Authorization Scheme vs. "Authorization Scheme"

Question

Hi,
I've just completed building four Authorization Schemes for my app; is_admin, is_pm, is_user, is_read mapping to my concept of roles for admin, pm, user and read-only. Pretty self-explanatory and I set them up across my app so they could perform their various duties. For example, I have a page that all four roles can view, but each role sees a subset of the entire page. Most of what gets hidden as you go down the line of authorization are buttons to add/edit/delete content and some small regions of specialized content.
Each scheme calls a function which in turns make a query to get the appropriate result. So for my main page there are 24 checks to see if the current user has the rights to view certain things. 24? Wow!
So I started thinking (and searching this blog) to find a better way to do that. I didn't really come up with a "better way" but I did have an idea that I'm sure isn't new. I create four sessions variables and set their values ahead of time using the Authorization Scheme code and I'm good to go! Right?
So, some questions:
1. Do I create these variables as Items on a page 0?
2. Are these region level items or page level items?
3. Is my original way of using the Authorization Schemes the right way to do what I'm doing?
Thanks in advance for any advice here!
Cheers,
Jon

Answer 1

Jon,
I assume you have a 'employee' table which has columns
username varchar2(50);
emp_role varchar2(1);
Take emp_role as say,'A' for admin,'M' for pm,'U' for user etc...So each user will have a role associated to him.
So you can define the authorization schemes in the application's shared components as
AUTH_PM ->scheme type :Exists sql query ->Evaluation point ->once per page view
select 1 from employee where username = lower(:app_user) and emp_role ='M'
AUTH_ADMIN->scheme type :Exists sql query ->Evaluation point ->once per page view
select 1 from employee where username = lower(:app_user) and emp_role ='A'
AUTH_AD_PM->scheme type :Exists sql query ->Evaluation point ->once per page view
select 1 from employee where username = lower(:app_user) and emp_role in ('A','M) ......etc for all the combinations you are looking for.
Now,AUTH_PM on "delete" button will allow only the users with pm roles only to view the delete button.
Similarly,AUTH_AD_PM on a region will make the region visible to the users with pm and admin roles only.
Thanks,
Anandi