Apache Derby Database Engine and Embedded JDBC Driver 10.17.1.0 · org.apache.derby.impl.sql.catalog.RoleClosureIteratorImpl

Allows iterator over the role grant closure defined by the relation GRANT role-a TO role-b, or its inverse.

The graph is represented as a HashMap where the key is the node and the value is a List grant descriptors representing outgoing arcs. The set constructed depends on whether inverse was specified in the constructor.

Field Summary

Modifier and Type	Field and Description
private Iterator<RoleGrantDescriptor>	currNodeIter Last node returned by next; a logical pointer into the arcs list of a node we are currently processing.
private DataDictionaryImpl	dd DataDictionaryImpl used to get closure graph
private HashMap<String, List<RoleGrantDescriptor>>	graph Holds the grant graph.
private boolean	initial true before next is called the first time
private final boolean	inverse true if closure is inverse of GRANT role-a TO role-b.
private List<RoleGrantDescriptor>	lifo Holds discovered, but not yet handed out, roles in the closure.
private String	root The role for which we compute the closure.
private HashMap<String, Object>	seenSoFar Holds roles seen so far when computing the closure.
private TransactionController	tc TransactionController used to get closure graph

Constructor Summary

Access	Constructor and Description
pack-priv	RoleClosureIteratorImpl(String The role name for which to compute the closure root, boolean If `true`, `graph` represents the grant^-1 relation. inverse, DataDictionaryImpl data dictionary dd, TransactionController transaction controller tc) Constructor (package private).

Method Summary

Modifier and Type	Method and Description
public String	next() Implements org.apache.derby.iapi.sql.dictionary.RoleClosureIterator.next. Returns the next (as yet unreturned) role in the transitive closure of the grant or grant^-1 relation.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

currNodeIter	back to summary
private Iterator<RoleGrantDescriptor> currNodeIter Last node returned by next; a logical pointer into the arcs list of a node we are currently processing.

dd	back to summary
private DataDictionaryImpl dd DataDictionaryImpl used to get closure graph

graph back to summary

graph	back to summary
private HashMap<String, List<RoleGrantDescriptor>> graph Holds the grant graph. key: role name value: list of `RoleGrantDescriptor`, making up outgoing arcs in graph

private HashMap<String, List<RoleGrantDescriptor>> graph

Holds the grant graph.

key: role name
value: list of RoleGrantDescriptor, making up outgoing arcs in graph

initial	back to summary
private boolean initial true before next is called the first time

inverse	back to summary
private final boolean inverse true if closure is inverse of GRANT role-a TO role-b.

lifo	back to summary
private List<RoleGrantDescriptor> lifo Holds discovered, but not yet handed out, roles in the closure.

root	back to summary
private String root The role for which we compute the closure.

seenSoFar back to summary

seenSoFar	back to summary
private HashMap<String, Object> seenSoFar Holds roles seen so far when computing the closure. Key: role name. Depending on value of `inverse`, the key represents and is compared against `roleName()` or `grantee()` of role descriptors visited. Value: none

private HashMap<String, Object> seenSoFar

Holds roles seen so far when computing the closure.

Key: role name. Depending on value of inverse, the key represents and is compared against roleName() or grantee() of role descriptors visited.
Value: none

tc	back to summary
private TransactionController tc TransactionController used to get closure graph

Constructor Detail

RoleClosureIteratorImpl back to summary

RoleClosureIteratorImpl	back to summary
pack-priv RoleClosureIteratorImpl(String root, boolean inverse, DataDictionaryImpl dd, TransactionController tc) Constructor (package private). Use `createRoleClosureIterator` to obtain an instance. Parameters root:String The role name for which to compute the closure inverse:boolean If `true`, `graph` represents the grant^-1 relation. dd:DataDictionaryImpl data dictionary tc:TransactionController transaction controller See Also `org.apache.derby.iapi.sql.dictionary.DataDictionary#createRoleClosureIterator`

pack-priv RoleClosureIteratorImpl(String root, boolean inverse, DataDictionaryImpl dd, TransactionController tc)

Constructor (package private). Use createRoleClosureIterator to obtain an instance.

Parameters

root:String: The role name for which to compute the closure
inverse:boolean: If true, graph represents the grant^-1 relation.
dd:DataDictionaryImpl: data dictionary
tc:TransactionController: transaction controller

Method Detail

next	back to summary
public String next() throws StandardException Implements org.apache.derby.iapi.sql.dictionary.RoleClosureIterator.next. Doc from org.apache.derby.iapi.sql.dictionary.RoleClosureIterator.next. Returns the next (as yet unreturned) role in the transitive closure of the grant or grant^-1 relation. The grant relation forms a DAG (directed acyclic graph). Example: Assume a set of created roles forming nodes: {a1, a2, a3, b, c, d, e, f, h, j} Assume a set of GRANT statements forming arcs: GRANT a1 TO b; GRANT b TO e; GRANT e TO h; GRANT a1 TO c; GRANT e TO f; GRANT a2 TO c; GRANT c TO f; GRANT f TO h; GRANT a3 TO d; GRANT d TO f; GRANT a1 to j; a1 a2 a3 / \| \ \| \| / b +--------> c d j \| \ / e---+ \ / \ \ \ / \ \---------+ \ / \ \_ f \ / \ / \ / \ / \ / \ / h An iterator on the inverse relation starting at h for the above grant graph will return: closure(h, grant-inv) = {h, e, b, a1, f, c, a2, d, a3} An iterator on normal (not inverse) relation starting at a1 for the above grant graph will return: closure(a1, grant) = {a1, b, j, e, h, f, c} Returns:String a role name identifying a yet unseen node, or null if the closure is exhausted. The order in which the nodes are returned is not defined, except that the root is always returned first (h and a1 in the above examples).

back to summary

public String next() throws StandardException

Implements org.apache.derby.iapi.sql.dictionary.RoleClosureIterator.next.

Doc from org.apache.derby.iapi.sql.dictionary.RoleClosureIterator.next.

Returns the next (as yet unreturned) role in the transitive closure of the grant or grant^-1 relation. The grant relation forms a DAG (directed acyclic graph).

Example:
     Assume a set of created roles forming nodes:
           {a1, a2, a3, b, c, d, e, f, h, j}

     Assume a set of GRANT statements forming arcs:

     GRANT a1 TO b;   GRANT b TO e;  GRANT e TO h;
     GRANT a1 TO c;                  GRANT e TO f;
     GRANT a2 TO c;   GRANT c TO f;  GRANT f TO h;
     GRANT a3 TO d;   GRANT d TO f;  GRANT a1 to j;


         a1            a2         a3
        / | \           |          |
       /  b  +--------> c          d
      j   |              \        /
          e---+           \      /
           \   \           \    /
            \   \---------+ \  /
             \             \_ f
              \             /
               \           /
                \         /
                 \       /
                  \     /
                   \   /
                     h

An iterator on the inverse relation starting at h for the above grant graph will return:

      closure(h, grant-inv) = {h, e, b, a1, f, c, a2, d, a3}

An iterator on normal (not inverse) relation starting at a1 for the above grant graph will return:

      closure(a1, grant)    = {a1, b, j, e, h, f, c}