fix #477: add group based role grants

sql/adb/25_agent_ords_security_backoffice_support.sql

@@ -72,6 +72,54 @@ EXCEPTION
 END;
 /
 
+PROMPT === Creating group role support tables ===
+BEGIN
+  EXECUTE IMMEDIATE '
+    CREATE TABLE cb_app_group (
+      group_id     NUMBER PRIMARY KEY,
+      group_code   VARCHAR2(100) NOT NULL UNIQUE,
+      group_name   VARCHAR2(100) NOT NULL,
+      description  VARCHAR2(200),
+      active_yn    CHAR(1) DEFAULT ''Y'' CHECK (active_yn IN (''Y'',''N'')) NOT NULL
+    )';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -955 THEN
+      RAISE;
+    END IF;
+END;
+/
+
+BEGIN
+  EXECUTE IMMEDIATE '
+    CREATE TABLE cb_user_group (
+      group_id  NUMBER NOT NULL,
+      user_id   NUMBER NOT NULL,
+      CONSTRAINT cb_user_group_pk PRIMARY KEY (group_id, user_id)
+    )';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -955 THEN
+      RAISE;
+    END IF;
+END;
+/
+
+BEGIN
+  EXECUTE IMMEDIATE '
+    CREATE TABLE cb_group_role (
+      group_id  NUMBER NOT NULL,
+      role_id   NUMBER NOT NULL,
+      CONSTRAINT cb_group_role_pk PRIMARY KEY (group_id, role_id)
+    )';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -955 THEN
+      RAISE;
+    END IF;
+END;
+/
+
 CREATE TABLE cb_protected_object (
   object_id    NUMBER PRIMARY KEY,
   owner        VARCHAR2(128) NOT NULL,
@@ -226,13 +274,25 @@ BEGIN
 
   SELECT COUNT(*)
   INTO   v_allowed
-  FROM   cb_user_role ur
+  FROM   (
+           SELECT ur.role_id
+           FROM   cb_user_role ur
+           WHERE  ur.user_id = TO_NUMBER(SYS_CONTEXT('CB_AGENT_CTX', 'USER_ID'))
+           UNION
+           SELECT gr.role_id
+           FROM   cb_user_group ug
+           JOIN   cb_app_group g
+           ON     g.group_id = ug.group_id
+           AND    g.active_yn = 'Y'
+           JOIN   cb_group_role gr
+           ON     gr.group_id = ug.group_id
+           WHERE  ug.user_id = TO_NUMBER(SYS_CONTEXT('CB_AGENT_CTX', 'USER_ID'))
+         ) er
   JOIN   cb_permission p
-  ON     p.role_id = ur.role_id
+  ON     p.role_id = er.role_id
   JOIN   cb_permission_column pc
   ON     pc.permission_id = p.perm_id
-  WHERE  ur.user_id = TO_NUMBER(SYS_CONTEXT('CB_AGENT_CTX', 'USER_ID'))
+  WHERE  p.target_name = UPPER(p_target_name)
-  AND    p.target_name = UPPER(p_target_name)
   AND    p.action_name = 'SELECT'
   AND    pc.column_name = UPPER(p_column_name);
 

sql/adb/26_agent_ords_security_dynamic_vpd_filter.sql

@@ -3,7 +3,8 @@
 -- Replaces the demo VPD filter with a whitelist predicate builder.
 --
 -- The function does not hardcode object names or rule values. It reads:
---   CB_AGENT_CTX.USER_ID -> CB_USER_ROLE -> CB_PERMISSION -> CB_PERMISSION_RULE
+--   CB_AGENT_CTX.USER_ID -> direct CB_USER_ROLE + group CB_USER_GROUP/CB_GROUP_ROLE
+--   -> CB_PERMISSION -> CB_PERMISSION_RULE
 -- and builds a row predicate for the object passed by DBMS_RLS.
 -- ============================================================
 WHENEVER SQLERROR EXIT SQL.SQLCODE
@@ -94,17 +95,30 @@ BEGIN
   v_target := UPPER(TRIM(p_object));
 
