|
|
|
|
@@ -0,0 +1,455 @@
|
|
|
|
|
package com.cloudhandson.ddsbackoffice.service;
|
|
|
|
|
|
|
|
|
|
import com.cloudhandson.ddsbackoffice.config.DdsProperties;
|
|
|
|
|
import com.cloudhandson.ddsbackoffice.domain.DdsGrantPlan;
|
|
|
|
|
import com.cloudhandson.ddsbackoffice.domain.DdsProvisioningPlan;
|
|
|
|
|
import java.util.ArrayList;
|
|
|
|
|
import java.util.LinkedHashMap;
|
|
|
|
|
import java.util.LinkedHashSet;
|
|
|
|
|
import java.util.List;
|
|
|
|
|
import java.util.Locale;
|
|
|
|
|
import java.util.Map;
|
|
|
|
|
import java.util.Set;
|
|
|
|
|
import java.util.regex.Pattern;
|
|
|
|
|
import org.springframework.dao.DataAccessException;
|
|
|
|
|
import org.springframework.jdbc.core.JdbcTemplate;
|
|
|
|
|
import org.springframework.stereotype.Service;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Compiles the application's effective permission model into DDS grants.
|
|
|
|
|
*
|
|
|
|
|
* DDS does not evaluate CB_PERMISSION at query time. This service is the
|
|
|
|
|
* explicit publish boundary: application users/groups/roles are expanded,
|
|
|
|
|
* ALLOW/DENY rules are compiled into one predicate per user/object, and the
|
|
|
|
|
* resulting DATA GRANT is created or replaced. A publish with no ALLOW rule
|
|
|
|
|
* drops the reserved grant, preserving default deny.
|
|
|
|
|
*/
|
|
|
|
|
@Service
|
|
|
|
|
public class DdsGrantPublisher {
|
|
|
|
|
|
|
|
|
|
private static final Pattern IDENTIFIER = Pattern.compile("[A-Z][A-Z0-9_$#]*");
|
|
|
|
|
private static final Pattern OBJECT = Pattern.compile(
|
|
|
|
|
"[A-Z][A-Z0-9_$#]*(\\.[A-Z][A-Z0-9_$#]*)*"
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
private final JdbcTemplate jdbcTemplate;
|
|
|
|
|
private final DdsProperties properties;
|
|
|
|
|
|
|
|
|
|
public DdsGrantPublisher(JdbcTemplate jdbcTemplate, DdsProperties properties) {
|
|
|
|
|
this.jdbcTemplate = jdbcTemplate;
|
|
|
|
|
this.properties = properties;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public DdsProvisioningPlan preview() {
|
|
|
|
|
List<DdsGrantPlan> grants = new ArrayList<>();
|
|
|
|
|
List<String> warnings = new ArrayList<>();
|
|
|
|
|
int mappedUsers = 0;
|
|
|
|
|
|
|
|
|
|
for (Map.Entry<String, DdsProperties.User> entry : properties.users().entrySet()) {
|
|
|
|
|
String userKey = entry.getKey();
|
|
|
|
|
DdsProperties.User ddsUser = entry.getValue();
|
|
|
|
|
if (!ddsUser.mapped()) {
|
|
|
|
|
// The demo's "none" identity is deliberately a DDS-only default-deny
|
|
|
|
|
// subject. It has no application user mapping by design, so do not
|
|
|
|
|
// turn that expected state into a noisy warning.
|
|
|
|
|
if (ddsUser.applicationUserId() == 0L && "none".equals(userKey)) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
warnings.add(userKey + ": 애플리케이션 사용자 ID 또는 DDS DATA ROLE 매핑이 없습니다.");
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
AppIdentity identity = findIdentity(ddsUser.applicationUserId());
|
|
|
|
|
if (identity == null) {
|
|
|
|
|
warnings.add(userKey + ": CB_APP_USER " + ddsUser.applicationUserId() + "를 찾을 수 없습니다.");
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
if (!identity.active()) {
|
|
|
|
|
warnings.add(userKey + ": 애플리케이션 사용자가 비활성 상태입니다.");
|
|
|
|
|
}
|
|
|
|
|
mappedUsers++;
|
|
|
|
|
|
|
|
|
|
Map<Long, PermissionEntry> permissions = findEffectivePermissions(identity.userId());
|
|
|
|
|
// Include every approved mapping, not only objects that still have a
|
|
|
|
|
// permission row. This lets an explicit publish revoke a previously
|
|
|
|
|
// generated grant when an application permission is removed; the DDS
|
|
|
|
|
// side otherwise has no way to observe that deletion.
