joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refs #722: externalize backoffice customer configuration

Browse Source
This commit is contained in:
devmrko
2026-07-23 19:14:37 +09:00
parent 7ba173240c
commit 53342e7bc3
47 changed files with 622 additions and 216 deletions
Download Patch File Download Diff File Expand all files Collapse all files

329
sql/adb/legacy/smilegate/71_identity_administration.sql Normal file
View File

@@ -0,0 +1,329 @@
-- Smilegate PoC backoffice identity administration model.
-- Tool operators are distinct from game-service users and from the admin login.
set define off
declare
procedure create_if_missing(p_sql varchar2) is
begin
execute immediate p_sql;
exception
when others then
if sqlcode != -955 then raise; end if;
end;
begin
create_if_missing('create table sg_app_user (
user_id number primary key,
login_id varchar2(100) not null unique,
user_name varchar2(200) not null,
employee_no varchar2(100),
dept_code varchar2(100),
can_read_contents char(1) default ''N'' not null,
active char(1) default ''Y'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_app_user_active_ck check (active in (''Y'', ''N''))
)');
create_if_missing('create table sg_app_group (
group_id number primary key,
group_code varchar2(100) not null unique,
group_name varchar2(200) not null,
description varchar2(500),
active_yn char(1) default ''Y'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_app_group_active_ck check (active_yn in (''Y'', ''N''))
)');
create_if_missing('create table sg_app_role (
role_id number primary key,
role_name varchar2(100) not null unique,
description varchar2(500),
max_sensitivity_level varchar2(30) default ''INTERNAL'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_app_role_sensitivity_ck check (max_sensitivity_level in (''PUBLIC'', ''INTERNAL'', ''CONFIDENTIAL'', ''RESTRICTED''))
)');
create_if_missing('create table sg_user_role (
user_id number not null,
role_id number not null,
created_at timestamp default systimestamp not null,
constraint sg_user_role_pk primary key (user_id, role_id),
constraint sg_user_role_user_fk foreign key (user_id) references sg_app_user(user_id),
constraint sg_user_role_role_fk foreign key (role_id) references sg_app_role(role_id)
)');
create_if_missing('create table sg_user_group (
group_id number not null,
user_id number not null,
created_at timestamp default systimestamp not null,
constraint sg_user_group_pk primary key (group_id, user_id),
constraint sg_user_group_group_fk foreign key (group_id) references sg_app_group(group_id),
constraint sg_user_group_user_fk foreign key (user_id) references sg_app_user(user_id)
)');
create_if_missing('create table sg_group_role (
group_id number not null,
role_id number not null,
created_at timestamp default systimestamp not null,
constraint sg_group_role_pk primary key (group_id, role_id),
constraint sg_group_role_group_fk foreign key (group_id) references sg_app_group(group_id),
constraint sg_group_role_role_fk foreign key (role_id) references sg_app_role(role_id)
)');
create_if_missing('create table sg_audit_event (
audit_id number primary key,
event_type varchar2(100) not null,
key_id number,
object_id number,
status varchar2(30) not null,
row_count number,
error_code varchar2(100),
message varchar2(2000),
created_at timestamp default systimestamp not null
)');
create_if_missing('create sequence sg_audit_event_seq start with 1 increment by 1 nocache');
create_if_missing('create table sg_protected_object (
object_id number primary key,
owner varchar2(128) not null,
object_name varchar2(128) not null,
ords_path varchar2(500),
enabled_yn char(1) default ''Y'' not null,
description varchar2(500),
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_protected_object_uq unique (owner, object_name),
constraint sg_protected_object_enabled_ck check (enabled_yn in (''Y'', ''N''))
