From 4d662f7a36a5bb01405908f550c3fa6aee678e29 Mon Sep 17 00:00:00 2001
From: devmrko <devmrko@gmail.com>
Date: Thu, 25 Jun 2026 16:19:26 +0900
Subject: [PATCH] fix #424: set VPD context before ORDS query cursors

---
 ...agent_ords_security_ords_handler_setup.sql | 56 ++++++++++++++++---
 .../service/OrdsMetadataService.java          | 39 +++++++++++--
 2 files changed, 80 insertions(+), 15 deletions(-)

diff --git a/sql/adb/22_agent_ords_security_ords_handler_setup.sql b/sql/adb/22_agent_ords_security_ords_handler_setup.sql
index c4b09c9..47d7e9a 100644
--- a/sql/adb/22_agent_ords_security_ords_handler_setup.sql
+++ b/sql/adb/22_agent_ords_security_ords_handler_setup.sql
@@ -86,17 +86,45 @@ BEGIN
     p_module_name    => 'cb.agent.security',
     p_pattern        => 'vpd/documents',
     p_method         => 'POST',
-    p_source_type    => ORDS.source_type_query,
+    p_source_type    => ORDS.source_type_plsql,
     p_source         => q'!
-SELECT d.doc_id,
-       d.title,
-       d.owner_emp_no,
-       d.dept_code,
-       d.contents
-FROM   admin.cb_v_search_documents d
-WHERE  (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual) = 1
+DECLARE
+  v_rows SYS_REFCURSOR;
+BEGIN
+  cb_ords_handler_pkg.set_vpd_context(:auth_header);
+
+  OPEN v_rows FOR
+    SELECT d.doc_id,
+           d.title,
+           d.owner_emp_no,
+           d.dept_code,
+           d.contents
+    FROM   admin.cb_v_search_documents d
+    WHERE  ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500);
+
+  :status_code := 200;
+  OWA_UTIL.MIME_HEADER('application/json', FALSE);
+  HTP.P('Cache-Control: no-store');
+  OWA_UTIL.HTTP_HEADER_CLOSE;
+
+  APEX_JSON.OPEN_OBJECT;
+  APEX_JSON.WRITE('items', v_rows);
+  APEX_JSON.CLOSE_OBJECT;
+
+  cb_ords_handler_pkg.clear_vpd_context;
+EXCEPTION
+  WHEN OTHERS THEN
+    cb_ords_handler_pkg.clear_vpd_context;
+    :status_code := 403;
+    OWA_UTIL.MIME_HEADER('application/json', FALSE);
+    HTP.P('Cache-Control: no-store');
+    OWA_UTIL.HTTP_HEADER_CLOSE;
+    APEX_JSON.OPEN_OBJECT;
+    APEX_JSON.WRITE('error', SQLERRM);
+    APEX_JSON.CLOSE_OBJECT;
+END;
 !',
-    p_items_per_page => 25
+    p_items_per_page => 0
   );
 
   ORDS.DEFINE_PARAMETER(
@@ -109,6 +137,16 @@ WHERE  (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual)
     p_param_type         => 'STRING',
     p_access_method      => 'IN'
   );
+  ORDS.DEFINE_PARAMETER(
+    p_module_name        => 'cb.agent.security',
+    p_pattern            => 'vpd/documents',
+    p_method             => 'POST',
+    p_name               => 'limit',
+    p_bind_variable_name => 'row_limit',
+    p_source_type        => 'URI',
+    p_param_type         => 'INT',
+    p_access_method      => 'IN'
+  );
 
   COMMIT;
 END;
diff --git a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsMetadataService.java b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsMetadataService.java
index 7bbf015..b231519 100644
--- a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsMetadataService.java
+++ b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsMetadataService.java
@@ -186,9 +186,9 @@ public class OrdsMetadataService {
             p_module_name    => ?,
             p_pattern        => ?,
             p_method         => 'POST',
-            p_source_type    => ORDS.source_type_query,
+            p_source_type    => ORDS.source_type_plsql,
             p_source         => ?,
-            p_items_per_page => 25
+            p_items_per_page => 0
           );
           ORDS.DEFINE_PARAMETER(
             p_module_name        => ?,
@@ -229,10 +229,37 @@ public class OrdsMetadataService {
         .reduce((left, right) -> left + ",\n       " + right)
         .orElseThrow();
     return """
-        SELECT %s
-        FROM   %s.%s o
-        WHERE  (SELECT cb_ords_handler_pkg.set_vpd_context_sql(:auth_header) FROM dual) = 1
-          AND  ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500)
+        DECLARE
+          v_rows SYS_REFCURSOR;
+        BEGIN
+          cb_ords_handler_pkg.set_vpd_context(:auth_header);
+
+          OPEN v_rows FOR
+            SELECT %s
+            FROM   %s.%s o
+            WHERE  ROWNUM <= LEAST(GREATEST(NVL(:row_limit, 50), 1), 500);
+
+          :status_code := 200;
+          OWA_UTIL.MIME_HEADER('application/json', FALSE);
+          HTP.P('Cache-Control: no-store');
+          OWA_UTIL.HTTP_HEADER_CLOSE;
+
+          APEX_JSON.OPEN_OBJECT;
+          APEX_JSON.WRITE('items', v_rows);
+          APEX_JSON.CLOSE_OBJECT;
+
+          cb_ords_handler_pkg.clear_vpd_context;
+        EXCEPTION
+          WHEN OTHERS THEN
+            cb_ords_handler_pkg.clear_vpd_context;
+            :status_code := 403;
+            OWA_UTIL.MIME_HEADER('application/json', FALSE);
+            HTP.P('Cache-Control: no-store');
+            OWA_UTIL.HTTP_HEADER_CLOSE;
+            APEX_JSON.OPEN_OBJECT;
+            APEX_JSON.WRITE('error', SQLERRM);
+            APEX_JSON.CLOSE_OBJECT;
+        END;
         """.formatted(selectColumns, object.owner(), object.objectName());
   }