REPORT ZSF_DT_ROLE_MANAGEMENT. *&---------------------------------------------------------------------* *& Dynamic Tool: role_management *& Description: SAP Role Management Tool - PFCG/SUIM automation for *& role lifecycle, authorization management, and search *& Author: SAP Fever Premium Tools *& Version: 1.0.0 *& Category: Security / Administration *& Operations: CHECK, CREATE, COPY, UPDATE, DELETE, SET_AUTH, GENERATE, *& ASSIGN, UNASSIGN, SEARCH *&---------------------------------------------------------------------* FORM execute USING it_params TYPE ztt_zmcp_params CHANGING ct_result TYPE ztt_zmcp_params ct_messages TYPE bapiret2_t. " Clear output parameters CLEAR: ct_result, ct_messages. REFRESH: ct_result, ct_messages. " Local variables for parameters DATA: lv_operation TYPE string, lv_role_name TYPE agr_name, lv_description TYPE string, lv_role_type TYPE string, lv_copy_from TYPE agr_name, lv_child_roles TYPE string, lv_tcodes TYPE string, lv_auth_object TYPE string, lv_auth_field TYPE string, lv_auth_low TYPE string, lv_auth_high TYPE string, lv_username TYPE xubname, lv_users TYPE string, lv_validfrom TYPE d, lv_validto TYPE d, lv_search_type TYPE string, lv_search_pattern TYPE string, lv_max_results TYPE i. " Return and result variables DATA: ls_message TYPE bapiret2, lv_result_json TYPE string, ls_result TYPE zmcp_param. FIELD-SYMBOLS: TYPE zmcp_param. " ── Extract operation parameter ────────────────────────────────────── READ TABLE it_params ASSIGNING WITH KEY name = 'operation'. IF sy-subrc = 0. lv_operation = -value. TRANSLATE lv_operation TO UPPER CASE. ELSE. ls_message-type = 'E'. ls_message-message = 'Operation parameter is required (CHECK/CREATE/COPY/UPDATE/DELETE/SET_AUTH/GENERATE/ASSIGN/UNASSIGN/SEARCH)'. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing operation parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. " ── Extract all parameters ─────────────────────────────────────────── READ TABLE it_params ASSIGNING WITH KEY name = 'roleName'. IF sy-subrc = 0. lv_role_name = -value. TRANSLATE lv_role_name TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'description'. IF sy-subrc = 0. lv_description = -value. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'roleType'. IF sy-subrc = 0. lv_role_type = -value. TRANSLATE lv_role_type TO UPPER CASE. ELSE. lv_role_type = 'S'. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'copyFromRole'. IF sy-subrc = 0. lv_copy_from = -value. TRANSLATE lv_copy_from TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'childRoles'. IF sy-subrc = 0. lv_child_roles = -value. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'tcodes'. IF sy-subrc = 0. lv_tcodes = -value. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'authObject'. IF sy-subrc = 0. lv_auth_object = -value. TRANSLATE lv_auth_object TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'authField'. IF sy-subrc = 0. lv_auth_field = -value. TRANSLATE lv_auth_field TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'authLow'. IF sy-subrc = 0. lv_auth_low = -value. TRANSLATE lv_auth_low TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'authHigh'. IF sy-subrc = 0. lv_auth_high = -value. TRANSLATE lv_auth_high TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'username'. IF sy-subrc = 0. lv_username = -value. TRANSLATE lv_username TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'users'. IF sy-subrc = 0. lv_users = -value. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'validfrom'. IF sy-subrc = 0. TRY. lv_validfrom = -value. CATCH cx_sy_conversion_no_date. CLEAR lv_validfrom. ENDTRY. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'validto'. IF sy-subrc = 0. TRY. lv_validto = -value. CATCH cx_sy_conversion_no_date. CLEAR lv_validto. ENDTRY. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'searchType'. IF sy-subrc = 0. lv_search_type = -value. TRANSLATE lv_search_type TO UPPER CASE. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'searchPattern'. IF sy-subrc = 0. lv_search_pattern = -value. " Note: Do NOT uppercase here. MENU text search needs mixed case. " Individual search FORMs handle uppercasing where needed. ENDIF. READ TABLE it_params ASSIGNING WITH KEY name = 'maxResults'. IF sy-subrc = 0. TRY. lv_max_results = -value. CATCH cx_sy_conversion_no_number. lv_max_results = 100. ENDTRY. ENDIF. IF lv_max_results <= 0. lv_max_results = 100. ENDIF. " ── Validate roleName for non-SEARCH operations ───────────────────── IF lv_operation <> 'SEARCH' AND lv_role_name IS INITIAL. ls_message-type = 'E'. ls_message-message = 'roleName parameter is required for this operation'. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Missing roleName parameter"{ '}' }|. ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. RETURN. ENDIF. " ── Dispatch to operation handler ──────────────────────────────────── CASE lv_operation. WHEN 'CHECK'. PERFORM op_check USING lv_role_name CHANGING lv_result_json ct_messages. WHEN 'CREATE'. PERFORM op_create USING lv_role_name lv_description lv_role_type lv_child_roles lv_tcodes CHANGING lv_result_json ct_messages. WHEN 'COPY'. PERFORM op_copy USING lv_role_name lv_copy_from CHANGING lv_result_json ct_messages. WHEN 'UPDATE'. PERFORM op_update USING lv_role_name lv_description lv_tcodes CHANGING lv_result_json ct_messages. WHEN 'DELETE'. PERFORM op_delete USING lv_role_name CHANGING lv_result_json ct_messages. WHEN 'SET_AUTH'. PERFORM op_set_auth USING lv_role_name lv_auth_object lv_auth_field lv_auth_low lv_auth_high CHANGING lv_result_json ct_messages. WHEN 'GENERATE'. PERFORM op_generate USING lv_role_name CHANGING lv_result_json ct_messages. WHEN 'ASSIGN'. PERFORM op_assign USING lv_role_name lv_username lv_users lv_validfrom lv_validto CHANGING lv_result_json ct_messages. WHEN 'UNASSIGN'. PERFORM op_unassign USING lv_role_name lv_username lv_users CHANGING lv_result_json ct_messages. WHEN 'SEARCH'. PERFORM op_search USING lv_search_type lv_search_pattern lv_username lv_auth_object lv_max_results CHANGING lv_result_json ct_messages. WHEN OTHERS. ls_message-type = 'E'. ls_message-message = |Invalid operation: { lv_operation }. Use CHECK, CREATE, COPY, UPDATE, DELETE, SET_AUTH, GENERATE, ASSIGN, UNASSIGN, or SEARCH|. APPEND ls_message TO ct_messages. lv_result_json = |{ '{' }"success": false, "error": "Invalid operation: { lv_operation }"{ '}' }|. ENDCASE. " Add result to output ls_result-name = 'RESULT'. ls_result-value = lv_result_json. APPEND ls_result TO ct_result. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_CHECK *&---------------------------------------------------------------------* *& Full role details: definition, tcodes, auth objects, users, profile, *& composite children *&---------------------------------------------------------------------* FORM op_check USING pv_role_name TYPE agr_name CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check if role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'W'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "exists": false, "role_name": "{ pv_role_name }"{ '}' }|. RETURN. ENDIF. " Get role definition DATA: ls_agr_define TYPE agr_define. SELECT SINGLE * FROM agr_define INTO ls_agr_define WHERE agr_name = pv_role_name. " Determine role type by checking if it has children in AGR_AGRS DATA: lv_role_type_text TYPE string, lv_child_check TYPE i. SELECT COUNT(*) FROM agr_agrs INTO lv_child_check WHERE agr_name = pv_role_name. IF lv_child_check > 0. lv_role_type_text = 'COMPOSITE'. ELSE. lv_role_type_text = 'SINGLE'. ENDIF. " Get role description DATA: lv_desc TYPE string. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = pv_role_name AND spras = sy-langu AND line = 0. IF sy-subrc <> 0. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = pv_role_name AND spras = 'E' AND line = 0. ENDIF. " Escape description for JSON DATA: lv_desc_escaped TYPE string. lv_desc_escaped = lv_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_escaped WITH '\"'. REPLACE ALL OCCURRENCES OF '\' IN lv_desc_escaped WITH '\\'. " Get profile name DATA: lv_profile TYPE string. SELECT SINGLE profile FROM agr_prof INTO lv_profile WHERE agr_name = pv_role_name AND langu = sy-langu. IF sy-subrc <> 0. SELECT SINGLE profile FROM agr_prof INTO lv_profile WHERE agr_name = pv_role_name. ENDIF. " Get transaction codes DATA: lt_tcodes TYPE TABLE OF agr_tcodes, ls_tcode TYPE agr_tcodes, lv_tcodes_json TYPE string, lv_tcodes_count TYPE i. SELECT * FROM agr_tcodes INTO TABLE lt_tcodes WHERE agr_name = pv_role_name. lv_tcodes_count = lines( lt_tcodes ). lv_tcodes_json = '['. LOOP AT lt_tcodes INTO ls_tcode. IF sy-tabix > 1. lv_tcodes_json = lv_tcodes_json && ','. ENDIF. lv_tcodes_json = lv_tcodes_json && |"{ ls_tcode-tcode }"|. ENDLOOP. lv_tcodes_json = lv_tcodes_json && ']'. " Get authorization objects DATA: lt_auth TYPE TABLE OF agr_1251, ls_auth TYPE agr_1251, lv_auth_json TYPE string, lv_auth_count TYPE i. SELECT * FROM agr_1251 INTO TABLE lt_auth WHERE agr_name = pv_role_name AND deleted = ' '. lv_auth_count = lines( lt_auth ). lv_auth_json = '['. DATA: lv_auth_idx TYPE i. LOOP AT lt_auth INTO ls_auth. lv_auth_idx = lv_auth_idx + 1. IF lv_auth_idx > 1. lv_auth_json = lv_auth_json && ','. ENDIF. lv_auth_json = lv_auth_json && |{ '{' }"object": "{ ls_auth-object }", "field": "{ ls_auth-field }", | && |"low": "{ ls_auth-low }", "high": "{ ls_auth-high }"{ '}' }|. ENDLOOP. lv_auth_json = lv_auth_json && ']'. " Get assigned users DATA: lt_users TYPE TABLE OF agr_users, ls_user TYPE agr_users, lv_users_json TYPE string, lv_users_count TYPE i. SELECT * FROM agr_users INTO TABLE lt_users WHERE agr_name = pv_role_name. lv_users_count = lines( lt_users ). lv_users_json = '['. DATA: lv_usr_idx TYPE i. LOOP AT lt_users INTO ls_user. lv_usr_idx = lv_usr_idx + 1. IF lv_usr_idx > 1. lv_users_json = lv_users_json && ','. ENDIF. lv_users_json = lv_users_json && |{ '{' }"username": "{ ls_user-uname }", "from_dat": "{ ls_user-from_dat }", "to_dat": "{ ls_user-to_dat }"{ '}' }|. ENDLOOP. lv_users_json = lv_users_json && ']'. " Get composite children (if composite role) DATA: lt_children TYPE TABLE OF agr_agrs, ls_child TYPE agr_agrs, lv_children_json TYPE string, lv_children_count TYPE i. SELECT * FROM agr_agrs INTO TABLE lt_children WHERE agr_name = pv_role_name. lv_children_count = lines( lt_children ). lv_children_json = '['. DATA: lv_child_idx TYPE i. LOOP AT lt_children INTO ls_child. lv_child_idx = lv_child_idx + 1. IF lv_child_idx > 1. lv_children_json = lv_children_json && ','. ENDIF. lv_children_json = lv_children_json && |"{ ls_child-child_agr }"|. ENDLOOP. lv_children_json = lv_children_json && ']'. " Get menu entries from AGR_HIER + AGR_HIERT " These contain BSP apps, Fiori catalogs, Fiori groups, OData services, Web Dynpro, etc. TYPES: BEGIN OF ty_hier_entry, object_id TYPE agr_hier-object_id, report TYPE agr_hier-report, reporttype TYPE agr_hier-reporttype, END OF ty_hier_entry. DATA: lt_hier TYPE TABLE OF ty_hier_entry, ls_hier TYPE ty_hier_entry, lv_menu_json TYPE string, lv_menu_count TYPE i. SELECT object_id report reporttype INTO TABLE lt_hier FROM agr_hier WHERE agr_name = pv_role_name AND report <> space AND folder = space. lv_menu_count = lines( lt_hier ). lv_menu_json = '['. DATA: lv_menu_idx TYPE i. LOOP AT lt_hier INTO ls_hier. lv_menu_idx = lv_menu_idx + 1. IF lv_menu_idx > 1. lv_menu_json = lv_menu_json && ','. ENDIF. " Determine entry type from REPORT field DATA: lv_entry_type TYPE string. CASE ls_hier-report. WHEN 'BSP_APPLICATION'. lv_entry_type = 'BSP'. WHEN 'CAT_PROVIDER'. lv_entry_type = 'FIORI_CATALOG'. WHEN 'GROUP_PROVIDER'. lv_entry_type = 'FIORI_GROUP'. WHEN 'SERVICE'. lv_entry_type = 'ODATA_SERVICE'. WHEN OTHERS. lv_entry_type = ls_hier-report. ENDCASE. " Get menu entry text from AGR_HIERT DATA: lv_menu_text TYPE string, lv_menu_text_safe TYPE string. CLEAR lv_menu_text. SELECT SINGLE text FROM agr_hiert INTO lv_menu_text WHERE agr_name = pv_role_name AND object_id = ls_hier-object_id AND spras = sy-langu. IF sy-subrc <> 0. SELECT SINGLE text FROM agr_hiert INTO lv_menu_text WHERE agr_name = pv_role_name AND object_id = ls_hier-object_id AND spras = 'E'. ENDIF. lv_menu_text_safe = lv_menu_text. REPLACE ALL OCCURRENCES OF '\' IN lv_menu_text_safe WITH '\\'. REPLACE ALL OCCURRENCES OF '"' IN lv_menu_text_safe WITH '\"'. lv_menu_json = lv_menu_json && |{ '{' }"entry_type": "{ lv_entry_type }", "name": "{ lv_menu_text_safe }", | && |"report": "{ ls_hier-report }", "reporttype": "{ ls_hier-reporttype }"{ '}' }|. ENDLOOP. lv_menu_json = lv_menu_json && ']'. " Build result JSON pv_result_json = |{ '{' }"success": true, "exists": true, | && |"role_name": "{ pv_role_name }", | && |"role_type": "{ lv_role_type_text }", | && |"description": "{ lv_desc_escaped }", | && |"profile": "{ lv_profile }", | && |"tcodes": { lv_tcodes_json }, "tcodes_count": { lv_tcodes_count }, | && |"menu_entries": { lv_menu_json }, "menu_entries_count": { lv_menu_count }, | && |"auth_objects": { lv_auth_json }, "auth_objects_count": { lv_auth_count }, | && |"users": { lv_users_json }, "users_count": { lv_users_count }, | && |"child_roles": { lv_children_json }, "child_roles_count": { lv_children_count }{ '}' }|. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } check completed|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_CREATE *&---------------------------------------------------------------------* *& Create single or composite role with optional tcodes *&---------------------------------------------------------------------* FORM op_create USING pv_role_name TYPE agr_name pv_description TYPE string pv_role_type TYPE string pv_child_roles TYPE string pv_tcodes TYPE string CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2, lt_return TYPE TABLE OF bapiret2, ls_return TYPE bapiret2, lv_desc TYPE agr_title. lv_desc = pv_description. " Determine if composite DATA: lv_is_composite TYPE abap_bool. IF pv_role_type = 'C'. lv_is_composite = abap_true. ENDIF. IF lv_is_composite = abap_false. " ── Single role: use PRGN_RFC_CREATE_ACTIVITY_GROUP ── " This FM creates role + adds tcodes to menu + generates profile DATA: lt_tcodes TYPE TABLE OF ssm_tcodes, ls_ssm_tcode TYPE ssm_tcodes, lv_tcode TYPE string. DATA: lt_tcode_list TYPE string_table. " Build tcode table DATA: lv_tcode_count TYPE i. IF pv_tcodes IS NOT INITIAL. SPLIT pv_tcodes AT ',' INTO TABLE lt_tcode_list. LOOP AT lt_tcode_list INTO lv_tcode. CONDENSE lv_tcode. TRANSLATE lv_tcode TO UPPER CASE. IF lv_tcode IS NOT INITIAL. CLEAR ls_ssm_tcode. ls_ssm_tcode-tcode = lv_tcode. APPEND ls_ssm_tcode TO lt_tcodes. lv_tcode_count = lv_tcode_count + 1. ENDIF. ENDLOOP. ENDIF. CALL FUNCTION 'PRGN_RFC_CREATE_ACTIVITY_GROUP' EXPORTING activity_group = pv_role_name activity_group_text = lv_desc no_dialog = 'X' TABLES tcodes = lt_tcodes return = lt_return EXCEPTIONS activity_group_already_exists = 1 activity_group_enqueued = 2 namespace_problem = 3 illegal_characters = 4 error_when_creating_actgroup = 5 not_authorized = 6 illegal_tcodes = 7 OTHERS = 8. IF sy-subrc <> 0. " Copy return messages LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. ENDLOOP. DATA(lv_err) = SWITCH string( sy-subrc WHEN 1 THEN |Role already exists| WHEN 2 THEN |Role is locked by another user| WHEN 3 THEN |Namespace problem| WHEN 4 THEN |Illegal characters in role name| WHEN 5 THEN |Error creating role| WHEN 6 THEN |Not authorized| WHEN 7 THEN |Illegal transaction codes| ELSE |Unknown error (subrc={ sy-subrc })| ). ls_message-type = 'E'. ls_message-message = |CREATE failed: { lv_err }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, | && |"error": "{ lv_err }"{ '}' }|. RETURN. ENDIF. " Copy return messages LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. ENDLOOP. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } created successfully|. APPEND ls_message TO ct_messages. " Generate authorization tree from SU24 defaults and create profile " SUPRN_DARK_MANIPULATE_PROFILE is PFCG's headless auth data engine. " Pass TCODES table explicitly to ensure SU24 lookup works correctly. " Without this, the FM reads menu tree internally which may miss tcodes. DATA: lt_return_gen TYPE bapiret2_t, ls_return_gen TYPE bapiret2, lv_profile_gen TYPE agprofile, lv_profile TYPE agr_prof-profile. " Build TWBTCODE table from parsed tcodes for explicit passing DATA: lt_twbtcode TYPE TABLE OF twbtcode, ls_twbtcode TYPE twbtcode. LOOP AT lt_tcode_list INTO lv_tcode. CONDENSE lv_tcode. TRANSLATE lv_tcode TO UPPER CASE. IF lv_tcode IS NOT INITIAL. ls_twbtcode-tcode = lv_tcode. APPEND ls_twbtcode TO lt_twbtcode. ENDIF. ENDLOOP. TRY. CALL FUNCTION 'SUPRN_DARK_MANIPULATE_PROFILE' EXPORTING activity_group = pv_role_name fill_orgs_with_star = 'X' fill_fields_with_star = 'X' no_dialog = 'X' rebuild_auth_data = 'X' generate_profile = 'X' IMPORTING profile_torso = lv_profile_gen return = lt_return_gen TABLES tcodes = lt_twbtcode EXCEPTIONS profile_not_in_namespace = 1 profile_name_exists = 2 no_auth_for_role_change = 3 no_auth_for_prof_creation = 4 no_auth_for_auth_maint = 5 no_auth_for_gen = 6 no_auths = 7 open_auths = 8 too_many_auths = 9 error_when_generating_profile = 10 OTHERS = 11. IF sy-subrc = 0. LOOP AT lt_return_gen INTO ls_return_gen. ls_message-type = ls_return_gen-type. ls_message-message = ls_return_gen-message. APPEND ls_message TO ct_messages. ENDLOOP. SELECT SINGLE profile FROM agr_prof INTO lv_profile WHERE agr_name = pv_role_name. ls_message-type = 'S'. ls_message-message = |Auth tree generated and profile { lv_profile } created|. APPEND ls_message TO ct_messages. ELSE. ls_message-type = 'W'. ls_message-message = |Role created but auth tree generation failed (subrc={ sy-subrc }). Run GENERATE separately.