chore: licence checker sync

Reviewed-on: #53

.gitea/workflows/development-test.yaml

@@ -21,10 +21,11 @@ jobs:
          echo '${{ secrets.NPMRC}}' > client/.npmrc
 
       - name: Install Chrome for Angular tests
-        run: apt-get update
+        run: |
-        run: wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
+          apt-get update
-        run: apt install -y ./google-chrome*.deb;
+          wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
-        run: export CHROME_BIN=/usr/bin/google-chrome
+          apt install -y ./google-chrome*.deb;
+          export CHROME_BIN=/usr/bin/google-chrome
 
       - name: Write cypress credentials
         run: echo "$CYPRESS_CREDS" > ./client/cypress.env.json
@@ -38,18 +39,20 @@ jobs:
       - name: Check audit
       # Audit should fail and stop the CI if critical vulnerability found
         run: |
-          npm audit --audit-level=critical
+          npm audit --audit-level=critical --omit=dev
           cd ./sas
-          npm audit --audit-level=critical
+          npm audit --audit-level=critical --omit=dev
-          cd ./client
+          cd ../client
-          npm audit --audit-level=critical
+          npm audit --audit-level=critical --omit=dev
 
       - name: Angular Tests
         run: |
+          cd client
           npm test -- --no-watch --no-progress --browsers=ChromeHeadlessCI
 
       - name: Angular Production Build
         run: |
+          cd client
           npm run postinstall
           npm run build
 

.gitea/workflows/release.yaml

@@ -35,6 +35,8 @@ jobs:
         run: |
           npm i
           npm i -g semantic-release
+          # We do a semantic-release DRY RUN to make the job fail if there are no changes to release
+          GITEA_TOKEN=${{ secrets.RELEASE_TOKEN }} GITEA_URL=https://git.datacontroller.io semantic-release --dry-run | grep -q "There are no relevant changes, so no new version is released." && exit 1
           GITEA_TOKEN=${{ secrets.RELEASE_TOKEN }} GITEA_URL=https://git.datacontroller.io semantic-release
 
       - name: Frontend Build
@@ -48,7 +50,7 @@ jobs:
         description: Compile SAS 9 services, remove tests & create deployment program
         run: |
           cd sas
-          npm ci
+          npm i
           sasjs c -t sas9
           rm -rf sasjsbuild/tests
           sasjs b -t sas9
@@ -105,7 +107,7 @@ jobs:
           RELEASE_ID=`curl -k 'https://git.datacontroller.io/api/v1/repos/dc/dc/releases/latest?access_token=${{ secrets.RELEASE_TOKEN }}' | jq -r '.id'`
           RELEASE_BODY=`curl -k 'https://git.datacontroller.io/api/v1/repos/dc/dc/releases/latest?access_token=${{ secrets.RELEASE_TOKEN }}' | jq -r '.body'`
           # Update body
-          curl --data '{"draft": true,"body":"'"$RELEASE_BODY\n\nFor installation instructions, please visit https://docs.datacontroller.io/"'"}' -X PATCH --header 'Content-Type: application/json' -k https://git.datacontroller.io/api/v1/repos/dc/dc/releases/$RELEASE_ID?access_token=${{ secrets.RELEASE_TOKEN }}
+          curl --data '{"draft": false,"body":"'"$RELEASE_BODY\n\nFor installation instructions, please visit https://docs.datacontroller.io/"'"}' -X PATCH --header 'Content-Type: application/json' -k https://git.datacontroller.io/api/v1/repos/dc/dc/releases/$RELEASE_ID?access_token=${{ secrets.RELEASE_TOKEN }}
           # Upload assets
           URL="https://git.datacontroller.io/api/v1/repos/dc/dc/releases/$RELEASE_ID/assets?access_token=${{ secrets.RELEASE_TOKEN }}"
           curl -k $URL -F attachment=@frontend.zip

.npmrc

@@ -1 +1 @@
-legacy-peer-deps=false
+legacy-peer-deps=true

.releaserc

@@ -6,11 +6,13 @@
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
+    "@semantic-release/npm",
     [
       "@semantic-release/git",
       {
         "assets": [
-          "CHANGELOG.md"
+          "CHANGELOG.md",
+          "package.json"
         ]
       }
     ],

