Dynamically adding attribute based on PL/SQL function

Question

I've been tasked with dynamically applying security to an XMLType input sample as a post XML generation process (on an 11g R2 DB) based on several parameters. The best way to describe it is with an example block of code, I need to write ApplySecurity....
declare
  vXML XMLType;
  BONUS_SEC constant integer := 24; -- Security identifier for Bonus
  function ApplySecurity(pXML        XMLType,
                         pSecurityID integer,    -- A Security identifier
                         pDataIDPath varchar2,   -- Absolute XPath to the data id which is passed to value
                         pAttribPath varchar2    -- Relative XPath to pDataIDPath where we want the security result attribute stored
                         ) return XMLType is
  begin
      for all DataIDs found in pDataIDPath
        Call an PL/SQL function GetSecurityDesc(pSecurityID, pDataID)
          Store the result of this back in the XML in the pAttribPath as SECURITY attribute
  end;
begin
  vXML := ApplySecurity(XMLType('<ROWSET>
                                   <ROW>                                
                                     <BONUS_ID>8</BONUS_ID>
                                     <DESCRIPTION>Test Bonus</DESCRIPTION>                                                                           
                                   </ROW>
                                   <ROW>                                
                                     <BONUS_ID>9</BONUS_ID>
                                     <DESCRIPTION>Another Bonus</DESCRIPTION>                                                                           
                                   </ROW>                         
                                   <ROW>                                
                                     <BONUS_ID>10</BONUS_ID>
                                     <DESCRIPTION>April Bonus</DESCRIPTION>                                                                           
                                   </ROW>                         
                                 </ROWSET>'),
                         BONUS_SEC,       
                         '/ROWSET/ROW/BONUS_ID',
end;
/* Example of the Desired Output =
<ROWSET>
  <ROW>                                
    <BONUS_ID SECURITY="HIDDEN">8</BONUS_ID>
    <DESCRIPTION>Test Bonus</DESCRIPTION>                                                                           
  </ROW>
  <ROW>                                
    <BONUS_ID SECURITY="READONLY">9</BONUS_ID>
    <DESCRIPTION>Another Bonus</DESCRIPTION>                                                                           
  </ROW>                         
  <ROW>                                
    <BONUS_ID SECURITY="NONE">10</BONUS_ID>
    <DESCRIPTION>April Bonus</DESCRIPTION>                                                                           
  </ROW>                         
</ROWSET>
*/I have tried several approaches like iterating using a dynamically created XMLTable and calling InsertChildXML for each iteration, but that seems messy and inefficient as the call to InsertChildXML will have to locate the correct node each time. Ideally I think the best solution would be to do it with XQuery, but online examples are few and far between and I don't know how I'd call a PL/SQL function as part of an XQuery iteration as well as passing in the path information.
Anyone have any ideas? Thanks!

Answer 1

A funnier option, adapted from http://odieweblog.wordpress.com/2012/06/19/how-to-update-xml-nodes-with-values-from-same-doc/ :
declare
  BONUS_SEC  constant integer := 24;
  vXML XMLType := XMLType(
'<ROWSET>
  <ROW>                                
    <BONUS_ID>8</BONUS_ID>
    <DESCRIPTION>Test Bonus</DESCRIPTION>                                                                           
  </ROW>
  <ROW>                                
    <BONUS_ID>9</BONUS_ID>
    <DESCRIPTION>Another Bonus</DESCRIPTION>                                                                           
  </ROW>                         
  <ROW>                                
    <BONUS_ID>10</BONUS_ID>
    <DESCRIPTION>April Bonus</DESCRIPTION>                                                                           
  </ROW>                         
</ROWSET>');
  pSecurityID integer      := BONUS_SEC;
  pDataIDPath varchar2(80) := '/ROWSET/ROW/BONUS_ID';
  pAttribPath varchar2(80) := '.';
  queryString varchar2(4000);
begin
  queryString :=
q'~select xmlpatch(
         :b1
       , xmlelement("xd:xdiff"
         , xmlattributes(
             'http://www.w3.org/2001/XMLSchema-instance' as "xmlns:xsi"
           , 'http://xmlns.oracle.com/xdb/xdiff.xsd http://xmlns.oracle.com/xdb/xdiff.xsd' as "xsi:schemaLocation"
           , 'http://xmlns.oracle.com/xdb/xdiff.xsd' as "xmlns:xd"
         , xmlpi("oracle-xmldiff", 'operations-in-docorder="true" output-model="current"')
         , xmlagg(
             xmlelement("xd:append-node"
             , xmlattributes(
                 'attribute' as "xd:node-type"
               , '(#DATA-ID-PATH#)[' || x.NodeOrder || ']' as "xd:parent-xpath"
               , 'SECURITY' as "xd:attr-local"
             , xmlelement("xd:content", GetSecurityDesc(:b2, x.DataID))
from xmltable('#DATA-ID-PATH#'
       passing :b3
       columns DataID    integer path '#ATTRIB-PATH#'
             , NodeOrder for ordinality ) x~';
  queryString := replace(queryString, '#DATA-ID-PATH#', pDataIDPath);
  queryString := replace(queryString, '#ATTRIB-PATH#', pAttribPath);
  execute immediate queryString into vXML using vXML, BONUS_SEC, vXML ;
  dbms_output.put_line(vXML.getclobval);
end;
/probably slower though.