joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix #424: set VPD context before ORDS query cursors

Browse Source
This commit is contained in:
devmrko
2026-06-25 16:19:26 +09:00
parent 079f5a9678
commit 4d662f7a36
2 changed files with 80 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
sql/adb/22_agent_ords_security_ords_handler_setup.sql
View File

@@ -86,17 +86,45 @@ BEGIN
p_module_name => 'cb.agent.security',
p_pattern => 'vpd/documents',
p_method => 'POST',
p_source_type => ORDS.source_type_query,
p_source_type => ORDS.source_type_plsql,
p_source => q'!
SELECT d.doc_id,
d.title,
d.owner_emp_no,
d.dept_code,
d.contents
FROM admin.cb_v_search_documents d
WHERE (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual) = 1
DECLARE
v_rows SYS_REFCURSOR;
BEGIN
cb_ords_handler_pkg.set_vpd_context(:auth_header);
OPEN v_rows FOR
SELECT d.doc_id,
d.title,
d.owner_emp_no,
d.dept_code,
d.contents
FROM admin.cb_v_search_documents d
WHERE ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500);
:status_code := 200;
OWA_UTIL.MIME_HEADER('application/json', FALSE);
HTP.P('Cache-Control: no-store');
OWA_UTIL.HTTP_HEADER_CLOSE;
APEX_JSON.OPEN_OBJECT;
APEX_JSON.WRITE('items', v_rows);
APEX_JSON.CLOSE_OBJECT;
cb_ords_handler_pkg.clear_vpd_context;
EXCEPTION
WHEN OTHERS THEN
cb_ords_handler_pkg.clear_vpd_context;
:status_code := 403;
OWA_UTIL.MIME_HEADER('application/json', FALSE);
HTP.P('Cache-Control: no-store');
OWA_UTIL.HTTP_HEADER_CLOSE;
APEX_JSON.OPEN_OBJECT;
APEX_JSON.WRITE('error', SQLERRM);
APEX_JSON.CLOSE_OBJECT;
END;
!',
p_items_per_page => 25
p_items_per_page => 0
);
ORDS.DEFINE_PARAMETER(
@@ -109,6 +137,16 @@ WHERE (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual)
p_param_type => 'STRING',
p_access_method => 'IN'
);
ORDS.DEFINE_PARAMETER(
p_module_name => 'cb.agent.security',
p_pattern => 'vpd/documents',
p_method => 'POST',
p_name => 'limit',
p_bind_variable_name => 'row_limit',
p_source_type => 'URI',
p_param_type => 'INT',
p_access_method => 'IN'
);
COMMIT;
END;

39
src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsMetadataService.java
View File

@@ -186,9 +186,9 @@ public class OrdsMetadataService {
p_module_name => ?,
p_pattern => ?,
p_method => 'POST',
p_source_type => ORDS.source_type_query,
p_source_type => ORDS.source_type_plsql,
p_source => ?,
p_items_per_page => 25
p_items_per_page => 0
);
ORDS.DEFINE_PARAMETER(
p_module_name => ?,
@@ -229,10 +229,37 @@ public class OrdsMetadataService {
.reduce((left, right) -> left + ",\n " + right)
.orElseThrow();
return """
SELECT %s
FROM %s.%s o
WHERE (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual) = 1
AND ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500)
DECLARE
v_rows SYS_REFCURSOR;
BEGIN
cb_ords_handler_pkg.set_vpd_context(:auth_header);
OPEN v_rows FOR
SELECT %s
FROM %s.%s o
WHERE ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500);
:status_code := 200;
OWA_UTIL.MIME_HEADER('application/json', FALSE);
HTP.P('Cache-Control: no-store');
OWA_UTIL.HTTP_HEADER_CLOSE;
APEX_JSON.OPEN_OBJECT;
APEX_JSON.WRITE('items', v_rows);
APEX_JSON.CLOSE_OBJECT;
cb_ords_handler_pkg.clear_vpd_context;
EXCEPTION
WHEN OTHERS THEN
cb_ords_handler_pkg.clear_vpd_context;
:status_code := 403;
OWA_UTIL.MIME_HEADER('application/json', FALSE);
HTP.P('Cache-Control: no-store');
OWA_UTIL.HTTP_HEADER_CLOSE;
APEX_JSON.OPEN_OBJECT;
APEX_JSON.WRITE('error', SQLERRM);
APEX_JSON.CLOSE_OBJECT;
END;
""".formatted(selectColumns, object.owner(), object.objectName());
}