Package net.pricefx.domain

Class User

Object
DomainObject
PersistedObject
PartitionedObject
User
All Implemented Interfaces:
RenameSoftDeletedInNameConflict
@Entity public class User extends PartitionedObject implements RenameSoftDeletedInNameConflict
A User (type code U) is a Pricefx login account: its identity fields (login name, name, email), authentication settings (password, Two-Factor Authentication, Single Sign-On), and the Roles, UserGroups and BusinessRoles that govern what it can access.

The current user is available in a logic via api.user(), which returns the whole User object, or api.user(fieldName), which returns a single value. Supported field names are loginName, firstName, lastName, email, additionalInfo1 to additionalInfo4, and currentLocale (the language of the current request locale, not a stored field). Field names are case-insensitive. An unknown field name returns null. Both calls return null when there is no current user.

Example: 


 def email = api.user()?.email
 def loginName = api.user("loginName")

  • Nested Class Summary

    Nested classes/interfaces inherited from class PersistedObject

    PersistedObject.BatchDelete, PersistedObject.BulkloadFilterCheckCallback, PersistedObject.ComputedFieldMapping, PersistedObject.ComputedFields, PersistedObject.HardDelete, PersistedObject.ImportManagerEnabled, PersistedObject.PersistedObjectMeta, PersistedObject.VirtualField, PersistedObject.VirtualFieldMapping, PersistedObject.VirtualFields, PersistedObject.VirtualSearchFields, PersistedObject.VirtualSortFields

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    CACHE_REGION_NAME
     
    static final String
    FIELD_ACTIVATED
     
    static final String
    FIELD_EMAIL
     
    static final String
    FIELD_LOGINNAME
     
    static final String
    FIELD_PASSWORD_HASH
     
    static final String
    FIELD_PASSWORD_SALT
     
    protected static final Supplier<String>
    NEW_PASSWORD_HASH
     
    protected static final Supplier<String>
    NEW_PASSWORD_NOSESSION_HASH
     
    static final String
    SYSTEM_SUPPORT_USER_NAME
     
    static final String
    SYSTEM_USER_NAME
     
    protected static final String
    UNKNOWN_HASH
     

    Fields inherited from class PartitionedObject

    FIELD_PARTITION, FIELD_PARTITIONID, PARTITION_FILTER_NAME, PARTITION_FILTER_PARAM

    Fields inherited from class PersistedObject

    FIELD_CREATEDATE, FIELD_CREATEDBY, FIELD_DELETEDATE, FIELD_DELETEDBY, FIELD_ID, FIELD_ISDELETED, FIELD_LASTUPDATEBY, FIELD_LASTUPDATEDATE, FIELD_VERSION