|
|
|
|
|
Set<String> targets = new LinkedHashSet<>(properties.objectMappings().keySet());
|
|
|
|
|
permissions.values().forEach(permission -> targets.add(permission.targetName()));
|
|
|
|
|
for (String target : targets) {
|
|
|
|
|
String normalizedTarget = target.toUpperCase(Locale.ROOT);
|
|
|
|
|
String ddsObject = properties.objectMappings().get(normalizedTarget);
|
|
|
|
|
String grantName = grantName(userKey, normalizedTarget);
|
|
|
|
|
if (ddsObject == null || ddsObject.isBlank()) {
|
|
|
|
|
warnings.add(userKey + ": " + normalizedTarget + "에 대한 DDS 보호 객체 매핑이 없습니다.");
|
|
|
|
|
grants.add(unpublishable(userKey, ddsUser, normalizedTarget, grantName,
|
|
|
|
|
"DDS object mapping 필요"));
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
if (!OBJECT.matcher(ddsObject).matches()) {
|
|
|
|
|
warnings.add(userKey + ": 안전하지 않은 DDS 객체 매핑을 건너뛰었습니다: " + ddsObject);
|
|
|
|
|
grants.add(unpublishable(userKey, ddsUser, normalizedTarget, grantName,
|
|
|
|
|
"DDS object 이름 검증 실패"));
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
ObjectInfo object = findProtectedObject(normalizedTarget);
|
|
|
|
|
if (object == null) {
|
|
|
|
|
warnings.add(userKey + ": 보호 객체 메타데이터가 없습니다: " + normalizedTarget);
|
|
|
|
|
grants.add(unpublishable(userKey, ddsUser, normalizedTarget, grantName,
|
|
|
|
|
"CB_PROTECTED_OBJECT 등록 필요"));
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
if (!ddsObjectExists(ddsObject)) {
|
|
|
|
|
warnings.add(userKey + ": DDS 보호 객체가 DB에 없습니다: " + ddsObject);
|
|
|
|
|
grants.add(unpublishable(userKey, ddsUser, normalizedTarget, grantName,
|
|
|
|
|
"DDS VIEW/TABLE 생성 필요"));
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
List<PermissionEntry> targetPermissions = permissions.values().stream()
|
|
|
|
|
.filter(permission -> normalizedTarget.equals(permission.targetName()))
|
|
|
|
|
.toList();
|
|
|
|
|
PredicateBuild predicate = buildPredicate(targetPermissions, identity, object);
|
|
|
|
|
String excludedColumns = excludedColumns(normalizedTarget, targetPermissions, object.objectId());
|
|
|
|
|
if (predicate.allow().isBlank()) {
|
|
|
|
|
grants.add(new DdsGrantPlan(
|
|
|
|
|
userKey, valueOrDefault(ddsUser.label(), userKey), identity.userId(),
|
|
|
|
|
ddsUser.dataRole(), normalizedTarget, ddsObject, grantName,
|
|
|
|
|
"1 = 0", excludedColumns, "", false,
|
|
|
|
|
"ALLOW 규칙이 없어 기존 DDS Grant를 회수합니다.")
|
|
|
|
|
);
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
String where = predicate.expression();
|
|
|
|
|
String sql = createGrantSql(grantName, ddsObject, where, excludedColumns, ddsUser.dataRole());
|
|
|
|
|
grants.add(new DdsGrantPlan(
|
|
|
|
|
userKey, valueOrDefault(ddsUser.label(), userKey), identity.userId(),
|
|
|
|
|
ddsUser.dataRole(), normalizedTarget, ddsObject, grantName,
|
|
|
|
|
where, excludedColumns, sql, true,
|
|
|
|
|
"애플리케이션 유효 권한을 DDS DATA GRANT로 게시할 수 있습니다.")