CHANGELOG.md

@@ -1,9 +1,21 @@
-## [6.2.1](https://git.datacontroller.io/dc/dc/compare/v6.2.0...v6.2.1) (2023-08-25)
+## [6.2.2](https://git.datacontroller.io/dc/dc/compare/v6.2.1...v6.2.2) (2023-10-09)
+
+
+### Bug Fixes
+
+* updated SheetJS (crypto) to the latest ([8bd0dd2](https://git.datacontroller.io/dc/dc/commit/8bd0dd22c258911672303869e4df893a98e93575))
+
+## [6.2.1](https://git.datacontroller.io/dc/dc/compare/v6.2.0...v6.2.1) (2023-10-09)
 
 
 ### Bug Fixes
 
 * approve, history and submit pages grouped in review module ([e056ece](https://git.datacontroller.io/dc/dc/commit/e056ece2234ef6aab050f6a5b1f8de633b163d91))
+* closes [#39](https://git.datacontroller.io/dc/dc/issues/39) upcase issue in MPE_SECURITY ([a00d31c](https://git.datacontroller.io/dc/dc/commit/a00d31caf3c5634cd61a4700fb175e76856edbb6))
+* handsontable v13 ([6f482ec](https://git.datacontroller.io/dc/dc/commit/6f482ec6d909907a304ef9975262889e2370035f))
+* latest adapter ([5e30dc0](https://git.datacontroller.io/dc/dc/commit/5e30dc0f892fab2af41f4ea56e30f27ec3b3912e))
+* sasjs/cli and sasjs/core updated to the latest ([8571e01](https://git.datacontroller.io/dc/dc/commit/8571e01e44a8cb6df9d150d271c34bb75bffdf31))
+* updating editors/stagedata to address issues in particular viya configurations as described in issue [#33](https://git.datacontroller.io/dc/dc/issues/33) ([94ab949](https://git.datacontroller.io/dc/dc/commit/94ab949df8c75072525751a2156b7a32c2e641dc))
 * updating logic for REPLACE loadtype ([1f2ce55](https://git.datacontroller.io/dc/dc/commit/1f2ce55f249f4af56f0cacdec47e69246cd47431))
 
 # [6.2.0](https://git.datacontroller.io/dc/dc/compare/v6.1.0...v6.2.0) (2023-08-24)
@@ -13,19 +25,6 @@
 
 * re-enabling full REPLACE uploads ([08e39c4](https://git.datacontroller.io/dc/dc/commit/08e39c4fca570406f9aad3d907cb04596421d074))
 
-
-### Features
-
-* support for European numeric formats ([e48e47b](https://git.datacontroller.io/dc/dc/commit/e48e47bc635452b59e107b235e597c26e748875e))
-
-# [6.2.0](https://git.datacontroller.io/dc/dc/compare/v6.1.0...v6.2.0) (2023-08-24)
-
-
-### Bug Fixes
-
-* re-enabling full REPLACE uploads ([08e39c4](https://git.datacontroller.io/dc/dc/commit/08e39c4fca570406f9aad3d907cb04596421d074))
-
-
 ### Features
 
 * support for European numeric formats ([e48e47b](https://git.datacontroller.io/dc/dc/commit/e48e47bc635452b59e107b235e597c26e748875e))

CONTRIBUTING.md

@@ -53,6 +53,17 @@ npm run lint:fix
 Typedoc is used for generating typescript documentation based on the code.
 That part is automated and beign done as a part of CI job.
 
+# Release
+Release is automated as a part of CI job. Workflow file: `.gitea/workflows/release.yaml`.  
+It will run automatically when branch merged to the `main` branch.  
+IMPORTANT!  
+If release job fails, after it has been created empty release and a tag, we must not re-run the relase job until we removed the newly create GIT TAG and RELEASE.  
+To remove the git tag run:  
+```
+git push -d origin vX.X.X
+```
+To remove the release, you need to do it with repo administration over at [https://git.datacontroller.io/dc/dc](https://git.datacontroller.io/dc/dc)
+
 # Troubleshooting
 