  • Constructor Summary

    Constructors
    Constructor
    Description
    User()
    Creates a User that is activated and has workflow emailing enabled.
    User(Partition partition)
    Creates a User in the given partition that is activated and has workflow emailing enabled.
    User(Partition partition, String loginName, String firstName, String lastName, String clearTextPassword)
    Creates a User in the given partition that is activated and has workflow emailing enabled.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    addRelevantFilter(Search search)
    Adds this User's access restriction filter to search, if one applies.
    void
    auditOperation(AuditOperation operation, User byUser, CommandContext context, PersistedObjectService objService, String details)
    Records a security-relevant operation performed on this User (for example, an edit) as a SecurityAuditTrail entry.
    boolean
    canEdit(User user, ValidationVisitor validationVisitor, PersistedObjectService objService, Map<String,Object> fieldsToEdit)
    Returns whether user may edit this User, in addition to the superclass's own check: if this User is platform-managed, only a system user may edit it.
    boolean
    checkPassword(String clearTextPassword)
    Returns whether the given clear-text password matches this User's stored password hash, using getHashMethod() and the stored (or, if not set, the login-name-based fallback) salt.
    @NotNull String
    computeFullName()
    Returns getFirstName() and getLastName() joined with a space, skipping either one if it is null or empty.
    static void
    createOrUpdateSupportUser(PersistedObjectService objService)
    Internal server method, not for use in logics: creates the built-in pricefx-support user, or updates it if it exists.
    static void
    createRootUser(PersistedObjectService objService)
    Internal server method, not for use in logics: creates the built-in root system user.
    static void
    createSupportUser(PersistedObjectService objService)
    Internal server method, not for use in logics: creates the built-in pricefx-support user.
    void
    emitUserUpdateActionAfterCommit()
    Internal server method, not for use in logics: refreshes the cached user data of this User's partition on all nodes after the current transaction commits.
    BigDecimal
    getAdditionalInfo1()
    Returns the first of four general-purpose extension fields on this User, with no built-in meaning.
    BigDecimal
    getAdditionalInfo2()
    Returns the second of four general-purpose extension fields on this User, with no built-in meaning.
    String
    getAdditionalInfo3()
    Returns the third of four general-purpose extension fields on this User, with no built-in meaning.
    String
    getAdditionalInfo4()
    Returns the fourth of four general-purpose extension fields on this User, with no built-in meaning.
    Set<UserGroup>
    getAllGroups()
    Returns every UserGroup this User belongs to, whether directly assigned (see getGroups()) or granted via a BusinessRole (see getBusinessRoles()).
    Set<String>
    getAllRoleNames()
    Returns the unique names of getAllRoles(), that is, every role this User has, whether directly assigned or granted via a BusinessRole.
    Set<Role>
    getAllRoles()
    Returns every Role this User has, whether directly assigned (see getRoles()) or granted via a BusinessRole (see getBusinessRoles()).
    Set<BusinessRole>
    getBusinessRoles()
    Returns the BusinessRoles assigned to this User.
    Filter
    getCustomerFilter()
    Returns this User's Customer access restriction resolved into a Filter, built from getCustomerFilterCriteria(), or null if no restriction is set.
    String
    getCustomerFilterCriteria()
    Returns this User's Customer access restriction, as a JSON-encoded advanced filter criteria.
    String
    getDefaultUserGroupEdit()
    Returns the UserGroup unique name that the server copies onto the edit-access user-group restriction of a new object when this User creates it, but only if the defaultGroups application setting enables this for the object's type.
    String
    getDefaultUserGroupViewDetails()
    Returns the UserGroup unique name that the server copies onto the view-details-access user-group restriction of a new object when this User creates it, but only if the defaultGroups application setting enables this for the object's type.
    String
    getEmail()
    Returns this User's email address.
    String
    getEmailLocale()
    Returns the locale used for notifications to this User, such as emails and notification titles.
    Map<String,Object>
    getExtendedData()
    Returns server/environment metadata attached to this User for an "extended" login response (for example, cluster name, feature-flag context, max form content size).
    String
    getFirstName()
    Returns this User's first name.
    String
    getFQLoginName()
    Returns this User's login name qualified by its partition's unique name, formatted as "<partition>/<loginName>".
    Set<UserGroup>
    getGroups()
    Returns the UserGroups directly assigned to this User, not including groups granted via a BusinessRole.
    String
    getHashMethod()
    Returns the algorithm used to hash this User's password, or "SHA-1" if none is recorded (accounts created before the hash method was tracked).
    LocalDateTime
    getLastLogin()
    Returns the date/time this User last logged in, or null if never.
    String
    getLastName()
    Returns this User's last name.
    LocalDateTime
    getLastTermsOfUseAgreedDate()
    Returns the date/time this User last agreed to the Terms of Use.
    String
    getLastTermsOfUseVersionAgreed()
    Returns the version identifier of the Terms of Use this User last agreed to.
    String
    getLoginName()
    Returns this User's login name.
    Boolean
    getNoSession()
    Returns whether this is a no-session (API-only) account: when true, a successful Basic Authentication does not create a browser session (no session cookie or CSRF token is issued), and setPassword(String) hashes the password with the separately configurable no-session hash method.
    LocalDateTime
    getPasswordExpiry()
    Returns the date/time after which this User's password is expired and must be changed, or null if this User has SSO-only login enabled (an SSO-only account never has a password expiry) or no expiry is set.
    String
    getPasswordHash()
    Returns this User's stored password hash.
    String
    getPasswordSalt()
    Returns the salt used to hash this User's password.
    Set<Permission>
    getPermissions()
    Returns every permission granted by this User's roles (direct or granted via a BusinessRole).
    Boolean
    getPlatformManaged()
    Returns whether this User's account is managed by Platform Manager rather than by a partition administrator.
    String
    getProductFilterCriteria()
    Returns this User's Product access restriction, as a JSON-encoded advanced filter criteria.
    Boolean
    getReceiveAdminEmail()
    Returns whether this User is a partition administrator contact.
    Boolean
    getRequireTFA()
    Returns whether Two-Factor Authentication (TFA) is required for this User specifically.
    List<String>
    getRoleNames()
    Returns the unique names of the Roles directly assigned to this User (not including roles granted via a BusinessRole).
    Set<Role>
    getRoles()
    Returns the Roles directly assigned to this User, not including roles granted via a BusinessRole.
    Filter
    getSellerFilter()
    Returns this User's Seller access restriction resolved into a Filter, built from getSellerFilterCriteria(), or null if no restriction is set.
    String
    getSellerFilterCriteria()
    Returns this User's Seller access restriction, as a JSON-encoded advanced filter criteria.
