[Developer] #424 support object column row rules

Refs #424

sql/adb/17_agent_ords_security_local_vpd_setup.sql

@@ -71,6 +71,7 @@ CREATE TABLE cb_permission (
 CREATE TABLE cb_permission_rule (
   rule_id     NUMBER PRIMARY KEY,
   perm_id     NUMBER NOT NULL REFERENCES cb_permission(perm_id),
+  rule_column VARCHAR2(128),
   rule_type   VARCHAR2(30) NOT NULL,
   rule_value  VARCHAR2(100)
 );
@@ -293,6 +294,24 @@ BEGIN
                     r.rule_type = ''EMP_NO''
                     AND r.rule_value = owner_emp_no
                   )
+               OR (
+                    r.rule_type = ''=''
+                    AND (
+                         (r.rule_column = ''DOC_ID'' AND TO_CHAR(doc_id) = r.rule_value)
+                         OR (r.rule_column = ''TITLE'' AND title = r.rule_value)
+                         OR (r.rule_column = ''OWNER_EMP_NO'' AND owner_emp_no = r.rule_value)
+                         OR (r.rule_column = ''DEPT_CODE'' AND dept_code = r.rule_value)
+                    )
+                  )
+               OR (
+                    r.rule_type = ''!=''
+                    AND (
+                         (r.rule_column = ''DOC_ID'' AND TO_CHAR(doc_id) != r.rule_value)
+                         OR (r.rule_column = ''TITLE'' AND title != r.rule_value)
+                         OR (r.rule_column = ''OWNER_EMP_NO'' AND owner_emp_no != r.rule_value)
+                         OR (r.rule_column = ''DEPT_CODE'' AND dept_code != r.rule_value)
+                    )
+                  )
              )
      )';
 END;

sql/adb/25_agent_ords_security_backoffice_support.sql

@@ -42,6 +42,16 @@ END;
 /
 
 PROMPT === Creating protected object whitelist ===
+BEGIN
+  EXECUTE IMMEDIATE 'ALTER TABLE cb_permission_rule ADD (rule_column VARCHAR2(128))';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -1430 THEN
+      RAISE;
+    END IF;
+END;
+/
+
 CREATE TABLE cb_protected_object (
   object_id    NUMBER PRIMARY KEY,
   owner        VARCHAR2(128) NOT NULL,

src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/PermissionRule.java

@@ -3,6 +3,7 @@ package com.cloudhandson.vpdbackoffice.domain.permission;
 public record PermissionRule(
     long ruleId,
     long permissionId,
+    String ruleColumn,
     String ruleType,
     String ruleValue
 ) {

src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/RuleCommand.java

@@ -3,6 +3,7 @@ package com.cloudhandson.vpdbackoffice.domain.permission;
 import jakarta.validation.constraints.NotBlank;
 
 public record RuleCommand(
+    String ruleColumn,
     @NotBlank String ruleType,
     String ruleValue
 ) {

src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java

@@ -19,7 +19,7 @@ import org.springframework.transaction.annotation.Transactional;
 @Service
 public class PermissionService {
 
-  private static final Set<String> RULE_TYPES = Set.of("ALL", "MY_DEPT", "SELF", "REGION");
+  private static final Set<String> RULE_TYPES = Set.of("ALL", "=", "!=", "MY_DEPT", "SELF");
 
   private final PermissionMapper permissionMapper;
   private final ProtectedObjectService protectedObjectService;
@@ -72,7 +72,7 @@ public class PermissionService {
       throw new AppException("역할을 찾을 수 없습니다.");
     }
     protectedObjectService.assertEnabled(command.objectId());
-    validateRules(command.rules());
+    validateRules(command.objectId(), command.rules());
     validateVisibleColumns(command.objectId(), command.visibleColumns());
 
     Long existingId = permissionMapper.findPermissionId(command.roleId(), command.objectId());
@@ -88,6 +88,7 @@ public class PermissionService {
       permissionMapper.insertRule(new PermissionRule(
           permissionMapper.nextRuleId(),
           permissionId,
+          normalizeNullable(rule.ruleColumn()),
           normalize(rule.ruleType()),
           clean(rule.ruleValue())
       ));
@@ -119,22 +120,30 @@ public class PermissionService {
         "permissionId=" + permissionId));
   }
 