   FOR r IN (
+    WITH effective_role AS (
+      SELECT ur.role_id
+      FROM   cb_user_role ur
+      WHERE  ur.user_id = v_user_id
+      UNION
+      SELECT gr.role_id
+      FROM   cb_user_group ug
+      JOIN   cb_app_group g
+      ON     g.group_id = ug.group_id
+      AND    g.active_yn = 'Y'
+      JOIN   cb_group_role gr
+      ON     gr.group_id = ug.group_id
+      WHERE  ug.user_id = v_user_id
+    )
     SELECT UPPER(TRIM(r.rule_type)) AS rule_type,
            UPPER(TRIM(r.rule_column)) AS rule_column,
            NVL(UPPER(TRIM(p.permission_effect)), 'ALLOW') AS permission_effect,
            r.rule_value
-    FROM   cb_user_role ur
+    FROM   effective_role er
     JOIN   cb_permission p
-    ON     p.role_id = ur.role_id
+    ON     p.role_id = er.role_id
     JOIN   cb_permission_rule r
     ON     r.perm_id = p.perm_id
-    WHERE  ur.user_id = v_user_id
+    WHERE  p.target_name = v_target
-    AND    p.target_name = v_target
     AND    p.action_name = 'SELECT'
     ORDER BY r.rule_id
   ) LOOP

src/main/java/com/cloudhandson/vpdbackoffice/domain/group/AppGroup.java

@@ -0,0 +1,14 @@
+package com.cloudhandson.vpdbackoffice.domain.group;
+
+public record AppGroup(
+    long groupId,
+    String groupCode,
+    String groupName,
+    String description,
+    String activeYn
+) {
+
+  public boolean active() {
+    return "Y".equalsIgnoreCase(activeYn);
+  }
+}

src/main/java/com/cloudhandson/vpdbackoffice/domain/group/GroupCreateCommand.java

@@ -0,0 +1,8 @@
+package com.cloudhandson.vpdbackoffice.domain.group;
+
+public record GroupCreateCommand(
+    String groupCode,
+    String groupName,
+    String description
+) {
+}

src/main/java/com/cloudhandson/vpdbackoffice/domain/group/GroupRoleView.java

@@ -0,0 +1,10 @@
+package com.cloudhandson.vpdbackoffice.domain.group;
+
+public record GroupRoleView(
+    long groupId,
+    String groupCode,
+    String groupName,
+    long roleId,
+    String roleName
+) {
+}

src/main/java/com/cloudhandson/vpdbackoffice/domain/group/GroupUserView.java

@@ -0,0 +1,10 @@
+package com.cloudhandson.vpdbackoffice.domain.group;
+
+public record GroupUserView(
+    long groupId,
+    String groupCode,
+    String groupName,
+    long userId,
+    String username
+) {
+}

src/main/java/com/cloudhandson/vpdbackoffice/mapper/GroupMapper.java

@@ -0,0 +1,33 @@
+package com.cloudhandson.vpdbackoffice.mapper;
+
+import com.cloudhandson.vpdbackoffice.domain.group.AppGroup;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupCreateCommand;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupRoleView;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupUserView;
+import java.util.List;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Param;
+
+@Mapper
+public interface GroupMapper {
+
+  List<AppGroup> findAll();
+
+  List<GroupUserView> findGroupUsers();
+
+  List<GroupRoleView> findGroupRoles();
+
+  long nextGroupId();
+
+  void insertGroup(@Param("groupId") long groupId, @Param("command") GroupCreateCommand command);
+
+  int updateActive(@Param("groupId") long groupId, @Param("activeYn") String activeYn);
+
+  void insertGroupUser(@Param("groupId") long groupId, @Param("userId") long userId);
+
+  int deleteGroupUser(@Param("groupId") long groupId, @Param("userId") long userId);
+
+  void insertGroupRole(@Param("groupId") long groupId, @Param("roleId") long roleId);
+
+  int deleteGroupRole(@Param("groupId") long groupId, @Param("roleId") long roleId);
+}

src/main/java/com/cloudhandson/vpdbackoffice/service/BackofficeSchemaService.java

