[Developer] #424 add user and permission management

Refs #424

src/main/resources/mapper/PermissionMapper.xml

@@ -14,6 +14,23 @@
     WHERE role_id = #{roleId}
   </select>
 
+  <select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
+    SELECT p.perm_id AS permission_id,
+           r.role_id,
+           r.role_name,
+           o.object_id,
+           p.target_name AS object_name,
+           p.action_name AS action,
+           LISTAGG(pr.rule_type || NVL2(pr.rule_value, ':' || pr.rule_value, ''), ', ')
+             WITHIN GROUP (ORDER BY pr.rule_id) AS rules
+    FROM cb_permission p
+    JOIN cb_app_role r ON r.role_id = p.role_id
+    LEFT JOIN cb_protected_object o ON o.object_name = p.target_name
+    LEFT JOIN cb_permission_rule pr ON pr.perm_id = p.perm_id
+    GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name
+    ORDER BY r.role_name, p.target_name
+  </select>
+
   <select id="findPermissionId" resultType="long">
     SELECT p.perm_id
     FROM cb_permission p
@@ -73,4 +90,9 @@
     INSERT INTO cb_permission_column (permission_id, column_name)
     VALUES (#{permissionId}, #{columnName})
   </insert>
+
+  <delete id="deletePermission">
+    DELETE FROM cb_permission
+    WHERE perm_id = #{permissionId}
+  </delete>
 </mapper>

src/main/resources/mapper/ProtectedObjectMapper.xml

@@ -21,4 +21,34 @@
     WHERE object_id = #{objectId}
     ORDER BY column_id
   </select>
+
+  <select id="nextObjectId" resultType="long">
+    SELECT NVL(MAX(object_id), 0) + 1 FROM cb_protected_object
+  </select>
+
+  <select id="nextColumnId" resultType="long">
+    SELECT NVL(MAX(column_id), 0) + 1 FROM cb_protected_column
+  </select>
+
+  <insert id="insertObject">
+    INSERT INTO cb_protected_object (object_id, owner, object_name, ords_path, enabled_yn)
+    VALUES (
+      #{objectId},
+      UPPER(#{command.owner}),
+      UPPER(#{command.objectName}),
+      #{command.ordsPath},
+      'Y'
+    )
+  </insert>
+
+  <insert id="insertColumn">
+    INSERT INTO cb_protected_column (column_id, object_id, column_name, sensitive_yn)
+    VALUES (#{columnId}, #{objectId}, UPPER(#{columnName}), #{sensitiveYn})
+  </insert>
+
+  <update id="disableObject">
+    UPDATE cb_protected_object
+    SET enabled_yn = 'N'
+    WHERE object_id = #{objectId}
+  </update>
 </mapper>

src/main/resources/mapper/UserMapper.xml

@@ -7,6 +7,7 @@
            user_name AS username,
            employee_no AS emp_no,
            dept_code,
+           can_read_contents,
            active AS active_yn
     FROM cb_app_user
     ORDER BY username
@@ -17,8 +18,57 @@
            user_name AS username,
            employee_no AS emp_no,
            dept_code,
+           can_read_contents,
            active AS active_yn
     FROM cb_app_user
     WHERE user_id = #{userId}
   </select>
+
+  <select id="findUserRoles" resultType="com.cloudhandson.vpdbackoffice.domain.user.UserRoleView">
+    SELECT u.user_id,
+           u.user_name AS username,
+           r.role_id,
+           r.role_name
+    FROM cb_user_role ur
+    JOIN cb_app_user u ON u.user_id = ur.user_id
+    JOIN cb_app_role r ON r.role_id = ur.role_id
+    ORDER BY u.user_name, r.role_name
+  </select>
+
+  <select id="nextUserId" resultType="long">
+    SELECT NVL(MAX(user_id), 0) + 1 FROM cb_app_user
+  </select>
+
+  <insert id="insertUser">
+    INSERT INTO cb_app_user (
+      user_id, user_name, employee_no, dept_code, can_read_contents, active
+    ) VALUES (
+      #{userId},
+      #{command.username},
+      #{command.empNo},
+      #{command.deptCode},
+      <choose>
+        <when test="command.canReadContents"> 'Y' </when>
+        <otherwise> 'N' </otherwise>
+      </choose>,
+      'Y'
+    )
+  </insert>
+
+  <update id="updateActive">
+    UPDATE cb_app_user
+    SET active = #{activeYn}
+    WHERE user_id = #{userId}
+  </update>
+
+  <insert id="insertUserRole">
+    INSERT INTO cb_user_role (user_id, role_id)
+    VALUES (#{userId}, #{roleId})
+  </insert>
+
+  <delete id="deleteUserRole">
+    DELETE FROM cb_user_role
+    WHERE user_id = #{userId}
+      AND role_id = #{roleId}
+  </delete>
 </mapper>

