WebSphere Commerce access policy not working for a command

Problem

You developed a new custom WebSphere Commerce command, you defined access policy for it and you are sure it is correct but for some reason, your command executes without confirming to your access policy.

What might be the root cause ?

Fix

Access policy are defined for interfaces and not for the actual command. So if your command is not picking up the access policy, then you didn't define the relation between your command and its interface properly. Example:

Let's assume, your new custom command is called ProcessRefundCmdImpl and its interface is ProcessRefundCmd.  Let's assume as well, you defined NAME & defaultCommandClassName properly in your interface.

If your ProcessRefundCmdImpl is defined as shown below, two things will happen:

• The command will execute as you expect and implementation class ProcessRefundCmdImpl will be picked up from CMDREG or defaultCommandClassName (as you expect)
• Once you apply access policy, command will not work anymore.

public class ProcessRefundCmdImpl extends ControllerCommandImpl

Now, once you change your code to be as shown below, your access policy will start working as expected.

public class ProcessRefundCmdImpl extends ControllerCommandImpl implements ProcessRefundCmd

It is one of those small mistakes that can take hours or even days to find out. It would have been much better, if the command never executes if it doesn't implement the proper interface in first place, but it is there for developers to have fun with.