)');
create_if_missing('create table sg_protected_column (
column_id number primary key,
object_id number not null,
column_name varchar2(128) not null,
sensitive_yn char(1) default ''N'' not null,
visible_role_id number,
sensitivity_level varchar2(30) default ''PUBLIC'' not null,
redaction_method varchar2(30) default ''NONE'' not null,
constraint sg_protected_column_uq unique (object_id, column_name),
constraint sg_protected_column_object_fk foreign key (object_id) references sg_protected_object(object_id),
constraint sg_protected_column_role_fk foreign key (visible_role_id) references sg_app_role(role_id)
)');
create_if_missing('create table sg_permission (
perm_id number primary key,
role_id number not null,
target_name varchar2(128) not null,
action_name varchar2(30) not null,
permission_effect varchar2(30) default ''ALLOW'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_permission_role_fk foreign key (role_id) references sg_app_role(role_id),
constraint sg_permission_effect_ck check (permission_effect in (''ALLOW'', ''DENY''))
)');
create_if_missing('create table sg_permission_rule (
rule_id number primary key,
perm_id number not null,
rule_column varchar2(128),
rule_type varchar2(50) not null,
rule_value varchar2(2000),
constraint sg_permission_rule_perm_fk foreign key (perm_id) references sg_permission(perm_id)
)');
create_if_missing('create table sg_permission_column (
permission_id number not null,
column_name varchar2(128) not null,
constraint sg_permission_column_pk primary key (permission_id, column_name),
constraint sg_permission_column_perm_fk foreign key (permission_id) references sg_permission(perm_id)
)');
create_if_missing('create sequence sg_permission_seq start with 1 increment by 1 nocache');
create_if_missing('create sequence sg_permission_rule_seq start with 1 increment by 1 nocache');
create_if_missing('create table sg_vpd_policy_note (
object_owner varchar2(128) not null,
object_name varchar2(128) not null,
policy_name varchar2(128) not null,
description varchar2(2000),
updated_at timestamp default systimestamp not null,
constraint sg_vpd_policy_note_pk primary key (object_owner, object_name, policy_name)
)');
create_if_missing('create table sg_vpd_filter_note (
function_owner varchar2(128) not null,
function_name varchar2(128) not null,
description varchar2(2000),
updated_at timestamp default systimestamp not null,
constraint sg_vpd_filter_note_pk primary key (function_owner, function_name)
)');
create_if_missing('create table sg_masking_rule (
rule_id number primary key,
rule_code varchar2(100) not null unique,
rule_name varchar2(200) not null,
template_code varchar2(100) not null,
description varchar2(2000),
enabled_yn char(1) default ''Y'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_masking_rule_enabled_ck check (enabled_yn in (''Y'', ''N''))
)');
create_if_missing('create table sg_access_bearer_token (
key_id number primary key, user_id number not null, key_prefix varchar2(100) not null,
key_hash varchar2(256) not null unique, expires_at timestamp not null, revoked_at timestamp,
description varchar2(500), created_at timestamp default systimestamp not null,
constraint sg_access_bearer_token_user_fk foreign key (user_id) references sg_app_user(user_id)
)');
create_if_missing('create table sg_backoffice_setting (
setting_key varchar2(200) primary key, setting_value varchar2(4000),
updated_at timestamp default systimestamp not null
)');
create_if_missing('create table sg_vector_document_chunk (
chunk_id number primary key, document_id varchar2(200) not null, chunk_no number not null,
content clob not null, embedding vector(1536, float32), created_at timestamp default systimestamp not null
)');
create_if_missing('create table sg_vector_document_tag (
chunk_id number not null, tech_tag varchar2(200) not null,
constraint sg_vector_document_tag_pk primary key (chunk_id, tech_tag),