src/main/resources/static/css/app.css

@@ -86,6 +86,14 @@ body {
   display: inline;
 }
 
+.switch-field {
+  align-items: center;
+  display: flex;
+  gap: .5rem;
+  min-height: 38px;
+  padding-left: 2.5rem;
+}
+
 .token-value {
   display: block;
   margin-top: .5rem;

src/main/resources/templates/fragments/layout.html

@@ -15,7 +15,9 @@
   <div class="container">
     <a class="navbar-brand" href="/">VPD Backoffice</a>
     <div class="navbar-nav">
+      <a class="nav-link" href="/users">사용자</a>
       <a class="nav-link" href="/permissions">권한</a>
+      <a class="nav-link" href="/objects">테이블/뷰</a>
       <a class="nav-link" href="/tokens">토큰</a>
       <a class="nav-link" href="/probe">ORDS 검증</a>
     </div>

src/main/resources/templates/objects.html

@@ -0,0 +1,78 @@
+<!doctype html>
+<html lang="ko" xmlns:th="http://www.thymeleaf.org">
+<head th:replace="~{fragments/layout :: head('테이블/뷰 관리')}"></head>
+<body>
+<nav th:replace="~{fragments/layout :: nav}"></nav>
+<main class="container py-4">
+  <div class="page-title">
+    <h1>테이블/뷰 관리</h1>
+    <p>권한에 사용할 보호 객체와 ORDS 경로를 등록합니다.</p>
+  </div>
+
+  <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+
+  <section class="content-band">
+    <h2>테이블/뷰 추가</h2>
+    <form method="post" action="/objects" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        Owner
+        <input class="form-control" name="owner" value="ADMIN" required>
+      </label>
+      <label>
+        Object
+        <input class="form-control" name="objectName" placeholder="CB_V_SEARCH_DOCUMENTS" required>
+      </label>
+      <label>
+        ORDS Path
+        <input class="form-control" name="ordsPath" placeholder="cb-agent-security/vpd/documents" required>
+      </label>
+      <label>
+        컬럼
+        <input class="form-control" name="columns" placeholder="DOC_ID,TITLE,CONTENTS">
+      </label>
+      <label>
+        민감 컬럼
+        <input class="form-control" name="sensitiveColumns" placeholder="CONTENTS">
+      </label>
+      <button class="btn btn-primary" type="submit">추가</button>
+    </form>
+  </section>
+
+  <section class="content-band">
+    <h2>등록된 테이블/뷰</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>ID</th>
+          <th>Owner</th>
+          <th>Object</th>
+          <th>ORDS Path</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="object : ${objects}">
+          <td th:text="${object.objectId()}">1</td>
+          <td th:text="${object.owner()}">ADMIN</td>
+          <td th:text="${object.objectName()}">CB_V_SEARCH_DOCUMENTS</td>
+          <td><code th:text="${object.ordsPath()}">path</code></td>
+          <td>
+            <form method="post" action="/objects/disable" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="objectId" th:value="${object.objectId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">비활성화</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(objects)}">
+          <td colspan="5" class="text-muted">등록된 테이블/뷰가 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+</main>
+</body>
+</html>

