Copy this script into ServiceNow under application x_786686_hr_leave (Australia). Table/API names already use the current scope.
Source: src/server/script_includes/HRLXProSecurityUtilsV2.js
/**
* Script Include: HRLXProSecurityUtilsV2
* Scope: x_786686_hr_leave
* Application: Custom · Scope: x_786686_hr_leave · sys_id: c84db0e8839f0b509f02b0d6feaad3c9
* Client callable: false
* Purpose: Centralized security checks used by ACLs.
*
* Used by ACL scripts, e.g.:
* answer = new x_786686_hr_leave.HRLXProSecurityUtilsV2().canReadLeave(current);
*/
var HRLXProSecurityUtilsV2 = Class.create();
HRLXProSecurityUtilsV2.prototype = {
initialize: function () {
this.userId = gs.getUserID();
},
/** HR admin can do anything. */
isHrAdmin: function () {
return gs.hasRole('x_786686_hr_leave.hr_admin');
},
/** Can the current user READ this leave request? */
canReadLeave: function (current) {
if (this.isHrAdmin()) return true;
// owner
if (current.getValue('u_requested_for_user') === this.userId) return true;
// approver / manager
if (current.getValue('u_approver_user') === this.userId) return true;
// manager of the employee
return this._isManagerOfEmployee(current.getValue('u_employee_ref'));
},
/** Can the current user WRITE this leave request? */
canWriteLeave: function (current) {
if (this.isHrAdmin()) return true;
var state = current.getValue('u_state');
// owner can edit only while draft/submitted
if (current.getValue('u_requested_for_user') === this.userId) {
return (state === 'draft' || state === 'submitted');
}
// approver can act when submitted
if (current.getValue('u_approver_user') === this.userId) {
return (state === 'submitted');
}
return false;
},
_isManagerOfEmployee: function (employeeSysId) {
if (!employeeSysId) return false;
var emp = new GlideRecord('x_786686_hr_leave_employee_v2');
if (emp.get(employeeSysId)) {
return emp.getValue('u_manager') === this.userId;
}
return false;
},
type: 'HRLXProSecurityUtilsV2'
};