crudy/pgmorbac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

misc(all): cleanup comments, update documentation, tidy up code

Browse Source
This commit is contained in:
Marc VILLAIN
2026-03-27 21:56:00 +01:00
parent 41747a79a0
commit 145f50749b
26 changed files with 131 additions and 451 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/hierarchy_functions.sql
+26 -80
View File
@@ -1,9 +1,5 @@
-- =============================================================================
-- HIERARCHY FUNCTIONS
-- =============================================================================
-- Functions to compute transitive closures for organization and role hierarchies
-- Transitive closure and effective role/activity/view lookup functions
-- Get all ancestor organizations (including self)
CREATE OR REPLACE FUNCTION morbac.get_org_ancestors(p_org_id UUID)
RETURNS TABLE(org_id UUID, depth INTEGER)
LANGUAGE plpgsql
@@ -12,10 +8,8 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE org_ancestors AS (
-- Base case: the organization itself
SELECT p_org_id AS org_id, 0 AS depth
UNION
-- Recursive case: parent organizations
SELECT o.parent_id, oa.depth + 1
FROM org_ancestors oa
INNER JOIN morbac.orgs o ON o.id = oa.org_id
@@ -28,7 +22,6 @@ $$;
COMMENT ON FUNCTION morbac.get_org_ancestors(UUID) IS
'Returns all ancestor organizations (including self) with depth in hierarchy';
-- Get all descendant organizations (including self)
CREATE OR REPLACE FUNCTION morbac.get_org_descendants(p_org_id UUID)
RETURNS TABLE(org_id UUID, depth INTEGER)
LANGUAGE plpgsql
@@ -37,10 +30,8 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE org_descendants AS (
-- Base case: the organization itself
SELECT p_org_id AS org_id, 0 AS depth
UNION
-- Recursive case: child organizations
SELECT o.id, od.depth + 1
FROM org_descendants od
INNER JOIN morbac.orgs o ON o.parent_id = od.org_id
@@ -52,7 +43,7 @@ $$;
COMMENT ON FUNCTION morbac.get_org_descendants(UUID) IS
'Returns all descendant organizations (including self) with depth in hierarchy';
-- Get a named scope of organizations relative to a given org
-- Get a named scope of organizations relative to a given org.
--
-- Supported scopes:
-- 'self' — the org itself only (depth = 0)
@@ -65,8 +56,6 @@ COMMENT ON FUNCTION morbac.get_org_descendants(UUID) IS
-- 'root' — topmost ancestor only (max depth ancestor)
--
-- Optional p_max_depth limits how many levels are traversed (NULL = unlimited).
-- For upward scopes (parent/ancestors/lineage/root) depth counts steps toward root.
-- For downward scopes (children/descendants/subtree) depth counts steps toward leaves.
CREATE OR REPLACE FUNCTION morbac.get_org_scope(
p_org_id UUID,
p_scope TEXT,
@@ -138,7 +127,6 @@ $$;
COMMENT ON FUNCTION morbac.get_org_scope(UUID, TEXT, INTEGER) IS
'Returns a named set of organizations relative to p_org_id. Scopes: self, children, descendants, subtree, parent, ancestors, lineage, root. Optional p_max_depth limits traversal depth.';
-- Get all roles a user effectively has (direct + inherited via role hierarchy)
CREATE OR REPLACE FUNCTION morbac.get_effective_roles(p_user_id UUID, p_org_id UUID)
RETURNS TABLE(role_id UUID, depth INTEGER)
LANGUAGE plpgsql
@@ -147,13 +135,11 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE effective_roles AS (
-- Base case: directly assigned roles
SELECT ur.role_id, 0 AS depth
FROM morbac.user_roles ur
WHERE ur.user_id = p_user_id
AND ur.org_id = p_org_id
UNION
-- Recursive case: junior roles (inherited by the user's assigned roles)
SELECT rh.junior_role_id, er.depth + 1
FROM effective_roles er
INNER JOIN morbac.role_hierarchy rh ON rh.senior_role_id = er.role_id
@@ -167,7 +153,6 @@ $$;
COMMENT ON FUNCTION morbac.get_effective_roles(UUID, UUID) IS
'Returns all effective roles for a user in an organization (direct + inherited via role hierarchy)';
-- Get all roles inherited by a role (transitive closure)
CREATE OR REPLACE FUNCTION morbac.get_inherited_roles(p_role_id UUID)
RETURNS TABLE(role_id UUID, depth INTEGER)
LANGUAGE plpgsql
@@ -176,10 +161,8 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE inherited_roles AS (
-- Base case: the role itself
SELECT p_role_id AS role_id, 0 AS depth
UNION
-- Recursive case: junior roles
SELECT rh.junior_role_id, ir.depth + 1
FROM inherited_roles ir
INNER JOIN morbac.role_hierarchy rh ON rh.senior_role_id = ir.role_id
@@ -193,7 +176,6 @@ $$;
COMMENT ON FUNCTION morbac.get_inherited_roles(UUID) IS
'Returns all roles inherited by a role (transitive closure via role hierarchy)';
-- Get all effective activities (including inherited via activity hierarchy)
CREATE OR REPLACE FUNCTION morbac.get_effective_activities(p_activity TEXT)
RETURNS TABLE(activity TEXT, depth INTEGER)
LANGUAGE plpgsql
