To get full access to the Kademi Hub existing customers can login here, or new customers can register here.
Provides the security and profile-lookup operations available to app controller scripts, wrapping KademiSecurityManager for the currently running request. Reached from JS as the securityManager global, it lets a controller check roles and privileges, look up or impersonate profiles, log a user in by setting the auth cookie, and generate one-time login tokens for a website.
Group: Managers
Properties
| Property | Returns | Description |
|---|---|---|
| currentProfile | Profile | The profile of the currently authenticated user for this request. |
| currentRequestPrivs | Set<Priviledge> | The privileges calculated for the current user on the current resource. This just provides access to the privileges already stored on the request's attributes, it does not calculate them itself. |
| currentRootFolder | RootFolder | The root folder for the current request, resolved by the current root folder service. |
| currentUser | UserResource | The currently authenticated user for this request. |
| roles | Set<Role> | All roles available within the current account. |
Methods
yield() · getCurrentUser() · getCurrentProfile() · hasRole(Profile p, String roleName) · hasDirectRole(Profile p, String roleName, Organisation targetDirectOrg) · getRoles() · getCurrentRootFolder() · findApplicableRoles(Organisation targetOrg, Profile p) · containsRole(Set<Role> roles, String roleName) · runAsUser(UserResource userRes, VarArgFunction objectMirror) · runAsUser(ProfileBean pb, VarArgFunction objectMirror) · runAsUser(String userName, VarArgFunction objectMirror) · runAsUser(Profile p, VarArgFunction objectMirror) · runAsUser(Profile p, RootFolder rf, VarArgFunction objectMirror) · generateLoginToken(String websiteName, ProfileBean profileBean) · generateLoginToken(String websiteName, boolean versioned, ProfileBean profileBean) · generateLoginToken(Website website, Branch branch, Profile p) · generateLoginToken(Website website, Branch branch, boolean forceVersioned, Profile p) · isUserInGroup(String email, String groupName) · getCurrentRequestPrivs() · containsPriv(Set<Priviledge> privs, Object priv) · getPriviledges(Profile curUser, String resourcePath) · getPriviledges(Profile curUser, CommonResource resource) · getPriviledges(Profile curUser, CommonResource resource, Narrative authNarrative)
yield()
Returns: void
Yields to the operating system. Should be called inside long-running loops that the governor cannot otherwise interrupt, so the platform's CPU time limit can be enforced.
getCurrentUser()
Returns: UserResource
The currently authenticated user for this request.
getCurrentProfile()
Returns: Profile
The profile of the currently authenticated user for this request.
hasRole(Profile p, String roleName)
Returns: boolean
Checks if the profile has the given role on any of their memberships.
| Parameter | Description |
|---|---|
p | the profile to check |
roleName | the name of the role to look for |
hasDirectRole(Profile p, String roleName, Organisation targetDirectOrg)
Returns: boolean
True if the profile has a membership with the requested role which applies directly to the requested target organisation. This method does not consider hierarchy, so a role on a parent org does not apply to child orgs.
| Parameter | Description |
|---|---|
p | the profile to check |
roleName | the name of the role to look for |
targetDirectOrg | the organisation the membership must apply directly to |
getRoles()
Returns: Set<Role>
All roles available within the current account.
getCurrentRootFolder()
Returns: RootFolder
The root folder for the current request, resolved by the current root folder service.
findApplicableRoles(Organisation targetOrg, Profile p)
Returns: Set<Role>
Finds the roles that apply to the given profile on the given target organisation, taking organisation hierarchy into account.
| Parameter | Description |
|---|---|
targetOrg | the organisation to find applicable roles on |
p | the profile to find roles for |
containsRole(Set<Role> roles, String roleName)
Returns: boolean
Checks whether a set of roles contains a role with the given name.
| Parameter | Description |
|---|---|
roles | the roles to search, may be null |
roleName | the role name to look for |
runAsUser(UserResource userRes, VarArgFunction objectMirror)
Returns: Object
Runs the given JS function with the current principal switched to the given user for its duration.
| Parameter | Description |
|---|---|
userRes | the user to run as |
objectMirror | the JS function to run |
runAsUser(ProfileBean pb, VarArgFunction objectMirror)
Returns: Object
Runs the given JS function with the current principal switched to the profile wrapped by pb for its duration.
