for (Iterator gIter = grantees.iterator(); gIter.hasNext();) {
String grantee = (String)gIter.next();
// check that role exists
RoleGrantDescriptor rdDef =
dd.getRoleDefinitionDescriptor(role);
if (rdDef == null) {
throw StandardException.
newException(SQLState.ROLE_INVALID_SPECIFICATION, role);
}
// Check that role is granted to us (or PUBLIC) with
// WITH ADMIN option so we can grant it. For database
// owner, a role definition always fulfills this
// requirement. If we implement granting with WITH ADMIN
// option later, we need to look for a grant to us (or
// PUBLIC) which has WITH ADMIN. The role definition
// descriptor will not suffice in that case, so we
// need something like:
//
// rdDef = dd.findRoleGrantWithAdminToRoleOrPublic(grantor)
// if (rdDef != null) {
// :
if (grantor.equals(lcc.getDataDictionary().
getAuthorizationDatabaseOwner())) {
// All ok, we are database owner
if (SanityManager.DEBUG) {
SanityManager.ASSERT(
rdDef.getGrantee().equals(grantor),
"expected database owner in role grant descriptor");
SanityManager.ASSERT(
rdDef.isWithAdminOption(),
"expected role definition to have ADMIN OPTION");
}
} else {
throw StandardException.newException
(SQLState.AUTH_ROLE_DBO_ONLY, "GRANT role");
}
// Has it already been granted?
RoleGrantDescriptor rgd =
dd.getRoleGrantDescriptor(role, grantee, grantor);
if (rgd != null &&
withAdminOption && !rgd.isWithAdminOption()) {
// NOTE: Never called yet, withAdminOption not yet
// implemented.
// Remove old descriptor and add a new one with admin
// option: cf. SQL 2003, section 12.5, general rule 3
rgd.drop(lcc);
rgd.setWithAdminOption(true);
dd.addDescriptor(rgd,
null, // parent
DataDictionary.SYSROLES_CATALOG_NUM,
false, // no duplicatesAllowed
tc);
} else if (rgd == null) {
// Check if the grantee is a role (if not, it is a user)
RoleGrantDescriptor granteeDef =
dd.getRoleDefinitionDescriptor(grantee);
if (granteeDef != null) {
checkCircularity(role, grantee, grantor, tc, dd);
}