feat(backoffice): grant full game data access to PoC users

sql/adb/71_sg_identity_administration.sql

@@ -168,3 +168,85 @@ merge into sg_group_role t using (select 2001 group_id, 3002 role_id from dual)
 on (t.group_id=s.group_id and t.role_id=s.role_id) when not matched then insert (group_id, role_id) values (s.group_id, s.role_id);
 
 commit;
+
+-- Compatibility layer for remaining backoffice modules.  The data is stored
+-- only in SG_* tables; these views prevent older controller paths from
+-- querying non-existent CB_* physical tables during the Smilegate transition.
+create or replace view cb_app_user as
+select user_id, user_name, employee_no, dept_code, can_read_contents, active from sg_app_user;
+create or replace view cb_app_group as
+select group_id, group_code, group_name, description, active_yn from sg_app_group;
+create or replace view cb_app_role as
+select role_id, role_name, max_sensitivity_level from sg_app_role;
+create or replace view cb_user_role as select user_id, role_id from sg_user_role;
+create or replace view cb_user_group as select group_id, user_id from sg_user_group;
+create or replace view cb_group_role as select group_id, role_id from sg_group_role;
+create or replace view cb_protected_object as
+select object_id, owner, object_name, ords_path, enabled_yn, description from sg_protected_object;
+create or replace view cb_protected_column as
+select column_id, object_id, column_name, sensitive_yn, visible_role_id, sensitivity_level, redaction_method from sg_protected_column;
+create or replace view cb_permission as
+select perm_id, role_id, target_name, action_name, permission_effect from sg_permission;
+create or replace view cb_permission_rule as
+select rule_id, perm_id, rule_column, rule_type, rule_value from sg_permission_rule;
+create or replace view cb_permission_column as
+select permission_id, column_name from sg_permission_column;
+
+-- PoC administrator access: both demo operators can manage and query every
+-- Smilegate game-data object registered in SGMP_POC.
+merge into sg_app_role t
+using (select 3099 role_id, 'DATA_AI_POC_ADMIN' role_name,
+              'Full access to all Smilegate PoC game-data objects' description,
+              'RESTRICTED' max_sensitivity_level from dual) s
+on (t.role_id = s.role_id)
+when matched then update set t.role_name=s.role_name, t.description=s.description,
+                             t.max_sensitivity_level=s.max_sensitivity_level, t.updated_at=systimestamp
+when not matched then insert (role_id, role_name, description, max_sensitivity_level)
+values (s.role_id, s.role_name, s.description, s.max_sensitivity_level);
+
+merge into sg_user_role t
+using (select 1001 user_id, 3099 role_id from dual union all select 1002, 3099 from dual) s
+on (t.user_id=s.user_id and t.role_id=s.role_id)
+when not matched then insert (user_id, role_id) values (s.user_id, s.role_id);
+
+declare
+  l_object_id number;
+  l_permission_id number;
+begin
+  for source_object in (
+    select table_name
+    from all_tables
+    where owner = 'SGMP_POC'
+      and table_name not in ('SEMANTIC_METADATA_CHANGE_LOG', 'SGMP_TERM_CONTEXT_CACHE',
+                             'SGMP_TERM_DICTIONARY', 'SGMP_TERM_SEARCH_LOG', 'SGMP_TERM_SYNONYM')
+    order by table_name
+  ) loop
+    begin
+      select object_id into l_object_id
+      from sg_protected_object
+      where owner = 'SGMP_POC' and object_name = source_object.table_name;
+    exception
+      when no_data_found then
+        select nvl(max(object_id), 0) + 1 into l_object_id from sg_protected_object;
+        insert into sg_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
+        values (l_object_id, 'SGMP_POC', source_object.table_name,
+                '/sgmp-poc/' || lower(source_object.table_name), 'Y',
+                'Smilegate PoC game-data object');
+    end;
+
+    begin
+      select perm_id into l_permission_id
+      from sg_permission
+      where role_id = 3099 and target_name = source_object.table_name;
+    exception
+      when no_data_found then
+        l_permission_id := sg_permission_seq.nextval;
+        insert into sg_permission (perm_id, role_id, target_name, action_name, permission_effect)
+        values (l_permission_id, 3099, source_object.table_name, 'SELECT', 'ALLOW');
+        insert into sg_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
+        values (sg_permission_rule_seq.nextval, l_permission_id, null, 'ALL', null);
+    end;
+  end loop;
+  commit;
+end;
+/