|
|
|
|
|
);
|
|
|
|
|
warnings.addAll(predicate.warnings());
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return new DdsProvisioningPlan(grants, warnings, mappedUsers);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public DdsProvisioningPlan publish() {
|
|
|
|
|
DdsProvisioningPlan plan = preview();
|
|
|
|
|
for (DdsGrantPlan grant : plan.grants()) {
|
|
|
|
|
// Never touch a grant for an application object that has no approved
|
|
|
|
|
// DDS object mapping. An operator may still manage that DDS object by a
|
|
|
|
|
// separate process; the preview warning must not become an accidental
|
|
|
|
|
// revoke. Known mappings are safe to replace or revoke.
|
|
|
|
|
if (grant.ddsObject() == null || grant.ddsObject().isBlank()) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
dropGrant(grant.grantName());
|
|
|
|
|
if (grant.publishable()) {
|
|
|
|
|
jdbcTemplate.execute(grant.sql());
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return plan;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private Map<Long, PermissionEntry> findEffectivePermissions(long userId) {
|
|
|
|
|
String sql = """
|
|
|
|
|
WITH effective_role AS (
|
|
|
|
|
SELECT ur.role_id
|
|
|
|
|
FROM cb_user_role ur
|
|
|
|
|
WHERE ur.user_id = ?
|
|
|
|
|
UNION
|
|
|
|
|
SELECT gr.role_id
|
|
|
|
|
FROM cb_user_group ug
|
|
|
|
|
JOIN cb_app_group g ON g.group_id = ug.group_id AND g.active_yn = 'Y'
|
|
|
|
|
JOIN cb_group_role gr ON gr.group_id = ug.group_id
|
|
|
|
|
WHERE ug.user_id = ?
|
|
|
|
|
)
|
|
|
|
|
SELECT p.perm_id, p.target_name, p.permission_effect,
|
|
|
|
|
r.rule_id, r.rule_column, r.rule_type, r.rule_value
|
|
|
|
|
FROM effective_role er
|
|
|
|
|
JOIN cb_permission p ON p.role_id = er.role_id
|
|
|
|
|
LEFT JOIN cb_permission_rule r ON r.perm_id = p.perm_id
|
|
|
|
|
WHERE p.action_name = 'SELECT'
|
|
|
|
|
ORDER BY p.perm_id, r.rule_id
|
|
|
|
|
""";
|
|
|
|
|
Map<Long, PermissionEntry> result = new LinkedHashMap<>();
|
|
|
|
|
List<RawPermissionRow> rows = jdbcTemplate.query(sql, (row, ignored) -> new RawPermissionRow(
|
|
|
|
|
row.getLong("perm_id"),
|
|
|
|
|
row.getString("target_name"),
|
|
|
|
|
row.getString("permission_effect"),
|
|
|
|
|
row.getString("rule_column"),
|
|
|
|
|
row.getString("rule_type"),
|
|
|
|
|
row.getString("rule_value")
|
|
|
|
|
), userId, userId);
|
|
|
|
|
for (RawPermissionRow row : rows) {
|
|
|
|
|
long permissionId = row.permissionId();
|
|
|
|
|
PermissionEntry permission = result.computeIfAbsent(permissionId, ignored ->
|
|
|
|
|
new PermissionEntry(
|
|
|
|
|
permissionId,
|
|
|
|
|
upper(row.targetName()),
|
|
|
|
|
normalizeEffect(row.permissionEffect()),
|
|
|
|
|
new ArrayList<>(),
|
|
|
|
|
findVisibleColumns(permissionId)
|
|
|
|
|
));
|
|
|
|
|
if (row.ruleType() != null && !row.ruleType().isBlank()) {
|
|
|
|
|
permission.rules().add(new Rule(
|
|
|
|
|
upperNullable(row.ruleColumn()),
|
|
|
|
|
upper(row.ruleType()),
|
|
|
|
|
row.ruleValue()
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private List<String> findVisibleColumns(long permissionId) {
|
|
|
|
|
return jdbcTemplate.query(
|
|
|
|
|
"SELECT column_name FROM cb_permission_column WHERE permission_id = ? ORDER BY column_name",
|
|
|
|
|
