MONDRIAN: Fix bug 2141337, "Roles and virtual cubes".

[git-p4: depot-paths = "//open/mondrian/": change = 11671]

src/main/mondrian/olap/RoleImpl.java

@@ -192,7 +192,7 @@ public Access getAccess(Dimension dimension) {
             }
             final Dimension[] dimensions = cubeGrant.getKey().getDimensions();
             for (Dimension dimension1 : dimensions) {
-                if (dimension1 == dimension) {
+                if (dimension1.equals(dimension)) {
                     return access;
                 }
             }

src/main/mondrian/rolap/RolapCube.java

@@ -1040,15 +1040,13 @@ private void register() {
         if (isVirtual()) {
             return;
         }
-        List<Member> list = new ArrayList<Member>();
-        List<Member> measures = getMeasures();
-        for (Member measure : measures) {
+        List<RolapBaseCubeMeasure> storedMeasures =
+            new ArrayList<RolapBaseCubeMeasure>();
+        for (Member measure : getMeasures()) {
             if (measure instanceof RolapBaseCubeMeasure) {
-                list.add(measure);
+                storedMeasures.add((RolapBaseCubeMeasure) measure);
             }
         }
-        RolapBaseCubeMeasure[] storedMeasures =
-            list.toArray(new RolapBaseCubeMeasure[list.size()]);
 
         RolapStar star = getStar();
         RolapStar.Table table = star.getFactTable();

src/main/mondrian/rolap/RolapHierarchy.java

@@ -261,7 +261,7 @@ void setMemberReader(MemberReader memberReader) {
     }
 
     MemberReader getMemberReader() {
-        return this.memberReader;
+        return memberReader;
     }
 
     RolapLevel newMeasuresLevel() {
@@ -543,13 +543,17 @@ private static MondrianDef.RelationOrJoin lookupRelationSubset(
      * <p>This method may not be efficient, so the caller should take care
      * not to call it too often. A cache is a good idea.
      *
+     * @param role Role
+     * @return Member reader that implements access control
+     *
      * @pre role != null
      * @post return != null
      */
     MemberReader createMemberReader(Role role) {
         final Access access = role.getAccess(this);
         switch (access) {
         case NONE:
+            role.getAccess(this); // todo: remove
             throw Util.newInternal("Illegal access to members of hierarchy "
                     + this);
         case ALL:
@@ -609,7 +613,7 @@ public void unparse(Exp[] args, PrintWriter pw) {
                         new Exp[0],
                         returnType);
                 return new LimitedRollupSubstitutingMemberReader(
-                    role, hierarchyAccess, partialExp);
+                    getMemberReader(), role, hierarchyAccess, partialExp);
 
             case HIDDEN:
                 Exp hiddenExp =
@@ -628,7 +632,7 @@ public void unparse(Exp[] args, PrintWriter pw) {
                         new Exp[0],
                         returnType);
                 return new LimitedRollupSubstitutingMemberReader(
-                    role, hierarchyAccess, hiddenExp);
+                    getMemberReader(), role, hierarchyAccess, hiddenExp);
             default:
                 throw Util.unexpected(rollupPolicy);
             }
@@ -927,20 +931,29 @@ public boolean isCalculated() {
      * role has limited access to the hierarchy, replaces members with
      * dummy members which evaluate to the sum of only the accessible children.
      */
-    private class LimitedRollupSubstitutingMemberReader
+    private static class LimitedRollupSubstitutingMemberReader
         extends SubstitutingMemberReader
     {
         private final Role.HierarchyAccess hierarchyAccess;
         private final Exp exp;
 
+        /**
+         * Creates a LimitedRollupSubstitutingMemberReader.
+         *
+         * @param memberReader Underlying member reader
+         * @param role Role to enforce
+         * @param hierarchyAccess Access this role has to the hierarchy
+         * @param exp Expression for hidden member
+         */
         public LimitedRollupSubstitutingMemberReader(
+            MemberReader memberReader,
             Role role,
             Role.HierarchyAccess hierarchyAccess,
             Exp exp)
         {
             super(
                 new RestrictedMemberReader(
-                    RolapHierarchy.this.getMemberReader(), role));
+                    memberReader, role));
             this.hierarchyAccess = hierarchyAccess;
             this.exp = exp;
         }

testsrc/main/mondrian/test/AccessControlTest.java

@@ -1399,6 +1399,59 @@ public void reset() {
             }
         }
     }
+
+    /**
+     * Tests that hierarchy-level access control works on a virtual cube.
+     * See bug
+     * <a href="https://sourceforge.net/tracker/index.php?func=detail&aid=2141337&group_id=35302&atid=414613">
+     * 2141337, "Roles and virtual cubes"</a>.
+     */
+    public void testVirtualCube() {
+        TestContext testContext = TestContext.create(
+            null, null, null, null, null,
+            "<Role name=\"VCRole\">\n"
+                + "  <SchemaGrant access=\"none\">\n"
+                + "    <CubeGrant cube=\"Warehouse and Sales\" access=\"all\">\n"
+                + "      <HierarchyGrant hierarchy=\"[Store]\" access=\"custom\"\n"
+                + "          topLevel=\"[Store].[Store Country]\">\n"
+                + "        <MemberGrant member=\"[Store].[USA].[CA]\" access=\"all\"/>\n"
+                + "        <MemberGrant member=\"[Store].[USA].[CA].[Los Angeles]\" access=\"none\"/>\n"
+                + "      </HierarchyGrant>\n"
+                + "      <HierarchyGrant hierarchy=\"[Customers]\" access=\"custom\"\n"
+                + "          topLevel=\"[Customers].[State Province]\" bottomLevel=\"[Customers].[City]\">\n"
+                + "        <MemberGrant member=\"[Customers].[USA].[CA]\" access=\"all\"/>\n"
+                + "        <MemberGrant member=\"[Customers].[USA].[CA].[Los Angeles]\" access=\"none\"/>\n"
+                + "      </HierarchyGrant>\n"
+                + "      <HierarchyGrant hierarchy=\"[Gender]\" access=\"none\"/>\n"
+                + "    </CubeGrant>\n"
+                + "  </SchemaGrant>\n"
+                + "</Role>").withRole("VCRole");
+        testContext.assertQueryReturns(
+            "select [Store].Members on 0 from [Warehouse and Sales]",
+            fold("Axis #0:\n" +
+                "{}\n" +
+                "Axis #1:\n" +
+                "{[Store].[All Stores].[USA]}\n" +
+                "{[Store].[All Stores].[USA].[CA]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[Alameda]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[Alameda].[HQ]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[Beverly Hills]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[Beverly Hills].[Store 6]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[San Diego]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[San Diego].[Store 24]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[San Francisco]}\n" +
+                "{[Store].[All Stores].[USA].[CA].[San Francisco].[Store 14]}\n" +
+                "Row #0: 159,167.84\n" +
+                "Row #0: 159,167.84\n" +
+                "Row #0: \n" +
+                "Row #0: \n" +
+                "Row #0: 45,750.24\n" +
+                "Row #0: 45,750.24\n" +
+                "Row #0: 54,431.14\n" +
+                "Row #0: 54,431.14\n" +
+                "Row #0: 4,441.18\n" +
+                "Row #0: 4,441.18\n"));
+    }
 }
 
 // End AccessControlTest.java