Postgres条件聚集数组

Question

我有一个包含应用程序功能的自引用树结构。 通过其他两个多对多表，我想知道用户可以访问哪些功能。

app_user (id, name, is_superuser)
feature (id, parent_id, name)
job (id, name)
job_feature_relationship (job_id, feature_id, deny)
job_user_relationship (job_id, user_id)

总结：用户可以有多个作业。 作业包含一组功能，并可以选择拒绝。 这对于在树结构中管理权限很有用，例如：

有以下功能：

sales

sales/product
sales/product/createProduct
sales/product/deleteProduct
sales/product/listProducts

sales/customer
sales/customer/createCustomer
sales/customer/deleteCustomer
sales/customer/listCustomers

只有叶节点（ createProduct ， deleteProduct ， listProducts ， createCustomer ， deleteCustomer ， listCustomers ）才是实际操作。

如果工作看起来像这样：

(sales)

用户应该能够执行销售下的所有动作，因此在此示例中，所有动作。

但是，如果工作看起来像这样：

(sales/customer)

(sales/customer/deleteCustomer, deny)

用户应该只能listCustomers和createCustomer ，因为sales/customer会允许子树中的所有内容，但是deleteCustomer会被拒绝。

最后添加的内容与该问题并不完全相关，但是superuser用户用户可以访问所有功能，这意味着，如果if_superuser bool标志设置为true，则无论作业如何，所有功能都应可访问。

我离解决方案只有一步之遥。

with recursive
feature_tree(parent, child, name, level) as (
    select id, id, feature, 1
    from feature
    union all
    select parent, id, feature.feature, feature_tree.level + 1
    from feature_tree
    join feature on (
        feature_tree.child = feature.parent_id
    )
)
select
    feature_tree.name
    , feature_tree.level
    , deny
from feature
join feature_tree on (
    feature_tree.parent = feature.id
)
left join job_feature_relationship on (
    job_feature_relationship.feature_id = feature.id
)
left join job_user_relationship on (
    job_user_relationship.job_id = job_feature_relationship.job_id
)
join app_user on (
    -- app_user.id = 1
    app_user.id = 2
    -- app_user.id = 3
    -- app_user.id = 4
)
where (
    -- this condition is responsible for only returning leafs
    not exists(select 1 from feature descendant where descendant.parent_id = feature_tree.child)
    and (
        app_user.is_superuser
        or job_user_relationship.user_id = app_user.id
    )
)
order by feature_tree.level desc;

查看此字段

我想要的内容可以很容易地按顺序描述，python示例代码：

features = set()
for feature in features:
    if feature.deny:
        features = features.difference(feature.tree)
    else:
        features = features.union(feature.tree)

由于顺序，添加和删除功能集将具有正确的最终结果。 感谢您的帮助。

Answer 1

自然，在创建所有小提琴和说明后5分钟，我成功解决了该问题。 解决方案是一种不同的方法，而不是花哨的方式进行汇总，我要做的是在尽可能低的级别上检查拒绝标志。

with recursive
feature_tree(parent, child, name, level) as (
    select id, id, feature, 1
    from feature
    union all
    select parent, id, feature.feature, feature_tree.level + 1
    from feature_tree
    join feature on (
        feature_tree.child = feature.parent_id
    )
)
, all_features(name, deny) as (
    select distinct on (feature_tree.name)
        feature_tree.name
        , not app_user.is_superuser and deny
    from feature
    join feature_tree on (
        feature_tree.parent = feature.id
    )
    left join job_feature_relationship on (
        job_feature_relationship.feature_id = feature.id
    )
    left join job_user_relationship on (
        job_user_relationship.job_id = job_feature_relationship.job_id
    )
    join app_user on (
        app_user.id = 4
    )
    where (
        (
            app_user.is_superuser
            or job_user_relationship.user_id = app_user.id
        )
        and not exists(
          select 1 
          from feature descendant 
          where descendant.parent_id = feature_tree.child
        )
    )
    order by feature_tree.name, feature_tree.level
)
select name
from all_features
where not deny;

关键指标是distinct on (name)和order by name, level的distinct on (name) 。 但是我不确定性能，我不得不创建另一个cte，因为上的distance不能让我正确过滤它们。