(row, ignored) -> upper(row.getString("column_name")), permissionId);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private AppIdentity findIdentity(long userId) {
|
|
|
|
|
List<AppIdentity> rows = jdbcTemplate.query(
|
|
|
|
|
"SELECT user_id, employee_no, dept_code, active FROM cb_app_user WHERE user_id = ?",
|
|
|
|
|
(row, ignored) -> new AppIdentity(
|
|
|
|
|
row.getLong("user_id"),
|
|
|
|
|
row.getString("employee_no"),
|
|
|
|
|
row.getString("dept_code"),
|
|
|
|
|
"Y".equalsIgnoreCase(row.getString("active"))
|
|
|
|
|
), userId);
|
|
|
|
|
return rows.isEmpty() ? null : rows.get(0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private ObjectInfo findProtectedObject(String targetName) {
|
|
|
|
|
List<ObjectInfo> rows = jdbcTemplate.query(
|
|
|
|
|
"SELECT object_id, owner, object_name FROM cb_protected_object WHERE object_name = UPPER(?)",
|
|
|
|
|
(row, ignored) -> new ObjectInfo(
|
|
|
|
|
row.getLong("object_id"), upper(row.getString("owner")), upper(row.getString("object_name"))),
|
|
|
|
|
targetName);
|
|
|
|
|
return rows.isEmpty() ? null : rows.get(0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private List<String> sensitiveColumns(long objectId) {
|
|
|
|
|
return jdbcTemplate.query(
|
|
|
|
|
"SELECT column_name FROM cb_protected_column WHERE object_id = ? AND sensitive_yn = 'Y' ORDER BY column_id",
|
|
|
|
|
(row, ignored) -> upper(row.getString("column_name")), objectId);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean ddsObjectExists(String objectName) {
|
|
|
|
|
String[] parts = objectName.split("\\.", 2);
|
|
|
|
|
if (parts.length != 2) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
Integer count = jdbcTemplate.queryForObject(
|
|
|
|
|
"SELECT COUNT(*) FROM all_objects WHERE owner = ? AND object_name = ? AND object_type IN ('TABLE','VIEW')",
|
|
|
|
|
Integer.class, parts[0], parts[1]);
|
|
|
|
|
return count != null && count > 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private PredicateBuild buildPredicate(
|
|
|
|
|
List<PermissionEntry> permissions,
|
|
|
|
|
AppIdentity identity,
|
|
|
|
|
ObjectInfo object
|
|
|
|
|
) {
|
|
|
|
|
List<String> allow = new ArrayList<>();
|
|
|
|
|
List<String> deny = new ArrayList<>();
|
|
|
|
|
List<String> warnings = new ArrayList<>();
|
|
|
|
|
for (PermissionEntry permission : permissions) {
|
|
|
|
|
List<String> clauses = new ArrayList<>();
|
|
|
|
|
for (Rule rule : permission.rules()) {
|
|
|
|
|
String clause = compileRule(rule, identity, object);
|
|
|
|
|
if (clause == null || clause.isBlank()) {
|
|
|
|
|
warnings.add(permission.targetName() + ": 지원하지 않거나 컬럼을 확인할 수 없는 규칙을 건너뛰었습니다: "
|
|
|
|
|
+ rule.ruleType());
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
clauses.add(clause);
|
|
|
|
|
}
|
|
|
|
|
if (clauses.isEmpty()) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
String expression = clauses.size() == 1 ? clauses.get(0) : "(" + String.join(" OR ", clauses) + ")";
|
|
|
|
|
if ("DENY".equals(permission.effect())) {
|
|
|
|
|
deny.add(expression);
|
|
|
|
|
} else {
|
|
|
|
|
allow.add(expression);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if (allow.isEmpty()) {
|
|
|
|
|
return new PredicateBuild("", "", warnings);
|
|
|
|
|
}
|
|
|
|
|