constraint sg_vector_document_tag_chunk_fk foreign key (chunk_id) references sg_vector_document_chunk(chunk_id)
)');
create_if_missing('create sequence sg_vector_chunk_seq start with 1 increment by 1 nocache');
create_if_missing('create table sg_column_masking_rule (
column_id number primary key,
rule_id number not null,
updated_at timestamp default systimestamp not null,
constraint sg_column_masking_rule_column_fk foreign key (column_id) references sg_protected_column(column_id),
constraint sg_column_masking_rule_rule_fk foreign key (rule_id) references sg_masking_rule(rule_id)
)');
create_if_missing('create table sg_user_masking_rule (
user_id number not null,
column_id number not null,
decision varchar2(30) not null,
active_yn char(1) default ''Y'' not null,
updated_at timestamp default systimestamp not null,
constraint sg_user_masking_rule_pk primary key (user_id, column_id),
constraint sg_user_masking_rule_user_fk foreign key (user_id) references sg_app_user(user_id),
constraint sg_user_masking_rule_column_fk foreign key (column_id) references sg_protected_column(column_id)
)');
end;
/
merge into sg_app_user t
using (
select 1001 user_id, 'sg-teamlead' login_id, 'SG Demo Team Lead' user_name, 'SG-001' employee_no, 'DATA_AI' dept_code from dual
union all
select 1002, 'sg-member', 'SG Demo Team Member', 'SG-002', 'DATA_AI' from dual
) s on (t.user_id = s.user_id)
when matched then update set t.login_id=s.login_id, t.user_name=s.user_name, t.employee_no=s.employee_no, t.dept_code=s.dept_code, t.active='Y', t.updated_at=systimestamp
when not matched then insert (user_id, login_id, user_name, employee_no, dept_code, can_read_contents, active)
values (s.user_id, s.login_id, s.user_name, s.employee_no, s.dept_code, 'N', 'Y');
merge into sg_app_group t
using (select 2001 group_id, 'DATA_AI_TF' group_code, 'Data & AI TF' group_name, 'Smilegate Data and AI proof-of-concept operators' description from dual) s
on (t.group_id = s.group_id)
when matched then update set t.group_code=s.group_code, t.group_name=s.group_name, t.description=s.description, t.active_yn='Y', t.updated_at=systimestamp
when not matched then insert (group_id, group_code, group_name, description, active_yn) values (s.group_id, s.group_code, s.group_name, s.description, 'Y');
merge into sg_app_role t
using (
select 3001 role_id, 'DATA_AI_TEAM_LEAD' role_name, 'Data and AI TF lead' description, 'CONFIDENTIAL' max_sensitivity_level from dual
union all
select 3002, 'DATA_AI_TEAM_MEMBER', 'Data and AI TF member', 'INTERNAL' from dual
) s on (t.role_id=s.role_id)
when matched then update set t.role_name=s.role_name, t.description=s.description, t.max_sensitivity_level=s.max_sensitivity_level, t.updated_at=systimestamp
when not matched then insert (role_id, role_name, description, max_sensitivity_level) values (s.role_id, s.role_name, s.description, s.max_sensitivity_level);
merge into sg_user_group t using (select 2001 group_id, 1001 user_id from dual union all select 2001, 1002 from dual) s
on (t.group_id=s.group_id and t.user_id=s.user_id) when not matched then insert (group_id, user_id) values (s.group_id, s.user_id);
merge into sg_user_role t using (select 1001 user_id, 3001 role_id from dual union all select 1002, 3002 from dual) s
on (t.user_id=s.user_id and t.role_id=s.role_id) when not matched then insert (user_id, role_id) values (s.user_id, s.role_id);
merge into sg_group_role t using (select 2001 group_id, 3002 role_id from dual) s
on (t.group_id=s.group_id and t.role_id=s.role_id) when not matched then insert (group_id, role_id) values (s.group_id, s.role_id);
commit;
-- Compatibility layer for remaining backoffice modules. The data is stored
-- only in SG_* tables; these views prevent older controller paths from
-- querying non-existent CB_* physical tables during the Smilegate transition.
