How should i go about doing this.

Question

OS: Windows Server 2003
DB: Oracle Database 11g
basically i have a Purchase Order table (PO) that has columns like the PO Number, Supplier, Date of Purchase etc.. but no items. the items to be purchased are in another table (PO_ITEM), that has a foreign key that references the PO Number in the PO table.
what i want to do is, as long as the PO has not been approved by the Purchasing Manager, users can still make modifications in the PO_ITEM table (like the quantity of the items to be purchased). after the manager has approved the PO, noone can make modifications to the PO_ITEM that has the referenced PO Number in their foreign key. the PO has a column (status) that indicates whether it has been approved by the manager.
how do i make the restriction?
i'm thinking i should put a trigger on the PO_ITEM before each update, that checks the status of the PO. if it's been approved, the changed is rollled back. what is the command to reject an update statement in a trigger?

Answer 1

Hi,
This sounds like a job for Row Level Security (also known as Virtual Private Database, or VPD) or Fine-Grained Auditing (FGA).
These allow you to attach policies to certain types of statements, such that certain conditions are automatically added to all statements.
That is, if a user submits the statement
UPDATE     po_item
SET     quantity_ordered     = 2
WHERE     po_item_number     = 9876
;what actually gets run is:
UPDATE     po_item
SET     quantity_ordered     = 2
WHERE     po_item_number     = 9876
AND     po_number     IN (     SELECT     po_number
                    FROM     po
                    WHERE     approved     = 'N'
;You can also make this dependent on the user, so that, for example, a few privileged users can still update approved orders, but most users can not.
Check out the package dbms_rls or dbms_fga.
http://download.oracle.com/docs/cd/B28359_01/server.111/b28314/tdpdw_security.htm#sthref360