Prevent BP code update by non Superusers

Question

I have created code for the Transaction Stored Procedure to prevent non Superusers from changing the BP code (cardcode) on the BP master. This code is allowing any user to update the Card code, what am i missing to identify that only the BP code has changed and prevent the update if the user is not a superuser?
If @object_type = '2' AND @transaction_type = 'U'
BEGIN
IF EXISTS(SELECT T1.superuser from OUSR t1 join OCRD t0 on t1.usersign = t0.usersign where t1.superuser = 'N' AND t0.cardcode = @list_of_cols_val_tab_del)
BEGIN
SELECT @error = -1,
@error_message = N'You are not authorized to change BP Code'
END
END
I will also want to do the same to the cardname field. Thanks

Answer 1

Hi Peter,
The UserSign field on the OCRD table holds the user id of the original creator of the master record. This value doesn't change. The user updating is UserSign2. Also, this UserSign field links to the UserID field from OUSR and not to the UserSign field.
If @object_type = '2' AND @transaction_type = 'U'
     BEGIN
          IF EXISTS(SELECT T1.superuser from OUSR t1 join OCRD t0 on t1.userid = t0.usersign2 where t1.superuser = 'N' AND t0.cardcode = @list_of_cols_val_tab_del)
               BEGIN
                    SELECT @error = -1,
                    @error_message = N'You are not authorised to change BPs'
              END
     END
However, the above will block ANY change made by the user and not just the CardCode or CardName. To do this, you need to cross reference the ACRD table to see if these fields have changed between updates. This could be problematic for the change of CardCode because there's no easy way to know that this value has been changed (ie because the link between the current values and the history records is the CardCode, you can't reference the old entries once the CardCode has been changed) . It would be better to block the change using the UI API via an addon.
Kind Regards,
Owen