joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Developer] #424 support object column row rules

Browse Source 
Refs #424
This commit is contained in:
devmrko
2026-06-23 14:24:00 +09:00
parent 97bb0357f9
commit 09e25a2349
11 changed files with 197 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/PermissionRule.java
View File

@@ -3,6 +3,7 @@ package com.cloudhandson.vpdbackoffice.domain.permission;
public record PermissionRule(
long ruleId,
long permissionId,
String ruleColumn,
String ruleType,
String ruleValue
) {

1
src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/RuleCommand.java
View File

@@ -3,6 +3,7 @@ package com.cloudhandson.vpdbackoffice.domain.permission;
import jakarta.validation.constraints.NotBlank;
public record RuleCommand(
String ruleColumn,
@NotBlank String ruleType,
String ruleValue
) {

32
src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java
View File

@@ -19,7 +19,7 @@ import org.springframework.transaction.annotation.Transactional;
@Service
public class PermissionService {
private static final Set<String> RULE_TYPES = Set.of("ALL", "MY_DEPT", "SELF", "REGION");
private static final Set<String> RULE_TYPES = Set.of("ALL", "=", "!=", "MY_DEPT", "SELF");
private final PermissionMapper permissionMapper;
private final ProtectedObjectService protectedObjectService;
@@ -72,7 +72,7 @@ public class PermissionService {
throw new AppException("역할을 찾을 수 없습니다.");
}
protectedObjectService.assertEnabled(command.objectId());
validateRules(command.rules());
validateRules(command.objectId(), command.rules());
validateVisibleColumns(command.objectId(), command.visibleColumns());
Long existingId = permissionMapper.findPermissionId(command.roleId(), command.objectId());
@@ -88,6 +88,7 @@ public class PermissionService {
permissionMapper.insertRule(new PermissionRule(
permissionMapper.nextRuleId(),
permissionId,
normalizeNullable(rule.ruleColumn()),
normalize(rule.ruleType()),
clean(rule.ruleValue())
));
@@ -119,22 +120,30 @@ public class PermissionService {
"permissionId=" + permissionId));
}
private void validateRules(List<RuleCommand> rules) {
private void validateRules(long objectId, List<RuleCommand> rules) {
if (rules == null || rules.isEmpty()) {
throw new AppException("행 규칙은 하나 이상 필요합니다.");
}
Set<String> seen = new HashSet<>();
boolean hasAll = false;
Set<String> allowedColumns = allowedColumns(objectId);
for (RuleCommand rule : rules) {
String type = normalize(rule.ruleType());
if (!RULE_TYPES.contains(type)) {
throw new AppException("허용되지 않은 행 규칙입니다: " + type);
}
if (!seen.add(type + ":" + clean(rule.ruleValue()))) {
String column = normalizeNullable(rule.ruleColumn());
if (!"ALL".equals(type) && !allowedColumns.contains(column)) {
throw new AppException("행 규칙 컬럼은 보호 객체 컬럼이어야 합니다: " + column);
}
if (!seen.add(column + ":" + type + ":" + clean(rule.ruleValue()))) {
throw new AppException("중복된 행 규칙이 있습니다.");
}
hasAll = hasAll || "ALL".equals(type);
if (!"ALL".equals(type) && clean(rule.ruleValue()).isBlank()) {
if (!"ALL".equals(type) && column.isBlank()) {
throw new AppException(type + " 규칙에는 컬럼이 필요합니다.");
}
if (("=".equals(type) || "!=".equals(type)) && clean(rule.ruleValue()).isBlank()) {
throw new AppException(type + " 규칙에는 값이 필요합니다.");
}
}
@@ -143,6 +152,14 @@ public class PermissionService {
}
}
private Set<String> allowedColumns(long objectId) {
Set<String> allowed = new HashSet<>();
for (ProtectedColumn column : protectedObjectService.findColumns(objectId)) {
allowed.add(column.columnName().toUpperCase(Locale.ROOT));
}
return allowed;
}
private void validateVisibleColumns(long objectId, List<String> visibleColumns) {
if (visibleColumns == null || visibleColumns.isEmpty()) {
return;
@@ -162,6 +179,11 @@ public class PermissionService {
return clean(value).toUpperCase(Locale.ROOT);
}
private String normalizeNullable(String value) {
String cleaned = clean(value);
return cleaned.isBlank() ? null : cleaned.toUpperCase(Locale.ROOT);
}
private String clean(String value) {
return value == null ? "" : value.trim();
}

39
src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java
View File

@@ -6,6 +6,7 @@ import com.cloudhandson.vpdbackoffice.service.PermissionService;
import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
@@ -29,8 +30,16 @@ public class PermissionController {
@GetMapping("/permissions")
public String permissions(Model model) {
var objects = protectedObjectService.findEnabled();
model.addAttribute("roles", permissionService.findRoles());
model.addAttribute("objects", protectedObjectService.findEnabled());
model.addAttribute("objects", objects);
model.addAttribute("columnsByObject", objects.stream()
.collect(Collectors.toMap(
object -> object.objectId(),
object -> protectedObjectService.findColumns(object.objectId()).stream()
.map(column -> column.columnName())
.toList()
)));
model.addAttribute("dbObjects", protectedObjectService.findDatabaseObjects());
model.addAttribute("permissions", permissionService.findPermissionViews());
return "permissions";
@@ -40,8 +49,9 @@ public class PermissionController {
public String save(
@RequestParam long roleId,
@RequestParam String objectRef,
@RequestParam String ruleType,
@RequestParam(required = false) String ruleValue,
@RequestParam(required = false) List<String> ruleColumn,
@RequestParam List<String> ruleType,
@RequestParam(required = false) List<String> ruleValue,
@RequestParam(required = false) String visibleColumns,
RedirectAttributes redirectAttributes
) {
@@ -50,13 +60,34 @@ public class PermissionController {
roleId,
objectId,
"SELECT",
List.of(new RuleCommand(ruleType, ruleValue)),
buildRules(ruleColumn, ruleType, ruleValue),
splitColumns(visibleColumns)
));
redirectAttributes.addFlashAttribute("message", "권한을 저장했습니다.");
return "redirect:/permissions";
}
private List<RuleCommand> buildRules(
List<String> ruleColumns,
List<String> ruleTypes,
List<String> ruleValues
) {
if (ruleTypes == null || ruleTypes.isEmpty()) {
return List.of();
}
return java.util.stream.IntStream.range(0, ruleTypes.size())
.mapToObj(index -> new RuleCommand(
valueAt(ruleColumns, index),
valueAt(ruleTypes, index),
valueAt(ruleValues, index)
))
.toList();
}
private String valueAt(List<String> values, int index) {
return values == null || index >= values.size() ? null : values.get(index);
}
private long resolveObjectId(String objectRef) {
if (objectRef == null || objectRef.isBlank()) {
throw new IllegalArgumentException("보호 객체를 선택하세요.");