 ## Makedata service "could not create directory" error

client/licenseChecker.js

@@ -10,7 +10,7 @@ const check = (cwd) => {
         onlyAllow:
           'AFLv2.1;Apache 2.0;Apache-2.0;Apache*;Artistic-2.0;0BSD;BSD*;BSD-2-Clause;BSD-3-Clause;CC0-1.0;CC-BY-3.0;CC-BY-4.0;ISC;MIT;MPL-2.0;ODC-By-1.0;Python-2.0;Unlicense;',
         excludePackages:
-          '@cds/city@1.1.0;@handsontable/angular@13.1.0;handsontable@13.1.0;hyperformula@2.5.0;jackspeak@2.2.0;path-scurry@1.7.0'
+          '@cds/city@1.1.0;@handsontable/angular@13.1.0;handsontable@13.1.0;hyperformula@2.6.0;jackspeak@2.2.0;path-scurry@1.7.0'
       },
       (error, json) => {
         if (error) {

package.json

@@ -1,11 +1,12 @@
 {
   "name": "dcfrontend",
-  "version": "6.0.0",
+  "version": "6.2.2",
   "description": "Data Controller",
   "devDependencies": {
     "@saithodev/semantic-release-gitea": "^2.1.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^10.0.1",
+    "@semantic-release/npm": "11.0.0",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/release-notes-generator": "^11.0.4",
     "commit-and-tag-version": "^11.2.2",
@@ -23,5 +24,10 @@
   "repository": {
     "type": "git",
     "url": "https://git.datacontroller.io/dc/dc.git"
-  }
+  },
+  "private": true,
+  "//": [
+    "Readme",
+    "We must set private: true so that semantic-release/npm plugin will update the package.json version but not try to release it as NPM package"
+  ]
 }

