ServiceNow

(function executeRule(current, previous /*null when async*/) {

    var tableName   = current.getValue('name');
    var elementType = current.getValue('element');

    // Validate: only Serval-managed records.
    // Replace 'serval.integration' with the user_name of your
    // Serval service account if it differs.
    var SERVAL_USER = 'serval.integration';

    var recordSysId = current.getValue('element_id');
    var parentRecord = new GlideRecord(tableName);
    if (!parentRecord.get(recordSysId)) {
        gs.warn('Serval webhook: parent record not found: '
                + tableName + '/' + recordSysId);
        return;
    }

    var openedBy = parentRecord.opened_by.user_name.toString();
    if (openedBy !== SERVAL_USER) {
        return;
    }

    // Build payload
    var instanceName = gs.getProperty('instance_name');
    var instanceUrl  = 'https://' + instanceName + '.service-now.com';

    var payload = {
        instance_url:  instanceUrl,
        table:         tableName,
        record_sys_id: recordSysId,
        number:        parentRecord.getValue('number'),
        comment: {
            sys_id:         current.getUniqueValue(),
            element:        elementType,
            value:          current.getValue('value'),
            sys_created_by: current.getValue('sys_created_by'),
            sys_created_on: current.getValue('sys_created_on')
        }
    };

    // Configuration
    // Replace the token value with the token provided by Serval.
    // For production, store this in a System Property
    // (e.g., x_serval.webhook_token) and retrieve it via
    // gs.getProperty('x_serval.webhook_token').
    var SERVAL_WEBHOOK_URL   = 'https://svwebhook.api.serval.com/servicenow/new-comment';
    var SERVAL_WEBHOOK_TOKEN = '<TOKEN_PROVIDED_BY_SERVAL>';

    try {
        var request = new sn_ws.RESTMessageV2();
        request.setEndpoint(SERVAL_WEBHOOK_URL);
        request.setHttpMethod('POST');
        request.setRequestHeader('Content-Type', 'application/json');
        request.setRequestHeader('X-Serval-Webhook-Token', SERVAL_WEBHOOK_TOKEN);
        request.setRequestBody(JSON.stringify(payload));

        // Run asynchronously so we don't block the user's transaction
        request.setEccParameter('skip_sensor', 'true');

        var response = request.executeAsync();

        gs.info('Serval webhook: sent ' + elementType + ' event for '
            + tableName + '/' + parentRecord.getValue('number')
            + ' (async)');
    } catch (e) {
        gs.error('Serval webhook: failed to send event: ' + e.message);
    }

})(current, previous);

/**
 * Serval ACL evaluation endpoint (matching_criteria).
 *
 * Paste this file verbatim into the Script field of the Serval ACL Scripted
 * REST API's POST /matching_criteria resource. Do not modify: the wire
 * contract, semantics, and install guide are maintained in Serval's source
 * repository (integrations/integrations/src/servicenow/acl-endpoint/README.md),
 * and the sync verifies SERVAL_ACL_VERSION on every response.
 */
(function process(request, response) {
  var SERVAL_ACL_VERSION = "1.1.0";

  var MAX_USERS_PER_REQUEST = 500;
  var MAX_CRITERIA_PER_REQUEST = 5000;

  var MAX_CRITERIA_PER_MATCHING_USERS_REQUEST = 100;
  var MAX_MEMBERS_PER_CRITERIA = 10000;

  var MAX_GROUP_NESTING_DEPTH = 10;

  var SYS_ID_IN_CHUNK = 100;

  var cachedAllActiveUsers = null;

  var body = readJsonBody(request);
  if (body === null) {
    return respondError(
      response,
      400,
      "invalid_json",
      "Request body is not valid JSON, or is not a JSON object."
    );
  }
  if (!isOptionalArray(body.user_sys_ids)) {
    return respondError(
      response,
      400,
      "invalid_request",
      "user_sys_ids must be an array when present."
    );
  }
  if (!isOptionalArray(body.criteria_sys_ids)) {
    return respondError(
      response,
      400,
      "invalid_request",
      "criteria_sys_ids must be an array when present."
    );
  }

