A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for data analytics in a first data center using transactional data of a second data center, the operations comprising:
- receiving, by a query manager service (QMS) executed within a database server of the first data center, a query definition provided from a browser of an analytics platform executed within the second data center, the query definition being stored in a query repository of the second data center, being validated by the QMS based on analytical metadata, and being stored in a mirror query repository of the first data center;
- providing, after validation of the query definition by the QMS, a raw calculation scenario as an object model based on the query definition, the raw calculation scenario being absent user-specific permissions;
- retrieving, by the QMS, user-specific permission metadata from a transactional application executed within an application server of the first data center to provide an enriched calculation scenario that includes user-specific permissions of the user, the user-specific permissions comprising cell-based permissions, row-based permissions, and field-based permissions of the user for accessing at least a portion of transactional data stored within the first data center;
- executing, by a calculation engine within the first data center, the enriched calculation scenario to provide an analytical artifact comprising a query-level calculation view on transactional data stored in the first data center, the executing comprising initially executing a row permission base join to replace a base transactional data source in at least one subsequent cell permission group, and subsequently executing a cell permission base join, where the cell permission base join is formed by a projection on cell group columns with a union of permission table function is inner-joined, and a permission compound join to provide a root compound projection to determine the transactional data that the user is allowed to access based on the field-based permissions;
- and
- transmitting, by the first data center, the analytical artifact to the second data center to perform analytics on at least a portion of the transactional data stored in the first data center.