Hide Entries and Vouchers Behind Their Account's View Capability

These two Groovy scripts give a document the View Capability of the account it posts to. One works on journal entries, the other on receipt and payment vouchers. Once the document carries the capability, only users who hold it can open the document.

Recommended pattern

These scripts are not tied to any customer's setup. You can paste them as they are; they take no parameters.

Class names	EACopyViewCapabilityFromAccountToJournalEntry (journal entry) and EACopyViewCapabilityFromAccountToRVPV (receipt and payment vouchers)
Scripts	EACopyViewCapabilityFromAccountToJournalEntry.groovy, EACopyViewCapabilityFromAccountToRVPV.groovy
Runs on	Journal Entry, or Receipt Voucher and Payment Voucher, on Update Calculated Fields
Uses	No parameters. Leave Parameter 1 empty.
Shipped as	Source to paste. It is not built into the system.

When to use it

A capability on an account protects the account itself, but not the documents that post to it. Suppose the board's expense account carries the View Capability Board Confidential. Anybody who can open journal entries can still open the entry that charged a board trip to that account, and read the amount and the narration.

With this script on the journal entry, the entry takes the account's capability when it is saved. Users without Board Confidential are then refused the entry itself, exactly as if someone had set its View Capability by hand through More → Change Capabilities. How capabilities are held and checked is explained in Users Counter and Capability Types.

How it works

1. It reads the lines in order. For each line it looks at the line's account.
2. It stops at the first account with a View Capability. That capability is copied into the document's own View Capability, and the remaining lines are not looked at.
3. Otherwise it changes nothing. When no line's account has a View Capability, the document keeps whatever View Capability it already had.

So the order of the lines matters when several accounts carry different capabilities: the first one wins. The script copies the View Capability only. The document's Update Capability and Usage Capability are not touched.

Setting it up

1. Give the account a View Capability: open the account and use More → Change Capabilities.
2. Open Administration → Display Customization → Entity Flow and create a new flow with Target Type set to Journal Entry.
3. Add a line to the Details grid with Target Action set to Update Calculated Fields. Paste the whole journal-entry script into Groovy Script, and leave Class Name empty: it is filled in when you save.
4. Save the flow. Class Name shows the script's class name, and the description appears in Description.
5. For vouchers, create a second flow in the same way with Target Type set to Payment Voucher (or Receipt Voucher, or an Entity Type List holding both), and paste the voucher script instead.

Parameter	Title shown after saving	What to enter
Parameter 1	Not used - leave empty	Nothing.

Example

A payment voucher has three lines:

Line	Account	Account's View Capability
1	Accounts payable	none
2	Board travel expenses	Board Confidential
3	Accounts payable	none

The first line's account has no capability, so the script moves on. The second line's account has one, so the voucher is saved with View Capability Board Confidential.

The scripts

The journal-entry script:

package com.namasoft.modules.accounting.utils.entityactions

import com.namasoft.infra.domainbase.datafields.LongTextDF
import com.namasoft.infra.domainbase.entity.base.EntityAction
import com.namasoft.infra.domainbase.util.Result
import com.namasoft.modules.accounting.domain.entities.JournalEntry

class EACopyViewCapabilityFromAccountToJournalEntry implements EntityAction<JournalEntry> {
    @Override
    Result doAction(JournalEntry object, LongTextDF... parameters) {
        for (final def line in object.getLines()) {
            if (line.getAccount() != null && line.getAccount().getViewCapability() != null) {
                object.setViewCapability(line.getAccount().getViewCapability());
                break;
            }
        }
        return Result.createSuccessResult();
    }

    @Override
    String describe() {
        return "Journal entry: copies the View Capability of the first line account that has one into the journal entry's own View Capability, " +
                "so the entry is visible only to users who may see that account. Run it on Update Calculated Fields. Takes no parameters."
    }

    @Override
    List<String> columnNames() {
        return Arrays.asList("Not used - leave empty")
    }
}

The receipt and payment voucher script:

package com.namasoft.modules.accounting.utils.entityactions

import com.namasoft.infra.domainbase.datafields.LongTextDF
import com.namasoft.infra.domainbase.entity.base.EntityAction
import com.namasoft.infra.domainbase.util.Result
import com.namasoft.modules.accounting.domain.entities.RVPVVoucher

class EACopyViewCapabilityFromAccountToRVPV implements EntityAction<RVPVVoucher> {
    @Override
    Result doAction(RVPVVoucher object, LongTextDF... parameters) {
        for (final def line in object.fetchLines()) {
            if (line.getAccount() != null && line.getAccount().getViewCapability() != null) {
                object.setViewCapability(line.getAccount().getViewCapability());
                break;
            }
        }
        return Result.createSuccessResult();
    }

    @Override
    String describe() {
        return "Receipt or payment voucher: copies the View Capability of the first line account that has one into the voucher's own View Capability, " +
                "so the voucher is visible only to users who may see that account. Run it on Update Calculated Fields. Takes no parameters."
    }

    @Override
    List<String> columnNames() {
        return Arrays.asList("Not used - leave empty")
    }
}

Related

• EAGroovyAction: how Groovy scripts are attached to entity flows and task schedules.
• Users Counter and Capability Types
• Journal Entries & Adjustments
• Receipt & Payment Vouchers