joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Developer] #424 remove probe wrappers from ORDS handler package

Browse Source
This commit is contained in:
devmrko
2026-06-23 15:37:20 +09:00
parent 46300e0168
commit 014e6eb3ec
1 changed files with 3 additions and 157 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
sql/adb/22_agent_ords_security_ords_handler_setup.sql
View File

@@ -12,9 +12,6 @@
-- * Object query handlers: call the common package, then query their
-- own protected table/view.
-- * VPD demo path: a fixed demo handler for ADMIN.CB_V_SEARCH_DOCUMENTS.
-- * DDS probe: Authorization header -> local mapping only. This does not
-- attach a DDS EndUserSecurityContext, so DDS cannot treat the request
-- as the mapped END USER. It is not a protected object query handler.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO OFF
@@ -24,8 +21,6 @@ PROMPT === Creating CB_ORDS handler package ===
CREATE OR REPLACE PACKAGE cb_ords_handler_pkg AUTHID DEFINER AS
PROCEDURE set_vpd_context(p_authorization IN VARCHAR2);
PROCEDURE clear_vpd_context;
FUNCTION vpd_search_json(p_authorization IN VARCHAR2) RETURN CLOB;
FUNCTION dds_bearer_probe_json(p_authorization IN VARCHAR2) RETURN CLOB;
END;
/
@@ -42,16 +37,6 @@ CREATE OR REPLACE PACKAGE BODY cb_ords_handler_pkg AS
RETURN TRIM(SUBSTR(v_auth, 8));
END;
FUNCTION mapped_dds_end_user(p_bearer_key IN VARCHAR2) RETURN VARCHAR2 AS
BEGIN
CASE p_bearer_key
WHEN 'cb_hr_key' THEN RETURN 'cb_dds_hr';
WHEN 'cb_fin_key' THEN RETURN 'cb_dds_fin';
WHEN 'cb_all_key' THEN RETURN 'cb_dds_all';
ELSE RETURN NULL;
END CASE;
END;
PROCEDURE set_vpd_context(p_authorization IN VARCHAR2) AS
v_bearer_key VARCHAR2(4000);
BEGIN
@@ -64,106 +49,6 @@ CREATE OR REPLACE PACKAGE BODY cb_ords_handler_pkg AS
BEGIN
admin.cb_agent_ctx_pkg.clear_user;
END;
FUNCTION vpd_search_json(p_authorization IN VARCHAR2) RETURN CLOB AS
v_rows_json CLOB;
v_response CLOB;
v_context_read_contents VARCHAR2(1);
BEGIN
set_vpd_context(p_authorization);
SELECT JSON_ARRAYAGG(
JSON_OBJECT(
'doc_id' VALUE doc_id,
'title' VALUE title,
'owner_emp_no' VALUE owner_emp_no,
'dept_code' VALUE dept_code,
'contents' VALUE contents
RETURNING CLOB
)
ORDER BY doc_id
RETURNING CLOB
)
INTO v_rows_json
FROM admin.cb_v_search_documents;
IF v_rows_json IS NULL THEN
v_rows_json := '[]';
END IF;
v_context_read_contents := admin.cb_agent_can_read_column('CB_V_SEARCH_DOCUMENTS', 'CONTENTS');
SELECT JSON_OBJECT(
'scenario' VALUE 'VPD_BEARER_HEADER',
'db_user' VALUE SYS_CONTEXT('USERENV', 'SESSION_USER'),
'context_user_id' VALUE SYS_CONTEXT('CB_AGENT_CTX', 'USER_ID'),
'context_emp_no' VALUE SYS_CONTEXT('CB_AGENT_CTX', 'EMP_NO'),
'context_dept_code' VALUE SYS_CONTEXT('CB_AGENT_CTX', 'DEPT_CODE'),
'context_read_contents' VALUE v_context_read_contents,
'rows' VALUE v_rows_json FORMAT JSON
