<!doctype html>
<html lang="ko" xmlns:th="http://www.thymeleaf.org">
<head th:fragment="head(title)">
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title th:text="${title}">DDS 권한 운영</title>
  <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
  <link href="/css/app.css" rel="stylesheet">
  <link th:if="${backofficeTrack == 'DDS'}" href="/css/dds.css" rel="stylesheet">
  <script src="https://unpkg.com/htmx.org@2.0.4"></script>
  <script defer src="https://unpkg.com/alpinejs@3.14.8/dist/cdn.min.js"></script>
  <script defer src="/js/app.js"></script>
</head>
<body>
<nav th:fragment="nav" class="navbar rw-nav navbar-expand-lg" data-product-nav>
  <div class="container rw-nav-top">
    <a class="navbar-brand" href="/">DDS 권한 운영</a>
    <span class="badge rounded-pill text-bg-primary">Deep Data Security</span>
    <div class="rw-menu" aria-label="주요 메뉴">
      <button class="rw-menu-trigger" type="button" data-submenu-trigger="access" aria-controls="submenu-access" aria-expanded="false">권한 관리</button>
      <button class="rw-menu-trigger" type="button" data-submenu-trigger="protection" aria-controls="submenu-protection" aria-expanded="false">보호 정책 관리</button>
      <button class="rw-menu-trigger" type="button" data-submenu-trigger="knowledge" aria-controls="submenu-knowledge" aria-expanded="false">지식자료 관리</button>
      <button class="rw-menu-trigger" type="button" data-submenu-trigger="verification" aria-controls="submenu-verification" aria-expanded="false">접근 검증</button>
    </div>
    <a class="btn btn-sm rw-btn-secondary" href="/dds-admin">Admin</a>
    <form method="post" action="/logout" class="ms-auto">
      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
      <button class="btn btn-sm btn-outline-secondary" type="submit">로그아웃</button>
    </form>
  </div>
  <div class="rw-submenu-bar" data-submenu-bar hidden>
    <div class="container">
      <div id="submenu-access" class="rw-submenu" data-submenu-panel="access" role="navigation" aria-label="권한 관리 메뉴" hidden>
        <a class="nav-link" href="/users">사용자 관리</a>
        <a class="nav-link" href="/groups">그룹 관리</a>
        <a class="nav-link" href="/roles">역할 관리</a>
        <a class="nav-link" href="/permissions">접근 규칙</a>
        <a class="nav-link" href="/effective-matrix">권한 현황</a>
      </div>
      <div id="submenu-protection" class="rw-submenu" data-submenu-panel="protection" role="navigation" aria-label="보호 정책 관리 메뉴" hidden>
        <a class="nav-link" href="/dds-protection">정책 상태</a>
        <a class="nav-link" href="/dds-provision">정책 적용</a>
        <a class="nav-link" href="/dds">보호 대상 관리</a>
      </div>
      <div id="submenu-knowledge" class="rw-submenu" data-submenu-panel="knowledge" role="navigation" aria-label="지식자료 관리 메뉴" hidden>
        <a class="nav-link" href="/vector-knowledge">자료 등록 및 검색</a>
      </div>
      <div id="submenu-verification" class="rw-submenu" data-submenu-panel="verification" role="navigation" aria-label="접근 검증 메뉴" hidden>
        <a class="nav-link" href="/dds-protection#direct-check-heading">직접 접근 검증</a>
        <a class="nav-link" href="/dds-evidence">실행 근거</a>
      </div>
    </div>
  </div>
</nav>

<div th:fragment="trackNotice" th:if="${backofficeTrack == 'DDS'}" class="container pt-3">
  <div class="alert alert-info mb-0">
    <strong>DDS 보호 운영</strong> · 실제 보호는 객체별 <code>DATA GRANT</code>가 담당합니다. MCP 검색은 <code>Bearer → 업무 사용자 → local END USER Context → DATA GRANT</code>, 직접 접근 비교는 <code>END USER → DATA ROLE → DATA GRANT</code> 경로로 동작합니다.
  </div>
</div>

<section th:fragment="architectureStrip(activeLayer)" th:unless="${backofficeTrack == 'DDS'}" class="architecture-strip" aria-label="권한 설정부터 결과 확인까지의 흐름">
  <div class="architecture-step" th:classappend="${activeLayer == 'permission'} ? ' active'">
    <span class="architecture-kicker">1 · WHO / WHAT</span>
    <strong>권한 설계</strong>
    <p th:if="${backofficeTrack != 'DDS'}">누가 어떤 데이터의 어느 행과 컬럼을 볼지 정합니다.</p>
  </div>
  <div class="architecture-arrow">→</div>
  <div class="architecture-step" th:classappend="${activeLayer == 'vpd' or activeLayer == 'protection'} ? ' active'">
    <span class="architecture-kicker" th:text="${backofficeTrack == 'DDS' ? '2 · ENFORCE' : '2 · ENFORCE'}">2 · ENFORCE</span>
    <strong th:text="${backofficeTrack == 'DDS' ? '보호 상태' : 'DB 보호 연결'}">DB 보호 연결</strong>
    <p th:if="${backofficeTrack != 'DDS'}" th:text="${'VPD가 저장된 권한체계를 매번 읽어 DB에서 행을 자동 제한합니다.'}">DB 보호 정책이 권한을 적용합니다.</p>
  </div>
  <div class="architecture-arrow">→</div>
  <div class="architecture-step" th:classappend="${activeLayer == 'token'} ? ' active'">
    <span class="architecture-kicker">3 · IDENTITY</span>
    <strong th:text="${backofficeTrack == 'DDS' ? '업무 사용자 식별' : '검증 세션'}">검증 세션</strong>
    <p th:if="${backofficeTrack != 'DDS'}">확인할 사용자를 나타내는 일회성 토큰을 준비합니다.</p>
  </div>
  <div class="architecture-arrow">→</div>
  <div class="architecture-step" th:classappend="${activeLayer == 'ords'} ? ' active'">
    <span class="architecture-kicker">4 · EVIDENCE</span>
    <strong>결과 확인</strong>
    <p th:if="${backofficeTrack != 'DDS'}">보호 정책을 통과한 데이터만 실제 결과로 확인합니다.</p>
  </div>
</section>

<details th:if="${backofficeTrack == 'DDS'}" class="explanation-details architecture-explanation">
  <summary>보호 방식 기술 상세 보기</summary>
  <ol>
    <li>권한 관리에서 사용자·그룹·역할과 TAG 규칙을 정의합니다.</li>
    <li>DDS 보호 VIEW/TABLE에 객체별 DATA GRANT를 연결합니다.</li>
    <li>토큰 Context 또는 DDS END USER가 조회 주체를 전달합니다.</li>
    <li>DATA GRANT를 통과한 행과 컬럼만 결과로 반환됩니다.</li>
  </ol>
</details>
</body>
</html>
