Search Results get_sec_predicate_with_clause

Overview

EGO_DATA_SECURITY is an Oracle E-Business Suite PL/SQL package body owned by the APPS schema and filed under the Oracle Product Information Management (EGO) module family. Its central business purpose is to enforce data-level and function-level security for EGO-based objects — most notably item and product definitions, object instance membership, and the menu/framework structures through which Oracle EBS users reach those objects. Rather than a pure API performing DML on business entities, the package functions primarily as a security decision engine: it evaluates whether a given user may access a function, an object instance, or a role mapping, and it generates the SQL predicate fragments that other packages, views, and forms embed to filter query results by the executing user's authorized scope.

This aligns with the broader EGO security model, in which sensitive product data is filtered by object instance sets and role mappings rather than by simple responsibility prerequisites. The package is documented as VALID and classified as OTHER in the ETRM metadata for 12.2.2, and it is referenced by twenty-seven other database objects while itself not being referenced by any single parent object, confirming its role as a shared infrastructure component.

Key Procedures and Functions

Twenty procedures and functions are documented. Grouped by purpose:

• Function checks: CHECK_FUNCTION and CHECK_INHERITED_FUNCTION evaluate whether the current user may invoke a given function, including functions granted through menu hierarchy inheritance.
• Function retrieval: GET_FUNCTIONS and GET_INHERITED_FUNCTIONS return the set of functions available to a user, again accounting for inherited menu grants.
• Predicate generation: GET_SECURITY_PREDICATE, GET_SEC_PREDICATE_WITH_EXISTS, GET_SEC_PREDICATE_WITH_CLAUSE, and GET_INHERITED_PREDICATE construct the SQL WHERE-clause fragments used to restrict queries to authorized object instances.
• Instance handling: GET_INSTANCES and CHECK_INSTANCE_IN_SET resolve object instance sets and test membership.
• Role mapping maintenance: CREATE_ROLE_MAPPING, UPDATE_ROLE_MAPPING, and DELETE_ROLE_MAPPING administer the assignment of roles to objects.
• Role function retrieval: GET_ROLE_FUNCTIONS returns the functions associated with a given role.

Tables Accessed

The package reads and writes EGO_OBJ_ROLE_MAPPINGS for role-to-object authorization data, and reads FND_OBJECTS and FND_OBJECT_INSTANCE_SETS for the object registry and instance-set definitions. Menu and grant structures are resolved through FND_MENUS, FND_MENU_ENTRIES, FND_FORM_FUNCTIONS, and FND_GRANTS, while FND_USER supplies user identity. HR and party data derive from PER_ALL_PEOPLE_F, HZ_PARTIES, and HZ_RELATIONSHIPS, supporting person-based access rules. Service and message plumbing uses FND_API, FND_GLOBAL, FND_MESSAGE, FND_MSG_PUB, and FND_LOG, with helper types EGO_VARCHAR_TBL_TYPE, EGO_SCTX, EGO_USER_V, and EGO_CUSTOM_SECURITY_PUB, plus PLITBLM and STANDARD.

Usage Notes

EGO_DATA_SECURITY is typically invoked indirectly. EGO forms and concurrent programs call its predicate and function-check routines to build filtered queries; the generated predicate fragments are embedded in views and ad hoc reports. Custom code integrating with the EGO security model should call GET_SECURITY_PREDICATE (or the EXISTS and clause variants) rather than reimplementing authorization logic. Role mapping changes should be made through CREATE_ROLE_MAPPING, UPDATE_ROLE_MAPPING, and DELETE_ROLE_MAPPING to preserve consistency with dependent objects in both 12.1.1 and 12.2.2.