[Developer] #619 focus POC on KB VPD permissions

sql/adb/54_drop_legacy_dds_ords_examples.sql

@@ -0,0 +1,47 @@
+-- ============================================================
+-- 54_drop_legacy_dds_ords_examples.sql
+-- Removes only the former document-search ORDS/DDS example objects.
+-- It deliberately keeps CB_ORDS because it is the non-exempt KB VPD
+-- runtime principal.
+-- ============================================================
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET ECHO OFF
+SET FEEDBACK ON
+SET DEFINE OFF
+SET SERVEROUTPUT ON
+
+BEGIN
+  ORDS.DELETE_MODULE(p_module_name => 'cb.agent.security');
+  DBMS_OUTPUT.PUT_LINE('dropped ORDS module cb.agent.security');
+EXCEPTION
+  WHEN OTHERS THEN
+    DBMS_OUTPUT.PUT_LINE('ORDS module not removed: ' || SQLERRM);
+END;
+/
+
+DECLARE
+  PROCEDURE drop_ddl_if_present(p_ddl IN VARCHAR2) IS
+  BEGIN
+    EXECUTE IMMEDIATE p_ddl;
+    DBMS_OUTPUT.PUT_LINE('dropped: ' || p_ddl);
+  EXCEPTION
+    WHEN OTHERS THEN
+      DBMS_OUTPUT.PUT_LINE('not present: ' || p_ddl);
+  END;
+BEGIN
+  drop_ddl_if_present('DROP DATA GRANT admin.cb_dg_hr_docs');
+  drop_ddl_if_present('DROP DATA GRANT admin.cb_dg_fin_docs');
+  drop_ddl_if_present('DROP DATA GRANT admin.cb_dg_all_docs');
+  drop_ddl_if_present('DROP END USER "cb_dds_hr"');
+  drop_ddl_if_present('DROP END USER "cb_dds_fin"');
+  drop_ddl_if_present('DROP END USER "cb_dds_all"');
+  drop_ddl_if_present('DROP END USER "cb_dds_none"');
+  drop_ddl_if_present('DROP DATA ROLE cb_dds_hr_role');
+  drop_ddl_if_present('DROP DATA ROLE cb_dds_fin_role');
+  drop_ddl_if_present('DROP DATA ROLE cb_dds_all_role');
+  drop_ddl_if_present('DROP DATA ROLE cb_dds_connect_only_role');
+  drop_ddl_if_present('DROP ROLE cb_dds_connect_role');
+END;
+/
+
+PROMPT === Legacy DDS/ORDS examples removed ===