feat #467: separate column sensitivity policies

src/main/resources/mapper/PermissionMapper.xml

@@ -3,13 +3,19 @@
     "https://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.cloudhandson.vpdbackoffice.mapper.PermissionMapper">
   <select id="findRoles" resultType="com.cloudhandson.vpdbackoffice.domain.permission.AppRole">
-    SELECT role_id, role_name, CAST(NULL AS VARCHAR2(200)) AS description
+    SELECT role_id,
+           role_name,
+           CAST(NULL AS VARCHAR2(200)) AS description,
+           NVL(max_sensitivity_level, 'PUBLIC') AS max_sensitivity_level
     FROM cb_app_role
     ORDER BY role_name
   </select>
 
   <select id="findRole" resultType="com.cloudhandson.vpdbackoffice.domain.permission.AppRole">
-    SELECT role_id, role_name, CAST(NULL AS VARCHAR2(200)) AS description
+    SELECT role_id,
+           role_name,
+           CAST(NULL AS VARCHAR2(200)) AS description,
+           NVL(max_sensitivity_level, 'PUBLIC') AS max_sensitivity_level
     FROM cb_app_role
     WHERE role_id = #{roleId}
   </select>
@@ -19,10 +25,20 @@
   </select>
 
   <insert id="insertRole">
-    INSERT INTO cb_app_role (role_id, role_name)
-    VALUES (#{roleId,jdbcType=NUMERIC}, UPPER(#{roleName,jdbcType=VARCHAR}))
+    INSERT INTO cb_app_role (role_id, role_name, max_sensitivity_level)
+    VALUES (
+      #{roleId,jdbcType=NUMERIC},
+      UPPER(#{roleName,jdbcType=VARCHAR}),
+      #{maxSensitivityLevel,jdbcType=VARCHAR}
+    )
   </insert>
 
+  <update id="updateRoleMaxSensitivity">
+    UPDATE cb_app_role
+    SET max_sensitivity_level = #{maxSensitivityLevel,jdbcType=VARCHAR}
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
+  </update>
+
   <delete id="deleteRole">
     DELETE FROM cb_app_role
     WHERE role_id = #{roleId,jdbcType=NUMERIC}

src/main/resources/mapper/ProtectedObjectMapper.xml

@@ -57,7 +57,13 @@
   </select>
 
   <select id="findColumns" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn">
-    SELECT column_id, object_id, column_name, sensitive_yn, visible_role_id
+    SELECT column_id,
+           object_id,
+           column_name,
+           sensitive_yn,
+           visible_role_id,
+           NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
+           NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
     FROM cb_protected_column
     WHERE object_id = #{objectId}
     ORDER BY column_id
@@ -83,10 +89,26 @@
   </insert>
 
   <insert id="insertColumn">
-    INSERT INTO cb_protected_column (column_id, object_id, column_name, sensitive_yn)
-    VALUES (#{columnId}, #{objectId}, UPPER(#{columnName}), #{sensitiveYn})
+    INSERT INTO cb_protected_column (
+      column_id, object_id, column_name, sensitive_yn, sensitivity_level, redaction_method
+    )
+    VALUES (
+      #{columnId}, #{objectId}, UPPER(#{columnName}), #{sensitiveYn}, #{sensitivityLevel}, #{redactionMethod}
+    )
   </insert>
 
+  <update id="updateColumnPolicy">
+    UPDATE cb_protected_column
+    SET sensitivity_level = #{sensitivityLevel,jdbcType=VARCHAR},
+        redaction_method = #{redactionMethod,jdbcType=VARCHAR},
+        sensitive_yn = CASE
+          WHEN #{sensitivityLevel,jdbcType=VARCHAR} = 'PUBLIC'
+           AND #{redactionMethod,jdbcType=VARCHAR} = 'NONE' THEN 'N'
+          ELSE 'Y'
+        END
+    WHERE column_id = #{columnId,jdbcType=NUMERIC}
+  </update>
+
   <update id="updateOrdsPath">
     UPDATE cb_protected_object
     SET ords_path = #{ordsPath,jdbcType=VARCHAR}

