feat: publish application permissions to DDS grants

sql/adb/32_dds_vector_tag_setup.sql

@@ -42,6 +42,21 @@ PROMPT === 2. Replacing DATA GRANTs for the four demo identities ===
 -- The tag expression is deliberately an OR expression.  Adding another
 -- allowed tag means replacing the corresponding grant expression, not
 -- writing a second conflicting policy.
+BEGIN
+  EXECUTE IMMEDIATE 'DROP DATA GRANT admin.dds_demo_my_vector_grant';
+EXCEPTION WHEN OTHERS THEN NULL;
+END;
+/
+BEGIN
+  EXECUTE IMMEDIATE 'DROP DATA GRANT admin.dds_demo_pg_vector_grant';
+EXCEPTION WHEN OTHERS THEN NULL;
+END;
+/
+BEGIN
+  EXECUTE IMMEDIATE 'DROP DATA GRANT admin.dds_demo_both_vector_grant';
+EXCEPTION WHEN OTHERS THEN NULL;
+END;
+/
 CREATE OR REPLACE DATA GRANT admin.dds_demo_my_vector_grant
   AS SELECT
   ON admin.cb_dds_vector_search_documents
@@ -62,7 +77,71 @@ CREATE OR REPLACE DATA GRANT admin.dds_demo_both_vector_grant
 
 -- dds_demo_none_role intentionally receives no grant (default deny).
 
-PROMPT === 3. Vector object inventory ===
+PROMPT === 3. Registering the vector object in the common application permission model ===
+-- The application permission tables remain the source of truth.  These rows
+-- make the standalone DDS example use the same role/TAG scenario as VPD:
+-- one ALLOW permission per role and multiple TAG rules combined with OR.
+-- The backoffice's DDS publish screen compiles these rows into the grants
+-- above (and excludes the protected EMBEDDING column by default).
+DECLARE
+  PROCEDURE ensure_vector_permission(
+      p_role_id IN NUMBER,
+      p_tag_list IN SYS.ODCIVARCHAR2LIST
+  ) IS
+    v_perm_id NUMBER;
+    v_rule_id NUMBER;
+    v_tag     VARCHAR2(100);
+  BEGIN
+    BEGIN
+      SELECT perm_id
+      INTO   v_perm_id
+      FROM   cb_permission
+      WHERE  role_id = p_role_id
+      AND    target_name = 'CB_VECTOR_SEARCH_DOCUMENTS'
+      AND    action_name = 'SELECT'
+      AND    permission_effect = 'ALLOW'
+      AND    ROWNUM = 1;
+    EXCEPTION
+      WHEN NO_DATA_FOUND THEN
+        SELECT NVL(MAX(perm_id), 0) + 1 INTO v_perm_id FROM cb_permission;
+        INSERT INTO cb_permission (
+          perm_id, role_id, target_name, action_name, permission_effect
+        ) VALUES (
+          v_perm_id, p_role_id, 'CB_VECTOR_SEARCH_DOCUMENTS', 'SELECT', 'ALLOW'
+        );
+    END;
+
+    FOR i IN 1 .. p_tag_list.COUNT LOOP
+      v_tag := UPPER(TRIM(p_tag_list(i)));
+      BEGIN
+        SELECT rule_id
+        INTO   v_rule_id
+        FROM   cb_permission_rule
+        WHERE  perm_id = v_perm_id
+        AND    rule_column = 'TECH_TAG'
+        AND    rule_type = 'TAG'
+        AND    rule_value = v_tag
+        AND    ROWNUM = 1;
+      EXCEPTION
+        WHEN NO_DATA_FOUND THEN
+          SELECT NVL(MAX(rule_id), 0) + 1 INTO v_rule_id FROM cb_permission_rule;
+          INSERT INTO cb_permission_rule (
+            rule_id, perm_id, rule_column, rule_type, rule_value
+          ) VALUES (
+            v_rule_id, v_perm_id, 'TECH_TAG', 'TAG', v_tag
+          );
+      END;
+    END LOOP;
+  END;
+BEGIN
+  ensure_vector_permission(10, SYS.ODCIVARCHAR2LIST('SPRING_BOOT', 'ORDS'));
+  ensure_vector_permission(20, SYS.ODCIVARCHAR2LIST('ORACLE_VPD', 'ORACLE_DDS'));
+  ensure_vector_permission(30, SYS.ODCIVARCHAR2LIST(
+      'SPRING_BOOT', 'ORDS', 'ORACLE_VPD', 'ORACLE_DDS', 'MCP'));
+END;
+/
+
+PROMPT === 4. Vector object inventory ===
 SELECT 'DDS_VECTOR_OBJECT' AS item,
        'ADMIN.CB_DDS_VECTOR_SEARCH_DOCUMENTS' AS value
 FROM dual;