|. APPEND ls_message TO ct_messages. ENDIF. CATCH cx_root INTO DATA(lx_gen_c). ls_message-type = 'W'. ls_message-message = |Role created but auth generation error: { lx_gen_c->get_text( ) }|. APPEND ls_message TO ct_messages. ENDTRY. pv_result_json = |{ '{' }"success": true, | && |"message": "Role created successfully", | && |"role_name": "{ pv_role_name }", | && |"role_type": "SINGLE"|. IF lv_tcode_count > 0. pv_result_json = pv_result_json && |, "tcodes_added": { lv_tcode_count }|. ENDIF. IF lv_profile IS NOT INITIAL. pv_result_json = pv_result_json && |, "profile": "{ lv_profile }"|. ENDIF. pv_result_json = pv_result_json && |{ '}' }|. ELSE. " ── Composite role: use PRGN_RFC_CREATE_AGR_MULTIPLE ── CALL FUNCTION 'PRGN_RFC_CREATE_AGR_MULTIPLE' EXPORTING activity_group = pv_role_name activity_group_text = lv_desc collective_agr = 'X' no_dialog = 'X' TABLES return = lt_return EXCEPTIONS activity_group_already_exists = 1 activity_group_enqueued = 2 namespace_problem = 3 illegal_characters = 4 error_when_creating_actgroup = 5 not_authorized = 6 OTHERS = 7. IF sy-subrc <> 0. LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. ENDLOOP. DATA(lv_err_c) = SWITCH string( sy-subrc WHEN 1 THEN |Role already exists| WHEN 2 THEN |Role is locked by another user| WHEN 3 THEN |Namespace problem| WHEN 4 THEN |Illegal characters in role name| WHEN 5 THEN |Error creating role| WHEN 6 THEN |Not authorized| ELSE |Unknown error (subrc={ sy-subrc })| ). ls_message-type = 'E'. ls_message-message = |CREATE failed: { lv_err_c }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, | && |"error": "{ lv_err_c }"{ '}' }|. RETURN. ENDIF. " Copy return messages LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. ENDLOOP. " Add child roles via PRGN_RFC_ADD_AGRS_TO_COLL_AGR DATA: lv_child_count TYPE i. IF pv_child_roles IS NOT INITIAL. DATA: lt_child_list TYPE string_table, lv_child_name TYPE string, lt_child_agrs TYPE TABLE OF agr_txt, ls_child_agr TYPE agr_txt, lt_child_ret TYPE TABLE OF bapiret2, ls_child_ret TYPE bapiret2. SPLIT pv_child_roles AT ',' INTO TABLE lt_child_list. LOOP AT lt_child_list INTO lv_child_name. CONDENSE lv_child_name. TRANSLATE lv_child_name TO UPPER CASE. IF lv_child_name IS NOT INITIAL. CLEAR ls_child_agr. ls_child_agr-agr_name = lv_child_name. APPEND ls_child_agr TO lt_child_agrs. ENDIF. ENDLOOP. IF lt_child_agrs IS NOT INITIAL. CALL FUNCTION 'PRGN_RFC_ADD_AGRS_TO_COLL_AGR' EXPORTING activity_group = pv_role_name profile_comparison = 'X' no_dialog = 'X' TABLES activity_groups = lt_child_agrs return = lt_child_ret EXCEPTIONS activity_group_does_not_exist = 1 no_collective_activity_group = 2 activity_group_enqueued = 3 namespace_problem = 4 not_authorized = 5 authority_incomplete = 6 OTHERS = 7. IF sy-subrc = 0. lv_child_count = lines( lt_child_agrs ). LOOP AT lt_child_ret INTO ls_child_ret. ls_message-type = ls_child_ret-type. ls_message-message = ls_child_ret-message. APPEND ls_message TO ct_messages. ENDLOOP. ELSE. LOOP AT lt_child_ret INTO ls_child_ret. ls_message-type = ls_child_ret-type. ls_message-message = ls_child_ret-message. APPEND ls_message TO ct_messages. ENDLOOP. ls_message-type = 'W'. ls_message-message = |Child role assignment failed (subrc={ sy-subrc })|. APPEND ls_message TO ct_messages. ENDIF. ENDIF. ENDIF. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } created successfully|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, | && |"message": "Role created successfully", | && |"role_name": "{ pv_role_name }", | && |"role_type": "COMPOSITE"|. IF lv_child_count > 0. pv_result_json = pv_result_json && |, "child_roles_added": { lv_child_count }|. ENDIF. pv_result_json = pv_result_json && |{ '}' }|. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_COPY *&---------------------------------------------------------------------* *& Copy role to new name with all authorizations *&---------------------------------------------------------------------* FORM op_copy USING pv_role_name TYPE agr_name pv_copy_from TYPE agr_name CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Validate copyFromRole IF pv_copy_from IS INITIAL. ls_message-type = 'E'. ls_message-message = 'copyFromRole parameter is required for COPY operation'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing copyFromRole parameter"{ '}' }|. RETURN. ENDIF. " Check source role exists DATA: lv_source_exists TYPE abap_bool. PERFORM role_exists USING pv_copy_from CHANGING lv_source_exists. IF lv_source_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Source role { pv_copy_from } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Source role does not exist"{ '}' }|. RETURN. ENDIF. " Check target role does not exist DATA: lv_target_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_target_exists. IF lv_target_exists = abap_true. ls_message-type = 'E'. ls_message-message = |Target role { pv_role_name } already exists|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Target role already exists"{ '}' }|. RETURN. ENDIF. " Try PRGN_ACTIVITY_GROUP_COPY TRY. CALL FUNCTION 'PRGN_ACTIVITY_GROUP_COPY' EXPORTING activity_group_old = pv_copy_from activity_group_new = pv_role_name EXCEPTIONS already_existing = 1 not_existing = 2 OTHERS = 3. IF sy-subrc <> 0. " Fallback: manual copy via table operations PERFORM copy_role_tables USING pv_copy_from pv_role_name CHANGING ct_messages. ENDIF. CATCH cx_root INTO DATA(lx_copy). " Fallback: manual copy PERFORM copy_role_tables USING pv_copy_from pv_role_name CHANGING ct_messages. ENDTRY. COMMIT WORK AND WAIT. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } copied from { pv_copy_from }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "message": "Role copied successfully", | && |"role_name": "{ pv_role_name }", "copied_from": "{ pv_copy_from }"{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_UPDATE *&---------------------------------------------------------------------* *& Update role description or add tcodes *&---------------------------------------------------------------------* FORM op_update USING pv_role_name TYPE agr_name pv_description TYPE string pv_tcodes TYPE string CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. " Validate at least one update field IF pv_description IS INITIAL AND pv_tcodes IS INITIAL. ls_message-type = 'E'. ls_message-message = 'No fields to update. Provide description or tcodes.'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "No fields to update"{ '}' }|. RETURN. ENDIF. DATA: lv_fields_updated TYPE string. " Update description IF pv_description IS NOT INITIAL. " Delete existing description and insert new DELETE FROM agr_texts WHERE agr_name = pv_role_name AND spras = sy-langu AND line = 0. DATA: ls_agr_text TYPE agr_texts. ls_agr_text-agr_name = pv_role_name. ls_agr_text-spras = sy-langu. ls_agr_text-line = 0. ls_agr_text-text = pv_description. INSERT agr_texts FROM ls_agr_text. lv_fields_updated = 'description'. ENDIF. " Add tcodes DATA: lv_tcode_count TYPE i. IF pv_tcodes IS NOT INITIAL. PERFORM add_tcodes_to_role USING pv_role_name pv_tcodes CHANGING lv_tcode_count ct_messages. IF lv_fields_updated IS INITIAL. lv_fields_updated = |tcodes({ lv_tcode_count })|. ELSE. lv_fields_updated = lv_fields_updated && |, tcodes({ lv_tcode_count })|. ENDIF. ENDIF. " Update change timestamp UPDATE agr_define SET change_dat = sy-datum change_tim = sy-uzeit change_usr = sy-uname WHERE agr_name = pv_role_name. COMMIT WORK AND WAIT. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } updated: { lv_fields_updated }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "message": "Role updated successfully", | && |"role_name": "{ pv_role_name }", "fields_updated": "{ lv_fields_updated }"{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_DELETE *&---------------------------------------------------------------------* *& Delete role from the system *&---------------------------------------------------------------------* FORM op_delete USING pv_role_name TYPE agr_name CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. " Try PRGN_ACTIVITY_GROUP_DELETE TRY. CALL FUNCTION 'PRGN_ACTIVITY_GROUP_DELETE' EXPORTING activity_group = pv_role_name show_dialog = space enqueue_and_transport = space EXCEPTIONS not_existing = 1 OTHERS = 2. IF sy-subrc <> 0. " Fallback: direct delete from all AGR tables PERFORM delete_role_tables USING pv_role_name. ENDIF. CATCH cx_root INTO DATA(lx_delete). PERFORM delete_role_tables USING pv_role_name. ENDTRY. COMMIT WORK AND WAIT. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } deleted successfully|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "message": "Role deleted successfully", "role_name": "{ pv_role_name }"{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SET_AUTH *&---------------------------------------------------------------------* *& Set authorization field values on a role using PFCG-native mechanism. *& For org-level fields (WERKS, BUKRS, etc.): writes to AGR_1252 and *& lets SUPRN_DARK_MANIPULATE_PROFILE propagate via orgebenen_uebertragen. *& For non-org fields: modifies existing AGR_1251 entry directly. *& Both paths auto-generate the profile via SUPRN_DARK_MANIPULATE_PROFILE. *&---------------------------------------------------------------------* FORM op_set_auth USING pv_role_name TYPE agr_name pv_auth_object TYPE string pv_auth_field TYPE string pv_auth_low TYPE string pv_auth_high TYPE string CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Validate required parameters IF pv_auth_object IS INITIAL OR pv_auth_field IS INITIAL OR pv_auth_low IS INITIAL. ls_message-type = 'E'. ls_message-message = 'SET_AUTH requires authObject, authField, and authLow parameters'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing required SET_AUTH parameters (authObject, authField, authLow)"{ '}' }|. RETURN. ENDIF. