Which methods are commonly used in server-side access control scripts?

Which methods are commonly used in server-side access control scripts?

• A. gs.hasRole() and current.isNewRecord()
• B. g_form.GetValue()
• C. GlideAjax
• D. gs.info()

Answer: (A)

In server-side access control scripts, you almost always evaluate who the user is and what state the record is in. The two commonly used methods for this are gs.hasRole() and current.isNewRecord(). gs.hasRole() checks if the current user has a specific role, which is essential for deciding whether they’re allowed to perform the action. current.isNewRecord() tells you whether the GlideRecord represents a new record (being created) or an existing one, which helps you tailor permissions for creation versus read/update scenarios. Using these together lets you write clear, server-side logic like allowing a user only with a certain role to modify existing records, or restricting creation to users with another role. The other options aren’t used for server-side access control decisions. g_form.GetValue() is a client-side API tied to forms in the browser, so it’s not available in server-side ACL scripts. GlideAjax is a mechanism for client-to-server calls, not part of evaluating server-side access rules. gs.info() is a logging function; it can help with debugging but doesn’t determine access rights. So the best fit is combining a user-role check with the record state check, which is exactly what gs.hasRole() and current.isNewRecord() provide.

In server-side access control scripts, you almost always evaluate who the user is and what state the record is in. The two commonly used methods for this are gs.hasRole() and current.isNewRecord(). gs.hasRole() checks if the current user has a specific role, which is essential for deciding whether they’re allowed to perform the action. current.isNewRecord() tells you whether the GlideRecord represents a new record (being created) or an existing one, which helps you tailor permissions for creation versus read/update scenarios. Using these together lets you write clear, server-side logic like allowing a user only with a certain role to modify existing records, or restricting creation to users with another role.

The other options aren’t used for server-side access control decisions. g_form.GetValue() is a client-side API tied to forms in the browser, so it’s not available in server-side ACL scripts. GlideAjax is a mechanism for client-to-server calls, not part of evaluating server-side access rules. gs.info() is a logging function; it can help with debugging but doesn’t determine access rights.

So the best fit is combining a user-role check with the record state check, which is exactly what gs.hasRole() and current.isNewRecord() provide.