[Developer] #424 remove probe wrappers from ORDS handler package

sql/adb/22_agent_ords_security_ords_handler_setup.sql

@@ -12,9 +12,6 @@
 --   * Object query handlers: call the common package, then query their
 --     own protected table/view.
 --   * VPD demo path: a fixed demo handler for ADMIN.CB_V_SEARCH_DOCUMENTS.
---   * DDS probe: Authorization header -> local mapping only. This does not
---     attach a DDS EndUserSecurityContext, so DDS cannot treat the request
---     as the mapped END USER. It is not a protected object query handler.
 -- ============================================================
 WHENEVER SQLERROR EXIT SQL.SQLCODE
 SET ECHO OFF
@@ -24,8 +21,6 @@ PROMPT === Creating CB_ORDS handler package ===
 CREATE OR REPLACE PACKAGE cb_ords_handler_pkg AUTHID DEFINER AS
   PROCEDURE set_vpd_context(p_authorization IN VARCHAR2);
   PROCEDURE clear_vpd_context;
-  FUNCTION vpd_search_json(p_authorization IN VARCHAR2) RETURN CLOB;
-  FUNCTION dds_bearer_probe_json(p_authorization IN VARCHAR2) RETURN CLOB;
 END;
 /
 
@@ -42,16 +37,6 @@ CREATE OR REPLACE PACKAGE BODY cb_ords_handler_pkg AS
     RETURN TRIM(SUBSTR(v_auth, 8));
   END;
 
-  FUNCTION mapped_dds_end_user(p_bearer_key IN VARCHAR2) RETURN VARCHAR2 AS
-  BEGIN
-    CASE p_bearer_key
-      WHEN 'cb_hr_key'  THEN RETURN 'cb_dds_hr';
-      WHEN 'cb_fin_key' THEN RETURN 'cb_dds_fin';
-      WHEN 'cb_all_key' THEN RETURN 'cb_dds_all';
-      ELSE RETURN NULL;
-    END CASE;
-  END;
-
   PROCEDURE set_vpd_context(p_authorization IN VARCHAR2) AS
     v_bearer_key VARCHAR2(4000);
   BEGIN
@@ -64,106 +49,6 @@ CREATE OR REPLACE PACKAGE BODY cb_ords_handler_pkg AS
   BEGIN
     admin.cb_agent_ctx_pkg.clear_user;
   END;
-
-  FUNCTION vpd_search_json(p_authorization IN VARCHAR2) RETURN CLOB AS
-    v_rows_json  CLOB;
-    v_response   CLOB;
-    v_context_read_contents VARCHAR2(1);
-  BEGIN
-    set_vpd_context(p_authorization);
-
-    SELECT JSON_ARRAYAGG(
-             JSON_OBJECT(
-               'doc_id'       VALUE doc_id,
-               'title'        VALUE title,
-               'owner_emp_no' VALUE owner_emp_no,
-               'dept_code'    VALUE dept_code,
-               'contents'     VALUE contents
-               RETURNING CLOB
-             )
-             ORDER BY doc_id
-             RETURNING CLOB
-           )
-    INTO   v_rows_json
-    FROM   admin.cb_v_search_documents;
-
-    IF v_rows_json IS NULL THEN
-      v_rows_json := '[]';
-    END IF;
-
-    v_context_read_contents := admin.cb_agent_can_read_column('CB_V_SEARCH_DOCUMENTS', 'CONTENTS');
-
-    SELECT JSON_OBJECT(
-             'scenario'              VALUE 'VPD_BEARER_HEADER',
-             'db_user'               VALUE SYS_CONTEXT('USERENV', 'SESSION_USER'),
-             'context_user_id'       VALUE SYS_CONTEXT('CB_AGENT_CTX', 'USER_ID'),
-             'context_emp_no'        VALUE SYS_CONTEXT('CB_AGENT_CTX', 'EMP_NO'),
-             'context_dept_code'     VALUE SYS_CONTEXT('CB_AGENT_CTX', 'DEPT_CODE'),
-             'context_read_contents' VALUE v_context_read_contents,
-             'rows'                  VALUE v_rows_json FORMAT JSON
-             RETURNING CLOB
-           )
-    INTO   v_response
-    FROM   dual;
-
-    clear_vpd_context;
-    RETURN v_response;
-  EXCEPTION
-    WHEN OTHERS THEN
-      clear_vpd_context;
-      RAISE;
-  END;
-
-  FUNCTION dds_bearer_probe_json(p_authorization IN VARCHAR2) RETURN CLOB AS
-    v_bearer_key           VARCHAR2(4000);
-    v_mapped_end_user      VARCHAR2(128);
-    v_dds_context_username VARCHAR2(128);
-    v_dds_context_error    VARCHAR2(4000);
-    v_rows_visible         NUMBER;
-    v_query_error          VARCHAR2(4000);
-    v_result               VARCHAR2(40);
-    v_response             CLOB;
-  BEGIN
-    v_bearer_key := extract_bearer_key(p_authorization);
-    v_mapped_end_user := mapped_dds_end_user(v_bearer_key);
-
-    BEGIN
-      SELECT ORA_END_USER_CONTEXT.username
-      INTO   v_dds_context_username
-      FROM   dual;
-    EXCEPTION
-      WHEN OTHERS THEN
-        v_dds_context_error := SQLERRM;
-    END;
-
-    BEGIN
-      EXECUTE IMMEDIATE
-        'SELECT COUNT(*) FROM admin.cb_dds_v_search_documents'
-      INTO v_rows_visible;
-
-      v_result := 'UNEXPECTED_ACCESS';
-    EXCEPTION
-      WHEN OTHERS THEN
-        v_query_error := SQLERRM;
-        v_result := 'EXPECTED_BLOCKED';
-    END;
-
-    SELECT JSON_OBJECT(
-             'scenario'              VALUE 'DDS_BEARER_HANDLER_PROBE',
-             'db_user'               VALUE SYS_CONTEXT('USERENV', 'SESSION_USER'),
-             'bearer_mapped_end_user' VALUE v_mapped_end_user,
-             'dds_context_username'  VALUE v_dds_context_username,
-             'dds_context_error'     VALUE v_dds_context_error,
-             'rows_visible'          VALUE v_rows_visible,
-             'query_error'           VALUE v_query_error,
-             'result'                VALUE v_result
-             RETURNING CLOB
-           )
-    INTO   v_response
-    FROM   dual;
-
-    RETURN v_response;
-  END;
 END;
 /
 