sas/package-lock.json

@@ -6,8 +6,8 @@
     "": {
       "name": "dc-sas",
       "dependencies": {
-        "@sasjs/cli": "^4.10.1",
+        "@sasjs/cli": "^4.11.1",
-        "@sasjs/core": "^4.46.6"
+        "@sasjs/core": "^4.48.0"
       }
     },
     "node_modules/@coolaj86/urequest": {
@@ -29,9 +29,9 @@
       }
     },
     "node_modules/@sasjs/adapter": {
-      "version": "4.9.2",
+      "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/@sasjs/adapter/-/adapter-4.9.2.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/adapter/-/adapter-4.10.1.tgz",
-      "integrity": "sha512-WAWhJAbhsOwChbRB6N+dcgj9Tods2Hq/ygsCASALbjKvqxtYlUDVBoEhdedur0VdsWyUaTAqcwioCiCpWtcRZA==",
+      "integrity": "sha512-/z6eR+3nNaLPyycK8YmpF+GAWNy0zgdl8n4cv4r45hjVBulPHVop7oj57JM/0uIPVOTT2V9IwrMCT/sFPq++vw==",
       "hasInstallScript": true,
       "dependencies": {
         "@sasjs/utils": "2.52.0",
@@ -78,12 +78,12 @@
       }
     },
     "node_modules/@sasjs/cli": {
-      "version": "4.10.1",
+      "version": "4.11.1",
-      "resolved": "https://registry.npmjs.org/@sasjs/cli/-/cli-4.10.1.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/cli/-/cli-4.11.1.tgz",
-      "integrity": "sha512-qnhTdwENC8j9NJwZKtVVXNmKfmdoIkMIYxgUnH4tw08630qCNPZaH/jGrwVFF5MSUyUswgOoLVyNjxSPAYaWMA==",
+      "integrity": "sha512-aI8V3YJGFXcY9OlNas0h8ZrajLIRPn4KmGkaOLHTDa8rZ2SOtj6W5by1RwyPB9iPIHcqW3JV3OgmtEB048zuYQ==",
       "hasInstallScript": true,
       "dependencies": {
-        "@sasjs/adapter": "4.9.2",
+        "@sasjs/adapter": "4.10.1",
         "@sasjs/core": "4.46.3",
         "@sasjs/lint": "2.3.1",
         "@sasjs/utils": "3.4.0",
@@ -116,9 +116,9 @@
       "integrity": "sha512-Grwydm5GxBsYk238PZw41XPjXVVQ9vWcvfZ06L2P0bQbvK0sGn7l69JA7H5MGr3QcaLpiD4Kg70cAh7PgE+JOw=="
     },
     "node_modules/@sasjs/core": {
-      "version": "4.46.6",
+      "version": "4.48.0",
-      "resolved": "https://registry.npmjs.org/@sasjs/core/-/core-4.46.6.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/core/-/core-4.48.0.tgz",
-      "integrity": "sha512-aXftehSL6eCGlfWxllR1fzzmUNf6mk32hGrcP/LK+lClTXTaC6Vjm4b9NdMtqy/7TK3uwXmV2+ChhOuXEUNipg=="
+      "integrity": "sha512-KaAvfTPv1UrP0I1fREDYjkfa7FRM9+yCseGXGLYylD30oH7BBOwLc7o/BkhRjjDvrBFoiJMjAOVKULhmkHz9zQ=="
     },
     "node_modules/@sasjs/lint": {
       "version": "2.3.1",
@@ -229,12 +229,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/tough-cookie": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.2.tgz",
-      "integrity": "sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==",
-      "peer": true
-    },
     "node_modules/abab": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
@@ -662,9 +656,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.2",
+      "version": "1.15.3",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz",
-      "integrity": "sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA==",
+      "integrity": "sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q==",
       "funding": [
         {
           "type": "individual",
@@ -1755,9 +1749,9 @@
       }
     },
     "@sasjs/adapter": {
-      "version": "4.9.2",
+      "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/@sasjs/adapter/-/adapter-4.9.2.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/adapter/-/adapter-4.10.1.tgz",
-      "integrity": "sha512-WAWhJAbhsOwChbRB6N+dcgj9Tods2Hq/ygsCASALbjKvqxtYlUDVBoEhdedur0VdsWyUaTAqcwioCiCpWtcRZA==",
+      "integrity": "sha512-/z6eR+3nNaLPyycK8YmpF+GAWNy0zgdl8n4cv4r45hjVBulPHVop7oj57JM/0uIPVOTT2V9IwrMCT/sFPq++vw==",
       "requires": {
         "@sasjs/utils": "2.52.0",
         "axios": "0.27.2",
@@ -1798,11 +1792,11 @@
       }
     },
     "@sasjs/cli": {
-      "version": "4.10.1",
+      "version": "4.11.1",
-      "resolved": "https://registry.npmjs.org/@sasjs/cli/-/cli-4.10.1.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/cli/-/cli-4.11.1.tgz",
-      "integrity": "sha512-qnhTdwENC8j9NJwZKtVVXNmKfmdoIkMIYxgUnH4tw08630qCNPZaH/jGrwVFF5MSUyUswgOoLVyNjxSPAYaWMA==",
+      "integrity": "sha512-aI8V3YJGFXcY9OlNas0h8ZrajLIRPn4KmGkaOLHTDa8rZ2SOtj6W5by1RwyPB9iPIHcqW3JV3OgmtEB048zuYQ==",
       "requires": {
-        "@sasjs/adapter": "4.9.2",
+        "@sasjs/adapter": "4.10.1",
         "@sasjs/core": "4.46.3",
         "@sasjs/lint": "2.3.1",
         "@sasjs/utils": "3.4.0",
@@ -1834,9 +1828,9 @@
       }
     },
     "@sasjs/core": {
-      "version": "4.46.6",
+      "version": "4.48.0",
-      "resolved": "https://registry.npmjs.org/@sasjs/core/-/core-4.46.6.tgz",
+      "resolved": "https://registry.npmjs.org/@sasjs/core/-/core-4.48.0.tgz",
-      "integrity": "sha512-aXftehSL6eCGlfWxllR1fzzmUNf6mk32hGrcP/LK+lClTXTaC6Vjm4b9NdMtqy/7TK3uwXmV2+ChhOuXEUNipg=="
+      "integrity": "sha512-KaAvfTPv1UrP0I1fREDYjkfa7FRM9+yCseGXGLYylD30oH7BBOwLc7o/BkhRjjDvrBFoiJMjAOVKULhmkHz9zQ=="
     },
     "@sasjs/lint": {
       "version": "2.3.1",
@@ -1933,12 +1927,6 @@
         "@types/node": "*"
       }
     },
-    "@types/tough-cookie": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.2.tgz",
-      "integrity": "sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==",
-      "peer": true
-    },
     "abab": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
@@ -2243,9 +2231,9 @@
       }
     },
     "follow-redirects": {
-      "version": "1.15.2",
+      "version": "1.15.3",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.3.tgz",
-      "integrity": "sha512-VQLG33o04KaQ8uYi2tVNbdrWp1QWxNNea+nmIB4EVM28v0hmP17z7aG1+wAkNzVq4KeXTq3221ye5qTJP91JwA=="
+      "integrity": "sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q=="
     },
     "form-data": {
       "version": "4.0.0",
@@ -2965,8 +2953,7 @@
     "ws": {
       "version": "8.13.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.13.0.tgz",
-      "integrity": "sha512-x9vcZYTrFPC7aSIbj7sRCYo7L/Xb8Iy+pW0ng0wt2vCJv7M9HOMy0UoN3rr+IFC7hb7vXoqS+P9ktyLLLhO+LA==",
+      "integrity": "sha512-x9vcZYTrFPC7aSIbj7sRCYo7L/Xb8Iy+pW0ng0wt2vCJv7M9HOMy0UoN3rr+IFC7hb7vXoqS+P9ktyLLLhO+LA=="
-      "requires": {}
     },
     "xml": {
       "version": "1.0.1",

