Search Results check_proj_auth_ci

Overview

APPS.PA_CI_SECURITY_PKG is the security enforcement package for Oracle Projects Control Items (CI), the framework underlying Issues, Change Requests, and Change Orders in Oracle E-Business Suite. Its primary business function is to answer authorization questions: whether a given user, in a given responsibility, may view, update, change the owner of, change the status of, highlight, or implement impact against a specific control item, and whether that user may create control items, create actions, or open actions assigned to other parties. Because control items are always tied to a project, essentially every check performed by this package reduces to a project-level privilege test mediated through PA_SECURITY_PVT and the responsibility assigned to the user.

The package is documented in ETRM with an API classification of OTHER. It is referenced by nine other packages, indicating that it is a foundational dependency of the Control Items feature rather than a standalone utility. In the 12.1.1 and 12.2.2 code lines, the source is versioned at 120.6.12020000.3 with a header date of 2013/03/19.

Key Procedures and Functions

The package exposes eighteen documented procedures and functions:

• CHECK_PROJ_AUTH_CI — the project-level authorization test used as the entry point by most CI security checks.
• CHECK_VIEW_ACCESS, CHECK_UPDATE_ACCESS, and CHECK_UPDATE_ACCESS1 — determine whether the caller may view or update the control item.
• CHECK_CHANGE_OWNER_ACCESS and CHECK_CHANGE_STATUS_ACCESS — govern the owner change and status transition actions on a control item.
• CHECK_HIGHLIGHT_ACCESS — controls the highlight flag on a control item.
• CHECK_IMPLEMENT_IMPACT_ACCESS — governs the implement-impact action.
• CHECK_ITEM_OWNER_PROJECT_AUTH — validates the relationship between the item owner and the project.
• CHECK_OPEN_ACTION_ASSIGNED_TO — validates whether an action may be opened and assigned to a given party.
• CHECK_CREATE_ACTION and CHECK_CREATE_CI — govern creation of actions and of control items respectively.
• CHECK_UPDATABLE_COMMENT — determines whether a comment on a control item may be modified.
• CHECK_VIEW_PROJECT — described in the source excerpt; resolves the control item's class code (ISSUE, CHANGE_REQUEST, or CHANGE_ORDER) and dispatches to PA_SECURITY_PVT.CHECK_USER_PRIVILEGE with the appropriate privilege.
• IS_TO_OWNER_ALLOWED — determines whether an assignment to the owner is permitted.
• GET_RESP_WITH_ACCESS — returns the responsibility under which the user holds access.

The source excerpt shows that the package maintains package-global caches (G_proj_auth_tab, G_ci_type_tab, G_view_proj_i_tab, G_view_proj_cr_tab, G_view_proj_co_tab) keyed by project, and invalidates the user, responsibility, and party context whenever the caller identity changes. This makes repeated calls within a session cheap while ensuring correctness across responsibility switches.

Tables Accessed

The package resolves control items to their type and security class through PA_CONTROL_ITEMS and PA_CI_TYPES_B. Actions and comments are validated against PA_CI_ACTIONS and PA_CI_COMMENTS. Usage and distribution rules draw on PA_CI_TYPE_USAGE, PA_DIST_LIST_ITEMS, PA_OBJECT_DIST_LISTS, and PLITBLM. Project, party, and status context is obtained from PA_PROJECTS_ALL, PA_PROJECT_PARTIES, PA_PROJECT_STATUSES, PA_PROJECT_TYPES_ALL, and FND_APPLICATION.

Usage Notes

PA_CI_SECURITY_PKG is invoked indirectly, typically through the Control Items and Change Management forms, through workflow and action processing logic, and through other packages that must confirm a caller's rights before displaying or mutating a control item. The package relies on FND_GLOBAL for the current user and responsibility, and honors the PA_DEBUG_MODE profile option for diagnostics. Custom code should not query the CI tables directly for authorization decisions; it should call the appropriate CHECK_ function in this package so that caching and privilege resolution remain consistent with the standard product.