Reports.AccessRightsAnalysis — technical description (Accounting for Kazakhstan 3.0.74.2)

1. Identification

Purpose. The report is intended for system administrators and serves as a tool for auditing and controlling access rights. It shows what rights (Read, Modify, View, etc.) specific users, user groups, and profiles/roles have on metadata objects (directories, documents, registers, reports). The report allows:

• to analyze assigned rights by users and by objects;
• to identify restrictions at the record level (RLS) and by access group profiles;
• to monitor the correctness of security settings when introducing new roles;
• to investigate incidents of unauthorized access.

The report has a service-analytical nature: it does not participate in accounting operations, does not generate accounting or tax data, and does not operate with monetary values. Tax rates and amounts of the RK (VAT 16%, MRP 4,325 ₸, MSP 85,000 ₸, deduction for individual income tax 30 MRP/month, etc.) are not applicable to this object — they relate to accounting documents of the configuration, not to the access rights report.

Where to find in 1C: section “Administration” → “Access Rights Analysis”. Navigation link: e1cib/list/Report.AccessRightsAnalysis

2. Header Attributes and Table Parts

2.1 Header Attributes

The report does not contain user-defined attributes in the metadata. All settings, parameters, and selections are defined through the standard data composition mechanism and user settings of the DCS.

2.2 Table Parts

The report does not contain table parts in the traditional sense. The resulting table is dynamically constructed by the data composition scheme based on data about access rights (roles, access group profiles, RLS, user composition), which are retrieved programmatically and/or from the relevant information registers of the access rights subsystem.

2.3 Standard Parameters and Selections (via DCS)

Although there are no strict attributes, for reports of this type, the following are usually available in user settings of the DCS:

• User / User Group — to analyze rights;
• Metadata Object — to show assigned rights for which object;
• Role / Access Group Profile — filter by source of rights;
• Type of Right (Read, Modify, Add, Delete, View, Interactive...);
• groupings: by user, by object, by role.

Requires verification in the specific version: the exact list of available selections and groupings depends on the composition scheme supplied in 3.0.74.2.

3. Forms

A separate list of forms in the metadata of the object is absent — an automatically generated report form based on the DCS is used.

The user works with the standard report form: selects variant/settings → clicks “Generate” → receives the result in the tabular document field.

4. Key Procedures of Modules

In the reference evidence, the source code of the modules (BSL) is not attached, so below are typical handlers for the report in DCS of this type. Paths and strings are indicated conditionally — they should be clarified for the specific module of the object.

Report object module (CombinedModule/ObjectModule):

• OnResultComposition(TablDocument, DataDecoding, StandardProcessing) — intercepts standard composition; here, for access rights reports, an external data set is usually programmatically formed: rights of roles, composition of access group profiles, active RLS restrictions are collected, after which the result is output to the tabular document. Sets StandardProcessing = False if the composition is done manually.
• OnDefiningPeriodicUpdateSettings(...) / OnDefiningReportVariants(...) — registration of report variants in the ReportVariants subsystem.

Form module (auto-form):

• OnCreatedOnServer — initialization of composition settings, setting available selections and default values.
• BeforeFilling / handlers of the “Generate” command — calling the layout composer and building the result.

If an exact signature and string are required — it is necessary to open the object module Report.AccessRightsAnalysis in the configurator 3.0.74.2 (evidence on BSL in the task is not provided).

5. Posting and Movements

The report is not posted and does not generate movements.

An object of the type “Report” is not an accounting document: it has no posting procedure, does not create records in accounting, accumulation, or information registers, and does not generate postings. Accordingly, for Report.AccessRightsAnalysis:

• movement registers — absent;
• accounting postings — not generated;
• accounts of the standard chart of accounts of the RK (1210, 1030, 1330, 3310, 3130, 6010, 7010), VAT registers, ESF/SNT — not involved.

The report only reads data about access rights (roles, access group profiles, information registers of the “Access Management” subsystem, user composition of the information base) and outputs them in a tabular document.

6. Related Objects and Input Based On

Input based on for the report is not provided (this is not a document). Logically, the report is related to objects of the access rights subsystem:

• Directory “Users” and “User Groups” — subjects of rights;
• Directory “Access Group Profiles” and “Access Groups” — sources of rights assignment;
• Configuration Roles (metadata objects “Role”) — basic sets of rights;
• Information Registers of the “Access Management” subsystem (for example, access value sets, access groups) — data sources for RLS analysis;
• subsystem “ReportVariants” — storage and publication of report variants.

7. Extension Points

• Configuration Extension: you can add your own report variant or redefine the composition scheme without changing the standard object.
• Additional Reports (BSP): if necessary — registration as an additional/external report through the “Additional Reports and Processing” subsystem.
• Handler OnResultComposition: a point for programmatically extending the data set (adding your own audit columns, merging with the registration log).
• Subsystem “ReportVariants”: adding user variants (predefined selections/groupings) for standard audit scenarios.
• Access Rights: visibility of the report is regulated by the right “View” on the object Report.AccessRightsAnalysis; granted through access group profiles of administrators.

Requires verification: the presence in 3.0.74.2 of supplied predefined report variants and the exact composition of the fields of the composition scheme.