@@ -47,6 +47,15 @@ public class BackofficeSchemaService {
         """);
     addColumn(results, "cb_app_role", "max_sensitivity_level",
         "ALTER TABLE cb_app_role ADD (max_sensitivity_level VARCHAR2(20) DEFAULT 'PUBLIC' NOT NULL)");
+    createTable(results, "cb_app_group", """
+        CREATE TABLE cb_app_group (
+          group_id     NUMBER PRIMARY KEY,
+          group_code   VARCHAR2(100) NOT NULL UNIQUE,
+          group_name   VARCHAR2(100) NOT NULL,
+          description  VARCHAR2(200),
+          active_yn    CHAR(1) DEFAULT 'Y' CHECK (active_yn IN ('Y','N')) NOT NULL
+        )
+        """);
     createTable(results, "cb_user_role", """
         CREATE TABLE cb_user_role (
           user_id  NUMBER NOT NULL,
@@ -54,6 +63,20 @@ public class BackofficeSchemaService {
           CONSTRAINT cb_user_role_pk PRIMARY KEY (user_id, role_id)
         )
         """);
+    createTable(results, "cb_user_group", """
+        CREATE TABLE cb_user_group (
+          group_id  NUMBER NOT NULL,
+          user_id   NUMBER NOT NULL,
+          CONSTRAINT cb_user_group_pk PRIMARY KEY (group_id, user_id)
+        )
+        """);
+    createTable(results, "cb_group_role", """
+        CREATE TABLE cb_group_role (
+          group_id  NUMBER NOT NULL,
+          role_id   NUMBER NOT NULL,
+          CONSTRAINT cb_group_role_pk PRIMARY KEY (group_id, role_id)
+        )
+        """);
     createTable(results, "cb_permission", """
         CREATE TABLE cb_permission (
           perm_id      NUMBER PRIMARY KEY,

src/main/java/com/cloudhandson/vpdbackoffice/service/GroupService.java

@@ -0,0 +1,86 @@
+package com.cloudhandson.vpdbackoffice.service;
+
+import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent;
+import com.cloudhandson.vpdbackoffice.domain.group.AppGroup;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupCreateCommand;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupRoleView;
+import com.cloudhandson.vpdbackoffice.domain.group.GroupUserView;
+import com.cloudhandson.vpdbackoffice.mapper.GroupMapper;
+import java.util.List;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+@Service
+public class GroupService {
+
+  private final GroupMapper groupMapper;
+  private final AuditService auditService;
+
+  public GroupService(GroupMapper groupMapper, AuditService auditService) {
+    this.groupMapper = groupMapper;
+    this.auditService = auditService;
+  }
+
+  public List<AppGroup> findAll() {
+    return groupMapper.findAll();
+  }
+
+  public List<GroupUserView> findGroupUsers() {
+    return groupMapper.findGroupUsers();
+  }
+
+  public List<GroupRoleView> findGroupRoles() {
+    return groupMapper.findGroupRoles();
+  }
+
+  @Transactional
+  public void createGroup(GroupCreateCommand command) {
+    long groupId = groupMapper.nextGroupId();
+    groupMapper.insertGroup(groupId, command);
+    auditService.record(new AuditEvent("GROUP_CREATED", null, null, "SUCCESS", null, null, command.groupCode()));
+  }
+
+  @Transactional
+  public void setActive(long groupId, boolean active) {
+    int updated = groupMapper.updateActive(groupId, active ? "Y" : "N");
+    if (updated == 0) {
+      throw new AppException("그룹을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_ACTIVE_CHANGED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",active=" + active));
+  }
+
+  @Transactional
+  public void addUser(long groupId, long userId) {
+    groupMapper.insertGroupUser(groupId, userId);
+    auditService.record(new AuditEvent("GROUP_USER_ADDED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",userId=" + userId));
+  }
+
+  @Transactional
+  public void removeUser(long groupId, long userId) {
+    int deleted = groupMapper.deleteGroupUser(groupId, userId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 그룹 사용자 매핑을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_USER_REMOVED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",userId=" + userId));
+  }
+
+  @Transactional
+  public void addRole(long groupId, long roleId) {
+    groupMapper.insertGroupRole(groupId, roleId);
+    auditService.record(new AuditEvent("GROUP_ROLE_ADDED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",roleId=" + roleId));
+  }
+
+  @Transactional
+  public void removeRole(long groupId, long roleId) {
+    int deleted = groupMapper.deleteGroupRole(groupId, roleId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 그룹 역할 매핑을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("GROUP_ROLE_REMOVED", null, null, "SUCCESS", null, null,
+        "groupId=" + groupId + ",roleId=" + roleId));
+  }
+}

