Search Results check_sec_by_role

Overview

PA_SECURITY_PVT is the private security engine for Oracle Projects. It implements the function-security and role-based access rules that govern who may view or act upon project-related objects such as projects, resources, roles, and assignment confirmations. The package is the generic security API used by Oracle Projects forms and concurrent programs whenever a privilege check must be performed, and it is the single point of control for granting, revoking, updating, and locking project grants and roles. Because it is classified as a private (PVT) package, it is not intended as a public integration point; callers should use the corresponding public APIs that delegate to it. The header, at version 120.4, describes the package as applying "all functions except confirm assignment function," with confirmation logic handled by a dedicated procedure.

Key Procedures and Functions

• CHECK_USER_PRIVILEGE — The primary privilege-checking entry point. Given a privilege, object name, and object key, it validates whether the current user is authorized and returns a return code, return status, and message count/data.
• CHECK_SEC_BY_ROLE — Determines whether role-based security is enforced for a user, object, source type, and object key.
• CHECK_SEC_BY_RESP — Determines whether responsibility-based security is enforced for the same set of keys.
• CHECK_CONFIRM_ASMT — Wraps all logic required to verify the confirm-assignment privilege for a project, resource, and privilege combination.
• CHECK_MANAGER_RELATION — Establishes whether a manager relationship exists between a user and a project or resource.
• GRANT_ROLE, GRANT_ORG_AUTHORITY, REVOKE_ROLE, REVOKE_GRANT, UPDATE_ROLE, LOCK_GRANT — Administrative operations that create, revoke, modify, and lock role assignments and grants. LOCK_GRANT, the object referenced in the search that surfaced this documentation, is the routine used to place a lock on an existing grant so that it cannot be modified or revoked through normal processing.
• GET_RESOURCE_ORG_ID, GET_PROJECT_ORG_ID, GET_INSTANCE_SET_ID, GET_MENU_NAME, GET_MENU_ID, GET_MENU_ID_FOR_ROLE, GET_PROJ_ROLE_NAME, GET_PARTY_ID — Accessor routines that resolve organizational, menu, role-name, and party identifiers used by the security rules.
• IS_ROLE_EXISTS, CHECK_ACCESS_EXIST — Validation helpers that test whether a role or an access record already exists before grants are created or evaluated.

Tables Accessed

The package operates across the FND and PA schemas through APPS synonyms. Oracle Foundation tables FND_GRANTS, FND_MENUS, FND_OBJECTS, FND_OBJECT_INSTANCE_SETS, FND_APPLICATION, and FND_USER supply the grant, menu, object, and user definitions that underpin function security. Project data is drawn from PA_PROJECTS_ALL, PA_PROJECT_PARTIES, PA_PROJECT_STATUSES, PA_PROJECT_ROLE_TYPES_B, PA_ROLE_STATUS_MENU_MAP, PA_RESOURCES, PA_RESOURCES_DENORM, and PA_RESOURCE_TXN_ATTRIBUTES. PER_ALL_ASSIGNMENTS_F is used to resolve the human-resources assignment context of a user, which is essential for manager-relationship and responsibility-based checks.

Usage Notes

PA_SECURITY_PVT is invoked at runtime by Oracle Projects forms, by concurrent programs performing privileged processing, and by other Project packages — 48 packages reference it. Custom code should avoid calling this private package directly; instead, it should call the public security APIs that wrap these routines so that patch upgrades do not invalidate the customization. The package name is relevant whenever project security behavior must be diagnosed, particularly for grant and role anomalies that involve locking or revocation.