feat: record DDS protection evidence

dds-backoffice/src/main/java/com/cloudhandson/ddsbackoffice/web/DdsProtectionController.java

@@ -2,9 +2,12 @@ package com.cloudhandson.ddsbackoffice.web;
 
 import com.cloudhandson.ddsbackoffice.config.DdsProperties;
 import com.cloudhandson.ddsbackoffice.service.DdsProtectionStatusService;
+import com.cloudhandson.ddsbackoffice.service.DdsProtectionValidationService;
+import com.cloudhandson.ddsbackoffice.service.DdsProtectionSchemaService;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.servlet.view.RedirectView;
 
 /** DDS protection status, deliberately separate from the legacy VPD route. */
@@ -13,13 +16,19 @@ public class DdsProtectionController {
 
   private final DdsProperties properties;
   private final DdsProtectionStatusService protectionStatusService;
+  private final DdsProtectionValidationService validationService;
+  private final DdsProtectionSchemaService schemaService;
 
   public DdsProtectionController(
       DdsProperties properties,
-      DdsProtectionStatusService protectionStatusService
+      DdsProtectionStatusService protectionStatusService,
+      DdsProtectionValidationService validationService,
+      DdsProtectionSchemaService schemaService
   ) {
     this.properties = properties;
     this.protectionStatusService = protectionStatusService;
+    this.validationService = validationService;
+    this.schemaService = schemaService;
   }
 
   @GetMapping("/dds-protection")
@@ -35,6 +44,35 @@ public class DdsProtectionController {
     return "fragments/dds-protection-direct :: directComparison";
   }
 
+  @PostMapping("/dds-protection/verify/service")
+  public RedirectView verifyService(org.springframework.web.servlet.mvc.support.RedirectAttributes attributes) {
+    try {
+      var result = validationService.runServiceFixtures();
+      attributes.addFlashAttribute(result.passed() ? "successMessage" : "errorMessage", result.message());
+    } catch (RuntimeException exception) {
+      attributes.addFlashAttribute("errorMessage", "DDS 보호 검증을 실행하지 못했습니다. fixture와 DB 설정을 확인하세요.");
+    }
+    return new RedirectView("/dds-protection#service-verify");
+  }
+
+  @PostMapping("/dds-protection/verify/direct")
+  public String verifyDirect(Model model) {
+    validationService.runDirectFixtures();
+    model.addAttribute("directPaths", protectionStatusService.directComparison());
+    return "fragments/dds-protection-direct :: directComparison";
+  }
+
+  @PostMapping("/dds-protection/setup")
+  public RedirectView setup(org.springframework.web.servlet.mvc.support.RedirectAttributes attributes) {
+    try {
+      schemaService.initialize();
+      attributes.addFlashAttribute("successMessage", "DDS 검증 이력과 fixture 구성을 완료했습니다.");
+    } catch (RuntimeException exception) {
+      attributes.addFlashAttribute("errorMessage", "DDS 검증 구성을 완료하지 못했습니다. DB 권한과 선행 DDS 객체를 확인하세요.");
+    }
+    return new RedirectView("/dds-protection");
+  }
+
   /** Existing bookmarks resolve to the DDS canonical route without retaining VPD in the UI. */
   @GetMapping("/vpd-policies")
   public RedirectView legacyPolicies() {

dds-backoffice/src/main/java/com/cloudhandson/ddsbackoffice/web/DdsProvisionController.java

@@ -2,6 +2,9 @@ package com.cloudhandson.ddsbackoffice.web;
 
 import com.cloudhandson.ddsbackoffice.domain.DdsProvisioningPlan;
 import com.cloudhandson.ddsbackoffice.service.DdsGrantPublisher;
+import com.cloudhandson.ddsbackoffice.service.DdsProtectionEvidenceStore;
+import com.cloudhandson.ddsbackoffice.service.DdsProtectionFingerprint;
+import com.cloudhandson.ddsbackoffice.domain.DdsPublishedProtectionSpec;
 import org.springframework.dao.DataAccessException;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -13,9 +16,11 @@ import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 public class DdsProvisionController {
 
   private final DdsGrantPublisher publisher;
+  private final DdsProtectionEvidenceStore evidenceStore;
 
-  public DdsProvisionController(DdsGrantPublisher publisher) {
+  public DdsProvisionController(DdsGrantPublisher publisher, DdsProtectionEvidenceStore evidenceStore) {
     this.publisher = publisher;
+    this.evidenceStore = evidenceStore;
   }
 
   @GetMapping("/dds-provision")
@@ -32,6 +37,16 @@ public class DdsProvisionController {
           "successMessage",
           plan.publishableCount() + "개 DDS DATA GRANT를 게시했습니다. 권한 없는 대상의 기존 Grant는 회수했습니다."
       );
+      try {
+        plan.grants().forEach(grant -> evidenceStore.recordPublished(
+            new DdsPublishedProtectionSpec(
+                "DIRECT", grant.userKey(), DdsProtectionFingerprint.direct(grant), java.time.Instant.now()),
+            "DDS Backoffice", "DDS 권한 반영"
+        ));
+      } catch (DataAccessException exception) {
+        redirectAttributes.addFlashAttribute("warningMessage",
+            "DDS Grant는 게시됐지만 상태 이력 저장에 실패했습니다. 상태 이력 DB 설정을 확인하세요.");
+      }
       if (plan.hasWarnings()) {
         redirectAttributes.addFlashAttribute("warningMessage", String.join(" / ", plan.warnings()));
       }