Search Results grant_role

Overview

APPS.FPA_SECURITY_PVT is a private PL/SQL package body that implements the security layer for Oracle Enterprise Business Suite's Portfolio Analysis (FPA) module. In Oracle EBS 12.1.1 and 12.2.2, Portfolio Analysis enables project-driven organizations to group and manage investment portfolios, and access to those portfolios must be tightly controlled through the native Oracle User Management (UM) and FND_GRANTS infrastructure. This package resolves that requirement by mapping the relationship between project roles, portfolio instances, and application users.

The package is classified as a "PVT" (private) API under the APPS schema, meaning it is intended for internal consumption by other FPA packages rather than direct invocation by external or customer code. It leverages the standardized EBS API conventions (G_PKG_NAME, G_APP_NAME, G_API_TYPE constants), and its grant-verification logic depends heavily on the cross-module Project Accounting security package PA_SECURITY_PVT. Notably, the source header indicates the specification dates from 2005 (FPAVSECB.pls 120.4), making this a long-standing and stable component of the EBS project portfolio stack. The package is referenced by two other packages within the application, confirming its role as a shared internal service.

Key Procedures and Functions

The documented public surface of FPA_SECURITY_PVT consists of eight procedures and functions:

• CHECK_USER_PREVILEGE — Validates whether a given user holds the necessary privilege (grant) to act on a portfolio; it is a wrapper-style check that returns a boolean-style indicator consumed by higher-level FPA logic.
• CHECK_PRIVILEGE — A more generalized privilege validation routine used to confirm that a user possesses the required access rights before a portfolio operation is permitted.
• GET_OWNER — Retrieves the owner identity associated with a portfolio, resolving the owner through the project party and role tables.
• GET_ROLE_ID — Returns the project role identifier for a given portfolio context, enabling downstream calls that expect a numeric role key.
• CREATE_PORTFOLIO_USER — Inserts a new portfolio user association, typically creating the grant records that bind a user to a portfolio instance set.
• UPDATE_PORTFOLIO_USER — Modifies an existing portfolio user record, for example when a role assignment changes.
• UPDATE_PORTFOLIO_OWNER — Reassigns the owner of a portfolio, updating the underlying owner attribute and associated security metadata.
• DELETE_PORTFOLIO_USER — Removes a user's association with a portfolio, effectively revoking the granted role.

The package body source also reveals an internal helper, Get_Grant, which is not listed among the documented public procedures. Get_Grant verifies whether a grant exists for a given project role and instance set by querying FND_GRANTS and resolving the instance set ID via PA_SECURITY_PVT.Get_Instance_Set_Id and the menu ID via PA_SECURITY_PVT.get_menu_id_for_role. This helper directly supports the "grant_role" search terminology, since it is the routine that determines whether a role grant already exists before one is created or updated.

Tables Accessed

The package reads and writes the following tables through APPS synonyms:

• FND_GRANTS — Stores the actual grant records, including grantee key, grantee type, instance set, instance type, and grant GUID; queried by Get_Grant and maintained by the create/update/delete procedures.
• FND_MENUS — Used to resolve the menu associated with a project role, which in FND_GRANTS terminology acts as the granted object.
• FND_OBJECT_INSTANCE_SETS — Provides the instance set name and ID that scope a grant to a specific portfolio.
• PA_PROJECT_PARTIES — Holds the project party records that link people to projects and portfolios.
• PA_PROJECT_ROLE_TYPES_B — Supplies the project role type definitions used when resolving role IDs to menus.
• PER_ALL_PEOPLE_F — The HR people table, used to resolve the owner or grantee to a valid person record.

Usage Notes

FPA_SECURITY_PVT is invoked indirectly by the Oracle Projects Portfolio Analysis forms and by any concurrent or custom code that must validate portfolio access. Because it is a private package, developers should not call it directly; instead they should use the public FPA APIs that invoke it internally. The "grant_role" pattern most commonly appears when an administrator assigns a project role to a user for a portfolio, triggering the create/update path that ultimately calls FND_GRANTS through this package. Custom integrations that need to replicate portfolio security should mirror the Get_Grant logic, resolving the instance set and menu identifiers before querying FND_GRANTS.