RETURNING CLOB
)
INTO v_response
FROM dual;
clear_vpd_context;
RETURN v_response;
EXCEPTION
WHEN OTHERS THEN
clear_vpd_context;
RAISE;
END;
FUNCTION dds_bearer_probe_json(p_authorization IN VARCHAR2) RETURN CLOB AS
v_bearer_key VARCHAR2(4000);
v_mapped_end_user VARCHAR2(128);
v_dds_context_username VARCHAR2(128);
v_dds_context_error VARCHAR2(4000);
v_rows_visible NUMBER;
v_query_error VARCHAR2(4000);
v_result VARCHAR2(40);
v_response CLOB;
BEGIN
v_bearer_key := extract_bearer_key(p_authorization);
v_mapped_end_user := mapped_dds_end_user(v_bearer_key);
BEGIN
SELECT ORA_END_USER_CONTEXT.username
INTO v_dds_context_username
FROM dual;
EXCEPTION
WHEN OTHERS THEN
v_dds_context_error := SQLERRM;
END;
BEGIN
EXECUTE IMMEDIATE
'SELECT COUNT(*) FROM admin.cb_dds_v_search_documents'
INTO v_rows_visible;
v_result := 'UNEXPECTED_ACCESS';
EXCEPTION
WHEN OTHERS THEN
v_query_error := SQLERRM;
v_result := 'EXPECTED_BLOCKED';
END;
SELECT JSON_OBJECT(
'scenario' VALUE 'DDS_BEARER_HANDLER_PROBE',
'db_user' VALUE SYS_CONTEXT('USERENV', 'SESSION_USER'),
'bearer_mapped_end_user' VALUE v_mapped_end_user,
'dds_context_username' VALUE v_dds_context_username,
'dds_context_error' VALUE v_dds_context_error,
'rows_visible' VALUE v_rows_visible,
'query_error' VALUE v_query_error,
'result' VALUE v_result
RETURNING CLOB
)
INTO v_response
FROM dual;
RETURN v_response;
END;
END;
/
@@ -195,7 +80,7 @@ BEGIN
p_pattern => 'vpd/documents',
p_method => 'POST',
p_source_type => ORDS.source_type_plsql,
p_source => q'[
p_source => q'!
DECLARE
v_rows_json CLOB;
BEGIN
@@ -229,9 +114,9 @@ EXCEPTION
cb_ords_handler_pkg.clear_vpd_context;
:status_code := 403;
OWA_UTIL.MIME_HEADER('application/json', TRUE);
HTP.P('{"error":"' || REPLACE(SQLERRM, '"', '\"') || '"}');
HTP.P(JSON_OBJECT('error' VALUE SQLERRM RETURNING CLOB));
END;
]',
!',
p_items_per_page => 0
);
@@ -246,45 +131,6 @@ END;
p_access_method => 'IN'
);
ORDS.DEFINE_TEMPLATE(
p_module_name => 'cb.agent.security',
p_pattern => 'dds/bearer-probe'
);
ORDS.DEFINE_HANDLER(
p_module_name => 'cb.agent.security',
p_pattern => 'dds/bearer-probe',
p_method => 'POST',
p_source_type => ORDS.source_type_plsql,
p_source => q'[
DECLARE
v_response CLOB;
BEGIN
v_response := cb_ords_handler_pkg.dds_bearer_probe_json(:auth_header);
:status_code := 200;
OWA_UTIL.MIME_HEADER('application/json', TRUE);
HTP.P(v_response);
EXCEPTION
WHEN OTHERS THEN
:status_code := 403;
OWA_UTIL.MIME_HEADER('application/json', TRUE);
HTP.P('{"error":"' || REPLACE(SQLERRM, '"', '\"') || '"}');
END;
]',
p_items_per_page => 0
);
ORDS.DEFINE_PARAMETER(
p_module_name => 'cb.agent.security',
p_pattern => 'dds/bearer-probe',
p_method => 'POST',
p_name => 'Authorization',
p_bind_variable_name => 'auth_header',
p_source_type => 'HEADER',
p_param_type => 'STRING',
p_access_method => 'IN'
);
COMMIT;
END;
/