I want to create an Appian Servlet plugin, so in SAIL form I can create a link t

I want to create an Appian Servlet plugin, so in SAIL form I can create a link to invoke that servlet by using


a!linkField(
label: "Links",
links: a!safeLink(
uri: "/suite/plugins/servlet/excelReport?reportId=123&startIndex=1&batchSize=100",
label: "download"
)
),

The problem is each user only has access to some of the reports, and the user can beat this limitation by just changing the report id in the URL.

So my questions are:

1). Can we pass in the process variable (which is report id) into the servlet without passing it in as the request parameter? Or is there a way to pass in the info as the POST instead of GET?

2). If this is not feasible, is there a way to get the current user of the SAIL form from servlet so I can make sure the user can only access the report that the user is allowed.

3). Can the servlet access the appian objects that I have created, such as the Rule Constants?
...

OriginalPostID-140186

OriginalPostID-140186