  var requestedUsers = toStringSet(body.user_sys_ids);
  var requestedCriteria = toStringSet(body.criteria_sys_ids);

  if (("" + (body.mode || "")).trim() === "matching_users") {
    return respondMatchingUsers(
      response,
      requestedCriteria,
      toNonNegativeInt(body.member_offset, 0),
      toBoundedInt(
        body.member_limit,
        MAX_MEMBERS_PER_CRITERIA,
        MAX_MEMBERS_PER_CRITERIA
      )
    );
  }

  if (requestedUsers.length > MAX_USERS_PER_REQUEST) {
    return respondError(
      response,
      400,
      "too_many_users",
      "user_sys_ids exceeds " + MAX_USERS_PER_REQUEST + "; chunk the request."
    );
  }
  if (requestedCriteria.length > MAX_CRITERIA_PER_REQUEST) {
    return respondError(
      response,
      400,
      "too_many_criteria",
      "criteria_sys_ids exceeds " +
        MAX_CRITERIA_PER_REQUEST +
        "; chunk the request."
    );
  }

  var criteria = loadCriteria(requestedCriteria, MAX_CRITERIA_PER_REQUEST);
  if (criteria.truncated) {
    return respondError(
      response,
      400,
      "too_many_criteria",
      "instance has more than " +
        MAX_CRITERIA_PER_REQUEST +
        " active criteria; send an explicit criteria_sys_ids list."
    );
  }

  if (criteria.ids.length > 0 && !criteriaLoaderAvailable()) {
    return respondError(
      response,
      500,
      "evaluator_unavailable",
      "sn_uc.UserCriteriaLoader.getMatchingCriteria is not available on this instance."
    );
  }

  var userOffset = toNonNegativeInt(body.user_offset, 0);
  var userLimit = toBoundedInt(
    body.user_limit,
    MAX_USERS_PER_REQUEST,
    MAX_USERS_PER_REQUEST
  );
  var users = loadUsers(requestedUsers, userOffset, userLimit);

  var matches = {};
  var errored = [];
  var i;
  for (i = 0; i < users.found.length; i++) {
    var userSysId = users.found[i];
    try {
      matches[userSysId] = evaluate(userSysId, criteria.ids);
    } catch (e) {
      errored.push(userSysId);
    }
  }

  var out = {
    serval_acl_version: SERVAL_ACL_VERSION,
    matches: matches,
    criteria: criteria.meta,

    unresolved_user_sys_ids: users.unresolved,

    errored_user_sys_ids: errored,
  };

  return respondJson(response, 200, out);

  function readJsonBody(req) {
    try {
      if (!req.body) {
        return {};
      }
      var raw = req.body.dataString;
      if (raw === null || raw === undefined || ("" + raw).trim() === "") {
        return {};
      }
      var parsed = JSON.parse("" + raw);
      if (parsed === null || typeof parsed !== "object" || isArray(parsed)) {
        return null;
      }
      return parsed;
    } catch (e) {
      return null;
    }
  }

  function criteriaLoaderAvailable() {
    try {
      return (
        typeof sn_uc !== "undefined" &&
        !!sn_uc.UserCriteriaLoader &&
        typeof sn_uc.UserCriteriaLoader.getMatchingCriteria === "function"
      );
    } catch (e) {
      return false;
    }
  }

  function loadCriteria(ids, cap) {
    var meta = [];
    var resolvedIds = [];

    if (ids.length === 0) {
      var all = new GlideRecord("user_criteria");
      all.addActiveQuery();
      all.orderBy("sys_id");
      all.setLimit(cap + 1);
      all.query();
      collectCriteria(all, resolvedIds, meta);
      return {
        ids: resolvedIds,
        meta: meta,
        truncated: resolvedIds.length > cap,
      };
    }

