What does it do? Aspect condition as part of an access condition cds_cond in an access rule of the statement DEFINE ROLE in CDS DCL. An aspect condition specifies the user-defined aspect aspect defined in an aspect definition in the right side introduced by ASPECT. In parentheses, the left side contains the ordered list of entity elements that match the output fields of the user-defined aspect. Left-side host expressions are not supported in this language element. The only comparison operator allowed is the equality operator =. When any of the left side elements of an aspect condition is declared as optional with default FALSE and missing at runtime, the entire aspect is handled as logically false. Missing optional elements with default TRUE are removed from the link condition between the aspect entity and the protected entity. This process may apply to all left side elements, in which case the aspect condition reduces to a mere existence check of any row in the aspect entity for the current user.
ABAP Addition When the aspect definition declares at least one filter element (see DEFINE ASPECT), you can use this addition to specify an additional selection condition for the rows of the aspect entity, before the result set is used to filter the rows of the protected entity. The condition can use the declared aspect filters, literals, session variables and parameters of the protected entity, but you cannot refer to elements of the protected entity. The aspect filter supports logical expressions and brackets.
ABAP_EXAMPLE_VX5 You have an aspect entity with the following content, where NULL denotes a null value: USERNAMECOSTCENTERSTATE A1U A2V A3NULL B1V B2U In the aspect definition, you specify USERNAME as the user element, COSTCENTER as the output element, and STATE as the filter element: DEFINE ASPECT DEMO_ASPECT AS SELECT FROM ... WITH USER ELEMENT USERNAME WITH FILTER ELEMENTS ( STATE ) ${ COSTCENTER $} In an access role you filter the protected entity based on column CostCenter using the user-defined aspect. GRANT SELECT ON ... WHERE (CostCenter) = ASPECT DEMO_ASPECT; With this condition, for user A the cost centers 1, 2 and 3 will be returned. When only the cost centers with state U or NULL are respected, you can filter the aspect rows: GRANT SELECT ON ... WHERE (CostCenter) = ASPECT DEMO_ASPECT FILER BY( STATE = 'U' OR STATE IS NULL ); For user A, this condition will return cost center 1 and 3, while for user B, cost center 2 would be returned. ABAP_EXAMPLE_END
ABAP_EXAMPLE_VX5 The following example shows a CDS role that defines an access condition based on the user-defined aspect DEMO_CDS_USER_DEFINED_ASPECT. DCLS DEMO_DCL_USER_DEFINED_ASPECT ABAP_EXAMPLE_END
