Customer

A Large Online Trading Platform (we cannot disclose its name)

Description

Each individual “fact” in Germain data model can be secured following a rule that the Germain Customer provides. That is generally done in Germain RUM JS’s Init Script (for User Session Replay data) or in a Rule (for other data).

Example

This client needed to dynamically set the visibility of the User Session that Germain records, so that a Recorded User Session cannot be replayed by any Team but instead only a dedicated Team is entitled to view them, based on the financial stock(s) that was/were being traded in that recorded user session.

To achieve this, the client customized Germain RUM JS’s init script with its data privacy logic.

Germain RUM JS’s init script:

Example to add access controls to all facts including replay:

/**
 * Sets all facts (and the Replay itself) to be visible based on the user being monitored
 *
 * In the example below:
 *  - Application User is an Admin user - Data visible to Germain UX Technical team only
 *  - Application User is a Business user - Data visible to Germain UX Technical team OR Germain UX Business team
 *  - Application User is any other type - Data visible to all Germain UX users
 */
settings.application.metadataProviders['access'] = function(window) {
    // These constants are available from the Teams view in Germain UX
    const technicalTeamAccessId = 't0';
    const businessTeamAccessId = 't1';
    if (isAdminUser(user)) {
        // If the user being collected is an Admin user (within the application being
        // monitored), only allow the Technical Team (in Germain UX) to access the replay
        return technicalTeamAccessId;
    } else if (isBusinessUser(user)) {
        // If the user being collected is a Business user (within the application being monitored),
        // allow the Technical Team (in Germain UX) or Business Team (in Germain UX) to access the replay
        return `${technicalTeamAccessId} || ${businessTeamAccessId}`;
    }
    // Otherwise any Germain UX user can view the replay
    return undefined;
};

function isAdminUser(user) {
    // custom application logic here...
    return user.type === 'Admin';
}

function isBusinessUser(user) {
    // custom application logic here...
    return user.type === 'Business';
}
JS

Example to add access controls to a specific type of fact (in this example UxConsoleEvent), not including replay:

/**
 * Sets UxConsoleEvents to be visible based on the user being monitored
 *
 * In the example below:
 *  - Application User is an Admin user - Data visible to Germain UX Technical team only
 *  - Application User is a Business user - Data visible to Germain UX Technical team OR Germain UX Business team
 *  - Application User is any other type - Data visible to all Germain UX users
 */
settings.application.factProcessor = (fact) => {
    if (fact.myClassName === 'UxConsoleEvent') {
        // These constants are available from the Teams view in Germain UX
        const technicalTeamAccessId = 't0';
        const businessTeamAccessId = 't1';
        if (isAdminUser(user)) {
            // If the user being collected is an Admin user (within the application being monitored),
            // only allow the Technical Team (in Germain UX) to access this fact
            fact.access = technicalTeamAccessId;
        } else if (isBusinessUser(user)) {
            // If the user being collected is a Business user (within the application being monitored),
            // allow the Technical Team (in Germain UX) or Business Team (in Germain UX) to access this fact
            fact.access = `${technicalTeamAccessId} || ${businessTeamAccessId}`;
        } else {
            // do nothing, this will mean the fact is visible to all Germain UX users
        }
    }
};

function isAdminUser(user) {
    // custom application logic here...
    return user.type === 'Admin';
}

function isBusinessUser(user) {
    // custom application logic here...
    return user.type === 'Business';
}
JS

Notes:

  • The isAdminUser and isBusinessUser would be logic based on the monitored application.

  • This logic is completely customisable, above are only examples, the important parts are:

    • In the first example the settings.application.metadataProviders['access'] should return the access expression

    • In the second example, the settings.application.factProcessor should set the fact.access property to the access expression for the fact

  • We support complex syntax for these access expressions:

    • t1 => only members of the Team with accessId t1 can see the data

    • t1 || t2 => members of either Team with accessId t1 OR t2 can see the data

    • t1 && t2 => members must be members of both Teams with accessId t1 AND t2 to be able to see the data

Configure Germain RUM JS