Abstract: A content management system may instantiate, from the same super class defined in a database schema, principal objects representing users and groups and content objects representing documents and folders. The principal objects and the content objects share the same social interaction functions. When a content object is modified, the system can create a message in which the content object identifies itself as a first person, update a message table such that any follower of the content object is notified of the message, and update a profile or feed associated with the content object. At least because content objects can “socialize” like principal objects, the system can generate a social graph containing content objects as nodes, map relationships among principal objects and content objects, and make recommendations to perhaps change/enhance such relationships.

Abstract: Disclosed can improve rights list management as well as performance of systems utilizing an access control list. A database server having a transitive closure management module may receive an identification of an entity defined in a database storing a cached transitive closure. The transitive closure management module may incrementally update the cached transitive closure stored in the database by generating a new transitive closure for the entity and determining a delete transitive closure record. The delete transitive closure record may be determined by analyzing the cached transitive closure and the new transitive closure, determining a first transitive closure path for the entity that is not specified in the new transitive closure and that is specified in the cached transitive closure, and selecting as the delete transitive closure record a record specifying the first transitive closure path. The delete transitive closure record can then be deleted from the cached transitive disclosure.

Abstract: A user authorization system may include a database server maintaining, in a database, a cached user rights list specifying associations between users and related entities from which the users inherit rights and an access control list specifying permissions of entities to access objects. A server may receive a request from a user to access an object and pass access information to the database server. The database server may filter the access control list based on the cached user rights list to generate a filtered access control list specifying permissions to the object for the user and return the filtered access control list to the server. The server may then utilize the filtered access control list returned from the database server to determine whether the user has permission to access the object.

Abstract: A hosted application gateway server node may be communicatively coupled to backend systems, client devices, and database shards associated with database servers. Through the gateway server node, various services may be provided to managed containers running on client devices such that enterprise applications can be centrally managed. A sharding manager may manage relationships of database items across database shards. Each shard stores a copy of a table representing a split of a relationship. A shard ID mask is included in each item's ID. At query time, the shard ID can be extracted and used to query the correct database. This query routing mechanism allows navigation from one shard to another when multiple items are in a relationship (e.g., share the same resource such as a document). As such, embodiments can eliminate the need for APIs to join in data that span multiple shards.