    String[]
    getSignificantFields()
    Returns the fields that form this User's business key, used to match records on import and update: loginName only.
    Filter
    getSkuFilter()
    Returns this User's Product access restriction resolved into a Filter, built from getProductFilterCriteria(), or null if no restriction is set.
    Boolean
    getSsoOnly()
    Returns whether this User may only log in via Single Sign-On (SSO), not with a password.
    String
    getWizardDashboardName()
    Returns the unique name of the Wizard Dashboard assigned to this User.
    boolean
    hasModuleAccess(ApplicationModule module)
    Returns whether any of this User's roles (direct or granted via a BusinessRole) belongs to the given application module.
    static void
    invalidateUsersOnAllNodes(String partitionName)
    Internal server method, not for use in logics: refreshes the cached user data of the given partition on all nodes.
    Boolean
    isActivated()
    Returns whether this User's account is active.
    boolean
    isAudited()
    Returns true, so the server records a security audit entry when a User is created, updated or deleted through the standard data commands (see auditOperation(AuditOperation, User, CommandContext, PersistedObjectService, String)).
    boolean
    isFirstLogin()
    Returns whether setLastLogin(LocalDateTime) has recorded this User's first-ever login on this object (that is, getLastLogin() transitioned from null).
    boolean
    isInGroup(UserGroup userGroup)
    Returns whether this User belongs to the given UserGroup, whether directly or via a BusinessRole.
    boolean
    isSystemUser()
    Returns whether this is the built-in root system user of the SYSTEM partition.
    Boolean
    isWorkflowEmailingActivated()
    Returns whether this User receives workflow-related email notifications.
    String
    lastUpdateDate()
    Returns getLastLogin() formatted as a display string, under the JSON property name lastLogin.
    void
    onSavedOrUpdated(PersistedObjectService objService)
    Runs the superclass's own post-save logic, then calls emitUserUpdateActionAfterCommit() to invalidate, on all nodes, the cached users, user groups, roles and business roles of this User's partition once the transaction commits.
    void
    onSaveOrUpdate(PersistedObjectService objService)
    Runs the superclass's own save/update logic, then clears getPasswordExpiry() if this User is SSO-only.
    String
    passwordExpiry()
    Returns the stored password expiry formatted as a display string, under the JSON property name passwordExpiry.
    void
    renameSoftDeleted(PersistedObjectService objService)
    Renames this soft-deleted User, via objService, so its getLoginName() no longer conflicts with another User's login name.
    void
    setActivated(Boolean activated)
    Sets whether this User's account is active.
    void
    setAdditionalInfo1(BigDecimal additionalInfo1)
    Sets the first of four general-purpose extension fields on this User.
    void
    setAdditionalInfo2(BigDecimal additionalInfo2)
    Sets the second of four general-purpose extension fields on this User.
    void
    setAdditionalInfo3(String additionalInfo3)
    Sets the third of four general-purpose extension fields on this User.
    void
    setAdditionalInfo4(String additionalInfo4)
    Sets the fourth of four general-purpose extension fields on this User.
    void
    setCustomerFilterCriteria(String customerFilterCriteria)
    Sets this User's Customer access restriction, as a JSON-encoded advanced filter criteria.
    void
    setDefaultUserGroupEdit(String defaultUserGroup)
    Sets the UserGroup unique name that the server copies onto the edit-access user-group restriction of a new object when this User creates it, if the defaultGroups application setting enables this for the object's type.
    void
    setDefaultUserGroupViewDetails(String defaultUserViewDetails)
    Sets the UserGroup unique name that the server copies onto the view-details-access user-group restriction of a new object when this User creates it, if the defaultGroups application setting enables this for the object's type.
    void
    setEmail(String email)
    Sets this User's email address, lowercased.
    void
    setEmailLocale(String emailLocale)
    Sets the locale used for notifications to this User.
    void
    setExtendedData(Map<String,Object> extendedData)
    Sets the server/environment metadata attached to this User for an "extended" login response.
    void
    setFirstName(String firstName)
    Sets this User's first name.
    void
    setLastLogin(LocalDateTime lastLogin)
    Sets the date/time this User last logged in.
    void
    setLastName(String lastName)
    Sets this User's last name.
    void
    setLastTermsOfUseAgreedDate(LocalDateTime lastTermsOfUseAgreedDate)
    Sets the date/time this User last agreed to the Terms of Use.
    void
    setLastTermsOfUseVersionAgreed(String lastTermsOfUseVersionAgreed)
    Sets the version identifier of the Terms of Use this User last agreed to.
    void
    setLoginName(String name)
    Sets this User's login name, lowercased.
    void
    setNoSession(Boolean noSession)
    Sets whether this is a no-session (API-only) account.
    void
    setPassword(String clearTextPassword)
    Sets this User's password from clear text: generates a new random salt, hashes the password with it using the configured hash method, and records the salt and hash method used.
    void
    setPasswordExpiry(LocalDateTime passwordExpiry)
    Sets the date/time after which this User's password is expired and must be changed.
    void
    setPasswordHash(String passwordHash)
    Sets this User's stored password hash directly.
    void
    setPasswordSalt(String passwordSalt)
    Sets the salt used to hash this User's password directly.
    void
    setPlatformManaged(Boolean platformManaged)
    Sets whether this User's account is managed by Platform Manager rather than by a partition administrator.
    void
    setProductFilterCriteria(String productFilterExpression)
    Sets this User's Product access restriction, as a JSON-encoded advanced filter criteria.
    void
    setReceiveAdminEmail(Boolean receiveAdminEmail)
    Sets whether this User is a partition administrator contact.
    void
    setRequireTFA(Boolean requireTFA)
    Sets whether Two-Factor Authentication (TFA) is required for this User specifically.
    void
    setSellerFilterCriteria(String sellerFilterCriteria)
    Sets this User's Seller access restriction, as a JSON-encoded advanced filter criteria.
    void
    setSsoOnly(Boolean ssoOnly)
    Sets whether this User may only log in via Single Sign-On (SSO), not with a password.
    void
    setUniqueLoginName(String name)
    Sets this User's login name to "<name>_<currentTimeMillis>", lowercased, so that it does not collide with an existing login name.
    void
    setWizardDashboardName(String wizardDashboardName)
    Sets the unique name of the Wizard Dashboard assigned to this User.
    void
    setWorkflowEmailingActivated(Boolean workflowEmailingActivated)
    Sets whether this User receives workflow-related email notifications.
    static void
    updateSupportUser(PersistedObjectService objService, User supportUser)
    Internal server method, not for use in logics: sets SUPPORT as the only directly assigned role of the built-in pricefx-support user, activates it, and saves it.
    boolean
    validate(ValidationVisitor validationVisitor, PersistedObjectService objService)
    Validates that getAdditionalInfo3(), getAdditionalInfo4(), getLoginName(), getLastName(), getFirstName() and getEmail() are all at most 255 characters, in addition to the superclass's own validation, recording a validation error for the first field found too long.

