Query Business Rule - Restrict Visible Records

(function executeRule(current, previous /*null when async*/) {

  // Skip for admin users
  if (gs.hasRole('admin')) {
    return;
  }

  // Configuration: Define restriction type
  var restrictionType = 'department';  // Options: 'department', 'location', 'group', 'custom'

  // Get current user
  var userId = gs.getUserID();
  var grUser = new GlideRecord('sys_user');
  if (!grUser.get(userId)) {
    gs.warn('Query BR: User not found: ' + userId);
    return;
  }

  // Apply restrictions based on type
  switch(restrictionType) {

    case 'department':
      // Users can only see incidents for their department
      var userDept = grUser.getValue('department');
      if (userDept) {
        current.addQuery('caller_id.department', userDept);
        gs.info('Query BR: Restricting to department: ' + grUser.department.getDisplayValue());
      }
      break;

    case 'location':
      // Users can only see incidents for their location
      var userLocation = grUser.getValue('location');
      if (userLocation) {
        current.addQuery('caller_id.location', userLocation);
        gs.info('Query BR: Restricting to location: ' + grUser.location.getDisplayValue());
      }
      break;

    case 'group':
      // Users can only see incidents assigned to their groups
      var userGroups = [];
      var grGroupMember = new GlideRecord('sys_user_grmember');
      grGroupMember.addQuery('user', userId);
      grGroupMember.query();

      while (grGroupMember.next()) {
        userGroups.push(grGroupMember.group.toString());
      }

      if (userGroups.length > 0) {
        current.addQuery('assignment_group', 'IN', userGroups.join(','));
        gs.info('Query BR: Restricting to ' + userGroups.length + ' groups');
      } else {
        // User not in any groups - show no records
        current.addQuery('sys_id', 'NULL');
      }
      break;

    case 'custom':
      // Custom logic: Users can only see incidents they created or are assigned to
      var orCondition = current.addQuery('caller_id', userId);
      orCondition.addOrCondition('assigned_to', userId);
      orCondition.addOrCondition('opened_by', userId);

      // Also include records where user is in watch list (custom field)
      // orCondition.addOrCondition('watch_list', 'CONTAINS', userId);

      gs.info('Query BR: Restricting to user-related records');
      break;

    default:
      gs.warn('Query BR: Unknown restriction type: ' + restrictionType);
  }

  // Optional: Add additional filters for all users
  // Example: Only show active records
  current.addQuery('active', 'true');

  // Example: Exclude certain states
  // current.addQuery('state', 'NOT IN', '6,7,8');  // Exclude Resolved, Closed, Cancelled

  // Log the constructed query for debugging
  gs.debug('Query BR: Final query - ' + current.getEncodedQuery());

})(current, previous);