Privilege Conditions

The single rights granted in a role of the yuuvis rights management can be accompanied by a clause that further refines it. The clause represents the "where ..." part of an eSQL statement. So any clause will be constructed as follows: "select * from dms:typename where <clause>". This page gives you examples of the possible clauses that can be in this context.
It is important to know that the rights controlling the visibility of an object - 'Available' and 'Display' - will be precompiled and written to the elasticsearch database. Thus statements with dynamic parts such as currentuserid() or dateadd() will not work for these rights!

Select objects by date/time criteria

Important:

The field sysitemcreationdate selects the creationdate of the entire object (item). syscreationdate selects the creationdate of the active version.
The datetime identifier takes input of the form "yyyy-MM-dd hh:mm:ss". The only required part is "yyyy" but all left out parts will be autocompleted with 00
Objecttype names and element (field) names are accessed by their technical name

Clause	Description
sysitemcreationdate <= datetime'2018-01-23 13:14:15'	The right will be granted to all objects (of the corresponding object-type) that were created before or exactly at 23rd January 2018 13:14:15 o'clock.
syscreationdate < datetime'2018-07'	The right will be granted to all objects (of the corresponding object-type) that were created and last modified before 1st July 2018 00:00:00 o'clock.
customfield1 = 'acknowledged' and customfield2 < datetime'2018-02-01'	The right will be granted to all objects (of the corresponding object-type) where customfield1 has the value 'acknowledged' and customfield2 contains a date that is 31st January 2018 23:59:59.999 or earlier
sysitemcreationdate <= dateadd(day, -7, currentdatetime())	The right will be granted to all objects (of the corresponding object-type) that were created a week ago or earlier (from now including the time). The function dateadd can add or substract a specified amount of time from the provided date: dateadd(<unit>, <amount>, <date>) The unit can be "second", "minute", "hour", "day", "week", "month", "year" The date can be taken from the indexdata, specified manually or currentdate() (start of current day) / currentdatetime() (now) WARNING: This is a dynamic statement. Do not use this for the 'Available' or 'Display' right.

Select objects by creator / modifier criteria

Statement

Description

exists (select 1 from sysversionedcreationtraceOwner2user r where r.sysid1=sysid and r.sysid2='user4711')

The right will be granted to all objects (of the corresponding object-type) where the creator of the currently active version was user4711.
This means either the object is in version 1 and user4711 was the creator or the object is in version 2 or higher and user4711 was the last modifier.

exists (select 1 from sysversionedcreationtraceOwner2user r where r.sysid1=sysid and r.sysid2=currentuserid())

The right will be granted to all objects (of the corresponding object-type) where the creator of the currently active version was the currently logged in user.
This means either the object is in version 1 and the currently logged in user was the creator or the object is in version 2 or higher and the currently logged in user was the last modifier.

WARNING: This is a dynamic statement. Do not use this for the 'Available' or 'Display' right.

exists (select 1 from sysversionedcreationtraceOwner2user r where r.sysid1=sysid and r.sysid2='user4711' and sysversionumber=1)

The right will be granted to all objects (of the corresponding object-type) where the creator of the first version was user4711.
This means user4711 created (the first version of the) item.

Select objects by indexdata / id

Statement	Description
sysitemid = id'ED01B5E5996648088D0A474C37962C93'	The right will be granted to the object (of the corresponding object-type) that has the item-id "ED01B5E5996648088D0A474C37962C93"
longnumber = 123456789L	The right will be granted to all objects (of the corresponding object-type) where the field "longnumber" has the value 123456789.
string1 = 'ipsum'	The right will be granted to all objects (of the corresponding object-type) where the field "string1" has the value "ipsum".
catalogfield = 'english'	The right will be granted to all objects (of the corresponding object-type) where the field "catalogfield" has the catalog entry with data value "english".
orderstable containsrowwithcondition(orderstablerecord.order = 'order4711')	The right will be granted to all objects (of the corresponding object-type) where the table "orderstable" has a row where the column order has the value "order4711". This also applies to multi-tagging fields which are technically a table with one column. In this case any chip has to have the value "order4711".