src/main/java/com/cloudhandson/vpdbackoffice/web/GroupController.java

@@ -0,0 +1,103 @@
+package com.cloudhandson.vpdbackoffice.web;
+
+import com.cloudhandson.vpdbackoffice.domain.group.GroupCreateCommand;
+import com.cloudhandson.vpdbackoffice.service.GroupService;
+import com.cloudhandson.vpdbackoffice.service.PermissionService;
+import com.cloudhandson.vpdbackoffice.service.UserService;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+@Controller
+public class GroupController {
+
+  private final GroupService groupService;
+  private final UserService userService;
+  private final PermissionService permissionService;
+
+  public GroupController(GroupService groupService, UserService userService, PermissionService permissionService) {
+    this.groupService = groupService;
+    this.userService = userService;
+    this.permissionService = permissionService;
+  }
+
+  @GetMapping("/groups")
+  public String groups(Model model) {
+    model.addAttribute("groups", groupService.findAll());
+    model.addAttribute("users", userService.findAll());
+    model.addAttribute("roles", permissionService.findRoles());
+    model.addAttribute("groupUsers", groupService.findGroupUsers());
+    model.addAttribute("groupRoles", groupService.findGroupRoles());
+    return "groups";
+  }
+
+  @PostMapping("/groups")
+  public String create(
+      @RequestParam String groupCode,
+      @RequestParam String groupName,
+      @RequestParam(required = false) String description,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.createGroup(new GroupCreateCommand(groupCode, groupName, description));
+    redirectAttributes.addFlashAttribute("message", "그룹을 추가했습니다.");
+    return "redirect:/groups";
+  }
+
+  @PostMapping("/groups/active")
+  public String active(
+      @RequestParam long groupId,
+      @RequestParam boolean active,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.setActive(groupId, active);
+    redirectAttributes.addFlashAttribute("message", "그룹 상태를 변경했습니다.");
+    return "redirect:/groups";
+  }
+
+  @PostMapping("/groups/users")
+  public String addUser(
+      @RequestParam long groupId,
+      @RequestParam long userId,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.addUser(groupId, userId);
+    redirectAttributes.addFlashAttribute("message", "그룹에 사용자를 추가했습니다.");
+    return "redirect:/groups";
+  }
+
+  @PostMapping("/groups/users/delete")
+  public String removeUser(
+      @RequestParam long groupId,
+      @RequestParam long userId,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.removeUser(groupId, userId);
+    redirectAttributes.addFlashAttribute("message", "그룹 사용자를 해제했습니다.");
+    return "redirect:/groups";
+  }
+
+  @PostMapping("/groups/roles")
+  public String addRole(
+      @RequestParam long groupId,
+      @RequestParam long roleId,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.addRole(groupId, roleId);
+    redirectAttributes.addFlashAttribute("message", "그룹에 역할을 부여했습니다.");
+    return "redirect:/groups";
+  }
+
+  @PostMapping("/groups/roles/delete")
+  public String removeRole(
+      @RequestParam long groupId,
+      @RequestParam long roleId,
+      RedirectAttributes redirectAttributes
+  ) {
+    groupService.removeRole(groupId, roleId);
+    redirectAttributes.addFlashAttribute("message", "그룹 역할을 해제했습니다.");
+    return "redirect:/groups";
+  }
+}

