get_security

get_security answers “who can open this component?” from PeopleSoft’s security definitions. It lists the permission lists that grant access to the component’s pages and the actions each one allows, plus the roles that include those permission lists and how many users have each role.

Use it for

“Which roles and permission lists grant access to this component?”
“Who can use Correction mode on Job Data?”
“Have managers been given access to ZZ_TRAINING_REQ yet?”

Input

Argument	Type	Required	Description
`component`	string	Yes	The component name, such as `JOB_DATA`. Up to 18 characters.
`market`	string	No	The market. Default: `GBL`.
`include_user_counts`	boolean	No	Count the users in each role. Default: `true`.

{
  "type": "object",
  "properties": {
    "component": {
      "type": "string",
      "pattern": "^[A-Za-z][A-Za-z0-9_]{0,17}$",
      "description": "Component name, for example JOB_DATA"
    },
    "market": {
      "type": "string",
      "pattern": "^[A-Za-z0-9]{3}$",
      "default": "GBL"
    },
    "include_user_counts": { "type": "boolean", "default": true }
  },
  "required": ["component"],
  "additionalProperties": false
}

Output

Field	Description
`component`, `market`	The component and its market
`menuItems`	Where the component is registered, each with `menu`, `bar`, and `item`
`permissionLists`	The permission lists that grant access, each with `name`, `description`, `pages`, and `roles`
`permissionLists[].pages`	The pages granted, each with `page`, `actions`, and `displayOnly` when access is display-only
`permissionLists[].roles`	The roles that include the permission list, each with `name` and `userCount`

The actions are the component modes that the permission list allows on the page:

Action	Bit value in `AUTHORIZEDACTIONS`
Add	1
Update/Display	2
Update/Display All	4
Correction	8
Data Entry	128

{
  "component": "ZZ_TRAINING_REQ",
  "market": "GBL",
  "menuItems": [
    { "menu": "ZZ_TRAINING", "bar": "USE", "item": "ZZ_TRAINING_REQ" }
  ],
  "permissionLists": [
    {
      "name": "ZZ_TRN_MGR",
      "description": "Training - Managers",
      "pages": [
        {
          "page": "ZZ_TRAIN_REQ",
          "actions": ["Add", "Update/Display"]
        },
        {
          "page": "ZZ_TRAIN_APPR",
          "actions": ["Update/Display"],
          "displayOnly": true
        }
      ],
      "roles": [{ "name": "ZZ Training Manager", "userCount": 42 }]
    }
  ]
}

How it works

Access to a component flows from menu items to permission lists to roles. The tool reads:

Table	What it provides
`PSMENUITEM`	The menu items that register the component, by `PNLGRPNAME` and `MARKET`
`PSAUTHITEM`	Each permission list’s access to the pages of those menu items, with `AUTHORIZEDACTIONS` and `DISPLAYONLY`
`PSCLASSDEFN`	Permission list descriptions, from `CLASSDEFNDESC`
`PSROLECLASS`	The roles that include each permission list
`PSROLEUSER`	How many users have each role

PSAUTHITEM identifies a menu item by MENUNAME, BARNAME, and BARITEMNAME, which is the menu item’s ITEMNAME, and a page by PNLITEMNAME:

SELECT A.CLASSID, C.CLASSDEFNDESC, A.PNLITEMNAME,
       A.AUTHORIZEDACTIONS, A.DISPLAYONLY, RC.ROLENAME
  FROM PSMENUITEM M
  JOIN PSAUTHITEM A
    ON A.MENUNAME = M.MENUNAME
   AND A.BARNAME = M.BARNAME
   AND A.BARITEMNAME = M.ITEMNAME
  JOIN PSCLASSDEFN C
    ON C.CLASSID = A.CLASSID
  LEFT JOIN PSROLECLASS RC
    ON RC.CLASSID = A.CLASSID
 WHERE M.PNLGRPNAME = :component
   AND M.MARKET = :market
 ORDER BY A.CLASSID, A.PNLITEMNAME, RC.ROLENAME

SELECT ROLENAME, COUNT(*) AS USER_COUNT
  FROM PSROLEUSER
 WHERE ROLENAME IN (:role1, :role2)
 GROUP BY ROLENAME

AUTHORIZEDACTIONS adds up the bit values of the allowed actions, so a value of 3 means Add and Update/Display.

Limits and errors

The tool reports access granted by security definitions. It doesn’t evaluate row-level security, such as which departments a user can see, or PeopleCode that hides pages and fields at runtime.
It counts the users in each role but doesn’t name them, which keeps personal data out of the conversation.
A component that isn’t registered on any menu returns empty menuItems and permissionLists lists: without a menu item, no permission list can grant access to it.

describe_component shows the component’s pages and navigation.
search_definitions finds a component from its navigation label.