Abstract: The described implementations relate to an access control framework for a database system. One implementation can receive, from a user, a request for data that identifies a resource, such as a view that obtains data from a database. The implementation can check the identity of the user to identify user roles associated with the user. The implementation can identify an access policy that is associated with the resource, and a rule that is associated with the access policy and applies to the user roles associated with the user. The rule can be applied to the request for data using attributes of the access policy. For example, if the request for data is a query on a view, the query can be rewritten to apply the rule.

Abstract: The techniques disclosed herein enable systems to safely deploy a plurality of upgrade variants to different resource units that provide a service by utilizing small-scale deployment and validation. To deploy upgrade variants, a system receives a selection of upgrade variants from a feature group and automatically selects an appropriate set of resource units at which to deploy the upgrade variants. The system is further configured to collect and analyze telemetry data from the set of resource units to determine if any problems have occurred as a result of the deployed upgrade variants. By analyzing the telemetry data, the system can also identify one or more upgrade variants that are causing the problems. In response, the system can remove the identified variants and proceed with deployment of the remaining upgrade variants.

Abstract: The described implementations relate to an access control framework for a database system. One implementation can receive, from a user, a request for data that identifies a resource, such as a view that obtains data from a database. The implementation can check the identity of the user to identify user roles associated with the user. The implementation can identify an access policy that is associated with the resource, and a rule that is associated with the access policy and applies to the user roles associated with the user. The rule can be applied to the request for data using attributes of the access policy. For example, if the request for data is a query on a view, the query can be rewritten to apply the rule.

Abstract: The described implementations relate to an access control framework for a database system. One implementation can receive, from a user, a request for data that identifies a resource, such as a view that obtains data from a database. The implementation can check the identity of the user to identify user roles associated with the user. The implementation can identify an access policy that is associated with the resource, and a rule that is associated with the access policy and applies to the user roles associated with the user. The rule can be applied to the request for data using attributes of the access policy. For example, if the request for data is a query on a view, the query can be rewritten to apply the rule.

Abstract: Orchestration of infrastructure service blocks (ISBs) within a hosted service may be automated. A datacenter deploying the hosted service may include one or more zones, each zone including at least a network and a server farm comprising one or more servers performing various roles within an infrastructure of the hosted service. A first orchestrator may receive a network and server manifest from the datacenter to be configured within an automation framework of the first orchestrator to create an ISB and/or update another ISB for each zone of the datacenter. The created ISB and/or updated other ISB may be deployed to a second orchestrator that may image the servers within each zone of the datacenter with the created ISB and/or updated other ISB. The hosted service may then be deployed at the datacenter such that the servers within each zone of the datacenter include the created ISB and/or updated other ISB.

Abstract: The described implementations relate to an access control framework for a database system. One implementation can receive, from a user, a request for data that identifies a resource, such as a view that obtains data from a database. The implementation can check the identity of the user to identify user roles associated with the user. The implementation can identify an access policy that is associated with the resource, and a rule that is associated with the access policy and applies to the user roles associated with the user. The rule can be applied to the request for data using attributes of the access policy. For example, if the request for data is a query on a view, the query can be rewritten to apply the rule.

Abstract: Automated tenant upgrades are provided for moving tenants in a multi-tenant service from a source scale unit to a target scale unit. Before real tenants are moved, test tenants are moved and the target scale unit health is monitored. Monitoring simulates user activity in the test tenants to look for problems with the target scale unit. If no significant problems are detected after moving the test tenants, real tenants are upgraded in batches. Target scale unit monitoring continues while real tenants are being upgraded and problems reported by real tenants already upgraded to the target scale unit are also considered when assessing the target scale unit health. If a significant problem occurs, tenant upgrades are paused until the issue is resolved. Automated tenant upgrades improve usability of a multi-tenant service by minimizing the service disruptions due to upgrade problems while providing cost effective upgrades to the latest builds.

Abstract: Orchestration of infrastructure service blocks (ISBs) within a hosted service may be automated. A datacenter deploying the hosted service may include one or more zones, each zone including at least a network and a server farm comprising one or more servers performing various roles within an infrastructure of the hosted service. A first orchestrator may receive a network and server manifest from the datacenter to be configured within an automation framework of the first orchestrator to create an ISB and/or update another ISB for each zone of the datacenter. The created ISB and/or updated other ISB may be deployed to a second orchestrator that may image the servers within each zone of the datacenter with the created ISB and/or updated other ISB. The hosted service may then be deployed at the datacenter such that the servers within each zone of the datacenter include the created ISB and/or updated other ISB.

Abstract: The described implementations relate to an access control framework for a database system. One implementation can receive, from a user, a request for data that identifies a resource, such as a view that obtains data from a database. The implementation can check the identity of the user to identify user roles associated with the user. The implementation can identify an access policy that is associated with the resource, and a rule that is associated with the access policy and applies to the user roles associated with the user. The rule can be applied to the request for data using attributes of the access policy. For example, if the request for data is a query on a view, the query can be rewritten to apply the rule.

Abstract: Systems and methods for digital negatives are described. In one aspect, a digital negative is created on a computing device from a digital image. The digital image is linked to the digital negative. In response to a save operation associated with the digital image, a new digital image is generated and bi-directionally connected to the digital negative. In response to a revert operation associated with the new digital image, contents of the new digital image are replaced with contents of the digital negative.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.

Abstract: Systems and methods for digital negatives are described. In one aspect, a digital negative is created on a computing device from a digital image. The digital image is linked to the digital negative. In response to a save operation associated with the digital image, a new digital image is generated and bi-directionally connected to the digital negative. In response to a revert operation associated with the new digital image, contents of the new digital image are replaced with contents of the digital negative.

Abstract: A tool for creating integrated collections. The tool may include a “basket” control that includes interfaces for receiving and displaying the data objects that are selected by a user to be included in a collection, and a collection creation component then provides a collection with one or more data items corresponding to the objects submitted to the basket control. The basket control may be employed by itself to make collections, or it may be hosted by another software object, such as a “listmaker” control that conveniently contains both the basket control and one or more user interfaces that a user can employ to provide data objects to the basket control. The listmaker control may thus include a viewing graphical user interface for viewing data objects and a navigation toolbar for navigating the viewing graphical user interface. The listmaker control may then be hosted as desired in a variety of software applications.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.

Abstract: The present invention relates to a system and method for providing dynamic wizard interfaces to end users. In one embodiment, a client device retrieves a container encapsulating a number of packages utilizing a self-describing data format from a remote server. A wizard engine on the client device interprets the container and packages to produce a wizard interface. Preferably, the present invention utilizes a compatible data structure for receiving, saving, and transmitting captured information regarding the wizard interface.