src/main/resources/mapper/GroupMapper.xml

@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
+    "https://mybatis.org/dtd/mybatis-3-mapper.dtd">
+<mapper namespace="com.cloudhandson.vpdbackoffice.mapper.GroupMapper">
+  <select id="findAll" resultType="com.cloudhandson.vpdbackoffice.domain.group.AppGroup">
+    SELECT group_id,
+           group_code,
+           group_name,
+           description,
+           active_yn
+    FROM cb_app_group
+    ORDER BY group_code
+  </select>
+
+  <select id="findGroupUsers" resultType="com.cloudhandson.vpdbackoffice.domain.group.GroupUserView">
+    SELECT g.group_id,
+           g.group_code,
+           g.group_name,
+           u.user_id,
+           u.user_name AS username
+    FROM cb_user_group ug
+    JOIN cb_app_group g ON g.group_id = ug.group_id
+    JOIN cb_app_user u ON u.user_id = ug.user_id
+    ORDER BY g.group_code, u.user_name
+  </select>
+
+  <select id="findGroupRoles" resultType="com.cloudhandson.vpdbackoffice.domain.group.GroupRoleView">
+    SELECT g.group_id,
+           g.group_code,
+           g.group_name,
+           r.role_id,
+           r.role_name
+    FROM cb_group_role gr
+    JOIN cb_app_group g ON g.group_id = gr.group_id
+    JOIN cb_app_role r ON r.role_id = gr.role_id
+    ORDER BY g.group_code, r.role_name
+  </select>
+
+  <select id="nextGroupId" resultType="long">
+    SELECT NVL(MAX(group_id), 0) + 1 FROM cb_app_group
+  </select>
+
+  <insert id="insertGroup">
+    INSERT INTO cb_app_group (
+      group_id, group_code, group_name, description, active_yn
+    ) VALUES (
+      #{groupId,jdbcType=NUMERIC},
+      UPPER(#{command.groupCode,jdbcType=VARCHAR}),
+      #{command.groupName,jdbcType=VARCHAR},
+      #{command.description,jdbcType=VARCHAR},
+      'Y'
+    )
+  </insert>
+
+  <update id="updateActive">
+    UPDATE cb_app_group
+    SET active_yn = #{activeYn,jdbcType=VARCHAR}
+    WHERE group_id = #{groupId,jdbcType=NUMERIC}
+  </update>
+
+  <insert id="insertGroupUser">
+    INSERT INTO cb_user_group (group_id, user_id)
+    VALUES (#{groupId,jdbcType=NUMERIC}, #{userId,jdbcType=NUMERIC})
+  </insert>
+
+  <delete id="deleteGroupUser">
+    DELETE FROM cb_user_group
+    WHERE group_id = #{groupId,jdbcType=NUMERIC}
+      AND user_id = #{userId,jdbcType=NUMERIC}
+  </delete>
+
+  <insert id="insertGroupRole">
+    INSERT INTO cb_group_role (group_id, role_id)
+    VALUES (#{groupId,jdbcType=NUMERIC}, #{roleId,jdbcType=NUMERIC})
+  </insert>
+
+  <delete id="deleteGroupRole">
+    DELETE FROM cb_group_role
+    WHERE group_id = #{groupId,jdbcType=NUMERIC}
+      AND role_id = #{roleId,jdbcType=NUMERIC}
+  </delete>
+</mapper>

src/main/resources/static/js/app.js

@@ -243,6 +243,29 @@ function filterUserRoleDetail() {
   empty.hidden = shown !== 0;
 }
 