String allowExpression = allow.size() == 1 ? allow.get(0) : "(" + String.join(" OR ", allow) + ")";
|
|
|
|
|
if (deny.isEmpty()) {
|
|
|
|
|
return new PredicateBuild(allowExpression, allowExpression, warnings);
|
|
|
|
|
}
|
|
|
|
|
String denyExpression = deny.size() == 1 ? deny.get(0) : "(" + String.join(" OR ", deny) + ")";
|
|
|
|
|
return new PredicateBuild(allowExpression, "(" + allowExpression + ") AND NOT (" + denyExpression + ")", warnings);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String compileRule(Rule rule, AppIdentity identity, ObjectInfo object) {
|
|
|
|
|
String type = rule.ruleType();
|
|
|
|
|
if ("ALL".equals(type)) {
|
|
|
|
|
return "1 = 1";
|
|
|
|
|
}
|
|
|
|
|
String column = rule.ruleColumn();
|
|
|
|
|
if (column == null || column.isBlank()) {
|
|
|
|
|
column = switch (type) {
|
|
|
|
|
case "MY_DEPT", "DEPT" -> "DEPT_CODE";
|
|
|
|
|
case "SELF", "EMP_NO" -> "OWNER_EMP_NO";
|
|
|
|
|
case "TAG" -> "TECH_TAG";
|
|
|
|
|
default -> null;
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
if (column == null || !IDENTIFIER.matcher(column).matches() || !hasColumn(object, column)) {
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
return switch (type) {
|
|
|
|
|
case "MY_DEPT" -> identity.deptCode() == null ? null : column + " = " + quote(identity.deptCode());
|
|
|
|
|
case "SELF" -> identity.employeeNo() == null ? null : column + " = " + quote(identity.employeeNo());
|
|
|
|
|
case "DEPT", "EMP_NO", "=" -> rule.ruleValue() == null ? null
|
|
|
|
|
: "TO_CHAR(" + column + ") = " + quote(rule.ruleValue());
|
|
|
|
|
case "!=", "<>" -> rule.ruleValue() == null ? null
|
|
|
|
|
: "TO_CHAR(" + column + ") <> " + quote(rule.ruleValue());
|
|
|
|
|
case "TAG" -> rule.ruleValue() == null || !rule.ruleValue().trim().matches("[A-Za-z0-9_-]+") ? null
|
|
|
|
|
: "REGEXP_LIKE(UPPER(" + column + "), "
|
|
|
|
|
+ quote("(^|,)" + rule.ruleValue().trim().toUpperCase(Locale.ROOT) + "(,|$)") + ")";
|
|
|
|
|
default -> null;
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private boolean hasColumn(ObjectInfo object, String column) {
|
|
|
|
|
Integer count = jdbcTemplate.queryForObject(
|
|
|
|
|
"SELECT COUNT(*) FROM all_tab_columns WHERE owner = ? AND table_name = ? AND column_name = ?",
|
|
|
|
|
Integer.class, object.owner(), object.objectName(), column);
|
|
|
|
|
return count != null && count > 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String excludedColumns(
|
|
|
|
|
String applicationObject,
|
|
|
|
|
List<PermissionEntry> permissions,
|
|
|
|
|
long objectId
|
|
|
|
|
) {
|
|
|
|
|
Set<String> visible = new LinkedHashSet<>();
|
|
|
|
|
permissions.stream()
|
|
|
|
|
.filter(permission -> "ALLOW".equals(permission.effect()))
|
|
|
|
|
.forEach(permission -> visible.addAll(permission.visibleColumns()));
|
|
|
|
|
return sensitiveColumns(objectId).stream()
|
|
|
|
|
// VECTOR_DISTANCE needs the VECTOR column while DDS evaluates the
|
|
|
|
|
// search. The service deliberately omits EMBEDDING from its response,
|
|
|
|
|
// but excluding a VECTOR column from DATA GRANT makes the predicate
|
|
|
|
|
// invalid at runtime (ORA-52561). Keep it available to the engine and
|
|
|
|
|
// enforce response shaping in DdsVectorKnowledgeService instead.
