[jira] Updated: (DERBY-3666) Make role descriptor a dependency Provider

["Dag H. Wanvik (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DERBY-3666?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Dag H. Wanvik updated DERBY-3666:
---------------------------------

    Attachment: derby-3666-1.stat
                derby-3666-1.diff

Patch derby-3666-1 makes the role descriptor a dependency Provider.
Regression tests ran OK.

Detailed patch comments:

M      java/engine/org/apache/derby/iapi/sql/dictionary/RoleDescriptor.java

This change makes the role (or technically, the role descriptor, as
stored in SYS.SYSROLES) a Derby Provider by having RoleDescriptor
implement the Provider interface. That is, other Derby objects can
register dependencies against role grants (role definitions are also
technically a grant) and get invalidation actions performed, for
example when a role is dropped, when a session's current role is
changed, or when a role grant is revoked. The role as provider is
persistent, since it is stored in SYS.SYSROLES. Being a persistent
provider relies on the UUID of the role descriptor (we introduced an
UUID earlier for this purpose, see DERBY-3137-uuid*). Dependents can
be in-memory (e.g prepared statements or maybe activations,
cf. discussion in DERBY-2207 with Dan) or persistent (views,
constraints, triggers).

M      java/engine/org/apache/derby/catalog/Dependable.java

Adds role grant to the universe of known dependables (a Provider is a
Dependable, which is a super-interface for Providers and Dependents).

M      java/engine/org/apache/derby/iapi/services/io/RegisteredFormatIds.java
M      java/engine/org/apache/derby/iapi/services/io/StoredFormatIds.java

Registering a format id for role grant formatable, to be handled by
the class CoreDDFinderClassInfo.

M      java/engine/org/apache/derby/iapi/sql/depend/DependencyManager.java

Adds a new "REVOKE ROLE" action to handle invalidation when a role
grant is revoke or a role is dropped.

M      java/engine/org/apache/derby/impl/sql/depend/BasicDependencyManager.java

Adds an entry to getActionString for the "REVOKE ROLE" action.

M      java/engine/org/apache/derby/impl/sql/catalog/DDdependableFinder.java

Extends this to handle role grant.

M      java/engine/org/apache/derby/impl/sql/catalog/CoreDDFinderClassInfo.java

Specifies that DDdependableFinder is to be used for role grant.

In the experimental patch in DERBY-3223,
DDdependableFinder#findDependable is never called for role grants,
since role grants do no rely on other objects, only vice versa. I
added the code to CoreDDFinderClassInfo and DDdependableFinder for
completeness anyway, since, as a Provider it is a dependable. If
someone thinks this is the wrong decision, I can backtrack it.


> Make role descriptor a dependency Provider
> ------------------------------------------
>
>                 Key: DERBY-3666
>                 URL: https://issues.apache.org/jira/browse/DERBY-3666
>             Project: Derby
>          Issue Type: Sub-task
>          Components: Security, SQL
>            Reporter: Dag H. Wanvik
>         Attachments: derby-3666-1.diff, derby-3666-1.stat
>
>
> Since dropping roles and revoking role grants (and setting the current
> role) can effect dependent objects, we need to track such
> dependencies. Derby already has a system for this, so we make the role
> descriptor as Provider in that system. This allows us to track
> dependencies that view, constraints and triggers may have on roles, as well
> prepared statements and/or activations.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.