-  private void validateRules(List<RuleCommand> rules) {
+  private void validateRules(long objectId, List<RuleCommand> rules) {
     if (rules == null || rules.isEmpty()) {
       throw new AppException("행 규칙은 하나 이상 필요합니다.");
     }
     Set<String> seen = new HashSet<>();
     boolean hasAll = false;
+    Set<String> allowedColumns = allowedColumns(objectId);
     for (RuleCommand rule : rules) {
       String type = normalize(rule.ruleType());
       if (!RULE_TYPES.contains(type)) {
         throw new AppException("허용되지 않은 행 규칙입니다: " + type);
       }
-      if (!seen.add(type + ":" + clean(rule.ruleValue()))) {
+      String column = normalizeNullable(rule.ruleColumn());
+      if (!"ALL".equals(type) && !allowedColumns.contains(column)) {
+        throw new AppException("행 규칙 컬럼은 보호 객체 컬럼이어야 합니다: " + column);
+      }
+      if (!seen.add(column + ":" + type + ":" + clean(rule.ruleValue()))) {
         throw new AppException("중복된 행 규칙이 있습니다.");
       }
       hasAll = hasAll || "ALL".equals(type);
-      if (!"ALL".equals(type) && clean(rule.ruleValue()).isBlank()) {
+      if (!"ALL".equals(type) && column.isBlank()) {
+        throw new AppException(type + " 규칙에는 컬럼이 필요합니다.");
+      }
+      if (("=".equals(type) || "!=".equals(type)) && clean(rule.ruleValue()).isBlank()) {
         throw new AppException(type + " 규칙에는 값이 필요합니다.");
       }
     }
@@ -143,6 +152,14 @@ public class PermissionService {
     }
   }
 
+  private Set<String> allowedColumns(long objectId) {
+    Set<String> allowed = new HashSet<>();
+    for (ProtectedColumn column : protectedObjectService.findColumns(objectId)) {
+      allowed.add(column.columnName().toUpperCase(Locale.ROOT));
+    }
+    return allowed;
+  }
+
   private void validateVisibleColumns(long objectId, List<String> visibleColumns) {
     if (visibleColumns == null || visibleColumns.isEmpty()) {
       return;
@@ -162,6 +179,11 @@ public class PermissionService {
     return clean(value).toUpperCase(Locale.ROOT);
   }
 
+  private String normalizeNullable(String value) {
+    String cleaned = clean(value);
+    return cleaned.isBlank() ? null : cleaned.toUpperCase(Locale.ROOT);
+  }
+
   private String clean(String value) {
     return value == null ? "" : value.trim();
   }

src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java

@@ -6,6 +6,7 @@ import com.cloudhandson.vpdbackoffice.service.PermissionService;
 import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
 import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Collectors;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -29,8 +30,16 @@ public class PermissionController {
 
   @GetMapping("/permissions")
   public String permissions(Model model) {
+    var objects = protectedObjectService.findEnabled();
     model.addAttribute("roles", permissionService.findRoles());
-    model.addAttribute("objects", protectedObjectService.findEnabled());
+    model.addAttribute("objects", objects);
+    model.addAttribute("columnsByObject", objects.stream()
+        .collect(Collectors.toMap(
+            object -> object.objectId(),
+            object -> protectedObjectService.findColumns(object.objectId()).stream()
+                .map(column -> column.columnName())
+                .toList()
+        )));
     model.addAttribute("dbObjects", protectedObjectService.findDatabaseObjects());
     model.addAttribute("permissions", permissionService.findPermissionViews());
     return "permissions";
@@ -40,8 +49,9 @@ public class PermissionController {
   public String save(
       @RequestParam long roleId,
       @RequestParam String objectRef,
-      @RequestParam String ruleType,
+      @RequestParam(required = false) List<String> ruleColumn,
-      @RequestParam(required = false) String ruleValue,
+      @RequestParam List<String> ruleType,
+      @RequestParam(required = false) List<String> ruleValue,
       @RequestParam(required = false) String visibleColumns,
       RedirectAttributes redirectAttributes
   ) {
@@ -50,13 +60,34 @@ public class PermissionController {
         roleId,
         objectId,
         "SELECT",
-        List.of(new RuleCommand(ruleType, ruleValue)),
+        buildRules(ruleColumn, ruleType, ruleValue),
         splitColumns(visibleColumns)
     ));
     redirectAttributes.addFlashAttribute("message", "권한을 저장했습니다.");
     return "redirect:/permissions";
   }
 
