Methods and systems for extending row-level security policies

A system comprising:

• a processor;
• and
• a memory containing instructions which, when executed by the processor, cause the processor to implement:
• a row-level security (RLS) policy creator configured to:
• access an object database, wherein objects stored within the object database correspond to separate SQL data tables;
• create an RLS policy for a primary object stored within the object database, wherein the RLS policy comprises
• (i) an access control list specifying row-level access permissions and
• (ii) a first plurality of SQL statements implementing the access control list;
• a related object identifier configured to:
• search a relationship database separate from the object database for a set of child relationships between a set of child objects and the primary object,
• wherein the set of child objects corresponds to at least one SQL data table that requires access, via the RLS policy, to at least a portion of data stored in an SQL data table corresponding to the primary object,
• wherein the relationship database stores relationship data for relationships between objects within the object database, and
• wherein the relationship data is separate from data stored within the object database;
• filter, after the relationship database is searched, the set of child relationships to identify a set of valid child relationships by
• (i) determining whether each child relationship in the set of child relationships is valid or invalid, and
• (ii) removing each invalid child relationship, wherein the determining is distinct from the removing,
• wherein invalid child relationships include child relationships that are forbidden, circular, or duplicative;
• and
• identify, within the object database, a set of valid child objects of the primary object based on the set of valid child relationships;
• and
• an RLS policy extender configured to:
• receive a request to extend the RLS policy to the set of valid child objects;
• and extend the RLS policy to the set of valid child objects.

A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause the processor to:

• access an object database, wherein objects stored within the object database correspond to separate SQL data tables;
• create a row-level security (RLS) policy for a primary object stored within the object database, wherein the RLS policy comprises
• (i) an access control list specifying row-level access permissions and
• (ii) a first plurality of SQL statements implementing the access control list;
• search a relationship database separate from the object database for a set of child relationships between a set of child objects and the primary object,
• wherein the set of child objects corresponds to at least one SQL data table that requires access, via the RLS policy to at least a portion of data stored in an SQL data table corresponding to the primary object,
• wherein the relationship database stores relationship data for relationships between objects within the object database, and
• wherein the relationship data is separate from data stored within the object database;
• filter, after the relationship database is searched, the set of child relationships to identify a set of valid child relationships by
• (i) determining whether each child relationship in the set of child relationships is valid or invalid, and
• (ii) removing each invalid child relationship, wherein the determining is distinct from the removing,
• wherein invalid child relationships include child relationships that are forbidden, circular, or duplicative;
• identify, within the object database, a set of valid child objects of the primary object based on the set of valid child relationships;
• receive a request to extend the RLS policy to the set of valid child objects;
• and
• extend the RLS policy to the set of valid child objects.