src/main/resources/templates/permissions.html

@@ -12,6 +12,7 @@
   <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
 
   <section class="content-band">
+    <h2>권한 추가</h2>
     <form method="post" action="/permissions" class="form-grid">
       <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
       <label>
@@ -42,6 +43,43 @@
       <button class="btn btn-primary" type="submit">저장</button>
     </form>
   </section>
+
+  <section class="content-band">
+    <h2>권한 목록</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>ID</th>
+          <th>역할</th>
+          <th>테이블/뷰</th>
+          <th>Action</th>
+          <th>행 규칙</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="permission : ${permissions}">
+          <td th:text="${permission.permissionId()}">100</td>
+          <td th:text="${permission.roleName()}">HR_DEPT_ROLE</td>
+          <td th:text="${permission.objectName()}">CB_V_SEARCH_DOCUMENTS</td>
+          <td th:text="${permission.action()}">SELECT</td>
+          <td th:text="${permission.rules()} ?: '-'">ALL</td>
+          <td>
+            <form method="post" action="/permissions/delete" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="permissionId" th:value="${permission.permissionId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">삭제</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(permissions)}">
+          <td colspan="6" class="text-muted">등록된 권한이 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
 </main>
 </body>
 </html>

src/main/resources/templates/users.html

@@ -0,0 +1,131 @@
+<!doctype html>
+<html lang="ko" xmlns:th="http://www.thymeleaf.org">
+<head th:replace="~{fragments/layout :: head('사용자 관리')}"></head>
+<body>
+<nav th:replace="~{fragments/layout :: nav}"></nav>
+<main class="container py-4">
+  <div class="page-title">
+    <h1>사용자 관리</h1>
+    <p>Bearer Token과 권한 매핑에 사용할 내부 사용자를 관리합니다.</p>
+  </div>
+
+  <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+
+  <section class="content-band">
+    <h2>사용자 추가</h2>
+    <form method="post" action="/users" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        사용자명
+        <input class="form-control" name="username" required>
+      </label>
+      <label>
+        사번
+        <input class="form-control" name="empNo" required>
+      </label>
+      <label>
+        부서코드
+        <input class="form-control" name="deptCode" required>
+      </label>
+      <label class="form-check form-switch switch-field">
+        <input class="form-check-input" name="canReadContents" type="checkbox" value="true">
+        <span class="form-check-label">민감 컬럼 표시</span>
+      </label>
+      <button class="btn btn-primary" type="submit">추가</button>
+    </form>
+  </section>
+
+  <section class="content-band">
+    <h2>사용자 목록</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>ID</th>
+          <th>사용자명</th>
+          <th>사번</th>
+          <th>부서</th>
+          <th>민감 컬럼</th>
+          <th>상태</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="user : ${users}">
+          <td th:text="${user.userId()}">1</td>
+          <td th:text="${user.username()}">agent_hr</td>
+          <td th:text="${user.empNo()}">E10234</td>
+          <td th:text="${user.deptCode()}">HR</td>
+          <td><span class="badge" th:classappend="${user.canReadContents() == 'Y'} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${user.canReadContents()}">N</span></td>
+          <td><span class="badge" th:classappend="${user.active()} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${user.activeYn()}">Y</span></td>
+          <td>
+            <form method="post" action="/users/active" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="userId" th:value="${user.userId()}">
+              <input type="hidden" name="active" th:value="${!user.active()}">
+              <button class="btn btn-sm btn-outline-secondary" type="submit" th:text="${user.active()} ? '비활성화' : '활성화'">변경</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(users)}">
+          <td colspan="7" class="text-muted">등록된 사용자가 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+
+  <section class="content-band">
+    <h2>역할 부여</h2>
+    <form method="post" action="/users/roles" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        사용자
+        <select class="form-select" name="userId" required>
+          <option th:each="user : ${users}" th:value="${user.userId()}" th:text="${user.username()}"></option>
+        </select>
+      </label>
+      <label>
+        역할
+        <select class="form-select" name="roleId" required>
+          <option th:each="role : ${roles}" th:value="${role.roleId()}" th:text="${role.roleName()}"></option>
+        </select>
+      </label>
+      <button class="btn btn-primary" type="submit">부여</button>
+    </form>
+  </section>
+
+  <section class="content-band">
+    <h2>사용자 역할 목록</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>사용자</th>
+          <th>역할</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="mapping : ${userRoles}">
+          <td th:text="${mapping.username()}">agent_hr</td>
+          <td th:text="${mapping.roleName()}">HR_DEPT_ROLE</td>
+          <td>
+            <form method="post" action="/users/roles/delete" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="userId" th:value="${mapping.userId()}">
+              <input type="hidden" name="roleId" th:value="${mapping.roleId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">해제</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(userRoles)}">
+          <td colspan="3" class="text-muted">부여된 역할이 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+</main>
+</body>
+</html>