DxpLife The practical Liferay DXP knowledge hub
Talk to us

Home/Field Guide/Practice & reference

LAB 01

Build a Partner Request Object

Publish a model, create test data, and prove that its permission boundary works.

25 minObjects-capable 7.4+

Before you begin

Use a disposable Liferay environment with the Objects application and two non-administrator users. This lab uses company scope for a simple API path. Treat the entry permission exercise as part of the lab. Use your actual account or site ownership model in a production implementation.

1. Define and publish

  1. In the Objects application, add a custom Object called Partner Request, with Partner Requests as the plural label.
  2. Select Company scope. Add required Text field summary and optional Long Text field details. Confirm their field names before publishing.
  3. Publish the definition and find its application. Create an entry with summary Replace damaged scanner and details Scanner 04 stops after startup.
  4. Open /o/api, select the generated REST application, and write down the exact collection path and item schema.

2. Configure and test access

Create a role for requestors. Grant the supported application access and entry creation permissions for that role, then configure a limited entry visibility policy. Use separate users Alice and Bob, with the minimum permissions your target permits for the exercise.

Sign in as Alice and create her own entry. Confirm Alice can retrieve it through the UI and, if configured, the API. Sign in as Bob and use Alice’s entry URL or ID. Verify the expected denial and that Alice’s entry is absent from Bob’s list. Repeat with admin only to diagnose differences in data and permissions.

3. Verify and extend

  • The Object is published and the generated API appears in API Explorer.
  • Entries contain the configured fields and can be found by a permitted actor.
  • The denied case is documented with the role and status.

If the collection is absent, check publication, activation, exact path, and scope. If admin can read the entry and Alice cannot, inspect application and entry permissions individually. For the next lab, keep the Object and record its collection URL. Remove the lab definition and data when you finish experimenting.

Official references