Use dynamic values in CDS access control

Question

How can I compare a cds element to a return value of an ABAP function?

As an example: An employee is assigned to a company and the company has orders from customers. These orders are displayed in a table and employees should only see orders for the company they are working for.

If employee A was working for Company B, the role would be something like this:

grant select on ConsumptionViewName
    where company = ‚B‘;

I now want to make this hardcoded 'B' dynamic and there is an ABAP helper function that returns the employer of an employee which should be used. There aren't any authorization objects that have a field for the company, is it possible to do it without one?

Answer 1

There is no way you can supply your dynamic values for the CDS DCL.

If no suitable authority object is found, either you define your own one and let DCL do its job. Alternatively you can filter the result at Gateway layer (methods in ...DPC_EXT class) by filtering the result with the ABAP helper function.