@@ -195,7 +80,7 @@ BEGIN
     p_pattern        => 'vpd/documents',
     p_method         => 'POST',
     p_source_type    => ORDS.source_type_plsql,
-    p_source         => q'[
+    p_source         => q'!
 DECLARE
   v_rows_json CLOB;
 BEGIN
@@ -229,9 +114,9 @@ EXCEPTION
     cb_ords_handler_pkg.clear_vpd_context;
     :status_code := 403;
     OWA_UTIL.MIME_HEADER('application/json', TRUE);
-    HTP.P('{"error":"' || REPLACE(SQLERRM, '"', '\"') || '"}');
+    HTP.P(JSON_OBJECT('error' VALUE SQLERRM RETURNING CLOB));
 END;
-]',
+!',
     p_items_per_page => 0
   );
 
@@ -246,45 +131,6 @@ END;
     p_access_method      => 'IN'
   );
 
-  ORDS.DEFINE_TEMPLATE(
-    p_module_name => 'cb.agent.security',
-    p_pattern     => 'dds/bearer-probe'
-  );
-
-  ORDS.DEFINE_HANDLER(
-    p_module_name    => 'cb.agent.security',
-    p_pattern        => 'dds/bearer-probe',
-    p_method         => 'POST',
-    p_source_type    => ORDS.source_type_plsql,
-    p_source         => q'[
-DECLARE
-  v_response CLOB;
-BEGIN
-  v_response := cb_ords_handler_pkg.dds_bearer_probe_json(:auth_header);
-  :status_code := 200;
-  OWA_UTIL.MIME_HEADER('application/json', TRUE);
-  HTP.P(v_response);
-EXCEPTION
-  WHEN OTHERS THEN
-    :status_code := 403;
-    OWA_UTIL.MIME_HEADER('application/json', TRUE);
-    HTP.P('{"error":"' || REPLACE(SQLERRM, '"', '\"') || '"}');
-END;
-]',
-    p_items_per_page => 0
-  );
-
-  ORDS.DEFINE_PARAMETER(
-    p_module_name        => 'cb.agent.security',
-    p_pattern            => 'dds/bearer-probe',
-    p_method             => 'POST',
-    p_name               => 'Authorization',
-    p_bind_variable_name => 'auth_header',
-    p_source_type        => 'HEADER',
-    p_param_type         => 'STRING',
-    p_access_method      => 'IN'
-  );
-
   COMMIT;
 END;
 /