A customer maintenance form in Uniface 10, part 9 - users, roles, a change history and a login lockout

Uniface 10 introduced a new customer maintenance form in part 9, addressing issues around users, roles, change history and login lockout. Previously, the application lacked any awareness of who was using it, treating every user equally with the same rights.

With the new USER_SVC service, users, passwords and roles are now managed. A change log, HISTORY_SVC, records field-level changes, while AUDIT_SVC keeps a login log with lockout and password rules.

Three tables were created to implement these services: APP_USER stores user details, CUSTOMER_HISTORY logs changes to customer records, and APP_LOGIN_LOG records login attempts. Indexes were also added for faster data retrieval.

The application now has three roles: READ, EDIT and ADMIN. Comparisons between roles are handled using a numeric comparison system, rather than multiple if statements. The HAS_RIGHT operation checks if a user has the required right based on their role.

Successful logins store the user name and role in global registers $91 and $92, available throughout the application's lifetime. These values are visible in every component, similar to the desktop session's lifetime.

Upon a successful login, the CURRENT_USER operation populates $91 and $92 with the logged-in user's name and role. If no login is detected, the application defaults to the Windows user with EDIT rights.

If the user table is empty, the first login creates an administrator user with all rights. The last administrator cannot be deactivated or demoted to another role. Passwords are stored as HMAC-SHA256 hashes, keyed with a fixed prefix and the upper-cased user name, ensuring different hashes for the same password among different users.