Hiding the full list of records, only allowing an exact match in a search result list

[axyl]

My client needed something a bit unusual. They wanted sales staff to be able to search the full Customer List to confirm whether a potential lead already has a relationship with the client. However, they didn't want sales staff to be able to view the full list or do any partial string matching—only full name matching. (So that sales staff find it more difficult to download potential customer lists and run away with them.)

There's an entity that has every Account Name replicated one-on-one to the full customer list entity, without any other details included, with full read rights ACL-wise.

And to restrict the list/search results, I used an Additional Applier to catch all possible search types.

custom\Espo\Custom\Classes\Select\AllCustomerSearc hObj\AdditionalAppliers\HideAllExactSearchShow.php

namespace Espo\Custom\Classes\Select\AllCustomerSearchObj\AdditionalAppliers;

use Espo\Core\Select\Applier\AdditionalApplier;
use Espo\Core\Select\SearchParams;
use Espo\ORM\Query\SelectBuilder;
use Espo\Core\Utils\Log;

class HideAllExactSearchShow implements AdditionalApplier
{
    public function __construct(
        private Log $log
    ) {        
    }


    public function apply(SelectBuilder $queryBuilder, SearchParams $searchParams): void
    {
        if ($searchParams->getTextFilter()) {
            // Instead of adding to the where, we're overriding.
            $queryBuilder->where(['name'=>$searchParams->getTextFilter()]);  // Specific name match
        } else {
            // This will hide all results, do this, only when there's no search phase included.
            $queryBuilder->where(['id'=>'1']);  // Hide all results.
        }
    }
}​ 

and then I linked that up in the reocrdDef for the entity, with the selectApplierClassNameList.

I'm sure that there's other ways to do this, but just FYI for anyone else looking.

(Yuri, cover your eyes)