+  private List<RuleCommand> buildRules(
+      List<String> ruleColumns,
+      List<String> ruleTypes,
+      List<String> ruleValues
+  ) {
+    if (ruleTypes == null || ruleTypes.isEmpty()) {
+      return List.of();
+    }
+    return java.util.stream.IntStream.range(0, ruleTypes.size())
+        .mapToObj(index -> new RuleCommand(
+            valueAt(ruleColumns, index),
+            valueAt(ruleTypes, index),
+            valueAt(ruleValues, index)
+        ))
+        .toList();
+  }
+
+  private String valueAt(List<String> values, int index) {
+    return values == null || index >= values.size() ? null : values.get(index);
+  }
+
   private long resolveObjectId(String objectRef) {
     if (objectRef == null || objectRef.isBlank()) {
       throw new IllegalArgumentException("보호 객체를 선택하세요.");

src/main/resources/mapper/PermissionMapper.xml

@@ -35,7 +35,12 @@
            o.object_id,
            p.target_name AS object_name,
            p.action_name AS action,
-           LISTAGG(pr.rule_type || NVL2(pr.rule_value, ':' || pr.rule_value, ''), ', ')
+           LISTAGG(
+             NVL2(pr.rule_column, pr.rule_column || ' ', '') ||
+             pr.rule_type ||
+             NVL2(pr.rule_value, ' ' || pr.rule_value, ''),
+             ', '
+           )
              WITHIN GROUP (ORDER BY pr.rule_id) AS rules,
            (
              SELECT LISTAGG(pc.column_name, ', ') WITHIN GROUP (ORDER BY pc.column_name)
@@ -96,8 +101,14 @@
   </delete>
 
   <insert id="insertRule" parameterType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionRule">
-    INSERT INTO cb_permission_rule (rule_id, perm_id, rule_type, rule_value)
+    INSERT INTO cb_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
-    VALUES (#{ruleId}, #{permissionId}, #{ruleType}, #{ruleValue})
+    VALUES (
+      #{ruleId,jdbcType=NUMERIC},
+      #{permissionId,jdbcType=NUMERIC},
+      #{ruleColumn,jdbcType=VARCHAR},
+      #{ruleType,jdbcType=VARCHAR},
+      #{ruleValue,jdbcType=VARCHAR}
+    )
   </insert>
 
   <delete id="deleteVisibleColumns">

src/main/resources/static/css/app.css

@@ -168,6 +168,24 @@ body {
   padding-bottom: 1rem;
 }
 
+.field-block-title {
+  color: var(--rw-muted);
+  font-size: .875rem;
+  font-weight: 700;
+  margin-bottom: .35rem;
+}
+
+.rule-list {
+  display: grid;
+  gap: .5rem;
+}
+
+.rule-row {
+  display: grid;
+  gap: .5rem;
+  grid-template-columns: 1fr 1fr 1fr auto;
+}
+
 .rw-btn,
 .btn {
   border-radius: 999px;

src/main/resources/static/js/app.js

@@ -28,10 +28,49 @@ function filterUserRoleDetail() {
   empty.hidden = shown !== 0;
 }
 
+function syncRuleColumnOptions() {
+  const objectSelect = document.querySelector('select[name="objectRef"]');
+  if (!objectSelect) {
+    return;
+  }
+  const selectedOption = objectSelect.options[objectSelect.selectedIndex];
+  const columns = (selectedOption?.dataset.columns || '').split(',').filter(Boolean);
+  document.querySelectorAll('.rule-column-select').forEach((select) => {
+    const current = select.value;
+    select.innerHTML = '<option value="">전체 행</option>' + columns
+        .map((column) => `<option value="${column}">${column}</option>`)
+        .join('');
+    if (columns.includes(current)) {
+      select.value = current;
+    }
+  });
+}
+
 document.addEventListener('DOMContentLoaded', () => {
   const master = document.getElementById('userRoleMaster');
   if (master) {
     master.addEventListener('change', filterUserRoleDetail);
     filterUserRoleDetail();
   }
+  const objectSelect = document.querySelector('select[name="objectRef"]');
+  if (objectSelect) {
+    objectSelect.addEventListener('change', syncRuleColumnOptions);
+    syncRuleColumnOptions();
+  }
+  document.querySelectorAll('[data-rule-add]').forEach((button) => {
+    button.addEventListener('click', () => {
+      const row = button.closest('.rule-row');
+      const list = document.getElementById('rowRuleList');
+      if (!row || !list) {
+        return;
+      }
+      const clone = row.cloneNode(true);
+      clone.querySelectorAll('input').forEach((input) => input.value = '');
+      const cloneButton = clone.querySelector('[data-rule-add]');
+      cloneButton.textContent = '삭제';
+      cloneButton.addEventListener('click', () => clone.remove());
+      list.appendChild(clone);
+      syncRuleColumnOptions();
+    });
+  });
 });

