Report "RightsRoles" (Reports.RightsRoles) — Technical Description

1. Identification

Purpose. The report is intended for the analysis and audit of access rights in the information database. It is used by administrators and information security specialists to check how role rights are distributed across configuration objects (documents, directories, registers, processes, etc.), as well as to control the rights of access group profiles. The report answers two main questions:

• what rights a specific role has on metadata objects;
• which roles have a certain right on a specific object.

It is used during the initial setup of rights, during security audits, and when diagnosing access issues for users ("why the user cannot see the document / cannot process"). The report is integrated with the reporting options mechanism of the BSP subsystem.

The report is of an administrative nature and is not related to accounting data. Fiscal parameters of the RK (VAT rate 16%, MRP 4,325 ₸, MSP 85,000 ₸, deductions for individual income tax, etc.) do not apply to this object and are not included in its selection.

Where to find in 1C: section "Administration" / "User and Rights Settings" → access rights reports; or via the direct navigation link e1cib/list/Report.RoleRights.

2. Header Attributes and Table Parts

2.1 Header Attributes

There are no specific attributes in the metadata of the object. All settings for formation (selection by role, by metadata object, by type of right, grouping, order) are passed through parameters and data composition settings and the context of the report form, rather than through the object's attributes.

2.2 Table Parts

Table parts are absent. The result is dynamically generated by the layout composer based on the data composition scheme; the rows of the final table (role / object / right / presence of right) are not stored in the object but are calculated at output.

2.3 Logical Data Composition (DCS Fields)

Although there are no attributes and table parts, the report operates with the following logical fields (data set of DCS):

3. Forms

Explicit forms are not defined in the metadata. The report uses the automatically generated main report form of the platform with a built-in DCS mechanism:

Additionally, standard service forms of the BSP reporting options mechanism (settings form, variant selection form) are available, connected by the platform and the "Reporting Options" subsystem.

4. Key Module Procedures

The attached evidence does not provide the source code (BSL) of the object/form module. Below are typical report handlers for DCS for this type of object in BSP-based configurations; specific names/existence require verification with the module version 3.0.74.2.

Report Object Module:

• OnResultComposition(DocumentResult, DataDecoding, StandardProcessing) — interception of composition; here, the data set is usually formed programmatically (iteration over Metadata.Roles and checking rights on objects through Access/AccessRight), as role rights are not data of the IB and are not selected by the query.
• SettingsForTechnicalSpecialist() / initialization of variants — registration of predefined report variants.

Report Form Module:

• OnCreateOnServer(Refusal, StandardProcessing) — initialization of the form, restoration of user settings.
• OnLoadVariantOnServer(Settings) — additional configuration when changing the variant.
• Handlers for selections by role and metadata object for interactive selection of the analysis area.

Requires verification: the exact method of data filling (programmatic filling in OnResultComposition through AccessRight() / reading from Metadata) in the specific assembly 3.0.74.2.

5. Processing and Movements

The report is not a document, is not processed, and does not generate movements in any registers and does not create accounting entries. It only reads the configuration (description of roles and rights) and does not modify the data of the information base.

Accordingly, the accounts of the standard chart of accounts of the RK (1210, 1030, 1330, 3310, 3130, 6010, 7010) and VAT/ESF/SNT registers are not involved in the operation of this object — they are mentioned here only for completeness of the configuration context and are not related to the "Role Rights" report.

6. Related Objects and Input Based On

• Input Based On — not supported (reports do not participate in the input based on mechanism).
• Related Objects:
  • Metadata.Roles — source of analyzed roles and their rights;
  • metadata objects of all classes (documents, directories, registers, processes) — as the scope of rights;
  • BSP subsystem "Access Management" / "Access Group Profiles" — mapping of roles and profiles;
  • "Reporting Options" subsystem — storage and selection of settings variants.

7. Extension Points

• Report Variants — addition of custom predefined or user variants (ready slices: "Rights by Role", "Roles by Object", "Rights Matrix").
• Configuration Extension — addition of handlers to the report form/module (for example, OnResultComposition) without removing from support for additional filtering or adding custom fields (for example, merging with user data).
• User DCS Settings — selections, groupings, conditional formatting are saved as user settings of the variant.
• External Report — if necessary, the object can be copied to an external report for refinement without changing the standard configuration.