rspec/rules/S5117/abap/rule.adoc

== Why is this an issue?

Every ``++AUTHORITY-CHECK++`` statement sets the fields ``++SY-SUBRC++`` (also accessible as ``++SYST-SUBRC++``) to the authorization check result. Thus ``++SY-SUBRC++`` value should be checked just after every ``++AUTHORITY-CHECK++`` statement.


=== Noncompliant code example

[source,abap]
----
AUTHORITY-CHECK OBJECT 'S_MYOBJ' "Noncompliant
    ID 'ID1' FIELD myvalue.
----


=== Compliant solution

[source,abap]
----
AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.

  IF sy-subrc <> 0. 
    MESSAGE 'NOT AUTHORIZED' TYPE 'E'. 
  ENDIF. 
----


=== Exceptions

No issue will be raised in the following cases:

* One or more ``++WRITE++`` operation are performed between the ``++AUTHORITY-CHECK++`` statement and ``++SY-SUBRC++`` check. An exception will be however raised if the ``++WRITE++`` operation is a ``++WRITE ... TO++`` statement, as this will set again ``++SY-SUBRC++``.
* ``++SY-SUBRC++``'s value is assigned to a variable. We then assume that it will be checked later.

[source,abap]
----
AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.
WRITE 'Test' " WRITE is accepted before checking SY-SUBRC
IF SY-SUBRC <> 0. 
    EXIT.
ENDIF.

AUTHORITY-CHECK OBJECT 'S_MYOBJ'  "Compliant
    ID 'ID1' FIELD myvalue.
Tmp = SY-SUBRC " Assigning SY-SUBRC value to a variable. We assume that it will be checked later.
IF Tmp <> 0.
    EXIT.
ENDIF.
----

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Check "SY-SUBRC" value after this "AUTHORITY-CHECK" statement.


=== Highlighting

The ``++AUTHORITY-CHECK OBJECT 'XXX'++`` statement.


endif::env-github,rspecator-view[]