src/main/resources/templates/permissions.html

@@ -27,6 +27,7 @@
           <optgroup label="등록된 보호 객체">
             <option th:each="object : ${objects}"
                     th:value="${'protected:' + object.objectId()}"
+                    th:attr="data-columns=${#strings.listJoin(columnsByObject[object.objectId()], ',')}"
                     th:text="${object.displayName()}"></option>
           </optgroup>
           <optgroup label="DB 스키마 객체">
@@ -36,23 +37,33 @@
           </optgroup>
         </select>
       </label>
-      <label>
+      <div class="span-2">
-        행 규칙
+        <div class="field-block-title">행 규칙</div>
-        <select class="form-select" name="ruleType">
+        <div id="rowRuleList" class="rule-list">
-          <option value="ALL">ALL</option>
+          <div class="rule-row">
-          <option value="REGION">REGION</option>
+            <select class="form-select rule-column-select" name="ruleColumn">
-          <option value="MY_DEPT">MY_DEPT</option>
+              <option value="">전체 행</option>
-          <option value="SELF">SELF</option>
+              <option value="DEPT_CODE">DEPT_CODE</option>
-        </select>
+              <option value="OWNER_EMP_NO">OWNER_EMP_NO</option>
-      </label>
+              <option value="DOC_ID">DOC_ID</option>
-      <label>
+              <option value="TITLE">TITLE</option>
-        규칙 값
+            </select>
-        <input class="form-control" name="ruleValue" placeholder="APAC 또는 HR">
+            <select class="form-select" name="ruleType">
-      </label>
+              <option value="ALL">ALL</option>
-      <label>
+              <option value="=">=</option>
-        NULL 제외 컬럼
+              <option value="!=">!=</option>
+              <option value="MY_DEPT">현재 사용자 부서</option>
+              <option value="SELF">현재 사용자 사번</option>
+            </select>
+            <input class="form-control" name="ruleValue" placeholder="비교 값">
+            <button class="btn btn-outline-secondary" type="button" data-rule-add>추가</button>
+          </div>
+        </div>
+      </div>
+      <div class="span-2">
+        <div class="field-block-title">컬럼 NULL 처리 예외</div>
         <input class="form-control" name="visibleColumns" placeholder="CONTENTS">
-      </label>
+      </div>
       <button class="btn btn-primary" type="submit">저장</button>
     </form>
   </section>

src/test/java/com/cloudhandson/vpdbackoffice/service/PermissionServiceTest.java

@@ -35,7 +35,10 @@ class PermissionServiceTest {
 
       @Override
       public List<ProtectedColumn> findColumns(long objectId) {
-        return List.of();
+        return List.of(
+            new ProtectedColumn(1L, 1L, "DEPT_CODE", "N", null),
+            new ProtectedColumn(2L, 1L, "OWNER_EMP_NO", "N", null)
+        );
       }
     };
     permissionService = new PermissionService(permissionMapper, protectedObjectService, auditService);
@@ -47,7 +50,7 @@ class PermissionServiceTest {
         10L,
         1L,
         "SELECT",
-        List.of(new RuleCommand("ALL", null), new RuleCommand("REGION", "APAC")),
+        List.of(new RuleCommand(null, "ALL", null), new RuleCommand("DEPT_CODE", "=", "APAC")),
         List.of()
     );
 
@@ -62,7 +65,7 @@ class PermissionServiceTest {
         10L,
         1L,
         "SELECT",
-        List.of(new RuleCommand("CUSTOM_PREDICATE", "1=1")),
+        List.of(new RuleCommand("DEPT_CODE", "CUSTOM_PREDICATE", "1=1")),
         List.of()
     );