A secure algorithm for a Rules Engine is to always handle manipulations record-by-record. This means that for each record to be manipulated, the Rules Engine implements all restrictive and corrective rules, and only then continues with the next record.
To optimise, the USoft Rules Engine handles manipulations record-by-record only if constraints or relationships need to be checked. Otherwise, a manipulation statement for multiple records is sent directly to the RDBMS.
In the Authorizer, the Allow Set Manipulations additional parameter specifies whether manipulations are handled set-oriented or not. This parameter can be specified separately for batch and online applications. The default value of this parameter is 'False' for online applications and 'True' for batch applications.
Example
This example demonstrates the difference between handling a statement record-by-record or as a set. Suppose there is an ORDER table and an ORDER_HISTORY table. Some constraint inserts a record in the history table every time the total amount of the order changes.
A batch job, which runs once a month, removes all occurrences of closed orders in the history table.
ORDER
|
ID
|
Total
|
Status
|
1
|
15000
|
CLOSED
|
2
|
12750
|
OPEN
|
ORDERLINE
|
Order ID
|
Datetime
|
Total
|
1
|
23-SEP-1999 13:59:35
|
12000
|
1
|
23-SEP-1999 15:21:15
|
13200
|
1
|
24-SEP-1999 09:01:21
|
15000
|
2
|
24-SEP-1999 08:41:14
|
12750
|
The batch job contains a SQL statement:
DELETE FROM order_history oh
WHERE EXISTS
(
SELECT ''
FROM order o
WHERE o.id=oh.order_id
AND oh.status = 'CLOSED'
)
|
If manipulations are handled record-by-record, the Rules Engine:
1. | Locks all child records with order_id 1in the ORDER_HISTORY table. |
2. | Deletes the first record with order id 1. |
3. | Deletes the second record with order id 1. |
4. | Deletes the third record with order id 1. |
If manipulations are handled set-oriented, the handling of this batch job statement has been optimized: all history records are now deleted in one single SQL statement:
DELETE FROM ORDER_HISTORY
WHERE EXISTS (SELECT ''
FROM ORDER t1
WHERE ORDER_HISTORY.ID=t1.ID
AND t1.STATUS = 'CLOSED')
)
|
If manipulations are handled set-oriented, there will be no automatic refresh of records on the screen. Also, the Rules Engine will perform no uniqueness checks. If a unique key violation takes place, the user will see a database error message instead of a USoft error message.
The Rules Engine CANNOT handle a manipulation set-oriented if:
•Constraints that need to be evaluated have been defined on the manipulated table, except when these constraints are deactivated. •Relationship columns (primary or foreign key columns) are changed within the manipulation. Insert and delete manipulations will therefore never be handled set-oriented in case of relationships. •Authorization on column level has been defined on the manipulated table. •The manipulation statement contains an 'INVOKE' part. •The manipulated table is a view, a temporary table, or a static table. •For INSERT statements, default values are defined for columns of the manipulated table that are not specified in the statement. •Generate Unique Values has been set for a column of the manipulated table. •The manipulated table is being referenced a second time in the new-values part. •The transaction mode of the Rules Engine is specified as 'Batch Manipulation'. In batch-manipulation mode the Rules Engine collects all row events and executes them on commit time. •The Auto-Commit application property has been set to Yes. •Corrective domain constraints have been defined. •Domain checks or column checks have been defined on the manipulated table. Manipulations on subtype constellations are partially supported:
•Insert statements are not supported. •Delete statements are only supported if the whole constellation resides in the same physical table and the delete-super-on-delete attribute is switched on for all affected subtypes. •Update statements are only supported if the columns being updated reside in the same physical table and none of the updated columns is a subtype indicator. |