    var chunks = chunk(ids, SYS_ID_IN_CHUNK);
    var c;
    for (c = 0; c < chunks.length; c++) {
      var gr = new GlideRecord("user_criteria");
      gr.addQuery("sys_id", "IN", chunks[c].join(","));
      gr.addActiveQuery();
      gr.query();
      collectCriteria(gr, resolvedIds, meta);
    }
    return { ids: resolvedIds, meta: meta, truncated: false };
  }

  function collectCriteria(gr, resolvedIds, meta) {
    while (gr.next()) {
      var sysId = gr.getUniqueValue();
      resolvedIds.push(sysId);
      meta.push({
        sys_id: sysId,
        sys_updated_on: gr.getValue("sys_updated_on"),
        advanced: getBool(gr, "advanced"),
        match_all: getBool(gr, "match_all"),
      });
    }
  }

  function loadUsers(ids, offset, limit) {
    var found = [];
    if (ids.length > 0) {
      var present = {};
      var chunks = chunk(ids, SYS_ID_IN_CHUNK);
      var c;
      for (c = 0; c < chunks.length; c++) {
        var gr = new GlideRecord("sys_user");
        gr.addQuery("sys_id", "IN", chunks[c].join(","));
        gr.addActiveQuery();
        gr.query();
        while (gr.next()) {
          present[gr.getUniqueValue()] = true;
        }
      }
      var unresolved = [];
      var j;
      for (j = 0; j < ids.length; j++) {
        if (present[ids[j]]) {
          found.push(ids[j]);
        } else {
          unresolved.push(ids[j]);
        }
      }
      return { found: found, unresolved: unresolved };
    }

    var pager = new GlideRecord("sys_user");
    pager.addActiveQuery();
    pager.orderBy("sys_id");
    pager.chooseWindow(offset, offset + limit, true);
    pager.query();
    while (pager.next() && found.length < limit) {
      found.push(pager.getUniqueValue());
    }
    return { found: found, unresolved: [] };
  }

  function evaluate(userSysId, criteriaIds) {
    if (criteriaIds.length === 0) {
      return [];
    }

    var result = sn_uc.UserCriteriaLoader.getMatchingCriteria(
      userSysId,
      criteriaIds
    );
    return normalizeIdArray(result);
  }

  function respondMatchingUsers(
    res,
    requestedCriteria,
    memberOffset,
    memberLimit
  ) {
    if (requestedCriteria.length === 0) {
      return respondError(
        res,
        400,
        "invalid_request",
        "criteria_sys_ids is required for matching_users mode."
      );
    }
    if (requestedCriteria.length > MAX_CRITERIA_PER_MATCHING_USERS_REQUEST) {
      return respondError(
        res,
        400,
        "too_many_criteria",
        "criteria_sys_ids exceeds " +
          MAX_CRITERIA_PER_MATCHING_USERS_REQUEST +
          " for matching_users mode; chunk the request."
      );
    }

    var readableTables = {};

    if (
      callerDomainMasksReads() ||
      !tableHasReadableRows("user_criteria", readableTables)
    ) {
      return respondJson(res, 200, {
        serval_acl_version: SERVAL_ACL_VERSION,
        mode: "matching_users",
        criteria: [],
        criteria_members: {},
        skipped_advanced_criteria_sys_ids: [],
        errored_criteria_sys_ids: requestedCriteria,
      });
    }

    var criteria = loadCriteriaConditions(requestedCriteria);
    var meta = [];
    var criteriaMembers = {};
    var skippedAdvanced = [];
    var errored = [];

    var i;
    for (i = 0; i < criteria.length; i++) {
      var crit = criteria[i];
      meta.push(crit.meta);

