Focal Point
Developers With Read Only Access to Code in Production

This topic can be found at:
https://forums.informationbuilders.com/eve/forums/a/tpc/f/7971057331/m/4197016976

December 02, 2015, 05:03 PM
Gene Gauthier
Developers With Read Only Access to Code in Production
This question is for
1) Customers running version 8 (where there is an IBI RDBMS repository).
2) Customers whose report code (fex/html) is in the Repository and not in the Reporting Server app directories.
3) Customers that have DEV and PROD environments with strict change control

We use WebFOCUS Change Management Scenarios to move code from DEV to PROD. So in DEV developers have full control of code and in PROD they have no ability to change code.

Sometimes the developers need to have read only access to the code in PROD to ensure we know what code is running there. Often when trying to debug issues. Validating what code is there.

The issue we are having is the ability to see all code in read only mode. Ive managed to get us the ability to use the BI Portal Text Editor in read only mode for most code except in one scenario. When the property is checked for "Do not show on User's List" we can't see the code. We aren't users. We also aren't Administrators. We are developers that need read access to all code.

In WebFOCUS 7 we could read the basedir at the OS level if we really had to. But now that code is in the Repository, it needs to be done through IBI GUI's.

Anyone struggle with this? Implement any techniques to allow their developers to have insight what is in PROD?

Thanks for any ideas!


WebFOCUS 7.7
Linux
December 03, 2015, 09:45 AM
Squatch
I know I'm not answering your question, but I am curious as to why your question is for customers that have DEV and PROD environments with strict change control?

If the change control is so strict, why would the developers need to know what code is running in the PROD environment? When moving items to PROD, you can make backup copies of what was moved there in your DEV environment. The developers could then look at that code without needing to inspect what is in PROD.

There is an export feature under "Change Management" in the WebFOCUS Portal area. In my organization, we use this feature to copy Repository files from DEV to PROD. If there is a need to see what's in PROD, someone with admin privileges can assist. Perhaps it's not such an issue for me, because I have both admin and developer rights. But I already know what's in PROD by looking at information in DEV.

Maybe I'm not understanding your situation... if that's the case, please let me know and I will try to be more helpful. But I do meet the criteria you laid out: I'm running version 8, we use code in the Repository and we have strict change control practices (Our IT department meets once per week to approve software moves from DEV to PROD environments).

I hope other WebFOCUS users weigh in on your question... I am curious as to how other organizations handle this sort of thing!


App Studio
WebFOCUS 8.1.05M
Windows, All Outputs
December 03, 2015, 11:16 AM
j.gross
I understand the discomfort with relying on a Perpetual Inventory approach.

Perhaps you should maintain a file-system mirror of the repository, created and periodically reloaded via the export function, and give the developer's R/O access to that.
December 04, 2015, 06:17 PM
Gene Gauthier
The issue with DEV is someone can make a change and never move it to PROD. Then later someone thinks that is the PROD code, makes additional changes and moves it to PROD introducing unexpected logic. That is one trap. When I used mainframe FOCUS back in the 80s I would copy PROD to DEV before I started my changes.

Also once you change DEV... ooops I made a mistake, what did it look like before I made the change? (remember no versions) duh... I forgot to make a copy of the fex before changing it.

So lots of scenarios.

Since we can clone PROD repository to DEV through database utilities, we are thinking of doing that once a quarter to clean up DEV.

Next I see your other post. I am considering doing a CM Scenario export to a file system, then mount it on a shared nas, then they can view code. I also am thinking about this in case the database repository gets corrupted somehow. Yes, we do DB backups... but we have 900 reports... that is a lot of code to lose.

All these seem like stupid workarounds which if IBI could present a read only role for ALL code or some other way to view code we wouldn't have to have this conversation. Smiler


WebFOCUS 7.7
Linux