    Methods inherited from class PartitionedObject

    addUniqueConstraint, getLoginNameByUserId, getPartition, setPartition, toString

    Methods inherited from class PersistedObject

    bumpVersion, canAdd, canDelete, canEdit, canRead, canReadElements, createDate, entityIsHardDeleted, entityIsMassDeletable, entityIsSafeInserted, entityIsSafeInserted, getBulkloadMap, getBusinessKey, getCreateDate, getCreatedBy, getDbColumnNameForField, getDeleteDate, getDeletedBy, getId, getLastUpdateBy, getLastUpdateDate, getSensitiveFields, getTypeCode, getTypedId, getVersion, getVirtualSearchFieldMappings, getVirtualSortFieldMappings, isDeleted, isHardDeleted, isVirtualSearchField, notifyOnBusinessKeyChange, onBusinessKeyChange, onDelete, onRefreshed, setCreateDate, setCreateDateShouldBeIgnored, setCreateDateTime, setCreatedBy, setDeleted, setDeleteDate, setDeletedBy, setId, setLastUpdateBy, setLastUpdateDate, setLastUpdateDateTime, setTypedId, setVersion, userGroupEditBulkloadFilter, userGroupEditBulkloadFilter

    Methods inherited from class DomainObject

    deepCopy, getNewMidnightDate, getNewMidnightDateTime, isMidnight, isMidnight, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonDeserialize, jsonSerialize, jsonSerialize, jsonSerialize, jsonSerialize, jsonSerialize, jsonSerialize, jsonSerializedSizeOK, jsonSerializeToBytes, jsonSerializeToBytes, setToDayEnd, setToDayEnd, setToMidnight, setToMidnight, setToMidnightAsLocalDateTime, toPropertyMap, truncatedToString

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Field Details

  • Constructor Details

    • User

      public User()
      Creates a User that is activated and has workflow emailing enabled.

    • User

      public User(Partition partition)
      Creates a User in the given partition that is activated and has workflow emailing enabled.
      Parameters:
      partition - the partition this User belongs to

    • User

      public User(Partition partition, String loginName, String firstName, String lastName, String clearTextPassword)
      Creates a User in the given partition that is activated and has workflow emailing enabled. The login name is lowercased, and the clear-text password is hashed through setPassword(String).
      Parameters:
      partition - the partition this User belongs to
      loginName - the login name
      firstName - the first name
      lastName - the last name
      clearTextPassword - the password in clear text

  • Method Details

    • getSignificantFields

      public String[] getSignificantFields()
      Returns the fields that form this User's business key, used to match records on import and update: loginName only.
      Overrides:
      getSignificantFields in class PersistedObject
      Returns:
      {"loginName"}

    • getFirstName

      public String getFirstName()
      Returns this User's first name.
      Returns:
      the first name

    • setFirstName

      public void setFirstName(String firstName)
      Sets this User's first name.
      Parameters:
      firstName - the first name

    • getLastName

      public String getLastName()
      Returns this User's last name.
      Returns:
      the last name

    • setLastName

      public void setLastName(String lastName)
      Sets this User's last name.
      Parameters:
      lastName - the last name

    • computeFullName

      @NotNull public @NotNull String computeFullName()
      Returns getFirstName() and getLastName() joined with a space, skipping either one if it is null or empty.
      Returns:
      the full name

    • getEmail

      public String getEmail()
      Returns this User's email address.
      Returns:
      the email address (lowercased when set via setEmail(String))

    • setEmail

      public void setEmail(String email)
      Sets this User's email address, lowercased.
      Parameters:
      email - the email address

    • getDefaultUserGroupEdit

      public String getDefaultUserGroupEdit()
      Returns the UserGroup unique name that the server copies onto the edit-access user-group restriction of a new object when this User creates it, but only if the defaultGroups application setting enables this for the object's type. Some types, such as Price List and Company Parameters, are disabled unless the setting enables them.
      Returns:
      the default edit-access user group's unique name

    • setDefaultUserGroupEdit

      public void setDefaultUserGroupEdit(String defaultUserGroup)
      Sets the UserGroup unique name that the server copies onto the edit-access user-group restriction of a new object when this User creates it, if the defaultGroups application setting enables this for the object's type.
      Parameters:
      defaultUserGroup - the default edit-access user group's unique name

    • getDefaultUserGroupViewDetails

      public String getDefaultUserGroupViewDetails()
      Returns the UserGroup unique name that the server copies onto the view-details-access user-group restriction of a new object when this User creates it, but only if the defaultGroups application setting enables this for the object's type. Some types, such as Price List and Company Parameters, are disabled unless the setting enables them.
      Returns:
      the default view-details-access user group's unique name

    • setDefaultUserGroupViewDetails

      public void setDefaultUserGroupViewDetails(String defaultUserViewDetails)
      Sets the UserGroup unique name that the server copies onto the view-details-access user-group restriction of a new object when this User creates it, if the defaultGroups application setting enables this for the object's type.
      Parameters:
      defaultUserViewDetails - the default view-details-access user group's unique name

    • getNoSession

      public Boolean getNoSession()
      Returns whether this is a no-session (API-only) account: when true, a successful Basic Authentication does not create a browser session (no session cookie or CSRF token is issued), and setPassword(String) hashes the password with the separately configurable no-session hash method.
      Returns:
      true if this is a no-session account; false if null or not set

    • getRequireTFA

      public Boolean getRequireTFA()
      Returns whether Two-Factor Authentication (TFA) is required for this User specifically. TFA can also be enforced for all users by a partition-level setting, so false does not mean this User can log in without TFA.
      Returns:
      true if TFA is required for this User; false if null or not set

