Effective Privileges
MediumGraphs · Oracle
In a database, a user's effective privileges come from three places:
user_grants: privileges granted directly to the user.user_roles: roles granted directly to the user.- Roles can themselves be granted other roles. Each row
[role, inner_role]ofrole_inheritancemeans anyone who holdsrolealso holdsinner_role. This applies transitively (a role granted to a role granted to the user still counts), and the grants may contain cycles.
Each row [role, privilege] of role_grants gives privilege to everyone who holds role.
Return the user's effective privileges: every privilege granted directly or through any role the user holds, with no duplicates, sorted in ascending string order. Role and privilege names are case-sensitive.
Example 1
- Input:
- user_grants = ["CONNECT"], user_roles = ["analyst"], role_grants = [["analyst", "SELECT"], ["reporting", "CREATE VIEW"], ["etl", "INSERT"], ["dba", "DROP"]], role_inheritance = [["analyst", "reporting"], ["reporting", "etl"]]
- Output:
- ["CONNECT", "CREATE VIEW", "INSERT", "SELECT"]
- Explanation
- The user holds
analystdirectly, which includesreporting, which includesetl. Those roles giveSELECT,CREATE VIEWandINSERT, plus the directCONNECT.dbais not reachable, soDROPis not included.
Example 2
- Input:
- user_grants = ["SELECT"], user_roles = ["a"], role_grants = [["a", "SELECT"], ["b", "UPDATE"], ["c", "DELETE"]], role_inheritance = [["a", "b"], ["b", "a"]]
- Output:
- ["SELECT", "UPDATE"]
- Explanation
- Roles
aandbinclude each other, which must not loop forever; the user holds both.SELECTarrives twice but is listed once. Rolecis never reached.
Example 3
- Input:
- user_grants = [], user_roles = ["junior"], role_grants = [["senior", "APPROVE"], ["junior", "VIEW"]], role_inheritance = [["senior", "junior"]]
- Output:
- ["VIEW"]
- Explanation
seniorincludesjunior, not the other way round, so ajuniorholder gets onlyVIEW.
Constraints
- 0 ≤ user_grants.length, user_roles.length ≤ 104
- 0 ≤ role_grants.length, role_inheritance.length ≤ 105
- Names are non-empty strings and are compared exactly.