Search Results pa_ci_secured_v




Overview
Explore in AI Chat

Overview

PA_CI_SECURED_V is a security-filtered view owned by the APPS schema in Oracle E-Business Suite, defined within the Projects (PA) product family. Its purpose is to expose control item records from PA_CONTROL_ITEMS only where the currently connected application user is authorized to view them, while simultaneously projecting row-level create and update privileges as flag columns. Rather than enforcing security through a separate grants table, the view delegates all authorization decisions to the PA_CI_SECURITY_PKG package at query execution time, making access control dynamic and consistent with Projects security rules such as project status, control item type class, and project-level responsibility assignments. In Oracle EBS 12.1.1 and 12.2.2, this view serves as the secured read interface for control items, shielding downstream Forms, OAF pages, concurrent programs, and custom reports from having to reimplement the same security logic. Because the view is documented as VALID in ETRM, it is a supported, active object rather than a legacy artifact, and it can be safely referenced in custom SQL and integrations.

Underlying Base Objects

ETRM lists four referenced objects: PA_CI_SECURITY_PKG, PA_CI_TYPES_B, PA_CONTROL_ITEMS, and PA_PROJECT_STATUSES. The first three and PA_PROJECT_STATUSES are referenced through APPS synonyms resolving to the base Projects entities. PA_CONTROL_ITEMS (aliased CI) is the primary driving table, supplying CI_ID, PROJECT_ID, CI_TYPE_ID, and STATUS_CODE. PA_CI_TYPES_B (aliased CIB) is joined on CI_TYPE_ID to retrieve CI_TYPE_CLASS_CODE, which the security package uses to classify the control item. PA_PROJECT_STATUSES is filtered by STATUS_TYPE = 'CONTROL_ITEM' and joined on STATUS_CODE to obtain PROJECT_SYSTEM_STATUS_CODE. PA_CI_SECURITY_PKG is not a table but a PL/SQL package whose CHECK_VIEW_ACCESS, CHECK_CREATE_ACTION, and CHECK_UPDATE_ACCESS functions are invoked once per candidate row in the SELECT list and WHERE clause, returning 'T' or 'F' to determine inclusion and flag values.

Key Columns

  • CI_ID — Primary identifier of the control item, sourced directly from PA_CONTROL_ITEMS.
  • CREATE_ACTION_FLAG — DECODE of PA_CI_SECURITY_PKG.CHECK_CREATE_ACTION(CI.CI_ID), returning 'Y' when the user may create subordinate action items, otherwise 'N'.
  • UPDATE_FLAG — DECODE of PA_CI_SECURITY_PKG.CHECK_UPDATE_ACCESS(CI.CI_ID), returning 'Y' when the user may update the control item, otherwise 'N'.

No view-access flag column is projected; view privilege is instead enforced implicitly by the WHERE predicate, so a row appears in the result set only if the user has view access.

Common Use Cases and Queries

Typical scenarios include secured control item LOVs, project status dashboards, and custom concurrent programs that must respect Projects security. The simplest access-controlled retrieval is:

SELECT ci_id, create_action_flag, update_flag
FROM   apps.pa_ci_secured_v;

To join secured control items to their project context and filter only editable rows:

SELECT s.ci_id, ci.project_id, s.create_action_flag, s.update_flag
FROM   apps.pa_ci_secured_v s,
       apps.pa_control_items ci
WHERE  s.ci_id = ci.ci_id
AND    s.update_flag = 'Y';

Because each predicate invokes PA_CI_SECURITY_PKG, performance on large control item populations depends on package-level caching; queries should filter by CI_ID or PROJECT_ID whenever possible. The view is also appropriate as a security gate in integrations, ensuring that inbound or outbound interfaces never surface control items the session user cannot view. Custom code should call the view rather than the base table to remain aligned with supported security behavior in 12.1.1 and 12.2.2.