+function filterGroupDetail(masterId) {
+  const master = document.getElementById(masterId);
+  const table = document.querySelector(`[data-group-detail-table="${masterId}"]`);
+  if (!master || !table) {
+    return;
+  }
+  const selected = master.value;
+  let shown = 0;
+  table.querySelectorAll('tbody tr[data-group-id]').forEach((row) => {
+    const visible = row.dataset.groupId === selected;
+    row.hidden = !visible;
+    shown += visible ? 1 : 0;
+  });
+  let empty = table.querySelector('tbody tr.empty-group-detail-runtime');
+  if (!empty) {
+    empty = document.createElement('tr');
+    empty.className = 'empty-group-detail-runtime';
+    empty.innerHTML = `<td colspan="3" class="text-muted">${escapeHtml(table.dataset.emptyMessage || '선택한 그룹에 등록된 항목이 없습니다.')}</td>`;
+    table.querySelector('tbody').appendChild(empty);
+  }
+  empty.hidden = shown !== 0;
+}
+
 function renderRuleColumnOptions(columns) {
   document.querySelectorAll('.rule-column-select').forEach((select) => {
     const current = select.value;
@@ -477,6 +500,10 @@ document.addEventListener('DOMContentLoaded', () => {
     master.addEventListener('change', filterUserRoleDetail);
     filterUserRoleDetail();
   }
+  document.querySelectorAll('.group-master-select').forEach((select) => {
+    select.addEventListener('change', () => filterGroupDetail(select.id));
+    filterGroupDetail(select.id);
+  });
   const objectSelect = document.querySelector('select[name="objectRef"]');
   if (objectSelect) {
     objectSelect.addEventListener('change', () => {

src/main/resources/templates/fragments/layout.html

@@ -19,6 +19,7 @@
         <button class="rw-menu-trigger" type="button" aria-expanded="false">권한 관리</button>
         <div class="rw-menu-panel">
           <a class="nav-link" href="/users">사용자</a>
+          <a class="nav-link" href="/groups">그룹</a>
           <a class="nav-link" href="/roles">역할</a>
           <a class="nav-link" href="/permissions">권한</a>
           <a class="nav-link" href="/tokens">토큰</a>
@@ -62,7 +63,7 @@
   <div class="architecture-step" th:classappend="${activeLayer == 'permission'} ? ' active'">
     <span class="architecture-kicker">Backoffice Tables</span>
     <strong>권한 테이블</strong>
-    <p>사용자, 역할, 행 규칙, 컬럼 원문 허용을 저장합니다.</p>
+    <p>사용자, 그룹, 역할, 행 규칙, 컬럼 원문 허용을 저장합니다.</p>
   </div>
   <div class="architecture-arrow">→</div>
   <div class="architecture-step" th:classappend="${activeLayer == 'vpd'} ? ' active'">