src/main/resources/templates/objects.html

@@ -86,6 +86,65 @@
           </tr>
           <tr>
             <td colspan="5" class="policy-source-cell">
+              <details class="column-policy-panel">
+                <summary>컬럼 민감도/마스킹 정책</summary>
+                <div class="table-responsive">
+                  <table class="table table-sm align-middle">
+                    <thead>
+                    <tr>
+                      <th>Column</th>
+                      <th>민감도</th>
+                      <th>마스킹</th>
+                      <th>상태</th>
+                      <th></th>
+                    </tr>
+                    </thead>
+                    <tbody>
+                    <tr th:each="column : ${columnsByObject[object.objectId()]}">
+                      <td>
+                        <span th:text="${column.columnName()}">CONTENTS</span>
+                        <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}"
+                               th:form="${'column-policy-form-' + column.columnId()}">
+                        <input type="hidden" name="columnId" th:value="${column.columnId()}"
+                               th:form="${'column-policy-form-' + column.columnId()}">
+                      </td>
+                      <td>
+                          <select class="form-select form-select-sm" name="sensitivityLevel"
+                                  th:form="${'column-policy-form-' + column.columnId()}">
+                            <option value="PUBLIC" th:selected="${column.sensitivityLevel() == 'PUBLIC'}">PUBLIC</option>
+                            <option value="INTERNAL" th:selected="${column.sensitivityLevel() == 'INTERNAL'}">INTERNAL</option>
+                            <option value="CONFIDENTIAL" th:selected="${column.sensitivityLevel() == 'CONFIDENTIAL'}">CONFIDENTIAL</option>
+                            <option value="RESTRICTED" th:selected="${column.sensitivityLevel() == 'RESTRICTED'}">RESTRICTED</option>
+                          </select>
+                      </td>
+                      <td>
+                          <select class="form-select form-select-sm" name="redactionMethod"
+                                  th:form="${'column-policy-form-' + column.columnId()}">
+                            <option value="NONE" th:selected="${column.redactionMethod() == 'NONE'}">NONE</option>
+                            <option value="NULLIFY" th:selected="${column.redactionMethod() == 'NULLIFY'}">NULLIFY</option>
+                            <option value="PARTIAL" th:selected="${column.redactionMethod() == 'PARTIAL'}">PARTIAL</option>
+                            <option value="FULL" th:selected="${column.redactionMethod() == 'FULL'}">FULL</option>
+                          </select>
+                      </td>
+                      <td>
+                        <span class="badge"
+                              th:classappend="${column.sensitive()} ? ' text-bg-warning' : ' text-bg-secondary'"
+                              th:text="${column.policyLabel()}">PUBLIC/NONE</span>
+                      </td>
+                      <td>
+                          <form method="post" action="/objects/column-policy"
+                                th:id="${'column-policy-form-' + column.columnId()}"></form>
+                          <button class="btn btn-sm btn-outline-primary" type="submit"
+                                  th:form="${'column-policy-form-' + column.columnId()}">저장</button>
+                      </td>
+                    </tr>
+                    <tr th:if="${#lists.isEmpty(columnsByObject[object.objectId()])}">
+                      <td colspan="5" class="text-muted">등록된 컬럼 정책이 없습니다.</td>
+                    </tr>
+                    </tbody>
+                  </table>
+                </div>
+              </details>
               <div th:id="${'handler-source-' + object.objectId()}" class="text-muted small">
                 소스 보기를 누르면 기본 Handler PL/SQL이 표시됩니다.
               </div>

src/main/resources/templates/roles.html

@@ -23,6 +23,15 @@
         설명
         <input class="form-control" name="description" maxlength="200">
       </label>
+      <label>
+        민감도 허용 상한
+        <select class="form-select" name="maxSensitivityLevel">
+          <option value="PUBLIC">PUBLIC</option>
+          <option value="INTERNAL">INTERNAL</option>
+          <option value="CONFIDENTIAL">CONFIDENTIAL</option>
+          <option value="RESTRICTED">RESTRICTED</option>
+        </select>
+      </label>
       <button class="btn rw-btn-primary" type="submit">추가</button>
     </form>
   </section>
@@ -35,6 +44,7 @@
         <tr>
           <th>ID</th>
           <th>역할명</th>
+          <th>민감도 허용 상한</th>
           <th></th>
         </tr>
         </thead>
@@ -42,6 +52,19 @@
         <tr th:each="role : ${roles}">
           <td th:text="${role.roleId()}">10</td>
           <td th:text="${role.roleName()}">HR_DEPT_ROLE</td>
+          <td>
+            <form method="post" action="/roles/max-sensitivity" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="roleId" th:value="${role.roleId()}">
+              <select class="form-select form-select-sm" name="maxSensitivityLevel">
+                <option value="PUBLIC" th:selected="${role.maxSensitivityLevel() == 'PUBLIC'}">PUBLIC</option>
+                <option value="INTERNAL" th:selected="${role.maxSensitivityLevel() == 'INTERNAL'}">INTERNAL</option>
+                <option value="CONFIDENTIAL" th:selected="${role.maxSensitivityLevel() == 'CONFIDENTIAL'}">CONFIDENTIAL</option>
+                <option value="RESTRICTED" th:selected="${role.maxSensitivityLevel() == 'RESTRICTED'}">RESTRICTED</option>
+              </select>
+              <button class="btn btn-sm btn-outline-primary" type="submit">저장</button>
+            </form>
+          </td>
           <td>
             <form method="post" action="/roles/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
@@ -51,7 +74,7 @@
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(roles)}">
-          <td colspan="3" class="text-muted">등록된 역할이 없습니다.</td>
+          <td colspan="4" class="text-muted">등록된 역할이 없습니다.</td>
         </tr>
         </tbody>
       </table>