      if (crit.advanced) {
        skippedAdvanced.push(crit.sysId);
        continue;
      }
      try {
        if (!criteriaDimensionsReadable(crit, readableTables)) {
          errored.push(crit.sysId);
          continue;
        }
        criteriaMembers[crit.sysId] = pageMembers(
          computeCriteriaMembers(crit),
          memberOffset,
          memberLimit
        );
      } catch (e) {
        errored.push(crit.sysId);
      }
    }

    return respondJson(res, 200, {
      serval_acl_version: SERVAL_ACL_VERSION,
      mode: "matching_users",
      criteria: meta,
      criteria_members: criteriaMembers,
      skipped_advanced_criteria_sys_ids: skippedAdvanced,
      errored_criteria_sys_ids: errored,
    });
  }

  function conditionDimensions() {
    return [
      { field: "user", kind: "user" },
      { field: "group", kind: "group" },
      { field: "role", kind: "role" },
      { field: "company", kind: "sys_user_field" },
      { field: "department", kind: "sys_user_field" },
      { field: "location", kind: "sys_user_field" },
      { field: "cost_center", kind: "sys_user_field" },
    ];
  }

  function loadCriteriaConditions(ids) {
    var out = [];
    var chunks = chunk(ids, SYS_ID_IN_CHUNK);
    var c;
    for (c = 0; c < chunks.length; c++) {
      var gr = new GlideRecord("user_criteria");
      gr.addQuery("sys_id", "IN", chunks[c].join(","));
      gr.addActiveQuery();
      gr.query();
      while (gr.next()) {
        var sysId = gr.getUniqueValue();
        out.push({
          sysId: sysId,
          advanced: getBool(gr, "advanced"),
          matchAll: getBool(gr, "match_all"),
          conditions: readConditions(gr),
          meta: {
            sys_id: sysId,
            sys_updated_on: gr.getValue("sys_updated_on"),
            advanced: getBool(gr, "advanced"),
            match_all: getBool(gr, "match_all"),
          },
        });
      }
    }
    return out;
  }

  function readConditions(gr) {
    var conditions = [];
    var dims = conditionDimensions();
    var d;
    for (d = 0; d < dims.length; d++) {
      var spec = dims[d];
      var ids = splitIds("" + (gr.getValue(spec.field) || ""), []);
      if (ids.length > 0) {
        conditions.push({ field: spec.field, kind: spec.kind, ids: ids });
      }
    }
    return conditions;
  }

  function conditionTables(condition) {
    if (condition.kind === "group") {
      return ["sys_user_grmember", "sys_user_group"];
    }
    if (condition.kind === "role") {
      return ["sys_user_has_role"];
    }
    return ["sys_user"];
  }

  function criteriaDimensionsReadable(crit, cache) {
    if (!tableHasReadableRows("sys_user", cache)) {
      return false;
    }
    var i;
    for (i = 0; i < crit.conditions.length; i++) {
      var tables = conditionTables(crit.conditions[i]);
      var t;
      for (t = 0; t < tables.length; t++) {
        if (!tableHasReadableRows(tables[t], cache)) {
          return false;
        }
      }
    }
    return true;
  }

  function callerDomainMasksReads() {
    try {
      if (typeof gs === "undefined" || typeof gs.getSession !== "function") {
        return false;
      }
      var session = gs.getSession();
      if (typeof session.getCurrentDomainID !== "function") {
        return false;
      }
      var domainID = "" + session.getCurrentDomainID();
      return domainID !== "" && domainID !== "null" && domainID !== "global";
    } catch (e) {
      return false;
    }
  }

  function tableHasReadableRows(table, cache) {
    if (cache[table] !== undefined) {
      return cache[table];
    }
    var ok = false;
    try {
      var gr = new GlideRecord(table);
      gr.setLimit(1);
      gr.query();
      ok = !!gr.next();
    } catch (e) {
      ok = false;
    }
    cache[table] = ok;
    return ok;
  }

  function computeCriteriaMembers(crit) {
    if (crit.conditions.length === 0) {
      return collectAllActiveUsers();
    }