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. " ── Determine if the field is an org-level field ─────────────────── " Org-level variables in AGR_1252 are named $FIELD (e.g., $WERKS, $BUKRS) DATA: lv_org_var TYPE agr_1252-varbl, lv_is_org TYPE abap_bool, lv_org_cnt TYPE i. CONCATENATE '$' pv_auth_field INTO lv_org_var. " Check if this org variable exists in the role's AGR_1252 SELECT COUNT(*) FROM agr_1252 INTO lv_org_cnt WHERE agr_name = pv_role_name AND varbl = lv_org_var. IF lv_org_cnt > 0. lv_is_org = abap_true. ENDIF. IF lv_is_org = abap_true. " ── ORG-LEVEL FIELD: Update AGR_1252 ────────────────────────────── " Write the org value to AGR_1252 so that SUPRN_DARK_MANIPULATE_PROFILE " reads it via PRGN_1252_READ_ORG_LEVELS and applies it to all matching " auth fields via PERFORM orgebenen_uebertragen. " Note: PRGN_1252_SAVE_ORG_LEVELS only writes to globals (not DB), " so we must write to AGR_1252 directly before calling the FM. DATA: ls_agr_1252 TYPE agr_1252. SELECT SINGLE * FROM agr_1252 INTO ls_agr_1252 WHERE agr_name = pv_role_name AND varbl = lv_org_var. IF sy-subrc = 0. " Update existing org level entry ls_agr_1252-low = pv_auth_low. IF pv_auth_high IS NOT INITIAL. ls_agr_1252-high = pv_auth_high. ENDIF. MODIFY agr_1252 FROM ls_agr_1252. ELSE. " Insert new org level entry DATA: lv_max_org_counter TYPE agr_1252-counter. SELECT MAX( counter ) FROM agr_1252 INTO lv_max_org_counter WHERE agr_name = pv_role_name. lv_max_org_counter = lv_max_org_counter + 1. ls_agr_1252-mandt = sy-mandt. ls_agr_1252-agr_name = pv_role_name. ls_agr_1252-counter = lv_max_org_counter. ls_agr_1252-varbl = lv_org_var. ls_agr_1252-low = pv_auth_low. IF pv_auth_high IS NOT INITIAL. ls_agr_1252-high = pv_auth_high. ENDIF. INSERT agr_1252 FROM ls_agr_1252. ENDIF. COMMIT WORK AND WAIT. ls_message-type = 'I'. ls_message-message = |Org level { lv_org_var }={ pv_auth_low } saved to AGR_1252|. APPEND ls_message TO ct_messages. ELSE. " ── NON-ORG FIELD: Modify or create auth object + field entries ──── DATA: lv_obj_exists TYPE i. SELECT COUNT(*) FROM agr_1250 INTO lv_obj_exists WHERE agr_name = pv_role_name AND object = pv_auth_object. IF lv_obj_exists = 0. " ── Auth object NOT in role yet → create it with all fields ────── " This handles disabled objects (TOBJ_OFF) that aren't auto-proposed " Look up object fields from TOBJ DATA: ls_tobj TYPE tobj. SELECT SINGLE * FROM tobj INTO ls_tobj WHERE objct = pv_auth_object. IF sy-subrc <> 0. ls_message-type = 'E'. ls_message-message = |Auth object { pv_auth_object } not found in TOBJ catalog|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Unknown authorization object"{ '}' }|. RETURN. ENDIF. " Get existing AUTH name from the role (reuse same auth grouping) DATA: lv_new_auth TYPE agr_1250-auth. SELECT SINGLE auth FROM agr_1250 INTO lv_new_auth WHERE agr_name = pv_role_name. IF sy-subrc <> 0. " Role has no auth data at all — shouldn't happen after CREATE ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } has no authorization data|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role has no authorization data"{ '}' }|. RETURN. ENDIF. " Create AGR_1250 entry for the new auth object DATA: ls_agr_1250_new TYPE agr_1250, lv_max_1250_cnt TYPE agr_1250-counter. SELECT MAX( counter ) FROM agr_1250 INTO lv_max_1250_cnt WHERE agr_name = pv_role_name. lv_max_1250_cnt = lv_max_1250_cnt + 1. ls_agr_1250_new-mandt = sy-mandt. ls_agr_1250_new-agr_name = pv_role_name. ls_agr_1250_new-counter = lv_max_1250_cnt. ls_agr_1250_new-object = pv_auth_object. ls_agr_1250_new-auth = lv_new_auth. ls_agr_1250_new-modified = 'M'. ls_agr_1250_new-node = 0. INSERT agr_1250 FROM ls_agr_1250_new. " Create AGR_1251 entries for each field of the object " Specified field gets user value, others get '*' DATA: lv_max_1251_cnt TYPE agr_1251-counter, ls_agr_1251_new TYPE agr_1251, lv_tobj_field TYPE fieldname, lv_field_idx TYPE i. SELECT MAX( counter ) FROM agr_1251 INTO lv_max_1251_cnt WHERE agr_name = pv_role_name. " Iterate over TOBJ field slots (FIEL1..FIEL0 = up to 10 fields) DO 10 TIMES. lv_field_idx = sy-index. CASE lv_field_idx. WHEN 1. lv_tobj_field = ls_tobj-fiel1. WHEN 2. lv_tobj_field = ls_tobj-fiel2. WHEN 3. lv_tobj_field = ls_tobj-fiel3. WHEN 4. lv_tobj_field = ls_tobj-fiel4. WHEN 5. lv_tobj_field = ls_tobj-fiel5. WHEN 6. lv_tobj_field = ls_tobj-fiel6. WHEN 7. lv_tobj_field = ls_tobj-fiel7. WHEN 8. lv_tobj_field = ls_tobj-fiel8. WHEN 9. lv_tobj_field = ls_tobj-fiel9. WHEN 10. lv_tobj_field = ls_tobj-fiel0. ENDCASE. IF lv_tobj_field IS INITIAL. EXIT. " No more fields ENDIF. lv_max_1251_cnt = lv_max_1251_cnt + 1. CLEAR ls_agr_1251_new. ls_agr_1251_new-mandt = sy-mandt. ls_agr_1251_new-agr_name = pv_role_name. ls_agr_1251_new-counter = lv_max_1251_cnt. ls_agr_1251_new-object = pv_auth_object. ls_agr_1251_new-auth = lv_new_auth. ls_agr_1251_new-field = lv_tobj_field. ls_agr_1251_new-modified = 'M'. ls_agr_1251_new-neu = 'X'. ls_agr_1251_new-node = 0. IF lv_tobj_field = pv_auth_field. ls_agr_1251_new-low = pv_auth_low. IF pv_auth_high IS NOT INITIAL. ls_agr_1251_new-high = pv_auth_high. ENDIF. ELSE. ls_agr_1251_new-low = '*'. ENDIF. INSERT agr_1251 FROM ls_agr_1251_new. ENDDO. COMMIT WORK AND WAIT. ls_message-type = 'I'. ls_message-message = |Auth object { pv_auth_object } added to role with { pv_auth_field }={ pv_auth_low }|. APPEND ls_message TO ct_messages. ELSE. " ── Auth object already in role → update existing field entry ──── DATA: ls_agr_1251 TYPE agr_1251. SELECT SINGLE * FROM agr_1251 INTO ls_agr_1251 WHERE agr_name = pv_role_name AND object = pv_auth_object AND field = pv_auth_field AND deleted = space. IF sy-subrc = 0. " Update existing entry's value ls_agr_1251-low = pv_auth_low. IF pv_auth_high IS NOT INITIAL. ls_agr_1251-high = pv_auth_high. ENDIF. ls_agr_1251-modified = 'U'. MODIFY agr_1251 FROM ls_agr_1251. ELSE. " Field not found — add new entry with proper linkage DATA: lv_auth_name TYPE agr_1251-auth, lv_variant TYPE agr_1251-variant, lv_node TYPE agr_1251-node. SELECT SINGLE auth variant node FROM agr_1251 INTO (lv_auth_name, lv_variant, lv_node) WHERE agr_name = pv_role_name AND object = pv_auth_object AND deleted = space. IF sy-subrc <> 0. ls_message-type = 'E'. ls_message-message = |No field entries for { pv_auth_object } in AGR_1251|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Auth object has no field entries in AGR_1251"{ '}' }|. RETURN. ENDIF. DATA: lv_max_counter TYPE agr_1251-counter. SELECT MAX( counter ) FROM agr_1251 INTO lv_max_counter WHERE agr_name = pv_role_name. lv_max_counter = lv_max_counter + 1. CLEAR ls_agr_1251. ls_agr_1251-mandt = sy-mandt. ls_agr_1251-agr_name = pv_role_name. ls_agr_1251-counter = lv_max_counter. ls_agr_1251-object = pv_auth_object. ls_agr_1251-auth = lv_auth_name. ls_agr_1251-variant = lv_variant. ls_agr_1251-field = pv_auth_field. ls_agr_1251-low = pv_auth_low. IF pv_auth_high IS NOT INITIAL. ls_agr_1251-high = pv_auth_high. ENDIF. ls_agr_1251-modified = 'U'. ls_agr_1251-neu = 'X'. ls_agr_1251-node = lv_node. INSERT agr_1251 FROM ls_agr_1251. ENDIF. COMMIT WORK AND WAIT. ls_message-type = 'I'. ls_message-message = |Field { pv_auth_object }/{ pv_auth_field }={ pv_auth_low } saved to AGR_1251|. APPEND ls_message TO ct_messages. ENDIF. ENDIF. " ── Apply changes and generate profile via PFCG engine ───────────── " SUPRN_DARK_MANIPULATE_PROFILE loads auth data + org levels from DB, " transfers org values to auth fields (orgebenen_uebertragen), " saves everything, and generates the authorization profile. DATA: lt_sa_return TYPE bapiret2_t, ls_sa_return TYPE bapiret2, lv_sa_profile TYPE agprofile, lv_profile_name TYPE agr_prof-profile. TRY. CALL FUNCTION 'SUPRN_DARK_MANIPULATE_PROFILE' EXPORTING activity_group = pv_role_name fill_orgs_with_star = space fill_fields_with_star = space no_dialog = 'X' rebuild_auth_data = space generate_profile = 'X' IMPORTING profile_torso = lv_sa_profile return = lt_sa_return EXCEPTIONS profile_not_in_namespace = 1 profile_name_exists = 2 no_auth_for_role_change = 3 no_auth_for_prof_creation = 4 no_auth_for_auth_maint = 5 no_auth_for_gen = 6 no_auths = 7 open_auths = 8 too_many_auths = 9 error_when_generating_profile = 10 OTHERS = 11. IF sy-subrc = 0. " Success — value applied and profile generated LOOP AT lt_sa_return INTO ls_sa_return. ls_message-type = ls_sa_return-type. ls_message-message = ls_sa_return-message. APPEND ls_message TO ct_messages. ENDLOOP. SELECT SINGLE profile FROM agr_prof INTO lv_profile_name WHERE agr_name = pv_role_name. ls_message-type = 'S'. ls_message-message = |Authorization { pv_auth_object }/{ pv_auth_field }={ pv_auth_low } set and profile generated|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, | && |"message": "Authorization value set and profile generated", | && |"role_name": "{ pv_role_name }", | && |"auth_object": "{ pv_auth_object }", | && |"auth_field": "{ pv_auth_field }", | && |"auth_low": "{ pv_auth_low }", | && |"auth_high": "{ pv_auth_high }", | && |"profile": "{ lv_profile_name }", | && |"org_level": { COND string( WHEN lv_is_org = abap_true THEN 'true' ELSE 'false' ) }{ '}' }|. ELSE. " Profile generation failed but value was already committed LOOP AT lt_sa_return INTO ls_sa_return. ls_message-type = ls_sa_return-type. ls_message-message = ls_sa_return-message. APPEND ls_message TO ct_messages. ENDLOOP. DATA(lv_sa_err) = SWITCH string( sy-subrc WHEN 1 THEN |Profile not in namespace| WHEN 2 THEN |Profile name already exists| WHEN 3 THEN |No authorization for role change| WHEN 4 THEN |No authorization for profile creation| WHEN 5 THEN |No authorization for auth maintenance| WHEN 6 THEN |No authorization for generation| WHEN 7 THEN |No active authorizations in role| WHEN 8 THEN |Role has unmaintained authorizations (run GENERATE to fill with defaults)| WHEN 9 THEN |Too many authorization values| WHEN 10 THEN |Error during profile generation| ELSE |Unknown error (subrc={ sy-subrc })| ). ls_message-type = 'W'. ls_message-message = |Value set but profile generation failed: { lv_sa_err }. Run GENERATE separately.