|
|
|
|
|
.filter(column -> !("CB_VECTOR_SEARCH_DOCUMENTS".equals(applicationObject)
|
|
|
|
|
&& "EMBEDDING".equals(column)))
|
|
|
|
|
.filter(column -> !visible.contains(column))
|
|
|
|
|
.reduce((left, right) -> left + ", " + right)
|
|
|
|
|
.orElse("");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String createGrantSql(
|
|
|
|
|
String grantName,
|
|
|
|
|
String ddsObject,
|
|
|
|
|
String predicate,
|
|
|
|
|
String excludedColumns,
|
|
|
|
|
String dataRole
|
|
|
|
|
) {
|
|
|
|
|
String select = excludedColumns == null || excludedColumns.isBlank()
|
|
|
|
|
? "AS SELECT"
|
|
|
|
|
: "AS SELECT (ALL COLUMNS EXCEPT " + excludedColumns + ")";
|
|
|
|
|
return "CREATE OR REPLACE DATA GRANT ADMIN." + grantName
|
|
|
|
|
+ " " + select
|
|
|
|
|
+ " ON " + ddsObject
|
|
|
|
|
+ " WHERE " + predicate
|
|
|
|
|
+ " TO " + safeRole(dataRole);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private void dropGrant(String grantName) {
|
|
|
|
|
try {
|
|
|
|
|
jdbcTemplate.execute("DROP DATA GRANT ADMIN." + grantName);
|
|
|
|
|
} catch (DataAccessException ignored) {
|
|
|
|
|
// The first publish has no generated grant yet. DDS returns an object
|
|
|
|
|
// not found error, which is intentionally harmless here.
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private DdsGrantPlan unpublishable(
|
|
|
|
|
String userKey,
|
|
|
|
|
DdsProperties.User user,
|
|
|
|
|
String target,
|
|
|
|
|
String grantName,
|
|
|
|
|
String note
|
|
|
|
|
) {
|
|
|
|
|
return new DdsGrantPlan(
|
|
|
|
|
userKey, valueOrDefault(user.label(), userKey), user.applicationUserId(), user.dataRole(),
|
|
|
|
|
target, properties.objectMappings().getOrDefault(target, ""), grantName,
|
|
|
|
|
"", "", "", false, note);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String grantName(String userKey, String target) {
|
|
|
|
|
if ("CB_VECTOR_SEARCH_DOCUMENTS".equals(target)) {
|
|
|
|
|
return "DDS_DEMO_" + userKey.toUpperCase(Locale.ROOT) + "_VECTOR_GRANT";
|
|
|
|
|
}
|
|
|
|
|
String candidate = "DDS_" + userKey.toUpperCase(Locale.ROOT) + "_" + target + "_GRANT";
|
|
|
|
|
return candidate.length() <= 120 ? candidate : candidate.substring(0, 120);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String safeRole(String value) {
|
|
|
|
|
String normalized = upper(value);
|
|
|
|
|
if (normalized == null || !OBJECT.matcher(normalized).matches()) {
|
|
|
|
|
throw new IllegalArgumentException("안전하지 않은 DDS DATA ROLE 이름입니다: " + value);
|
|
|
|
|
}
|
|
|
|
|
return normalized;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String quote(String value) {
|
|
|
|
|
return "'" + value.replace("'", "''") + "'";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String normalizeEffect(String value) {
|
|
|
|
|
return "DENY".equalsIgnoreCase(value) ? "DENY" : "ALLOW";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String upper(String value) {
|
|
|
|
|
return value == null ? null : value.trim().toUpperCase(Locale.ROOT);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String upperNullable(String value) {
|
|
|
|
|
return value == null || value.isBlank() ? null : upper(value);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private String valueOrDefault(String value, String fallback) {
|
|
|
|
|
return value == null || value.isBlank() ? fallback : value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record AppIdentity(long userId, String employeeNo, String deptCode, boolean active) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record ObjectInfo(long objectId, String owner, String objectName) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record Rule(String ruleColumn, String ruleType, String ruleValue) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record RawPermissionRow(
|
|
|
|
|
long permissionId,
|
|
|
|
|
String targetName,
|
|
|
|
|
String permissionEffect,
|
|
|
|
|
String ruleColumn,
|
|
|
|
|
String ruleType,
|
|
|
|
|
String ruleValue
|
|
|
|
|
) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record PermissionEntry(
|
|
|
|
|
long permissionId,
|
|
|
|
|
String targetName,
|
|
|
|
|
String effect,
|
|
|
|
|
List<Rule> rules,
|
|
|
|
|
List<String> visibleColumns
|
|
|
|
|
) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private record PredicateBuild(String allow, String expression, List<String> warnings) {
|
|
|
|
|
}
|
|
|
|
|
}
|
devmrko