joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[DBA] add KB VPD admin full access condition

Browse Source
This commit is contained in:
devmrko
2026-07-08 13:02:11 +09:00
parent fbeb18ccec
commit 403298d474
5 changed files with 236 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sql/adb/51_kb_vpd_admin_token.sql
View File

@@ -18,7 +18,7 @@ GRANT EXECUTE ON cb_agent_ctx_pkg TO POC_2;
DECLARE
c_stakeholder_user_id CONSTANT VARCHAR2(30) := 'KB_VPD_ADMIN';
c_role_name CONSTANT VARCHAR2(80) := 'KB_VPD_ADMIN_ROLE';
c_token_description CONSTANT VARCHAR2(200) := 'KB VPD admin bootstrap token';
c_token_description CONSTANT VARCHAR2(200) := 'KB VPD admin full-access token';
v_admin_role_id NUMBER;
v_identity_role_id NUMBER;
@@ -83,7 +83,7 @@ DECLARE
DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, NULL, 'ALL', NULL);
VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, NULL, 'STATIC_SQL', '1 = 1');
-- CB_ORDS is the non-exempt data runtime. VPD still applies after
-- this object privilege is granted.
@@ -187,12 +187,11 @@ BEGIN
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_GRP');
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_TYPE');
-- Re-running this script rotates only the bootstrap administrator token.
-- Re-running this script rotates the only full-access administrator token.
UPDATE cb_agent_bearer_key
SET active = 'N',
revoked_at = SYSDATE
WHERE stakeholder_user_id = c_stakeholder_user_id
AND description = c_token_description
AND active = 'Y';
v_bearer_token := 'kbvpdadm_' || DBMS_RANDOM.STRING('x', 48);