|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, | && |"message": "Value set but profile generation failed", | && |"role_name": "{ pv_role_name }", | && |"auth_object": "{ pv_auth_object }", | && |"auth_field": "{ pv_auth_field }", | && |"auth_low": "{ pv_auth_low }", | && |"generation_error": "{ lv_sa_err }", | && |"note": "Run GENERATE to retry"{ '}' }|. ENDIF. CATCH cx_root INTO DATA(lx_sa_err). ls_message-type = 'W'. ls_message-message = |Value set but generation error: { lx_sa_err->get_text( ) }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, | && |"message": "Value set but profile generation error", | && |"role_name": "{ pv_role_name }", | && |"auth_object": "{ pv_auth_object }", | && |"auth_field": "{ pv_auth_field }", | && |"auth_low": "{ pv_auth_low }", | && |"note": "Run GENERATE to retry"{ '}' }|. ENDTRY. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_GENERATE *&---------------------------------------------------------------------* *& Rebuild authorization tree from SU24 and generate profile. *& Uses SUPRN_DARK_MANIPULATE_PROFILE (PFCG's headless engine). *& Rebuilds auth data from SU24 defaults, fills unmaintained fields *& with '*', then reads org levels from AGR_1252 and applies them *& via orgebenen_uebertragen (overriding '*' with specific values). *&---------------------------------------------------------------------* FORM op_generate USING pv_role_name TYPE agr_name CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. DATA: lv_profile_name TYPE agr_prof-profile, lt_return TYPE bapiret2_t, ls_return TYPE bapiret2, lv_has_error TYPE abap_bool, lv_profile_torso TYPE agprofile. " Read tcodes from AGR_TCODES to pass explicitly to SUPRN DATA: lt_gen_twbtcode TYPE TABLE OF twbtcode, ls_gen_twbtcode TYPE twbtcode, lt_agr_tcodes TYPE TABLE OF agr_tcodes, ls_agr_tcode TYPE agr_tcodes. SELECT * FROM agr_tcodes INTO TABLE lt_agr_tcodes WHERE agr_name = pv_role_name. LOOP AT lt_agr_tcodes INTO ls_agr_tcode. ls_gen_twbtcode-tcode = ls_agr_tcode-tcode. APPEND ls_gen_twbtcode TO lt_gen_twbtcode. ENDLOOP. TRY. CALL FUNCTION 'SUPRN_DARK_MANIPULATE_PROFILE' EXPORTING activity_group = pv_role_name fill_orgs_with_star = 'X' fill_fields_with_star = 'X' no_dialog = 'X' rebuild_auth_data = 'X' generate_profile = 'X' IMPORTING profile_torso = lv_profile_torso return = lt_return TABLES tcodes = lt_gen_twbtcode EXCEPTIONS profile_not_in_namespace = 1 profile_name_exists = 2 no_auth_for_role_change = 3 no_auth_for_prof_creation = 4 no_auth_for_auth_maint = 5 no_auth_for_gen = 6 no_auths = 7 open_auths = 8 too_many_auths = 9 error_when_generating_profile = 10 OTHERS = 11. IF sy-subrc = 0. LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. IF ls_return-type = 'E' OR ls_return-type = 'A'. lv_has_error = abap_true. ENDIF. ENDLOOP. IF lv_has_error = abap_false. SELECT SINGLE profile INTO lv_profile_name FROM agr_prof WHERE agr_name = pv_role_name. ls_message-type = 'S'. ls_message-message = |Profile generated for role { pv_role_name }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, | && |"message": "Profile generated successfully", | && |"role_name": "{ pv_role_name }", | && |"profile": "{ lv_profile_name }"{ '}' }|. ELSE. pv_result_json = |{ '{' }"success": false, | && |"error": "Profile generation completed with errors", | && |"role_name": "{ pv_role_name }"{ '}' }|. ENDIF. ELSE. DATA(lv_exc) = SWITCH string( sy-subrc WHEN 1 THEN |Profile not in namespace| WHEN 2 THEN |Profile name already exists| WHEN 3 THEN |No authorization for role change| WHEN 4 THEN |No authorization for profile creation| WHEN 5 THEN |No authorization for auth maintenance| WHEN 6 THEN |No authorization for generation| WHEN 7 THEN |No active authorizations in role| WHEN 8 THEN |Role has unmaintained authorizations| WHEN 9 THEN |Too many authorization values| WHEN 10 THEN |Error during profile generation| ELSE |Unknown error (subrc={ sy-subrc })| ). LOOP AT lt_return INTO ls_return. ls_message-type = ls_return-type. ls_message-message = ls_return-message. APPEND ls_message TO ct_messages. ENDLOOP. ls_message-type = 'E'. ls_message-message = |Profile generation failed: { lv_exc }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, | && |"error": "{ lv_exc }", | && |"role_name": "{ pv_role_name }", | && |"subrc": { sy-subrc }{ '}' }|. ENDIF. CATCH cx_root INTO DATA(lx_gen). ls_message-type = 'E'. ls_message-message = |Profile generation error: { lx_gen->get_text( ) }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, | && |"error": "{ lx_gen->get_text( ) }"{ '}' }|. ENDTRY. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_ASSIGN *&---------------------------------------------------------------------* *& Assign role to user(s) with validity dates (additive) *&---------------------------------------------------------------------* FORM op_assign USING pv_role_name TYPE agr_name pv_username TYPE xubname pv_users TYPE string pv_validfrom TYPE d pv_validto TYPE d CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. " Build user list from username and/or users parameter DATA: lt_user_list TYPE string_table, lv_user TYPE string. IF pv_username IS NOT INITIAL. APPEND pv_username TO lt_user_list. ENDIF. IF pv_users IS NOT INITIAL. SPLIT pv_users AT ',' INTO TABLE DATA(lt_users_split). LOOP AT lt_users_split INTO lv_user. CONDENSE lv_user. TRANSLATE lv_user TO UPPER CASE. IF lv_user IS NOT INITIAL. APPEND lv_user TO lt_user_list. ENDIF. ENDLOOP. ENDIF. " Remove duplicates SORT lt_user_list. DELETE ADJACENT DUPLICATES FROM lt_user_list. IF lines( lt_user_list ) = 0. ls_message-type = 'E'. ls_message-message = 'ASSIGN requires username or users parameter'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "No users specified for assignment"{ '}' }|. RETURN. ENDIF. " Set default validity dates DATA: lv_from TYPE d, lv_to TYPE d. IF pv_validfrom IS INITIAL. lv_from = sy-datum. ELSE. lv_from = pv_validfrom. ENDIF. IF pv_validto IS INITIAL. lv_to = '99991231'. ELSE. lv_to = pv_validto. ENDIF. " Assign role to each user using BAPI_USER_ACTGROUPS_ASSIGN DATA: lv_success_count TYPE i, lv_fail_count TYPE i, lv_users_result TYPE string. LOOP AT lt_user_list INTO lv_user. DATA: lv_target_user TYPE xubname. lv_target_user = lv_user. " Get current roles for user DATA: lt_current_roles TYPE TABLE OF bapiagr, lt_return TYPE TABLE OF bapiret2, ls_return TYPE bapiret2. CLEAR: lt_current_roles, lt_return. CALL FUNCTION 'BAPI_USER_GET_DETAIL' EXPORTING username = lv_target_user TABLES activitygroups = lt_current_roles return = lt_return. " Check if user exists READ TABLE lt_return INTO ls_return WITH KEY type = 'E'. IF sy-subrc = 0. lv_fail_count = lv_fail_count + 1. ls_message-type = 'W'. ls_message-message = |User { lv_target_user } not found, skipping|. APPEND ls_message TO ct_messages. CONTINUE. ENDIF. " Add the new role to existing roles (additive) DATA: ls_new_role TYPE bapiagr. ls_new_role-agr_name = pv_role_name. ls_new_role-from_dat = lv_from. ls_new_role-to_dat = lv_to. APPEND ls_new_role TO lt_current_roles. " Assign complete role list CLEAR lt_return. CALL FUNCTION 'BAPI_USER_ACTGROUPS_ASSIGN' EXPORTING username = lv_target_user TABLES activitygroups = lt_current_roles return = lt_return. READ TABLE lt_return INTO ls_return WITH KEY type = 'E'. IF sy-subrc = 0. lv_fail_count = lv_fail_count + 1. ls_message-type = 'W'. ls_message-message = |Failed to assign role to { lv_target_user }: { ls_return-message }|. APPEND ls_message TO ct_messages. ELSE. CALL FUNCTION 'BAPI_TRANSACTION_COMMIT' EXPORTING wait = 'X'. lv_success_count = lv_success_count + 1. ENDIF. CLEAR: lt_current_roles, ls_new_role. ENDLOOP. " Build users result IF lv_success_count > 0. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } assigned to { lv_success_count } user(s)|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "message": "Role assigned successfully", | && |"role_name": "{ pv_role_name }", | && |"users_assigned": { lv_success_count }, "users_failed": { lv_fail_count }, | && |"valid_from": "{ lv_from }", "valid_to": "{ lv_to }"{ '}' }|. ELSE. ls_message-type = 'E'. ls_message-message = |Failed to assign role { pv_role_name } to any user|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Assignment failed for all users", | && |"role_name": "{ pv_role_name }", "users_failed": { lv_fail_count }{ '}' }|. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_UNASSIGN *&---------------------------------------------------------------------* *& Remove role from user(s) (subtractive) *&---------------------------------------------------------------------* FORM op_unassign USING pv_role_name TYPE agr_name pv_username TYPE xubname pv_users TYPE string CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Check role exists DATA: lv_exists TYPE abap_bool. PERFORM role_exists USING pv_role_name CHANGING lv_exists. IF lv_exists = abap_false. ls_message-type = 'E'. ls_message-message = |Role { pv_role_name } does not exist|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Role does not exist"{ '}' }|. RETURN. ENDIF. " Build user list DATA: lt_user_list TYPE string_table, lv_user TYPE string. IF pv_username IS NOT INITIAL. APPEND pv_username TO lt_user_list. ENDIF. IF pv_users IS NOT INITIAL. SPLIT pv_users AT ',' INTO TABLE DATA(lt_users_split). LOOP AT lt_users_split INTO lv_user. CONDENSE lv_user. TRANSLATE lv_user TO UPPER CASE. IF lv_user IS NOT INITIAL. APPEND lv_user TO lt_user_list. ENDIF. ENDLOOP. ENDIF. SORT lt_user_list. DELETE ADJACENT DUPLICATES FROM lt_user_list. IF lines( lt_user_list ) = 0. ls_message-type = 'E'. ls_message-message = 'UNASSIGN requires username or users parameter'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "No users specified for unassignment"{ '}' }|. RETURN. ENDIF. " Remove role from each user DATA: lv_success_count TYPE i, lv_fail_count TYPE i. LOOP AT lt_user_list INTO lv_user. DATA: lv_target_user TYPE xubname. lv_target_user = lv_user. " Get current roles DATA: lt_current_roles TYPE TABLE OF bapiagr, lt_new_roles TYPE TABLE OF bapiagr, ls_role TYPE bapiagr, lt_return TYPE TABLE OF bapiret2, ls_return TYPE bapiret2. CLEAR: lt_current_roles, lt_new_roles, lt_return. CALL FUNCTION 'BAPI_USER_GET_DETAIL' EXPORTING username = lv_target_user TABLES activitygroups = lt_current_roles return = lt_return. READ TABLE lt_return INTO ls_return WITH KEY type = 'E'. IF sy-subrc = 0. lv_fail_count = lv_fail_count + 1. ls_message-type = 'W'. ls_message-message = |User { lv_target_user } not found, skipping|. APPEND ls_message TO ct_messages. CONTINUE. ENDIF. " Filter out the role to remove DATA: lv_found TYPE abap_bool. lv_found = abap_false. LOOP AT lt_current_roles INTO ls_role. IF ls_role-agr_name = pv_role_name. lv_found = abap_true. ELSE. APPEND ls_role TO lt_new_roles. ENDIF. ENDLOOP. IF lv_found = abap_false. lv_fail_count = lv_fail_count + 1. ls_message-type = 'W'. ls_message-message = |Role { pv_role_name } not assigned to { lv_target_user }, skipping|. APPEND ls_message TO ct_messages. CONTINUE. ENDIF. " Reassign remaining roles (this replaces the full list) CLEAR lt_return. CALL FUNCTION 'BAPI_USER_ACTGROUPS_ASSIGN' EXPORTING username = lv_target_user TABLES activitygroups = lt_new_roles return = lt_return. READ TABLE lt_return INTO ls_return WITH KEY type = 'E'. IF sy-subrc = 0. lv_fail_count = lv_fail_count + 1. ls_message-type = 'W'. ls_message-message = |Failed to unassign role from { lv_target_user }: { ls_return-message }|. APPEND ls_message TO ct_messages. ELSE. CALL FUNCTION 'BAPI_TRANSACTION_COMMIT' EXPORTING wait = 'X'. lv_success_count = lv_success_count + 1. ENDIF. CLEAR: lt_current_roles, lt_new_roles. ENDLOOP. IF lv_success_count > 0. ls_message-type = 'S'. ls_message-message = |Role { pv_role_name } unassigned from { lv_success_count } user(s)|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "message": "Role unassigned successfully", | && |"role_name": "{ pv_role_name }", | && |"users_unassigned": { lv_success_count }, "users_failed": { lv_fail_count }{ '}' }|. ELSE. ls_message-type = 'E'. ls_message-message = |Failed to unassign role { pv_role_name } from any user|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Unassignment failed for all users", | && |"role_name": "{ pv_role_name }", "users_failed": { lv_fail_count }{ '}' }|. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form OP_SEARCH *&---------------------------------------------------------------------* *& SUIM-style search: roles, users, tcodes, auth objects, composites *&---------------------------------------------------------------------* FORM op_search USING pv_search_type TYPE string pv_search_pattern TYPE string pv_username TYPE xubname pv_auth_object TYPE string pv_max_results TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Validate search type IF pv_search_type IS INITIAL. ls_message-type = 'E'. ls_message-message = 'searchType is required for SEARCH (ROLE, USER, TCODE, AUTH_OBJECT, COMPOSITE, MENU)'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing searchType parameter"{ '}' }|. RETURN. ENDIF. CASE pv_search_type. WHEN 'ROLE'. PERFORM search_roles USING pv_search_pattern pv_max_results CHANGING pv_result_json ct_messages. WHEN 'USER'. PERFORM search_by_user USING pv_username pv_max_results CHANGING pv_result_json ct_messages. WHEN 'TCODE'. PERFORM search_by_tcode USING pv_search_pattern pv_max_results CHANGING pv_result_json ct_messages. WHEN 'AUTH_OBJECT'. PERFORM search_by_auth_object USING pv_auth_object pv_max_results CHANGING pv_result_json ct_messages. WHEN 'COMPOSITE'. PERFORM search_composite USING pv_search_pattern pv_max_results CHANGING pv_result_json ct_messages. WHEN 'MENU'. PERFORM search_by_menu USING pv_search_pattern pv_max_results CHANGING pv_result_json ct_messages. WHEN OTHERS. ls_message-type = 'E'. ls_message-message = |Invalid searchType: { pv_search_type }. Use ROLE, USER, TCODE, AUTH_OBJECT, COMPOSITE, or MENU|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Invalid searchType"{ '}' }|. ENDCASE. ENDFORM. *&=====================================================================* *& SEARCH sub-operations *&=====================================================================* *&---------------------------------------------------------------------* *& Form SEARCH_ROLES *&---------------------------------------------------------------------* FORM search_roles USING pv_pattern TYPE string pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Convert wildcard and uppercase (role names are always uppercase) DATA: lv_pattern TYPE string. lv_pattern = pv_pattern. TRANSLATE lv_pattern TO UPPER CASE. IF lv_pattern IS INITIAL. lv_pattern = '%'. ELSE. REPLACE ALL OCCURRENCES OF '*' IN lv_pattern WITH '%'. ENDIF. " Query AGR_DEFINE for matching roles TYPES: BEGIN OF ty_role_result, agr_name TYPE agr_name, END OF ty_role_result. DATA: lt_roles TYPE TABLE OF ty_role_result, ls_role TYPE ty_role_result. SELECT agr_name INTO TABLE lt_roles FROM agr_define UP TO pv_max ROWS WHERE agr_name LIKE lv_pattern. DATA: lv_count TYPE i. lv_count = lines( lt_roles ). " Build results JSON with descriptions DATA: lv_results_json TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_roles INTO ls_role. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. " Determine if composite by checking AGR_AGRS DATA: lv_type_text TYPE string, lv_is_comp TYPE i. SELECT COUNT(*) FROM agr_agrs INTO lv_is_comp WHERE agr_name = ls_role-agr_name. IF lv_is_comp > 0. lv_type_text = 'COMPOSITE'. ELSE. lv_type_text = 'SINGLE'. ENDIF. " Get description DATA: lv_desc_safe TYPE string, lv_role_desc TYPE string. CLEAR lv_role_desc. SELECT SINGLE text FROM agr_texts INTO lv_role_desc WHERE agr_name = ls_role-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_role_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. REPLACE ALL OCCURRENCES OF '\' IN lv_desc_safe WITH '\\'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_role-agr_name }", "role_type": "{ lv_type_text }", "description": "{ lv_desc_safe }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } roles matching pattern { pv_pattern }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "ROLE", "pattern": "{ pv_pattern }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form SEARCH_BY_USER *&---------------------------------------------------------------------* FORM search_by_user USING pv_username TYPE xubname pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. IF pv_username IS INITIAL. ls_message-type = 'E'. ls_message-message = 'username parameter is required for USER search'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing username for USER search"{ '}' }|. RETURN. ENDIF. " Query AGR_USERS for this user TYPES: BEGIN OF ty_user_role, agr_name TYPE agr_name, from_dat TYPE d, to_dat TYPE d, END OF ty_user_role. DATA: lt_user_roles TYPE TABLE OF ty_user_role, ls_user_role TYPE ty_user_role. SELECT agr_name from_dat to_dat INTO TABLE lt_user_roles FROM agr_users UP TO pv_max ROWS WHERE uname = pv_username. DATA: lv_count TYPE i. lv_count = lines( lt_user_roles ). " Build results JSON with descriptions DATA: lv_results_json TYPE string, lv_desc TYPE string, lv_desc_safe TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_user_roles INTO ls_user_role. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. " Get description CLEAR lv_desc. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = ls_user_role-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_user_role-agr_name }", "description": "{ lv_desc_safe }", | && |"from_dat": "{ ls_user_role-from_dat }", "to_dat": "{ ls_user_role-to_dat }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } roles for user { pv_username }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "USER", "username": "{ pv_username }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form SEARCH_BY_TCODE *&---------------------------------------------------------------------* FORM search_by_tcode USING pv_tcode TYPE string pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. IF pv_tcode IS INITIAL. ls_message-type = 'E'. ls_message-message = 'searchPattern (tcode) is required for TCODE search'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing searchPattern for TCODE search"{ '}' }|. RETURN. ENDIF. DATA: lv_tcode_upper TYPE string. lv_tcode_upper = pv_tcode. TRANSLATE lv_tcode_upper TO UPPER CASE. " Query AGR_TCODES for this tcode TYPES: BEGIN OF ty_tcode_role, agr_name TYPE agr_name, END OF ty_tcode_role. DATA: lt_tcode_roles TYPE TABLE OF ty_tcode_role, ls_tcode_role TYPE ty_tcode_role. SELECT DISTINCT agr_name INTO TABLE lt_tcode_roles FROM agr_tcodes UP TO pv_max ROWS WHERE tcode = lv_tcode_upper. DATA: lv_count TYPE i. lv_count = lines( lt_tcode_roles ). " Build results JSON with descriptions DATA: lv_results_json TYPE string, lv_desc TYPE string, lv_desc_safe TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_tcode_roles INTO ls_tcode_role. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. CLEAR lv_desc. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = ls_tcode_role-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_tcode_role-agr_name }", "description": "{ lv_desc_safe }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } roles containing tcode { lv_tcode_upper }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "TCODE", "tcode": "{ lv_tcode_upper }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form SEARCH_BY_AUTH_OBJECT *&---------------------------------------------------------------------* FORM search_by_auth_object USING pv_auth_object TYPE string pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. IF pv_auth_object IS INITIAL. ls_message-type = 'E'. ls_message-message = 'authObject parameter is required for AUTH_OBJECT search'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing authObject for AUTH_OBJECT search"{ '}' }|. RETURN. ENDIF. " Query AGR_1251 for this auth object TYPES: BEGIN OF ty_auth_role, agr_name TYPE agr_name, END OF ty_auth_role. DATA: lt_auth_roles TYPE TABLE OF ty_auth_role, ls_auth_role TYPE ty_auth_role. SELECT DISTINCT agr_name INTO TABLE lt_auth_roles FROM agr_1251 UP TO pv_max ROWS WHERE object = pv_auth_object AND deleted = ' '. DATA: lv_count TYPE i. lv_count = lines( lt_auth_roles ). " Build results JSON DATA: lv_results_json TYPE string, lv_desc TYPE string, lv_desc_safe TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_auth_roles INTO ls_auth_role. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. CLEAR lv_desc. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = ls_auth_role-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_auth_role-agr_name }", "description": "{ lv_desc_safe }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } roles with auth object { pv_auth_object }|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "AUTH_OBJECT", "auth_object": "{ pv_auth_object }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form SEARCH_COMPOSITE *&---------------------------------------------------------------------* FORM search_composite USING pv_pattern TYPE string pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Convert wildcard and uppercase (role names are always uppercase) DATA: lv_pattern TYPE string. lv_pattern = pv_pattern. TRANSLATE lv_pattern TO UPPER CASE. IF lv_pattern IS INITIAL. lv_pattern = '%'. ELSE. REPLACE ALL OCCURRENCES OF '*' IN lv_pattern WITH '%'. ENDIF. " Find composite roles = roles that have children in AGR_AGRS TYPES: BEGIN OF ty_composite, agr_name TYPE agr_name, END OF ty_composite. DATA: lt_composites TYPE TABLE OF ty_composite, ls_composite TYPE ty_composite. SELECT DISTINCT agr_name INTO TABLE lt_composites FROM agr_agrs UP TO pv_max ROWS WHERE agr_name LIKE lv_pattern. DATA: lv_count TYPE i. lv_count = lines( lt_composites ). " Build results with child roles DATA: lv_results_json TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_composites INTO ls_composite. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. " Get description DATA: lv_desc TYPE string, lv_desc_safe TYPE string. CLEAR lv_desc. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = ls_composite-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_desc. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. " Get child roles DATA: lt_children TYPE TABLE OF agr_agrs, ls_child TYPE agr_agrs, lv_children_json TYPE string. CLEAR lt_children. SELECT * FROM agr_agrs INTO TABLE lt_children WHERE agr_name = ls_composite-agr_name. lv_children_json = '['. DATA: lv_cidx TYPE i. lv_cidx = 0. LOOP AT lt_children INTO ls_child. lv_cidx = lv_cidx + 1. IF lv_cidx > 1. lv_children_json = lv_children_json && ','. ENDIF. lv_children_json = lv_children_json && |"{ ls_child-child_agr }"|. ENDLOOP. lv_children_json = lv_children_json && ']'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_composite-agr_name }", "description": "{ lv_desc_safe }", | && |"child_roles": { lv_children_json }, "child_count": { lines( lt_children ) }{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } composite roles|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "COMPOSITE", "pattern": "{ pv_pattern }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&---------------------------------------------------------------------* *& Form SEARCH_BY_MENU *&---------------------------------------------------------------------* *& Search AGR_HIER for roles containing specific menu entries *& (BSP apps, Fiori catalogs, Fiori groups, OData services, etc.) *& searchPattern can be: entry name text, or a type filter like *& BSP_APPLICATION, CAT_PROVIDER, GROUP_PROVIDER, SERVICE *& Wildcards (*) are supported in searchPattern. *&---------------------------------------------------------------------* FORM search_by_menu USING pv_pattern TYPE string pv_max TYPE i CHANGING pv_result_json TYPE string ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. IF pv_pattern IS INITIAL. ls_message-type = 'E'. ls_message-message = 'searchPattern is required for MENU search (e.g., CAT_PROVIDER, BSP_APPLICATION, SERVICE, or a name text with wildcards)'. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": false, "error": "Missing searchPattern for MENU search"{ '}' }|. RETURN. ENDIF. " Convert wildcard DATA: lv_pattern TYPE string. lv_pattern = pv_pattern. REPLACE ALL OCCURRENCES OF '*' IN lv_pattern WITH '%'. " Determine search strategy: " If pattern is a known REPORT type (BSP_APPLICATION, CAT_PROVIDER, GROUP_PROVIDER, SERVICE), " search AGR_HIER.REPORT directly. Otherwise search AGR_HIERT.TEXT for matching names. DATA: lv_is_type_filter TYPE abap_bool. CASE pv_pattern. WHEN 'BSP_APPLICATION' OR 'CAT_PROVIDER' OR 'GROUP_PROVIDER' OR 'SERVICE'. lv_is_type_filter = abap_true. WHEN OTHERS. lv_is_type_filter = abap_false. ENDCASE. " Result structure TYPES: BEGIN OF ty_menu_result, agr_name TYPE agr_name, object_id TYPE agr_hier-object_id, report TYPE agr_hier-report, END OF ty_menu_result. DATA: lt_results TYPE TABLE OF ty_menu_result, ls_result_entry TYPE ty_menu_result. IF lv_is_type_filter = abap_true. " Search by REPORT type (e.g., find all roles with Fiori catalogs) SELECT agr_name object_id report INTO TABLE lt_results FROM agr_hier UP TO pv_max ROWS WHERE report = pv_pattern AND folder = space. ELSE. " Search by menu entry text in AGR_HIERT " First find matching object_ids from AGR_HIERT TYPES: BEGIN OF ty_text_match, agr_name TYPE agr_name, object_id TYPE agr_hiert-object_id, END OF ty_text_match. DATA: lt_text_matches TYPE TABLE OF ty_text_match, ls_text_match TYPE ty_text_match. SELECT agr_name object_id INTO TABLE lt_text_matches FROM agr_hiert UP TO pv_max ROWS WHERE text LIKE lv_pattern. " Now get the REPORT type from AGR_HIER for each match LOOP AT lt_text_matches INTO ls_text_match. DATA: lv_report TYPE agr_hier-report. CLEAR lv_report. SELECT SINGLE report FROM agr_hier INTO lv_report WHERE agr_name = ls_text_match-agr_name AND object_id = ls_text_match-object_id. IF sy-subrc = 0 AND lv_report IS NOT INITIAL. ls_result_entry-agr_name = ls_text_match-agr_name. ls_result_entry-object_id = ls_text_match-object_id. ls_result_entry-report = lv_report. APPEND ls_result_entry TO lt_results. ENDIF. ENDLOOP. ENDIF. DATA: lv_count TYPE i. lv_count = lines( lt_results ). " Build results JSON DATA: lv_results_json TYPE string. lv_results_json = '['. DATA: lv_idx TYPE i. LOOP AT lt_results INTO ls_result_entry. lv_idx = lv_idx + 1. IF lv_idx > 1. lv_results_json = lv_results_json && ','. ENDIF. " Map REPORT to friendly type DATA: lv_entry_type TYPE string. CASE ls_result_entry-report. WHEN 'BSP_APPLICATION'. lv_entry_type = 'BSP'. WHEN 'CAT_PROVIDER'. lv_entry_type = 'FIORI_CATALOG'. WHEN 'GROUP_PROVIDER'. lv_entry_type = 'FIORI_GROUP'. WHEN 'SERVICE'. lv_entry_type = 'ODATA_SERVICE'. WHEN OTHERS. lv_entry_type = ls_result_entry-report. ENDCASE. " Get description for the role DATA: lv_desc TYPE string, lv_desc_safe TYPE string. CLEAR lv_desc. SELECT SINGLE text FROM agr_texts INTO lv_desc WHERE agr_name = ls_result_entry-agr_name AND spras = sy-langu AND line = 0. lv_desc_safe = lv_desc. REPLACE ALL OCCURRENCES OF '\' IN lv_desc_safe WITH '\\'. REPLACE ALL OCCURRENCES OF '"' IN lv_desc_safe WITH '\"'. " Get menu entry text DATA: lv_menu_text TYPE string, lv_menu_text_safe TYPE string. CLEAR lv_menu_text. SELECT SINGLE text FROM agr_hiert INTO lv_menu_text WHERE agr_name = ls_result_entry-agr_name AND object_id = ls_result_entry-object_id AND spras = sy-langu. IF sy-subrc <> 0. SELECT SINGLE text FROM agr_hiert INTO lv_menu_text WHERE agr_name = ls_result_entry-agr_name AND object_id = ls_result_entry-object_id AND spras = 'E'. ENDIF. lv_menu_text_safe = lv_menu_text. REPLACE ALL OCCURRENCES OF '\' IN lv_menu_text_safe WITH '\\'. REPLACE ALL OCCURRENCES OF '"' IN lv_menu_text_safe WITH '\"'. lv_results_json = lv_results_json && |{ '{' }"role_name": "{ ls_result_entry-agr_name }", "role_description": "{ lv_desc_safe }", | && |"entry_type": "{ lv_entry_type }", "entry_name": "{ lv_menu_text_safe }"{ '}' }|. ENDLOOP. lv_results_json = lv_results_json && ']'. ls_message-type = 'S'. ls_message-message = |Found { lv_count } menu entries matching "{ pv_pattern }"|. APPEND ls_message TO ct_messages. pv_result_json = |{ '{' }"success": true, "search_type": "MENU", "pattern": "{ pv_pattern }", | && |"results": { lv_results_json }, "results_count": { lv_count }{ '}' }|. ENDFORM. *&=====================================================================* *& Utility FORMs *&=====================================================================* *&---------------------------------------------------------------------* *& Form ROLE_EXISTS *&---------------------------------------------------------------------* FORM role_exists USING pv_role_name TYPE agr_name CHANGING pv_exists TYPE abap_bool. DATA: lv_count TYPE i. SELECT COUNT(*) FROM agr_define INTO lv_count WHERE agr_name = pv_role_name. IF lv_count > 0. pv_exists = abap_true. ELSE. pv_exists = abap_false. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form ADD_TCODES_TO_ROLE *&---------------------------------------------------------------------* *& Parse comma-separated tcodes and insert into AGR_TCODES *&---------------------------------------------------------------------* FORM add_tcodes_to_role USING pv_role_name TYPE agr_name pv_tcodes TYPE string CHANGING pv_count TYPE i ct_messages TYPE bapiret2_t. DATA: lt_tcode_list TYPE string_table, lv_tcode TYPE string, ls_message TYPE bapiret2. " Read existing menu via PRGN_READ_ROLE_MENU DATA lt_nodes TYPE TABLE OF agr_hier. DATA lt_texts TYPE TABLE OF agr_hiert. DATA lt_tcodes TYPE TABLE OF agr_tcodes. DATA lt_urls TYPE TABLE OF agr_buffi. DATA lt_dtl_flags TYPE TABLE OF agr_dtl_flags. DATA lt_dtl_methods TYPE TABLE OF agr_dtl_bor_methods. DATA lt_dtl_params TYPE TABLE OF agr_dtl_bor_params. CALL FUNCTION 'PRGN_READ_ROLE_MENU' EXPORTING role = pv_role_name authorization_check = space TABLES t_nodes = lt_nodes t_dtl_flags = lt_dtl_flags t_dtl_bor_methods = lt_dtl_methods t_dtl_bor_params = lt_dtl_params t_texts = lt_texts t_tcodes = lt_tcodes t_urls = lt_urls EXCEPTIONS not_authorized = 1 OTHERS = 2. " Determine next object_id and sort_order from existing nodes DATA: lv_max_oid TYPE agr_hier-object_id, lv_max_sort TYPE agr_hier-sort_order, lv_parent_id TYPE agr_hier-object_id, lv_menu_level TYPE agr_hier-menu_level. LOOP AT lt_nodes INTO DATA(ls_node_tmp). IF ls_node_tmp-object_id > lv_max_oid. lv_max_oid = ls_node_tmp-object_id. ENDIF. IF ls_node_tmp-sort_order > lv_max_sort. lv_max_sort = ls_node_tmp-sort_order. ENDIF. ENDLOOP. " If menu is empty, create root folder structure IF lt_nodes IS INITIAL. DATA: ls_root TYPE agr_hier, ls_fold TYPE agr_hier. " Root node CLEAR ls_root. ls_root-mandt = sy-mandt. ls_root-agr_name = pv_role_name. ls_root-object_id = '00000001'. ls_root-folder = 'X'. ls_root-attributes = 'X'. ls_root-menu_level = '00'. ls_root-sort_order = '00000010'. CALL FUNCTION 'GUID_CREATE' IMPORTING ev_guid_32 = ls_root-sap_guid. APPEND ls_root TO lt_nodes. " Folder for tcodes CLEAR ls_fold. ls_fold-mandt = sy-mandt. ls_fold-agr_name = pv_role_name. ls_fold-object_id = '00000002'. ls_fold-parent_id = '00000001'. ls_fold-folder = 'X'. ls_fold-attributes = 'X'. ls_fold-menu_level = '01'. ls_fold-sort_order = '00000010'. CALL FUNCTION 'GUID_CREATE' IMPORTING ev_guid_32 = ls_fold-sap_guid. APPEND ls_fold TO lt_nodes. lv_max_oid = '00000002'. lv_max_sort = '00000010'. lv_parent_id = '00000002'. lv_menu_level = '02'. ELSE. " Find first non-root folder to use as parent READ TABLE lt_nodes INTO DATA(ls_first_fold) WITH KEY folder = 'X' menu_level = '01'. IF sy-subrc = 0. lv_parent_id = ls_first_fold-object_id. lv_menu_level = '02'. ELSE. " Use root as parent READ TABLE lt_nodes INTO DATA(ls_rt) WITH KEY folder = 'X' menu_level = '00'. IF sy-subrc = 0. lv_parent_id = ls_rt-object_id. lv_menu_level = '01'. ELSE. lv_parent_id = '00000001'. lv_menu_level = '01'. ENDIF. ENDIF. ENDIF. " Add new tcode nodes pv_count = 0. SPLIT pv_tcodes AT ',' INTO TABLE lt_tcode_list. LOOP AT lt_tcode_list INTO lv_tcode. CONDENSE lv_tcode. TRANSLATE lv_tcode TO UPPER CASE. CHECK lv_tcode IS NOT INITIAL. " Check if tcode already exists in menu READ TABLE lt_tcodes WITH KEY tcode = lv_tcode TRANSPORTING NO FIELDS. IF sy-subrc = 0. ls_message-type = 'W'. ls_message-message = |Tcode { lv_tcode } already in role|. APPEND ls_message TO ct_messages. CONTINUE. ENDIF. " Create AGR_HIER node DATA: ls_hier_new TYPE agr_hier. CLEAR ls_hier_new. lv_max_oid = lv_max_oid + 1. lv_max_sort = lv_max_sort + 10. ls_hier_new-mandt = sy-mandt. ls_hier_new-agr_name = pv_role_name. ls_hier_new-object_id = lv_max_oid. ls_hier_new-parent_id = lv_parent_id. ls_hier_new-report = lv_tcode. ls_hier_new-reporttype = 'TR'. ls_hier_new-attributes = 'X'. ls_hier_new-menu_level = lv_menu_level. ls_hier_new-sort_order = lv_max_sort. CALL FUNCTION 'GUID_CREATE' IMPORTING ev_guid_32 = ls_hier_new-sap_guid. APPEND ls_hier_new TO lt_nodes. " Create AGR_TCODES entry DATA: ls_agr_tcode TYPE agr_tcodes. CLEAR ls_agr_tcode. ls_agr_tcode-agr_name = pv_role_name. ls_agr_tcode-type = 'TN'. ls_agr_tcode-tcode = lv_tcode. ls_agr_tcode-direct = 'X'. APPEND ls_agr_tcode TO lt_tcodes. pv_count = pv_count + 1. ENDLOOP. " Save the complete menu using SAP standard FM IF pv_count > 0. DATA: lv_error_flag TYPE char01, lt_return TYPE TABLE OF bapiret2. CALL FUNCTION 'PRGN_SAVE_ROLE_MENU' EXPORTING activity_group = pv_role_name authority_check = space enqueue = 'X' IMPORTING error_flag = lv_error_flag TABLES nodes = lt_nodes texts = lt_texts urls = lt_urls tcodes = lt_tcodes return = lt_return EXCEPTIONS not_authorized = 1 activity_group_enqueued = 2 no_auth_for_tcodes = 3 OTHERS = 4. IF sy-subrc <> 0 OR lv_error_flag IS NOT INITIAL. " Append return messages LOOP AT lt_return INTO DATA(ls_ret). ls_message-type = ls_ret-type. ls_message-message = ls_ret-message. APPEND ls_message TO ct_messages. ENDLOOP. IF lv_error_flag IS NOT INITIAL. ls_message-type = 'W'. ls_message-message = |Menu save warning (flag={ lv_error_flag })|. APPEND ls_message TO ct_messages. ENDIF. ENDIF. ENDIF. ENDFORM. *&---------------------------------------------------------------------* *& Form COPY_ROLE_TABLES *&---------------------------------------------------------------------* *& Manual role copy via direct table operations (fallback) *&---------------------------------------------------------------------* FORM copy_role_tables USING pv_source TYPE agr_name pv_target TYPE agr_name CHANGING ct_messages TYPE bapiret2_t. DATA: ls_message TYPE bapiret2. " Copy AGR_DEFINE DATA: ls_agr_define TYPE agr_define. SELECT SINGLE * FROM agr_define INTO ls_agr_define WHERE agr_name = pv_source. IF sy-subrc = 0. ls_agr_define-agr_name = pv_target. ls_agr_define-create_dat = sy-datum. ls_agr_define-create_tim = sy-uzeit. ls_agr_define-create_usr = sy-uname. ls_agr_define-change_dat = sy-datum. ls_agr_define-change_tim = sy-uzeit. ls_agr_define-change_usr = sy-uname. INSERT agr_define FROM ls_agr_define. ENDIF. " Copy AGR_TEXTS DATA: lt_texts TYPE TABLE OF agr_texts, ls_text TYPE agr_texts. SELECT * FROM agr_texts INTO TABLE lt_texts WHERE agr_name = pv_source. LOOP AT lt_texts INTO ls_text. ls_text-agr_name = pv_target. INSERT agr_texts FROM ls_text. ENDLOOP. " Copy AGR_TCODES DATA: lt_tcodes TYPE TABLE OF agr_tcodes, ls_tcode TYPE agr_tcodes. SELECT * FROM agr_tcodes INTO TABLE lt_tcodes WHERE agr_name = pv_source. LOOP AT lt_tcodes INTO ls_tcode. ls_tcode-agr_name = pv_target. INSERT agr_tcodes FROM ls_tcode. ENDLOOP. " Copy AGR_1251 (authorization data) DATA: lt_auth TYPE TABLE OF agr_1251, ls_auth TYPE agr_1251. SELECT * FROM agr_1251 INTO TABLE lt_auth WHERE agr_name = pv_source. LOOP AT lt_auth INTO ls_auth. ls_auth-agr_name = pv_target. INSERT agr_1251 FROM ls_auth. ENDLOOP. " Copy AGR_AGRS (composite children) DATA: lt_children TYPE TABLE OF agr_agrs, ls_child TYPE agr_agrs. SELECT * FROM agr_agrs INTO TABLE lt_children WHERE agr_name = pv_source. LOOP AT lt_children INTO ls_child. ls_child-agr_name = pv_target. INSERT agr_agrs FROM ls_child. ENDLOOP. ls_message-type = 'I'. ls_message-message = |Role copied via table operations (fallback)|. APPEND ls_message TO ct_messages. ENDFORM. *&---------------------------------------------------------------------* *& Form DELETE_ROLE_TABLES *&---------------------------------------------------------------------* *& Delete role from all AGR tables (fallback) *&---------------------------------------------------------------------* FORM delete_role_tables USING pv_role_name TYPE agr_name. DELETE FROM agr_define WHERE agr_name = pv_role_name. DELETE FROM agr_texts WHERE agr_name = pv_role_name. DELETE FROM agr_tcodes WHERE agr_name = pv_role_name. DELETE FROM agr_1251 WHERE agr_name = pv_role_name. DELETE FROM agr_users WHERE agr_name = pv_role_name. DELETE FROM agr_agrs WHERE agr_name = pv_role_name. DELETE FROM agr_prof WHERE agr_name = pv_role_name. ENDFORM.

role_management

Related Tools

user_management

auth_object_management