sas/package.json

@@ -28,6 +28,6 @@
   "private": true,
   "dependencies": {
     "@sasjs/cli": "^4.11.1",
-    "@sasjs/core": "^4.47.0"
+    "@sasjs/core": "^4.48.0"
   }
 }

sas/sasjs/macros/mpe_accesscheck.sas

@@ -1,21 +1,33 @@
 /**
   @file
-  @brief Checks the level of access a user has to the MP Editor
+  @brief Checks group access level for a table or library
   @details In order for a user to be able to EDIT or APPROVE a table they must
-    be in a metadata group that has been granted access to that table in the
+    be in a group that has been granted access to that table in the
-    &mpelib..mpe_security table.  Alternatively, they may be in the
+    MPE_SECURITY table.  Alternatively, they may be in the &mpeadmins
-    &mpeadmins group (has overall access).
+    group (which has full access to everything).
+
+  @param [in] base_table The base table to check for
+  @param [in] user= The user for which the access level should be returned. If
+    not provided, the mf_user() result is used instead.
+  @param [in] access_level= (APPROVE) access_level (per MPE_SECURITY) reqd.
+    Valid values:
+      @li EDIT
+      @li APPROVE
+      @li VIEW
+  @param [in] cntl_lib_var= (MPELIB) The name of a global macro variable that
+    contains the libref in which the MPE_SECURITY table is stored
+  @param [out] outds= (MED_ACCESSCHECK) Output WORK table containing all the
+    groups for which the user is granted the particular ACCESS_LEVEL.
 
   <h4> SAS Macros </h4>
   @li mp_abort.sas
+  @li mf_getuniquename.sas
+  @li mf_getuser.sas
   @li mf_verifymacvars.sas
   @li mpe_getgroups.sas
-  @li mp_dropmembers.sas
 
-  @param [in] access_level= access_level (per &mpelib..mp_editor_security) reqd
+  <h4> Related Macros </h4>
-
+  @li mpe_accesscheck.test.sas
-  @returns outds A table containing all the groups that user is a member of,
-    which are granted the access_level requested.
 
   @version 9.2
   @author 4GL Apps Ltd
@@ -25,65 +37,64 @@
 **/
 
 %macro mpe_accesscheck(
-    base_table   /* base table to check for */
+    base_table
     ,outds=med_accesscheck /* WORK table to contain access details */
     ,user= /* metadata user to check for */
     ,access_level=APPROVE
+    ,cntl_lib_var=MPELIB
   );
 
   %if &user= %then %let user=%mf_getuser();
 
-  %if %index(&outds,.) %then %do;
+  %mp_abort(
-    %local lib ds;
+    iftrue=(%index(&outds,.)>0 and %upcase(%scan(&outds,1,.)) ne WORK)
-    %let lib=%scan(&outds,1,.);
+    ,mac=mpe_accesscheck
-    %let ds=%scan(&outds,2,.);
+    ,msg=%str(outds should be a WORK table)
-    %if %upcase(&lib) ne WORK %then %do;
+  )
-      %mp_abort(msg=outds should be a WORK table
-        ,mac=mpe_accesscheck);
-    %end;
-  %end;
-  %else %let ds=&outds;
 
   %mp_abort(
     iftrue=(%mf_verifymacvars(base_table user access_level)=0)
-    ,mac=bitemporal_dataloader
+    ,mac=mpe_accesscheck
-    ,msg=%str(Missing base_table/user access_level)
+    ,msg=%str(Missing base_table/user access_level variables)
   )
 
-  /* ensure any existing table is dropped */
+  /* make unique temp table vars */
-  %mp_dropmembers(&ds)
+  %local tempds1 tempds2;
+  %let tempds1=%mf_getuniquename(prefix=usergroups);
+  %let tempds2=%mf_getuniquename(prefix=tablegroups);
 