    • setRequireTFA

      public void setRequireTFA(Boolean requireTFA)
      Sets whether Two-Factor Authentication (TFA) is required for this User specifically. A partition-level setting can also enforce TFA for all users.
      Parameters:
      requireTFA - true to require TFA

    • getSsoOnly

      public Boolean getSsoOnly()
      Returns whether this User may only log in via Single Sign-On (SSO), not with a password. When true, getPasswordExpiry() always returns null.
      Returns:
      true if SSO-only; false if null or not set

    • setSsoOnly

      public void setSsoOnly(Boolean ssoOnly)
      Sets whether this User may only log in via Single Sign-On (SSO), not with a password.
      Parameters:
      ssoOnly - true to restrict this User to SSO login

    • getReceiveAdminEmail

      public Boolean getReceiveAdminEmail()
      Returns whether this User is a partition administrator contact. When true, this User receives the emails sent through Partition.sendAdminEmail, such as failed-job alerts and SAML certificate expiry warnings, and this User's email address is listed among the partition's contact emails in the partition registry. In both cases, only activated, non-deleted users with an email address are included.
      Returns:
      true if admin emails are received; false if null or not set

    • setReceiveAdminEmail

      public void setReceiveAdminEmail(Boolean receiveAdminEmail)
      Sets whether this User is a partition administrator contact.
      Parameters:
      receiveAdminEmail - true to receive admin emails
      See Also:

    • setNoSession

      public void setNoSession(Boolean noSession)
      Sets whether this is a no-session (API-only) account.
      Parameters:
      noSession - true to make this a no-session account
      See Also:

    • getPlatformManaged

      public Boolean getPlatformManaged()
      Returns whether this User's account is managed by Platform Manager rather than by a partition administrator. Only the system user can edit a platform-managed account (see canEdit(User, ValidationVisitor, PersistedObjectService, Map)) or change its password.
      Returns:
      true if platform-managed; false if null or not set

    • setPlatformManaged

      public void setPlatformManaged(Boolean platformManaged)
      Sets whether this User's account is managed by Platform Manager rather than by a partition administrator.
      Parameters:
      platformManaged - true to mark this account as platform-managed

    • passwordExpiry

      public String passwordExpiry()
      Returns the stored password expiry formatted as a display string, under the JSON property name passwordExpiry. This formats the stored value directly, not getPasswordExpiry(), so the SSO-only rule does not apply: for an SSO-only User whose stored expiry has not yet been cleared on save, this returns a date while getPasswordExpiry() returns null.
      Returns:
      the formatted password expiry date/time, or null if there is none

    • getPasswordExpiry

      public LocalDateTime getPasswordExpiry()
      Returns the date/time after which this User's password is expired and must be changed, or null if this User has SSO-only login enabled (an SSO-only account never has a password expiry) or no expiry is set.
      Returns:
      the password expiry date/time, or null

    • setPasswordExpiry

      public void setPasswordExpiry(LocalDateTime passwordExpiry)
      Sets the date/time after which this User's password is expired and must be changed.
      Parameters:
      passwordExpiry - the password expiry date/time

    • getPasswordHash

      public String getPasswordHash()
      Returns this User's stored password hash.
      Returns:
      the password hash

    • setPasswordHash

      public void setPasswordHash(String passwordHash)
      Sets this User's stored password hash directly. Prefer setPassword(String), which also generates a new salt and records the hash method used.
      Parameters:
      passwordHash - the password hash

    • getPasswordSalt

      public String getPasswordSalt()
      Returns the salt used to hash this User's password.
      Returns:
      the password salt

    • setPasswordSalt

      public void setPasswordSalt(String passwordSalt)
      Sets the salt used to hash this User's password directly. Prefer setPassword(String), which generates a new random salt itself.
      Parameters:
      passwordSalt - the password salt

    • isSystemUser

      public boolean isSystemUser()
      Returns whether this is the built-in root system user of the SYSTEM partition.
      Returns:
      true if this is the system user

    • getExtendedData

      public Map<String,Object> getExtendedData()
      Returns server/environment metadata attached to this User for an "extended" login response (for example, cluster name, feature-flag context, max form content size). This is not persisted and is only populated by the login command when requested; it is not part of the stored User record.
      Returns:
      the extended login metadata, or null if not populated

    • setExtendedData

      public void setExtendedData(Map<String,Object> extendedData)
      Sets the server/environment metadata attached to this User for an "extended" login response.
      Parameters:
      extendedData - the extended login metadata

    • getWizardDashboardName

      public String getWizardDashboardName()
      Returns the unique name of the Wizard Dashboard assigned to this User.
      Returns:
      the wizard dashboard's unique name

    • setWizardDashboardName

      public void setWizardDashboardName(String wizardDashboardName)
      Sets the unique name of the Wizard Dashboard assigned to this User.
      Parameters:
      wizardDashboardName - the wizard dashboard's unique name

    • setPassword

      public void setPassword(String clearTextPassword)
      Sets this User's password from clear text: generates a new random salt, hashes the password with it using the configured hash method, and records the salt and hash method used. No-session accounts (see getNoSession()) use the separately configurable no-session hash method. Also schedules a cluster-wide user cache invalidation after the transaction commits (see emitUserUpdateActionAfterCommit()). Does not save the User. A null password is a no-op.
      Parameters:
      clearTextPassword - the new clear-text password; null is ignored

    • checkPassword

      public boolean checkPassword(String clearTextPassword)
      Returns whether the given clear-text password matches this User's stored password hash, using getHashMethod() and the stored (or, if not set, the login-name-based fallback) salt.
      Parameters:
      clearTextPassword - the clear-text password to check
      Returns:
      true if it matches the stored password hash

    • getHashMethod

      public String getHashMethod()
      Returns the algorithm used to hash this User's password, or "SHA-1" if none is recorded (accounts created before the hash method was tracked).
      Returns:
      the password hash method

    • getRoles

      public Set<Role> getRoles()
      Returns the Roles directly assigned to this User, not including roles granted via a BusinessRole. See getAllRoles() for the combined set.
      Returns:
      the directly assigned roles, or an empty set if none were assigned

    • getRoleNames

      public List<String> getRoleNames()
      Returns the unique names of the Roles directly assigned to this User (not including roles granted via a BusinessRole).

