fix #477: add group based role grants

src/main/java/com/cloudhandson/vpdbackoffice/service/BackofficeSchemaService.java

@@ -47,6 +47,15 @@ public class BackofficeSchemaService {
         """);
     addColumn(results, "cb_app_role", "max_sensitivity_level",
         "ALTER TABLE cb_app_role ADD (max_sensitivity_level VARCHAR2(20) DEFAULT 'PUBLIC' NOT NULL)");
+    createTable(results, "cb_app_group", """
+        CREATE TABLE cb_app_group (
+          group_id     NUMBER PRIMARY KEY,
+          group_code   VARCHAR2(100) NOT NULL UNIQUE,
+          group_name   VARCHAR2(100) NOT NULL,
+          description  VARCHAR2(200),
+          active_yn    CHAR(1) DEFAULT 'Y' CHECK (active_yn IN ('Y','N')) NOT NULL
+        )
+        """);
     createTable(results, "cb_user_role", """
         CREATE TABLE cb_user_role (
           user_id  NUMBER NOT NULL,
@@ -54,6 +63,20 @@ public class BackofficeSchemaService {
           CONSTRAINT cb_user_role_pk PRIMARY KEY (user_id, role_id)
         )
         """);
+    createTable(results, "cb_user_group", """
+        CREATE TABLE cb_user_group (
+          group_id  NUMBER NOT NULL,
+          user_id   NUMBER NOT NULL,
+          CONSTRAINT cb_user_group_pk PRIMARY KEY (group_id, user_id)
+        )
+        """);
+    createTable(results, "cb_group_role", """
+        CREATE TABLE cb_group_role (
+          group_id  NUMBER NOT NULL,
+          role_id   NUMBER NOT NULL,
+          CONSTRAINT cb_group_role_pk PRIMARY KEY (group_id, role_id)
+        )
+        """);
     createTable(results, "cb_permission", """
         CREATE TABLE cb_permission (
           perm_id      NUMBER PRIMARY KEY,

src/main/java/com/cloudhandson/vpdbackoffice/service/GroupService.java

@@ -0,0 +1,86 @@
+package com.cloudhandson.vpdbackoffice.service;
+
+import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent;
+import com.cloudhandson.vpdbackoffice.domain.group.AppGroup;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupCreateCommand;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupRoleView;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupUserView;
+import com.cloudhandson.vpdbackoffice.mapper.GroupMapper;
+import java.util.List;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+public class GroupService {
+
+  private final GroupMapper groupMapper;
+  private final AuditService auditService;
+
+  public GroupService(GroupMapper groupMapper, AuditService auditService) {
+    this.groupMapper = groupMapper;
+    this.auditService = auditService;
+  }
+
+  public List<AppGroup> findAll() {
+    return groupMapper.findAll();
+  }
+
+  public List<GroupUserView> findGroupUsers() {
+    return groupMapper.findGroupUsers();
+  }
+
+  public List<GroupRoleView> findGroupRoles() {
+    return groupMapper.findGroupRoles();
+  }
+
+  @Transactional
+  public void createGroup(GroupCreateCommand command) {
+    long groupId = groupMapper.nextGroupId();
+    groupMapper.insertGroup(groupId, command);
+    auditService.record(new AuditEvent("GROUP_CREATED", null, null, "SUCCESS", null, null, command.groupCode()));
+  }
+
+  @Transactional
+  public void setActive(long groupId, boolean active) {
+    int updated = groupMapper.updateActive(groupId, active ? "Y" : "N");
+    if (updated == 0) {
+      throw new AppException("그룹을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_ACTIVE_CHANGED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",active=" + active));
+  }
+
+  @Transactional
+  public void addUser(long groupId, long userId) {
+    groupMapper.insertGroupUser(groupId, userId);
+    auditService.record(new AuditEvent("GROUP_USER_ADDED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",userId=" + userId));
+  }
+
+  @Transactional
+  public void removeUser(long groupId, long userId) {
+    int deleted = groupMapper.deleteGroupUser(groupId, userId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 그룹 사용자 매핑을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_USER_REMOVED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",userId=" + userId));
+  }
+
+  @Transactional
+  public void addRole(long groupId, long roleId) {
+    groupMapper.insertGroupRole(groupId, roleId);
+    auditService.record(new AuditEvent("GROUP_ROLE_ADDED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",roleId=" + roleId));
+  }
+
+  @Transactional
+  public void removeRole(long groupId, long roleId) {
+    int deleted = groupMapper.deleteGroupRole(groupId, roleId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 그룹 역할 매핑을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_ROLE_REMOVED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",roleId=" + roleId));
+  }
+}