Apress.Expert.Oracle.Database.Architecture.9i.and.10g.Programming.Techniques.and.Solutions.Sep.2005

CHAPTER 8 ■ TRANSACTIONS 279
5 pragma autonomous_transaction;
6 l_cnt number;
7 begin
8
9 select count(*) into l_cnt
10 from dual
11 where EXISTS ( select null
12 from emp
13 where empno = :new.empno
14 start with mgr = ( select empno
15 from emp
16 where ename = USER )
17 connect by prior empno = mgr );
18 if ( l_cnt = 0 )
19 then
20 insert into audit_tab ( msg )
21 values ( 'Attempt to update ' || :new.empno );
22 commit;
23
24 raise_application_error( -20001, 'Access Denied' );
25 end if;
26 end;
27 /
Trigger created.
Note the use of the CONNECT BY query. This will resolve the entire hierarchy for us, based
on the current user. It will verify that the record we are attempting to update belongs to someone
who reports to us at some level.
The main points to note about the action of this trigger are as follows:
• PRAGMA AUTONOMOUS_TRANSACTION is applied to the trigger definition. This entire trigger
is an “autonomous transaction” and so it is independent of the parent transaction, the
attempted update.
• The trigger actually reads from the table it is protecting, the EMP table, in the query.
That in itself would lead to a mutating table error at runtime were it not for the fact that
this is an autonomous transaction. The autonomous transaction gets us around this
problem—it allows us to read the table, but with the downside being that we’re not able
to see the changes we ourselves have made to the table. Extreme caution must be exercised
in such a case. This logic must be carefully inspected. What if the transaction we
were performing was an update to the employee hierarchy itself? We would not see
those changes in the trigger, and this must be taken into consideration when evaluating
the correctness of this trigger.
• This trigger commits. This has never been possible before—triggers could never commit
work. This trigger is not committing the work that actually fired the trigger; rather,
it is committing only the work that the trigger has performed (the audit record).