      Do not use this in code to check a User's roles: it exists only for JSON serialization. Use AuthUtil.userHasRole(Role.WF_ADMIN, currentUser)-style checks instead.

      Returns:
      the directly assigned roles' unique names

    • getAllRoleNames

      public Set<String> getAllRoleNames()
      Returns the unique names of getAllRoles(), that is, every role this User has, whether directly assigned or granted via a BusinessRole.

      Do not use this in code to check a User's roles: it exists only for JSON serialization. Use AuthUtil.userHasRole(Role.WF_ADMIN, currentUser)-style checks instead.

      Returns:
      all of this User's roles' unique names

    • getAllRoles

      public Set<Role> getAllRoles()
      Returns every Role this User has, whether directly assigned (see getRoles()) or granted via a BusinessRole (see getBusinessRoles()).
      Returns:
      all of this User's roles; never null, empty if none

    • getGroups

      public Set<UserGroup> getGroups()
      Returns the UserGroups directly assigned to this User, not including groups granted via a BusinessRole. See getAllGroups() for the combined set.
      Returns:
      the directly assigned user groups, or an empty set if none were assigned

    • getAllGroups

      public Set<UserGroup> getAllGroups()
      Returns every UserGroup this User belongs to, whether directly assigned (see getGroups()) or granted via a BusinessRole (see getBusinessRoles()).
      Returns:
      all of this User's user groups; never null, empty if none

    • getBusinessRoles

      public Set<BusinessRole> getBusinessRoles()
      Returns the BusinessRoles assigned to this User. Each Business Role can in turn grant additional roles and user groups, reflected in getAllRoles() and getAllGroups().
      Returns:
      the assigned business roles, or an empty set if none were assigned

    • isActivated

      public Boolean isActivated()
      Returns whether this User's account is active. An inactive User cannot log in. New Users are activated by default.
      Returns:
      true if activated; false if null or not set

    • setActivated

      public void setActivated(Boolean activated)
      Sets whether this User's account is active.
      Parameters:
      activated - true to activate this account

    • isWorkflowEmailingActivated

      public Boolean isWorkflowEmailingActivated()
      Returns whether this User receives workflow-related email notifications. Enabled by default for new Users.
      Returns:
      true if workflow emailing is activated; false if null or not set

    • setWorkflowEmailingActivated

      public void setWorkflowEmailingActivated(Boolean workflowEmailingActivated)
      Sets whether this User receives workflow-related email notifications.
      Parameters:
      workflowEmailingActivated - true to activate workflow emailing

    • getLastLogin

      public LocalDateTime getLastLogin()
      Returns the date/time this User last logged in, or null if never.
      Returns:
      the last login date/time

    • lastUpdateDate

      public String lastUpdateDate()
      Returns getLastLogin() formatted as a display string, under the JSON property name lastLogin. Overrides the superclass's generic "last update date" to report the last login instead.
      Overrides:
      lastUpdateDate in class PersistedObject
      Returns:
      the formatted last login date/time, or null if never logged in

    • setLastLogin

      public void setLastLogin(LocalDateTime lastLogin)
      Sets the date/time this User last logged in. Transitioning from no previous login (that is, getLastLogin() was null) to a non-null value marks isFirstLogin() as true.
      Parameters:
      lastLogin - the last login date/time

    • isFirstLogin

      public boolean isFirstLogin()
      Returns whether setLastLogin(LocalDateTime) has recorded this User's first-ever login on this object (that is, getLastLogin() transitioned from null). The flag is transient, not persisted, and is not reset afterwards.
      Returns:
      true if a first login was recorded on this object

    • getFQLoginName

      public String getFQLoginName()
      Returns this User's login name qualified by its partition's unique name, formatted as "<partition>/<loginName>".
      Returns:
      the partition-qualified login name

    • getLoginName

      public String getLoginName()
      Returns this User's login name.
      Returns:
      the login name (lowercased when set via setLoginName(String))

    • setLoginName

      public void setLoginName(String name)
      Sets this User's login name, lowercased.
      Parameters:
      name - the login name

    • setUniqueLoginName

      public void setUniqueLoginName(String name)
      Sets this User's login name to "<name>_<currentTimeMillis>", lowercased, so that it does not collide with an existing login name. It is used in two places: to rename a soft-deleted User whose login name blocks saving another User with the same login name (see renameSoftDeleted(PersistedObjectService)), and to build the login name of a copy when a User is copied.
      Parameters:
      name - the base login name

    • getAdditionalInfo1

      public BigDecimal getAdditionalInfo1()
      Returns the first of four general-purpose extension fields on this User, with no built-in meaning. Available in a logic as api.user("additionalInfo1").
      Returns:
      the first extension field's value