-  /* create a new table for temp use */
+  /* get list of user groups */
-  data; run;
+  %mpe_getgroups(user=&user,outds=&tempds1)
-  %local tempds; %let tempds=&syslast;
-
-  /* overwrite with the list of groups */
-  %mpe_getgroups(user=&user,outds=&tempds);
 
+  /* get list of groups with access for that table */
+  proc sql;
+  create table &tempds2 as
+    select distinct sas_group
+    from &&&cntl_lib_var...mpe_security
+    where &dc_dttmtfmt. lt tx_to
+    and access_level="&access_level"
+    and (
+      (libref="%scan(&base_table,1,.)" and upcase(dsn)="%scan(&base_table,2,.)")
+      or (libref="%scan(&base_table,1,.)" and dsn="*ALL*")
+      or (libref="*ALL*")
+    );
   %if &_debug ge 131 %then %do;
     data _null_;
-      set &tempds;
+      set &tempds1;
+      putlog (_all_)(=);
+    run;
+    data _null_;
+      set &tempds2;
       putlog (_all_)(=);
     run;
   %end;
 
   proc sql;
   create table &outds as
-  select * from &tempds
+  select * from &tempds1
     where groupname="&mpeadmins"
-      or groupname in
+      or groupname in (select * from &tempds2);
-      (select sas_group from &mpelib..mpe_security
-        where &dc_dttmtfmt. lt tx_to
-        and access_level="&access_level"
-          & (
-            (libref="%scan(&base_table,1,.)" and dsn="%scan(&base_table,2,.)")
-            or (libref="%scan(&base_table,1,.)" and dsn="*ALL*")
-            or (libref="*ALL*")
-          )
-      );
 
-%put base_table=&base_table;
+  %put &sysmacroname: base_table=&base_table;
-%put libref=%scan(&base_table,1,.);
+  %put &sysmacroname: access_level=&access_level;
-%put dsn=%scan(&base_table,2,.);
-%put access_level=&access_level;
 %mend mpe_accesscheck;

sas/sasjs/macros/mpe_accesscheck.test.sas

@@ -0,0 +1,68 @@
+/**
+  @file
+  @brief Testing mpe_accesscheck macro
+  @details Checking functionality of mpe_accesscheck.sas macro
+
+
+  <h4> SAS Macros </h4>
+  @li mf_getuniquename.sas
+  @li mf_getuser.sas
+  @li mp_assertdsobs.sas
+  @li mpe_getgroups.sas
+  @li mpe_accesscheck.sas
+
+
+  @author 4GL Apps Ltd
+  @copyright 4GL Apps Ltd.  This code may only be used within Data Controller
+    and may not be re-distributed or re-sold without the express permission of
+    4GL Apps Ltd.
+
+**/
+
+/* get the groups this user is actually a member of */
+%mpe_getgroups(user=%mf_getuser(),outds=work.groups)
+
+data _null_;
+  set work.groups;
+  call symputx('groupname',groupname);
+run;
+
+/* create demo MPE_SECURITY table */
+data work.mpe_security;
+  if 0 then set &dc_libref..mpe_security;
+  do access_level='EDIT','APPROVE','VIEW','SIGNOFF','AUDIT';
+    LIBREF='SOMELIB';
+    DSN='SOMEDS';
+    sas_group="&groupname";
+    tx_from=0;
+    tx_to='31dec4999:23:59:59'dt;
+    output;
+  end;
+run;
+
+%let WRK=WORK;
+
+%mpe_accesscheck(
+  SOMELIB.SOMEDS
+  ,outds=work.test1
+  ,access_level=APPROVE
+  ,cntl_lib_var=WRK
+)
+%mp_assertdsobs(work.test1,
+  desc=Test 1 - One record returned,
+  test=EQUALS 1,
+  outds=work.test_results
+)
+
+%mpe_accesscheck(
+  SOMELIB.INVALID
+  ,outds=work.test2
+  ,access_level=APPROVE
+  ,cntl_lib_var=WRK
+)
+%mp_assertdsobs(work.test2,
+  desc=Test 12 - 0 records returned,
+  test=EQUALS 0,
+  outds=work.test_results
+)
+

