt,'"','');
    call symputx('base_table',_bt,'l');
    call symputx('access_level',_lvl,'l');
    call symputx('is_libds',is_libds,'l');
    call symputx('is_level',1,'l');
  run;
 
  %mp_abort(
    iftrue=(&is_libds ne 1)
    ,mac=mpe_accesscheck
    ,msg=%str(Invalid base_table)
  )
  %mp_abort(
    iftrue=(&is_level ne 1)
    ,mac=mpe_accesscheck
    ,msg=%str(Invalid access_level)
  )
 
  /* make unique temp table vars */
  %local tempds1 tempds2;
  %let tempds1=%mf_getuniquename(prefix=usergroups);
  %let tempds2=%mf_getuniquename(prefix=tablegroups);
 
  /* get list of user groups */
  %mpe_getgroups(user=&user,outds=&tempds1)
 
  /* get list of groups with access for that table */
  proc sql;
  create table &tempds2 as
    select distinct sas_group
    from &&&cntl_lib_var...mpe_security
    where &dc_dttmtfmt. lt tx_to
    and access_level="&access_level"
    and (
      (libref="%scan(&base_table,1,.)" and upcase(dsn)="%scan(&base_table,2,.)")
      or (libref="%scan(&base_table,1,.)" and dsn="*ALL*")
      or (libref="*ALL*")
    );
  %if &_debug ge 131 %then %do;
    data _null_;
      set &tempds1;
      putlog (_all_)(=);
    run;
    data _null_;
      set &tempds2;
      putlog (_all_)(=);
    run;
  %end;
 
  proc sql;
  create table &outds as
  select * from &tempds1
    where groupname="&mpeadmins"
      or groupname in (select * from &tempds2);
 
  %put &sysmacroname: base_table=&base_table;
  %put &sysmacroname: access_level=&access_level;
%mend mpe_accesscheck;