    • setAdditionalInfo1

      public void setAdditionalInfo1(BigDecimal additionalInfo1)
      Sets the first of four general-purpose extension fields on this User.
      Parameters:
      additionalInfo1 - the first extension field's value

    • getAdditionalInfo2

      public BigDecimal getAdditionalInfo2()
      Returns the second of four general-purpose extension fields on this User, with no built-in meaning. Available in a logic as api.user("additionalInfo2").
      Returns:
      the second extension field's value

    • setAdditionalInfo2

      public void setAdditionalInfo2(BigDecimal additionalInfo2)
      Sets the second of four general-purpose extension fields on this User.
      Parameters:
      additionalInfo2 - the second extension field's value

    • getAdditionalInfo3

      public String getAdditionalInfo3()
      Returns the third of four general-purpose extension fields on this User, with no built-in meaning. Available in a logic as api.user("additionalInfo3").
      Returns:
      the third extension field's value

    • setAdditionalInfo3

      public void setAdditionalInfo3(String additionalInfo3)
      Sets the third of four general-purpose extension fields on this User.
      Parameters:
      additionalInfo3 - the third extension field's value

    • getAdditionalInfo4

      public String getAdditionalInfo4()
      Returns the fourth of four general-purpose extension fields on this User, with no built-in meaning. Available in a logic as api.user("additionalInfo4").
      Returns:
      the fourth extension field's value

    • setAdditionalInfo4

      public void setAdditionalInfo4(String additionalInfo4)
      Sets the fourth of four general-purpose extension fields on this User.
      Parameters:
      additionalInfo4 - the fourth extension field's value

    • getEmailLocale

      public String getEmailLocale()
      Returns the locale used for notifications to this User, such as emails and notification titles. It is also passed to the Single Sign-On (SSO) login flow.
      Returns:
      the email locale

    • setEmailLocale

      public void setEmailLocale(String emailLocale)
      Sets the locale used for notifications to this User.
      Parameters:
      emailLocale - the email locale

    • getProductFilterCriteria

      public String getProductFilterCriteria()
      Returns this User's Product access restriction, as a JSON-encoded advanced filter criteria. See getSkuFilter() for the resolved Filter.
      Returns:
      the Product filter criteria, as JSON

    • setProductFilterCriteria

      public void setProductFilterCriteria(String productFilterExpression)
      Sets this User's Product access restriction, as a JSON-encoded advanced filter criteria.
      Parameters:
      productFilterExpression - the Product filter criteria, as JSON

    • getCustomerFilterCriteria

      public String getCustomerFilterCriteria()
      Returns this User's Customer access restriction, as a JSON-encoded advanced filter criteria. See getCustomerFilter() for the resolved Filter.
      Returns:
      the Customer filter criteria, as JSON

    • setCustomerFilterCriteria

      public void setCustomerFilterCriteria(String customerFilterCriteria)
      Sets this User's Customer access restriction, as a JSON-encoded advanced filter criteria.
      Parameters:
      customerFilterCriteria - the Customer filter criteria, as JSON

    • getSellerFilterCriteria

      public String getSellerFilterCriteria()
      Returns this User's Seller access restriction, as a JSON-encoded advanced filter criteria. See getSellerFilter() for the resolved Filter.
      Returns:
      the Seller filter criteria, as JSON

    • setSellerFilterCriteria

      public void setSellerFilterCriteria(String sellerFilterCriteria)
      Sets this User's Seller access restriction, as a JSON-encoded advanced filter criteria.
      Parameters:
      sellerFilterCriteria - the Seller filter criteria, as JSON

    • getLastTermsOfUseVersionAgreed

      public String getLastTermsOfUseVersionAgreed()
      Returns the version identifier of the Terms of Use this User last agreed to.
      Returns:
      the agreed Terms of Use version

    • setLastTermsOfUseVersionAgreed

      public void setLastTermsOfUseVersionAgreed(String lastTermsOfUseVersionAgreed)
      Sets the version identifier of the Terms of Use this User last agreed to.
      Parameters:
      lastTermsOfUseVersionAgreed - the agreed Terms of Use version

    • getLastTermsOfUseAgreedDate

      public LocalDateTime getLastTermsOfUseAgreedDate()
      Returns the date/time this User last agreed to the Terms of Use.
      Returns:
      the Terms of Use agreement date/time

    • setLastTermsOfUseAgreedDate

      public void setLastTermsOfUseAgreedDate(LocalDateTime lastTermsOfUseAgreedDate)
      Sets the date/time this User last agreed to the Terms of Use.
      Parameters:
      lastTermsOfUseAgreedDate - the Terms of Use agreement date/time

    • addRelevantFilter

      public void addRelevantFilter(Search search)
      Adds this User's access restriction filter to search, if one applies. Which of getSkuFilter(), getCustomerFilter() or getSellerFilter() is added, if any, is determined by whether search's search class joins to Product, Customer, or Seller master data; if none does, search is left unchanged.
      Parameters:
      search - the search to restrict

    • getSkuFilter

      public Filter getSkuFilter()
      Returns this User's Product access restriction resolved into a Filter, built from getProductFilterCriteria(), or null if no restriction is set.
      Returns:
      the resolved Product filter, or null

    • getCustomerFilter

      public Filter getCustomerFilter()
      Returns this User's Customer access restriction resolved into a Filter, built from getCustomerFilterCriteria(), or null if no restriction is set.
      Returns:
      the resolved Customer filter, or null

