Do not use GlideRecord query inside ACL

Why is this an issue?

When accessing the database, the ACL scripts are executed once for every record being read in order to determine if the user has the permission. Doing expensive work inside this script will surely slow down your database as it grows. Querying the database is an expensive operation so doing it inside ACL scripts is an issue.

Avoiding queries

Complex conditions will often tempt us to implement them with scripting, overlooking that they could be implemented using other acl tools like the condition builder or composing multiple acls.

Rewrite without the script where possible

Complex conditions will often tempt us to implement them with scripting. Given the following acl script, let's try to find a way to rewrite it without javascript:

1
2
3
4
5
6
7
8
9
var userGr = new GlideRecord("sys_user");
if (userGr.get(gs.getUserID())) {
  if (
    gs.getUser().isMemberOf(current.assignment_group)
    userGr.user_name == current.sys_created_by ||
  ) {
    answer = true;
  }
}

Writing the logic as a statement, the user can read the record if:

1. he belongs to the assingment group

   or

2. he created the record

Condition 1 can be written using the condition builder, and condition 2 is querying the database unecessarily, since it can also be written with the condition builder.

The script would be fully expressed with:

1
2
Assignment group -> is (dynamic) -> One Of My Groups
  OR Created by -> is -> javascript:gs.getUserName()