Finding the topmost item in a denormalized hierarchy - sql-server

Question

I'm working with a set of tables that establishes a denormalized location structure with the following schema:
Location (Name,Id)
Sublocation1 (Name,Id,LocationId)
Sublocation2 (Name,Id,Sublocation1Id)
Sublocation3 (Name,Id,Sublocation2Id)
And a table that tracks the association between a user and each level:
UserLocation (User,LocationId,Sublocation1Id,Sublocation2Id,Sublocation3Id)
Access to a higher level location grants access to any level under it, so the second row in the following example is superfluous, but the third row is not:
User Location Sublocation1 Sublocation2 Sublocation3
----------------------------------------------------------------
Joe Houston Plant West Building NULL NULL
Joe Houston Plant West Building Third Floor Room 42
Joe Houston Plant East Building Second Floor Room 21
The third row grants Joe access to just room 21, but not other Sublocation3s under Second Floor
Question: How can I find all the records that grant the highest level of access without granting additional permissions to Joe? My goal is to be able to trim all these extraneous entries out of my database.
I can see a number of ways to solve this, but nothing that I've been able to translate into set-based logic to make a good query.

Answer 1

Given the following table:
CREATE TABLE UserLocation(
UserId int,
LocationId int,
Sublocation1Id int,
Sublocation2Id int,
Sublocation3Id int
)
The following query gives you the highest level accesses:
-- Highest level access:
SELECT * -- Level 3 grants with no higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NOT NULL
AND NOT EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND (UL1.Sublocation2Id IS NULL OR UL1.Sublocation2Id = UL.Sublocation2Id)
AND (UL1.Sublocation1Id IS NULL OR UL1.Sublocation1Id = UL.Sublocation1Id)
AND (UL1.LocationId = UL.LocationId)
)
UNION ALL
SELECT * -- Level 2 grants with no higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NULL
AND UL.Sublocation2Id IS NOT NULL
AND NOT EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND UL1.Sublocation2Id IS NULL
AND (UL1.Sublocation1Id IS NULL OR UL1.Sublocation1Id = UL.Sublocation1Id)
AND (UL1.LocationId = UL.LocationId)
)
UNION ALL
SELECT * -- Level 1 grants with no higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NULL
AND UL.Sublocation2Id IS NULL
AND UL.Sublocation1Id IS NOT NULL
AND NOT EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND UL1.Sublocation2Id IS NULL
AND UL1.Sublocation1Id IS NULL
AND (UL1.LocationId = UL.LocationId)
)
SELECT * -- Level 0 grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NULL
AND UL.Sublocation2Id IS NULL
AND UL.Sublocation1Id IS NULL
The following query shows you the superflous grants:
-- Superflous grants (there is higher level grants)
SELECT * -- Level 3 grants with higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NOT NULL
AND EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND (UL1.Sublocation2Id IS NULL OR UL1.Sublocation2Id = UL.Sublocation2Id)
AND (UL1.Sublocation1Id IS NULL OR UL1.Sublocation1Id = UL.Sublocation1Id)
AND (UL1.LocationId = UL.LocationId)
)
UNION ALL
SELECT * -- Level 2 grants with higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NULL
AND UL.Sublocation2Id IS NOT NULL
AND EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND UL1.Sublocation2Id IS NULL
AND (UL1.Sublocation1Id IS NULL OR UL1.Sublocation1Id = UL.Sublocation1Id)
AND (UL1.LocationId = UL.LocationId)
)
UNION ALL
SELECT * -- Level 1 grants with higher level grants
FROM UserLocation UL
WHERE
UL.Sublocation3Id IS NULL
AND UL.Sublocation2Id IS NULL
AND UL.Sublocation1Id IS NOT NULL
AND EXISTS (
SELECT * -- higher level grant
FROM UserLocation UL1
WHERE
UL1.Sublocation3Id IS NULL
AND UL1.Sublocation2Id IS NULL
AND UL1.Sublocation1Id IS NULL
AND (UL1.LocationId = UL.LocationId)
)
I assume that if the id of a location level L is null then the id of the location level L+1 is null.

Answer 2

Let's presume that UserLocation table has an Id column.
If it doesn't you can generate one using ROW_NUMBER.
In order to identify strong rules (the minimum set of existing access rules that is equivalent to all existing rules) or weak rules (a set of existing rules that are redundant because they are also covered by other "stronger" rules) you can join the UserLocation table with itself:
with access as (
select * from ( values
(1, 'Joe', 'Houston Plant', 'West Building', NULL, NULL ),
(2, 'Joe', 'Houston Plant', 'West Building', 'Third Floor', 'Room 42'),
(3, 'Joe', 'Houston Plant', 'East Building', 'Second Floor', 'Room 21'),
(4, 'Mark', 'Houston Plant', 'West Building', NULL, NULL ),
(5, 'Mark', 'Houston Plant', 'West Building', 'Third Floor', 'Room 42'),
(6, 'Mark', 'Houston Plant', 'West Building', 'Second Floor', 'Room 21'),
(7, 'Bob', null, null, NULL, NULL ),
(8, 'Bob', 'Houston Plant', 'West Building', 'Third Floor', 'Room 42'),
(9, 'Bob', 'Houston Plant', 'West Building', 'Second Floor', 'Room 21')
) as v(Id, Usr, Location1, Location2, Location3, Location4)
)
select distinct
weak.* -- or strong.*
from access strong
inner JOIN
access weak on weak.Usr = strong.Usr
and weak.Id <> strong.Id
and (strong.Location1 is null or weak.Location1 = strong.Location1)
and (strong.Location2 is null or weak.Location2 = strong.Location2)
and (strong.Location3 is null or weak.Location3 = strong.Location3)
and (strong.Location4 is null or weak.Location4 = strong.Location4)
Edit:
I figured out that there might be rules that are unique for user like:
(10, 'John', 'Houston Plant', 'West Building', 'Third Floor', 'Room 42'),
(11, 'Ana', 'Houston Plant', 'West Building', NULL, NULL )
Since the above query uses an INNER JOIN these rules are not reported in any set (weak or strong) but if you think about it you can consider that these rules are neutral so to speak because:
they do not override other rules
they are not overridden by other rules