    • getSellerFilter

      public Filter getSellerFilter()
      Returns this User's Seller access restriction resolved into a Filter, built from getSellerFilterCriteria(), or null if no restriction is set.
      Returns:
      the resolved Seller filter, or null

    • hasModuleAccess

      public boolean hasModuleAccess(ApplicationModule module)
      Returns whether any of this User's roles (direct or granted via a BusinessRole) belongs to the given application module.
      Parameters:
      module - the application module to check
      Returns:
      true if this User has access to module via at least one role

    • auditOperation

      public void auditOperation(AuditOperation operation, User byUser, CommandContext context, PersistedObjectService objService, String details)
      Records a security-relevant operation performed on this User (for example, an edit) as a SecurityAuditTrail entry.
      Overrides:
      auditOperation in class PersistedObject
      Parameters:
      operation - the operation performed
      byUser - the user who performed it
      context - the request context the operation was performed in
      objService - used to persist the audit trail entry
      details - additional details about the operation

    • isAudited

      public boolean isAudited()
      Returns true, so the server records a security audit entry when a User is created, updated or deleted through the standard data commands (see auditOperation(AuditOperation, User, CommandContext, PersistedObjectService, String)).
      Overrides:
      isAudited in class PersistedObject
      Returns:
      always true

    • isInGroup

      public boolean isInGroup(UserGroup userGroup)
      Returns whether this User belongs to the given UserGroup, whether directly or via a BusinessRole.
      Parameters:
      userGroup - the user group to check
      Returns:
      true if this User belongs to userGroup

    • renameSoftDeleted

      public void renameSoftDeleted(PersistedObjectService objService)
      Renames this soft-deleted User, via objService, so its getLoginName() no longer conflicts with another User's login name. Called when this User's login name would otherwise block saving (creating or updating) another User with the same login name; see setUniqueLoginName(String). This User must be soft-deleted; otherwise, the rename is not done and an error is logged.
      Specified by:
      renameSoftDeleted in interface RenameSoftDeletedInNameConflict
      Parameters:
      objService - used to perform the rename

    • validate

      public boolean validate(ValidationVisitor validationVisitor, PersistedObjectService objService)
      Validates that getAdditionalInfo3(), getAdditionalInfo4(), getLoginName(), getLastName(), getFirstName() and getEmail() are all at most 255 characters, in addition to the superclass's own validation, recording a validation error for the first field found too long.
      Overrides:
      validate in class PartitionedObject
      Parameters:
      validationVisitor - collects validation errors; may be null
      objService - used by the superclass's own validation
      Returns:
      true if all fields are within length limits and the superclass validation also passed; false otherwise

    • canEdit

      public boolean canEdit(User user, ValidationVisitor validationVisitor, PersistedObjectService objService, Map<String,Object> fieldsToEdit)
      Returns whether user may edit this User, in addition to the superclass's own check: if this User is platform-managed, only a system user may edit it.
      Overrides:
      canEdit in class PersistedObject
      Parameters:
      user - the user attempting the edit
      validationVisitor - collects a validation error if edit is denied; may be null
      objService - used by the superclass's own check
      fieldsToEdit - the fields being edited
      Returns:
      true if user may edit this User

    • onSaveOrUpdate

      public void onSaveOrUpdate(PersistedObjectService objService)
      Runs the superclass's own save/update logic, then clears getPasswordExpiry() if this User is SSO-only.
      Overrides:
      onSaveOrUpdate in class PersistedObject
      Parameters:
      objService - the persistence context this save/update runs in

    • onSavedOrUpdated

      public void onSavedOrUpdated(PersistedObjectService objService)
      Runs the superclass's own post-save logic, then calls emitUserUpdateActionAfterCommit() to invalidate, on all nodes, the cached users, user groups, roles and business roles of this User's partition once the transaction commits.
      Overrides:
      onSavedOrUpdated in class PersistedObject
      Parameters:
      objService - the persistence context this save/update ran in

    • emitUserUpdateActionAfterCommit

      public void emitUserUpdateActionAfterCommit()
      Internal server method, not for use in logics: refreshes the cached user data of this User's partition on all nodes after the current transaction commits.

    • invalidateUsersOnAllNodes

      public static void invalidateUsersOnAllNodes(String partitionName) throws ClusterException
      Internal server method, not for use in logics: refreshes the cached user data of the given partition on all nodes.
      Parameters:
      partitionName - the unique name of the partition
      Throws:
      ClusterException - if the request could not be sent

    • getPermissions

      public Set<Permission> getPermissions()
      Returns every permission granted by this User's roles (direct or granted via a BusinessRole).
      Returns:
      this User's permissions

    • createRootUser

      public static void createRootUser(PersistedObjectService objService)
      Internal server method, not for use in logics: creates the built-in root system user.
      Parameters:
      objService - the persistence service

    • createOrUpdateSupportUser

      public static void createOrUpdateSupportUser(PersistedObjectService objService)
      Internal server method, not for use in logics: creates the built-in pricefx-support user, or updates it if it exists.
      Parameters:
      objService - the persistence service

    • createSupportUser

      public static void createSupportUser(PersistedObjectService objService)
      Internal server method, not for use in logics: creates the built-in pricefx-support user.
      Parameters:
      objService - the persistence service

    • updateSupportUser

      public static void updateSupportUser(PersistedObjectService objService, User supportUser)
      Internal server method, not for use in logics: sets SUPPORT as the only directly assigned role of the built-in pricefx-support user, activates it, and saves it.
      Parameters:
      objService - the persistence service
      supportUser - the support user