create or replace view cb_app_user as
select user_id, user_name, employee_no, dept_code, can_read_contents, active from sg_app_user;
create or replace view cb_app_group as
select group_id, group_code, group_name, description, active_yn from sg_app_group;
create or replace view cb_app_role as
select role_id, role_name, max_sensitivity_level from sg_app_role;
create or replace view cb_user_role as select user_id, role_id from sg_user_role;
create or replace view cb_user_group as select group_id, user_id from sg_user_group;
create or replace view cb_group_role as select group_id, role_id from sg_group_role;
create or replace view cb_protected_object as
select object_id, owner, object_name, ords_path, enabled_yn, description from sg_protected_object;
create or replace view cb_protected_column as
select column_id, object_id, column_name, sensitive_yn, visible_role_id, sensitivity_level, redaction_method from sg_protected_column;
create or replace view cb_permission as
select perm_id, role_id, target_name, action_name, permission_effect from sg_permission;
create or replace view cb_permission_rule as
select rule_id, perm_id, rule_column, rule_type, rule_value from sg_permission_rule;
create or replace view cb_permission_column as
select permission_id, column_name from sg_permission_column;
create or replace view cb_vpd_policy_note as
select object_owner, object_name, policy_name, description, updated_at from sg_vpd_policy_note;
create or replace view cb_vpd_filter_note as
select function_owner, function_name, description, updated_at from sg_vpd_filter_note;
create or replace view cb_masking_rule as
select rule_id, rule_code, rule_name, template_code, description, enabled_yn from sg_masking_rule;
create or replace view cb_column_masking_rule as
select column_id, rule_id, updated_at from sg_column_masking_rule;
create or replace view cb_user_masking_rule as
select user_id, column_id, decision, active_yn, updated_at from sg_user_masking_rule;
create or replace view cb_ords_probe_audit as
select audit_id, event_type, key_id, object_id, status, row_count, error_code, message, created_at from sg_audit_event;
create or replace view cb_backoffice_setting as
select setting_key, setting_value, updated_at from sg_backoffice_setting;
-- PoC administrator access: both demo operators can manage and query every
-- Smilegate game-data object registered in SGMP_POC.
merge into sg_app_role t
using (select 3099 role_id, 'DATA_AI_POC_ADMIN' role_name,
'Full access to all Smilegate PoC game-data objects' description,
'RESTRICTED' max_sensitivity_level from dual) s
on (t.role_id = s.role_id)
when matched then update set t.role_name=s.role_name, t.description=s.description,
t.max_sensitivity_level=s.max_sensitivity_level, t.updated_at=systimestamp
when not matched then insert (role_id, role_name, description, max_sensitivity_level)
values (s.role_id, s.role_name, s.description, s.max_sensitivity_level);
merge into sg_user_role t
using (select 1001 user_id, 3099 role_id from dual union all select 1002, 3099 from dual) s
on (t.user_id=s.user_id and t.role_id=s.role_id)
when not matched then insert (user_id, role_id) values (s.user_id, s.role_id);
declare
l_object_id number;
l_permission_id number;
begin
for source_object in (
select table_name
from all_tables
where owner = 'SGMP_POC'
and table_name not in ('SEMANTIC_METADATA_CHANGE_LOG', 'SGMP_TERM_CONTEXT_CACHE',
'SGMP_TERM_DICTIONARY', 'SGMP_TERM_SEARCH_LOG', 'SGMP_TERM_SYNONYM')
order by table_name
) loop
begin
select object_id into l_object_id
from sg_protected_object
where owner = 'SGMP_POC' and object_name = source_object.table_name;
exception
when no_data_found then
select nvl(max(object_id), 0) + 1 into l_object_id from sg_protected_object;
insert into sg_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
values (l_object_id, 'SGMP_POC', source_object.table_name,
'/sgmp-poc/' || lower(source_object.table_name), 'Y',
'Smilegate PoC game-data object');
end;
begin
select perm_id into l_permission_id
from sg_permission
where role_id = 3099 and target_name = source_object.table_name;
exception
when no_data_found then
l_permission_id := sg_permission_seq.nextval;
insert into sg_permission (perm_id, role_id, target_name, action_name, permission_effect)
values (l_permission_id, 3099, source_object.table_name, 'SELECT', 'ALLOW');
insert into sg_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
values (sg_permission_rule_seq.nextval, l_permission_id, null, 'ALL', null);
end;
end loop;
commit;
end;
/