    var combined = null;
    var i;
    for (i = 0; i < crit.conditions.length; i++) {
      var fieldUsers = resolveFieldUsers(crit.conditions[i]);
      if (combined === null) {
        combined = fieldUsers;
      } else if (crit.matchAll) {
        combined = intersectSets(combined, fieldUsers);
        if (setIsEmpty(combined)) {
          return [];
        }
      } else {
        combined = unionInto(combined, fieldUsers);
      }
    }

    var members = setToSortedArray(combined);
    if (needsActiveUserFilter(crit)) {
      members = filterActiveUsers(members);
    }
    return members;
  }

  function resolveFieldUsers(condition) {
    var set = {};
    var i;
    if (condition.kind === "user") {
      for (i = 0; i < condition.ids.length; i++) {
        set[condition.ids[i]] = true;
      }
      return set;
    }
    if (condition.kind === "group") {
      return collectMembership(
        "sys_user_grmember",
        "group",
        expandGroupDescendants(condition.ids),
        "user"
      );
    }
    if (condition.kind === "role") {
      return collectMembership(
        "sys_user_has_role",
        "role",
        condition.ids,
        "user"
      );
    }
    return collectActiveUsersByField(condition.field, condition.ids);
  }

  function expandGroupDescendants(groupIds) {
    var all = {};
    var frontier = [];
    var i;
    for (i = 0; i < groupIds.length; i++) {
      all[groupIds[i]] = true;
      frontier.push(groupIds[i]);
    }
    var depth;
    for (
      depth = 0;
      depth < MAX_GROUP_NESTING_DEPTH && frontier.length > 0;
      depth++
    ) {
      var next = [];
      var chunks = chunk(frontier, SYS_ID_IN_CHUNK);
      var c;
      for (c = 0; c < chunks.length; c++) {
        var gr = new GlideRecord("sys_user_group");
        gr.addQuery("parent", "IN", chunks[c].join(","));
        gr.query();
        while (gr.next()) {
          var id = gr.getUniqueValue();
          if (!all[id]) {
            all[id] = true;
            next.push(id);
          }
        }
      }
      frontier = next;
    }
    return setToSortedArray(all);
  }

  function collectMembership(table, queryField, queryValues, userField) {
    var set = {};
    var chunks = chunk(queryValues, SYS_ID_IN_CHUNK);
    var c;
    for (c = 0; c < chunks.length; c++) {
      var gr = new GlideRecord(table);
      gr.addQuery(queryField, "IN", chunks[c].join(","));
      gr.query();
      while (gr.next()) {
        var v = gr.getValue(userField);
        if (v) {
          set["" + v] = true;
        }
      }
    }
    return set;
  }

  function collectAllActiveUsers() {
    if (cachedAllActiveUsers) {
      return cachedAllActiveUsers;
    }
    var out = [];
    var gr = new GlideRecord("sys_user");
    gr.addActiveQuery();
    gr.query();
    while (gr.next()) {
      out.push(gr.getUniqueValue());
    }
    out.sort();
    cachedAllActiveUsers = out;
    return out;
  }

  function collectActiveUsersByField(field, values) {
    var set = {};
    var chunks = chunk(values, SYS_ID_IN_CHUNK);
    var c;
    for (c = 0; c < chunks.length; c++) {
      var gr = new GlideRecord("sys_user");
      gr.addActiveQuery();
      gr.addQuery(field, "IN", chunks[c].join(","));
      gr.query();
      while (gr.next()) {
        set[gr.getUniqueValue()] = true;
      }
    }
    return set;
  }

  function needsActiveUserFilter(crit) {
    var hasMembership = false;
    var hasUserField = false;
    var i;
    for (i = 0; i < crit.conditions.length; i++) {
      if (crit.conditions[i].kind === "sys_user_field") {
        hasUserField = true;
      } else {
        hasMembership = true;
      }
    }
    if (crit.matchAll) {
      return !hasUserField;
    }
    return hasMembership;
  }