sas/sasjs/macros/mpe_alerts.sas

@@ -131,7 +131,7 @@ filename __out email ("&emails")
     txt=symget('SUBMITTED_TXT');
     put "Reason provided: " txt;
     put " ";
-    put "This is an automated email by Data Controller for SAS®. For "
+    put "This is an automated email by Data Controller for SAS. For "
       "documentation, please visit https://docs.datacontroller.io";
   run;
 %end;
@@ -144,7 +144,7 @@ filename __out email ("&emails")
     put "Please be advised that a change to table &alert_lib..&alert_ds has "
         "been approved by &from_user on the '&syshostname' SAS server.";
     put " ";
-    put "This is an automated email by Data Controller for SAS®. For "
+    put "This is an automated email by Data Controller for SAS. For "
       "documentation, please visit https://docs.datacontroller.io";
   run;
 %end;
@@ -165,7 +165,7 @@ filename __out email ("&emails")
     txt=symget('REVIEW_REASON_TXT');
     put "Reason provided: " txt;
     put " ";
-    put "This is an automated email by Data Controller for SAS®. For "
+    put "This is an automated email by Data Controller for SAS. For "
       "documentation, please visit https://docs.datacontroller.io";
   run;
 %end;

sas/sasjs/macros/mpe_makedata.sas

@@ -1014,7 +1014,8 @@ insert into &lib..mpe_selectbox set
       ,buskey='LIBREF DSN ACCESS_LEVEL SAS_GROUP'
       ,var_txfrom='TX_FROM'
       ,var_txto='TX_TO'
-      ,notes='Shows which metadata groups can edit which tables'
+      ,notes='Determines which groups can view/edit/approve which tables'
+      ,post_edit_hook='services/hooks/mpe_security_postedit'
     ;
   insert into &lib..mpe_tables
     set tx_from=0
@@ -1351,6 +1352,15 @@ insert into &lib..MPE_VALIDATIONS set
     ,rule_value='UPCASE'
     ,rule_active=1
     ,tx_to='31DEC5999:23:59:59'dt;
+insert into &lib..MPE_VALIDATIONS set
+    tx_from=0
+    ,base_lib="&lib"
+    ,base_ds="MPE_SECURITY"
+    ,base_col="LIBREF"
+    ,rule_type='CASE'
+    ,rule_value="UPCASE"
+    ,rule_active=1
+    ,tx_to='31DEC5999:23:59:59'dt;
 insert into &lib..MPE_VALIDATIONS set
     tx_from=0
     ,base_lib="&lib"
@@ -1369,6 +1379,15 @@ insert into &lib..MPE_VALIDATIONS set
     ,rule_value="&lib..MPE_TABLES.LIBREF"
     ,rule_active=1
     ,tx_to='31DEC5999:23:59:59'dt;
+insert into &lib..MPE_VALIDATIONS set
+    tx_from=0
+    ,base_lib="&lib"
+    ,base_ds="MPE_SECURITY"
+    ,base_col="DSN"
+    ,rule_type='CASE'
+    ,rule_value="UPCASE"
+    ,rule_active=1
+    ,tx_to='31DEC5999:23:59:59'dt;
 insert into &lib..MPE_VALIDATIONS set
     tx_from=0
     ,base_lib="&lib"

sas/sasjs/services/hooks/mpe_security_postedit.sas

@@ -0,0 +1,34 @@
+/**
+  @file
+  @brief Post Edit Hook script for the MPE_SECURITY table
+  @details Post edit hooks provide additional backend validation against
+  user-sourced data.  The incoming dataset is always `work.staging_ds` and this
+  file is included from the mpe_loader.sas macro.
+
+  Available (at runtime) macro variables:
+    @li DC_LIBREF - The DC control library for your site
+    @li LIBREF - The library of the dataset being edited (is assigned)
+    @li DS - The dataset being edited
+
+
+**/
+
+/* ensure upcase and check access level values*/
+%let errval=0;
+%let errmsg=;
+data work.staging_ds;
+  set work.staging_ds;
+  LIBREF=upcase(LIBREF);
+  DSN=upcase(DSN);
+  ACCESS_LEVEL=upcase(ACCESS_LEVEL);
+  if ACCESS_LEVEL not in ('EDIT','APPROVE','VIEW','SIGNOFF','AUDIT') then do;
+    putlog "ERR" +(-1) "OR: invalid ACCESS_LEVEL - " access_level;
+    call symputx('errval',1);
+    call symputx('errmsg',"Invalid ACCESS_LEVEL: "!!access_level);
+  end;
+run;
+
+%mp_abort(iftrue=(&errval=1)
+  ,mac=mpe_security_postedit.sas
+  ,msg=%str(&errmsg)
+)