Domain Separation Design Pattern

// Business Rule: Domain-Aware Assignment
// Table: incident, When: before, Insert/Update
// Purpose: Ensure assignments respect domain boundaries

(function executeRule(current, previous /*null when async*/) {
    
    // Skip if domain separation is not active
    if (!gs.hasRole('domain_admin') && !gs.getProperty('glide.sys.domain_separation.active', 'false') == 'true') {
        return;
    }
    
    var domainUtil = new DomainUtil();
    var currentDomain = current.sys_domain + '';
    
    // Validate assignment group belongs to same domain hierarchy
    if (!gs.nil(current.assignment_group)) {
        var agGr = new GlideRecord('sys_user_group');
        if (agGr.get(current.assignment_group)) {
            var agDomain = agGr.sys_domain + '';
            
            // Check if assignment group domain is in same hierarchy
            if (!domainUtil.isInDomainHierarchy(currentDomain, agDomain)) {
                gs.addErrorMessage('Assignment group must be within the same domain hierarchy');
                current.setAbortAction(true);
                return;
            }
        }
    }
    
    // Validate assigned user belongs to accessible domain
    if (!gs.nil(current.assigned_to)) {
        var userGr = new GlideRecord('sys_user');
        if (userGr.get(current.assigned_to)) {
            var userDomain = userGr.sys_domain + '';
            
            // Verify user can access the record's domain
            if (!domainUtil.canUserAccessDomain(current.assigned_to + '', currentDomain)) {
                gs.addErrorMessage('Assigned user does not have access to this domain');
                current.setAbortAction(true);
                return;
            }
        }
    }
    
    // Log domain assignment for audit
    gs.info('Domain validation passed for incident ' + current.number + 
            ' in domain ' + currentDomain + 
            ' assigned to group: ' + current.assignment_group.getDisplayValue());
            
})(current, previous);

// Script Include: DomainUtil
// Purpose: Utility functions for domain separation logic

var DomainUtil = Class.create();
DomainUtil.prototype = {
    initialize: function() {
    },
    
    // Check if target domain is within source domain hierarchy
    isInDomainHierarchy: function(sourceDomain, targetDomain) {
        if (gs.nil(sourceDomain) || gs.nil(targetDomain)) {
            return true; // Global domain access
        }
        
        var domainGr = new GlideRecord('sys_user_group_type');
        domainGr.addQuery('sys_id', targetDomain);
        domainGr.query();
        
        if (!domainGr.next()) {
            return false;
        }
        
        // Walk up the domain hierarchy
        var currentParent = domainGr.parent + '';
        while (!gs.nil(currentParent)) {
            if (currentParent == sourceDomain) {
                return true;
            }
            
            var parentGr = new GlideRecord('sys_user_group_type');
            if (parentGr.get(currentParent)) {
                currentParent = parentGr.parent + '';
            } else {
                break;
            }
        }
        
        return sourceDomain == targetDomain;
    },
    
    // Verify user has access to specified domain
    canUserAccessDomain: function(userId, domainId) {
        var userGr = new GlideRecord('sys_user');
        if (!userGr.get(userId)) {
            return false;
        }
        
        // Check user's domain access through roles and group memberships
        var domainAccess = new GlideRecord('sys_user_group_member');
        domainAccess.addQuery('user', userId);
        domainAccess.addQuery('group.sys_domain', domainId);
        domainAccess.query();
        
        return domainAccess.hasNext();
    },
    
    type: 'DomainUtil'
};

// Client Script: Domain-aware Reference Qualifier
// Type: onLoad
// Table: incident

function onLoad() {
    
    // Get current record's domain for reference filtering
    var currentDomain = g_form.getValue('sys_domain');
    
    if (!currentDomain) {
        return; // No domain restrictions for global domain
    }
    
    // Set domain-aware reference qualifier for assignment group
    var domainFilter = 'sys_domainSTARTSWITH' + currentDomain + '^ORsys_domain=NULL';
    g_form.addFilter('assignment_group', domainFilter);
    
    // Set domain-aware reference qualifier for assigned user
    // Users must belong to groups within the domain hierarchy
    var userFilter = 'group_listIN' + getDomainGroups(currentDomain);
    g_form.addFilter('assigned_to', userFilter);
    
    // Add informational message about domain restrictions
    g_form.addInfoMessage('Assignment options are filtered by domain: ' + 
                         g_form.getDisplayValue('sys_domain'));
}

function getDomainGroups(domainId) {
    var ga = new GlideAjax('DomainClientUtil');
    ga.addParam('sysparm_name', 'getDomainGroupIds');
    ga.addParam('sysparm_domain_id', domainId);
    ga.getXMLWait();
    
    return ga.getAnswer() || '';
}