src/main/resources/templates/groups.html

@@ -0,0 +1,173 @@
+<!doctype html>
+<html lang="ko" xmlns:th="http://www.thymeleaf.org">
+<head th:replace="~{fragments/layout :: head('그룹 관리')}"></head>
+<body>
+<nav th:replace="~{fragments/layout :: nav}"></nav>
+<main class="container py-4">
+  <div class="page-title">
+    <h1>그룹 관리</h1>
+    <p>사용자 그룹을 만들고 그룹에 사용자와 역할을 부여합니다. 권한은 역할에 연결되고, 사용자는 직접 역할과 그룹 역할을 함께 상속합니다.</p>
+  </div>
+
+  <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+
+  <section class="content-band">
+    <h2>그룹 추가</h2>
+    <form method="post" action="/groups" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        그룹 코드
+        <input class="form-control" name="groupCode" placeholder="SALES_TEAM" required>
+      </label>
+      <label>
+        그룹명
+        <input class="form-control" name="groupName" placeholder="영업팀" required>
+      </label>
+      <label class="span-2">
+        설명
+        <input class="form-control" name="description" maxlength="200">
+      </label>
+      <button class="btn rw-btn-primary" type="submit">추가</button>
+    </form>
+  </section>
+
+  <section class="content-band">
+    <h2>그룹 목록</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>ID</th>
+          <th>코드</th>
+          <th>그룹명</th>
+          <th>설명</th>
+          <th>상태</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="group : ${groups}">
+          <td th:text="${group.groupId()}">1</td>
+          <td><code th:text="${group.groupCode()}">SALES_TEAM</code></td>
+          <td th:text="${group.groupName()}">영업팀</td>
+          <td th:text="${group.description()}">설명</td>
+          <td><span class="badge" th:classappend="${group.active()} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${group.activeYn()}">Y</span></td>
+          <td>
+            <form method="post" action="/groups/active" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="groupId" th:value="${group.groupId()}">
+              <input type="hidden" name="active" th:value="${!group.active()}">
+              <button class="btn btn-sm btn-outline-secondary" type="submit" th:text="${group.active()} ? '비활성화' : '활성화'">변경</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(groups)}">
+          <td colspan="6" class="text-muted">등록된 그룹이 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+
+  <section class="content-band">
+    <h2>그룹 사용자</h2>
+    <form method="post" action="/groups/users" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        그룹
+        <select class="form-select group-master-select" id="groupUserMaster" name="groupId" required>
+          <option th:each="group : ${groups}" th:value="${group.groupId()}" th:text="${group.groupCode() + ' / ' + group.groupName()}"></option>
+        </select>
+      </label>
+      <label>
+        추가할 사용자
+        <select class="form-select" name="userId" required>
+          <option th:each="user : ${users}" th:value="${user.userId()}" th:text="${user.username()}"></option>
+        </select>
+      </label>
+      <button class="btn rw-btn-primary" type="submit">추가</button>
+    </form>
+
+    <h2 class="mt-4">선택 그룹 사용자</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle" data-group-detail-table="groupUserMaster" data-empty-message="선택한 그룹에 사용자가 없습니다.">
+        <thead>
+        <tr>
+          <th>그룹</th>
+          <th>사용자</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="mapping : ${groupUsers}" th:attr="data-group-id=${mapping.groupId()}">
+          <td><code th:text="${mapping.groupCode()}">SALES_TEAM</code></td>
+          <td th:text="${mapping.username()}">agent_sales</td>
+          <td>
+            <form method="post" action="/groups/users/delete" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="groupId" th:value="${mapping.groupId()}">
+              <input type="hidden" name="userId" th:value="${mapping.userId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">해제</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(groupUsers)}">
+          <td colspan="3" class="text-muted">등록된 그룹 사용자가 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+
+  <section class="content-band">
+    <h2>그룹 역할</h2>
+    <form method="post" action="/groups/roles" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        그룹
+        <select class="form-select group-master-select" id="groupRoleMaster" name="groupId" required>
+          <option th:each="group : ${groups}" th:value="${group.groupId()}" th:text="${group.groupCode() + ' / ' + group.groupName()}"></option>
+        </select>
+      </label>
+      <label>
+        부여할 역할
+        <select class="form-select" name="roleId" required>
+          <option th:each="role : ${roles}" th:value="${role.roleId()}" th:text="${role.roleName()}"></option>
+        </select>
+      </label>
+      <button class="btn rw-btn-primary" type="submit">부여</button>
+    </form>
+
+    <h2 class="mt-4">선택 그룹 역할</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle" data-group-detail-table="groupRoleMaster" data-empty-message="선택한 그룹에 부여된 역할이 없습니다.">
+        <thead>
+        <tr>
+          <th>그룹</th>
+          <th>역할</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="mapping : ${groupRoles}" th:attr="data-group-id=${mapping.groupId()}">
+          <td><code th:text="${mapping.groupCode()}">SALES_TEAM</code></td>
+          <td th:text="${mapping.roleName()}">SALES_ROLE</td>
+          <td>
+            <form method="post" action="/groups/roles/delete" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="groupId" th:value="${mapping.groupId()}">
+              <input type="hidden" name="roleId" th:value="${mapping.roleId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">해제</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(groupRoles)}">
+          <td colspan="3" class="text-muted">등록된 그룹 역할이 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+</main>
+</body>
+</html>