@@ -202,10 +184,8 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE effective_activities AS (
-- Base case: the activity itself
SELECT p_activity AS activity, 0 AS depth
UNION
-- Recursive case: junior activities (implied activities)
SELECT ah.junior_activity, ea.depth + 1
FROM effective_activities ea
INNER JOIN morbac.activity_hierarchy ah ON ah.senior_activity = ea.activity
@@ -219,7 +199,6 @@ $$;
COMMENT ON FUNCTION morbac.get_effective_activities(TEXT) IS
'Returns all activities including those implied via activity hierarchy (e.g., write implies read)';
-- Get all effective views (including inherited via view hierarchy)
CREATE OR REPLACE FUNCTION morbac.get_effective_views(p_view TEXT)
RETURNS TABLE(view TEXT, depth INTEGER)
LANGUAGE plpgsql
@@ -228,10 +207,8 @@ AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE effective_views AS (
-- Base case: the view itself
SELECT p_view AS view, 0 AS depth
UNION
-- Recursive case: junior views (more general categories)
SELECT vh.junior_view, ev.depth + 1
FROM effective_views ev
INNER JOIN morbac.view_hierarchy vh ON vh.senior_view = ev.view
@@ -245,7 +222,6 @@ $$;
COMMENT ON FUNCTION morbac.get_effective_views(TEXT) IS
'Returns all views including parent categories via view hierarchy';
-- Get comprehensive effective roles including delegation and derived roles
CREATE OR REPLACE FUNCTION morbac.get_comprehensive_roles(p_user_id UUID, p_org_id UUID)
RETURNS TABLE(role_id UUID, source TEXT, depth INTEGER)
LANGUAGE plpgsql
@@ -259,7 +235,6 @@ BEGIN
FROM morbac.user_roles ur
WHERE ur.user_id = p_user_id
AND ur.org_id = p_org_id
-- Check not negatively assigned
AND NOT EXISTS (
SELECT 1 FROM morbac.negative_role_assignments nra
WHERE nra.user_id = p_user_id
@@ -269,34 +244,32 @@ BEGIN
UNION
-- Delegated roles (active and not revoked)
SELECT d.role_id, 'delegation'::TEXT, 0 AS depth
FROM morbac.delegations d
WHERE d.delegatee_id = p_user_id
AND d.org_id = p_org_id
AND NOT d.revoked
AND now() BETWEEN d.valid_from AND d.valid_until
-- Check delegator has the role
AND EXISTS (
SELECT 1 FROM morbac.user_roles ur
WHERE ur.user_id = d.delegator_id
AND ur.role_id = d.role_id
AND ur.org_id = d.org_id
)
-- Check not negatively assigned to delegatee
AND NOT EXISTS (
SELECT 1 FROM morbac.negative_role_assignments nra
WHERE nra.user_id = p_user_id
AND nra.role_id = d.role_id
AND nra.org_id = p_org_id
)
-- Delegated roles (active and not revoked)
SELECT d.role_id, 'delegation'::TEXT, 0 AS depth
FROM morbac.delegations d
WHERE d.delegatee_id = p_user_id
AND d.org_id = p_org_id
AND NOT d.revoked
AND now() BETWEEN d.valid_from AND d.valid_until
AND EXISTS (
SELECT 1 FROM morbac.user_roles ur
WHERE ur.user_id = d.delegator_id
AND ur.role_id = d.role_id
AND ur.org_id = d.org_id
)
AND NOT EXISTS (
SELECT 1 FROM morbac.negative_role_assignments nra
WHERE nra.user_id = p_user_id
AND nra.role_id = d.role_id
AND nra.org_id = p_org_id
)
UNION
UNION
-- Role hierarchy (junior roles inherited by user's roles)
SELECT rh.junior_role_id, er.source || '_inherited', er.depth + 1
FROM effective_roles er
INNER JOIN morbac.role_hierarchy rh ON rh.senior_role_id = er.role_id
-- Role hierarchy (junior roles inherited by user's roles)
SELECT rh.junior_role_id, er.source || '_inherited', er.depth + 1
FROM effective_roles er
INNER JOIN morbac.role_hierarchy rh ON rh.senior_role_id = er.role_id
)
SELECT DISTINCT ON (effective_roles.role_id) effective_roles.role_id, effective_roles.source, effective_roles.depth
FROM effective_roles
@@ -322,7 +295,6 @@ $$;
COMMENT ON FUNCTION morbac.get_comprehensive_roles(UUID, UUID) IS
'Returns all effective roles including direct, delegated, derived, and inherited via hierarchy';
-- Helper to evaluate derived role conditions
CREATE OR REPLACE FUNCTION morbac.eval_derived_role(
p_evaluator REGPROC,
p_user_id UUID,
@@ -345,29 +317,3 @@ $$;
COMMENT ON FUNCTION morbac.eval_derived_role(REGPROC, UUID, UUID) IS
'Evaluates a derived role condition function';
-- Get all roles inherited by a role (transitive closure)
CREATE OR REPLACE FUNCTION morbac.get_inherited_roles(p_role_id UUID)
RETURNS TABLE(role_id UUID, depth INTEGER)
LANGUAGE plpgsql
STABLE
AS $$
BEGIN
RETURN QUERY
WITH RECURSIVE inherited_roles AS (
-- Base case: the role itself
SELECT p_role_id AS role_id, 0 AS depth
UNION
-- Recursive case: junior roles
SELECT rh.junior_role_id, ir.depth + 1
FROM inherited_roles ir
INNER JOIN morbac.role_hierarchy rh ON rh.senior_role_id = ir.role_id
)
SELECT DISTINCT ON (inherited_roles.role_id) inherited_roles.role_id, inherited_roles.depth
FROM inherited_roles
ORDER BY inherited_roles.role_id, inherited_roles.depth;
END;
$$;
COMMENT ON FUNCTION morbac.get_inherited_roles(UUID) IS
'Returns all roles inherited by a role (transitive closure via role hierarchy)';