  function filterActiveUsers(candidateIds) {
    var out = [];
    var chunks = chunk(candidateIds, SYS_ID_IN_CHUNK);
    var c;
    for (c = 0; c < chunks.length; c++) {
      var gr = new GlideRecord("sys_user");
      gr.addQuery("sys_id", "IN", chunks[c].join(","));
      gr.addActiveQuery();
      gr.query();
      while (gr.next()) {
        out.push(gr.getUniqueValue());
      }
    }
    out.sort();
    return out;
  }

  function unionInto(target, source) {
    var id;
    for (id in source) {
      if (source.hasOwnProperty(id)) {
        target[id] = true;
      }
    }
    return target;
  }

  function intersectSets(a, b) {
    var out = {};
    var id;
    for (id in a) {
      if (a.hasOwnProperty(id) && b[id]) {
        out[id] = true;
      }
    }
    return out;
  }

  function setIsEmpty(set) {
    var id;
    for (id in set) {
      if (set.hasOwnProperty(id)) {
        return false;
      }
    }
    return true;
  }

  function setToSortedArray(set) {
    var out = [];
    var id;
    for (id in set) {
      if (set.hasOwnProperty(id)) {
        out.push(id);
      }
    }
    out.sort();
    return out;
  }

  function pageMembers(members, offset, limit) {
    var page = members.slice(offset, offset + limit);
    return {
      member_sys_ids: page,
      total: members.length,
      truncated: offset + page.length < members.length,
    };
  }

  function isArray(value) {
    return Object.prototype.toString.call(value) === "[object Array]";
  }

  function isOptionalArray(value) {
    return value === undefined || value === null || isArray(value);
  }

  function toStringSet(value) {
    var out = [];
    var seen = {};
    if (!isArray(value)) {
      return out;
    }
    var i;
    for (i = 0; i < value.length; i++) {
      var s = ("" + value[i]).trim();
      if (s && !seen[s]) {
        seen[s] = true;
        out.push(s);
      }
    }
    return out;
  }

  function normalizeIdArray(value) {
    var out = [];
    if (value === null || value === undefined) {
      return out;
    }
    var i;

    if (typeof value === "string") {
      return splitIds(value, out);
    }
    if (typeof value.size === "function" && typeof value.get === "function") {
      var n = value.size();
      for (i = 0; i < n; i++) {
        pushId(out, value.get(i));
      }
      return out;
    }
    if (typeof value.length === "number") {
      for (i = 0; i < value.length; i++) {
        pushId(out, value[i]);
      }
      return out;
    }

    return splitIds("" + value, out);
  }

  function splitIds(str, out) {
    var parts = str.split(",");
    var i;
    for (i = 0; i < parts.length; i++) {
      pushId(out, parts[i]);
    }
    return out;
  }

  function pushId(out, raw) {
    var s = ("" + raw).trim();
    if (s) {
      out.push(s);
    }
  }

  function chunk(arr, size) {
    var chunks = [];
    var i;
    for (i = 0; i < arr.length; i += size) {
      chunks.push(arr.slice(i, i + size));
    }
    return chunks;
  }

  function getBool(gr, field) {
    var v = gr.getValue(field);
    return v === "1" || v === "true";
  }

  function toNonNegativeInt(value, fallback) {
    var n = parseInt(value, 10);
    if (isNaN(n) || n < 0) {
      return fallback;
    }
    return n;
  }

  function toBoundedInt(value, fallback, max) {
    var n = parseInt(value, 10);
    if (isNaN(n) || n <= 0 || n > max) {
      return fallback;
    }
    return n;
  }

  function respondJson(res, status, obj) {
    res.setStatus(status);
    res.setContentType("application/json");
    res.getStreamWriter().writeString(JSON.stringify(obj));
  }

  function respondError(res, status, code, message) {
    respondJson(res, status, {
      serval_acl_version: SERVAL_ACL_VERSION,
      error: { code: code, message: message },
    });
  }
})(request, response);