| Parameter | Description |
|---|---|
pb | the profile bean to run as |
objectMirror | the JS function to run |
runAsUser(String userName, VarArgFunction objectMirror)
Returns: Object
Looks up a profile by user name or email within the current organisation, recursing into child organisations, then runs the given JS function with the current principal switched to that profile.
| Parameter | Description |
|---|---|
userName | the user name or email of the profile to run as |
objectMirror | the JS function to run |
runAsUser(Profile p, VarArgFunction objectMirror)
Returns: Object
Runs the given JS function with the current principal switched to the given profile, on the current root folder, for its duration.
| Parameter | Description |
|---|---|
p | the profile to run as |
objectMirror | the JS function to run |
runAsUser(Profile p, RootFolder rf, VarArgFunction objectMirror)
Returns: Object
Runs the given JS function with the current principal switched to the given profile on the given root folder for its duration. Errors thrown by the function are logged and rethrown.
| Parameter | Description |
|---|---|
p | the profile to run as |
rf | the root folder to run within |
objectMirror | the JS function to run |
generateLoginToken(String websiteName, ProfileBean profileBean)
Returns: String
Generates a one-time login token cookie value for the profile, scoped to the live branch of the named website.
| Parameter | Description |
|---|---|
websiteName | the name of the website to generate the token for |
profileBean | the profile to generate the token for |
generateLoginToken(String websiteName, boolean versioned, ProfileBean profileBean)
Returns: String
Generates a one-time login token cookie value for the profile, scoped to the live branch of the named website, optionally forcing the versioned domain to be used.
| Parameter | Description |
|---|---|
websiteName | the name of the website to generate the token for |
versioned | true to force use of the versioned domain name |
profileBean | the profile to generate the token for |
generateLoginToken(Website website, Branch branch, Profile p)
Returns: String
Generates a one-time login token cookie value for the profile, scoped to the given website and branch.
| Parameter | Description |
|---|---|
website | the website to generate the token for |
branch | the branch used to determine the domain name |
p | the profile to generate the token for, must not be null |
generateLoginToken(Website website, Branch branch, boolean forceVersioned, Profile p)
Returns: String
Generates a one-time login token cookie value for the profile, scoped to the given website and branch, optionally forcing the versioned domain to be used.
| Parameter | Description |
|---|---|
website | the website to generate the token for |
branch | the branch used to determine the domain name |
forceVersioned | true to force use of the versioned domain name |
p | the profile to generate the token for, must not be null |
isUserInGroup(String email, String groupName)
Returns: MembershipBean
Checks whether the profile identified by the given email is a member of the named group, in the current organisation.
| Parameter | Description |
|---|---|
email | the email address identifying the profile to check |
groupName | the name of the group to check membership of |
getCurrentRequestPrivs()
Returns: Set<Priviledge>
The privileges calculated for the current user on the current resource. This just provides access to the privileges already stored on the request's attributes, it does not calculate them itself.
containsPriv(Set<Priviledge> privs, Object priv)
Returns: boolean
Checks if the given privilege is contained within the given set of privileges, either directly or implied by a broader privilege already in the set.
| Parameter | Description |
|---|---|
privs | the set of privileges to search, may be null |
priv | the privilege to look for, as a Priviledge instance or its name as a string |
getPriviledges(Profile curUser, String resourcePath)
Returns: Set<Priviledge>
Locates a resource for the given path, and then calculates the privileges the given profile has on it.
| Parameter | Description |
|---|---|
curUser | the profile to calculate privileges for |
resourcePath | the path of the resource to check privileges on |
getPriviledges(Profile curUser, CommonResource resource)
Returns: Set<Priviledge>
Calculates the privileges the given profile has on the given resource.
| Parameter | Description |
|---|---|
curUser | the profile to calculate privileges for |
resource | the resource to check privileges on |
getPriviledges(Profile curUser, CommonResource resource, Narrative authNarrative)
Returns: Set<Priviledge>
Calculates the privileges the given profile has on the given resource, recording how the calculation was performed on the supplied narrative.
| Parameter | Description |
|---|---|
curUser | the profile to calculate privileges for |
resource | the resource to check privileges on |
authNarrative | captures information about how the privileges were calculated, may be null |
© 2025 Kademi Ltd