External Users Groups" catalog (Trade Management for Kazakhstan 3.4)

1. Identification

Where to find: navigation link e1cib/list/Справочник.ГруппыВнешнихПользователей. In the interface — section Master Data and Administration → User and Rights Settings → External Users → External User Groups (available when the "External users" option is enabled).

The catalog is a service object: it does not participate in inventory, cash, or tax accounting. Application objects of TM (sales, e-invoices (ESF), waybills (SNT), VAT 16% calculations, IIT, MPC, etc.) do not reference it — it serves only the security and access control subsystem.

2. Header attributes and tabular sections

Header attributes

Tabular sections

Requires verification for the specific build 3.4.5.21: the exact set of columns in the Назначение tabular section and the presence of service attributes (e.g., the "Group participates in task assignment" flag) depend on the version of the embedded SSL. The core (hierarchy, ВсеПользователи, the Пользователи tabular section) remains unchanged between versions.

3. Forms

A separate group (folder) form is not required — the hierarchy is built at the item level, so editing is done through ФормаЭлемента.

4. Key module procedures

No separate application BSL code is attached in the evidence, so below are the standard handlers for this SSL object type. In the standard configuration code, the logic is placed in common modules of the "Users" subsystem (ВнешниеПользователи, ПользователиСлужебный, ПользователиВнутренние).

Object module (Справочник.ГруппыВнешнихПользователей.МодульОбъекта):

• ОбработкаЗаполнения — fills default attributes when creating a new group.
• ПередЗаписью — validity control: prohibits manual modification of the composition of the predefined "All external users" group (ВсеПользователи = True), checks the composition against the specified Назначение, prevents hierarchy loops.
• ПриЗаписи — calls the service method for updating the denormalized group composition (recalculating members taking into account nested groups) and subsequently updates RLS access keys/sets.
• ПередУдалением — checks references and prohibits deletion of the predefined "all external users" group.

Item form module (ФормаЭлемента):

• ПриСозданииНаСервере — blocks editing of the composition for the "All external users" group, configures element availability according to the current user's rights.
• External user selection handlers (ПользователиНачалоВыбора / the "Select" command) with a filter by the Назначение attribute.
• ПослеЗаписиНаСервере — notifies of composition changes to update related forms.

Common modules (serving the catalog):

• ВнешниеПользователи — programmatic API: getting a user's groups, checking membership, updating composition.
• ПользователиВнутренние / ПользователиСлужебный — recalculates the group composition register and updates RLS data.

5. Posting and movements

The catalog is not a document and is not posted — it does not generate ledger entries or movements in application accumulation registers. Accordingly, the accounts of the standard Kazakhstan chart of accounts (1210, 1030, 1330, 3310, 3130, 6010, 7010) and tax calculations (VAT 16%, IIT, MPC 10%, MPCE 3.5%, OSMC 2%, OSMC 3%, SC 5%, social tax 6%) do not apply to it — this is an object of the security subsystem, not accounting.

The only "movement" triggered by writing an item is the update of service data for the access restriction mechanism:

The recalculation is performed on the server when the item is written (ПриЗаписи → SSL service methods).

6. Related objects and input based on

Related objects:

• Справочник.ВнешниеПользователи — items in the group composition (external users are created based on partners, counterparties, individuals).
• Справочник.ГруппыПользователей — similar mechanism for internal (staff) users.
• РегистрСведений.СоставГруппВнешнихПользователей — denormalized composition for RLS.
• Objects of the "AccessManagement" subsystem: profiles, access groups, access keys/sets — use external user groups as access values.

Input based on: not provided (neither as a basis nor based on other objects). Created manually in the list or programmatically via the ВнешниеПользователи API.

7. Extension points

• Configuration extension: adding attributes/commands to ФормаЭлемента and ФормаСписка, intercepting object module handlers via &После / &Вместо annotations (with caution — the logic is tightly coupled to the SSL core).
• SSL programmatic API: methods of the common module ВнешниеПользователи (getting a user's groups, checking membership, programmatic management of composition) — the preferred integration method instead of working directly with the catalog.
• Additional attributes and information: the "Properties" subsystem allows the group to be extended with additional attributes without changing metadata (requires including the object in the set of additional information types).
• RLS mechanism: custom access restriction templates can rely on the СоставГруппВнешнихПользователей register when developing industry-specific data visibility restrictions for partners/counterparties.
• Event subscriptions on catalog writes — for integration with external access management systems (e.g., synchronizing group composition).

Requires verification during customization: the signatures of the "Users" subsystem service procedures belong to the internal SSL API and may change between platform/library releases — reliance should be placed on documented export methods of the ВнешниеПользователи module.