refs #722: externalize backoffice customer configuration

src/main/java/com/cloudhandson/vpdbackoffice/service/SecuritySqlScriptService.java

@@ -1,11 +1,15 @@
 package com.cloudhandson.vpdbackoffice.service;
 
+import com.cloudhandson.vpdbackoffice.config.SecuritySqlScriptProperties;
 import com.cloudhandson.vpdbackoffice.domain.securityscript.SecuritySqlScript;
 import com.cloudhandson.vpdbackoffice.domain.securityscript.SecuritySqlScriptSummary;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.List;
+import java.util.regex.Pattern;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.stereotype.Service;
 
@@ -17,25 +21,18 @@ import org.springframework.stereotype.Service;
 @Service
 public class SecuritySqlScriptService {
 
-  private static final List<ScriptDefinition> CURATED_SCRIPTS = List.of(
-      new ScriptDefinition(
-          "smilegate-tool-users",
-          "Smilegate 사용자",
-          "70_sg_tool_user.sql",
-          "PoC 도구 사용자 초기 데이터",
-          "Data & AI TF 팀장·팀원 데모 사용자와 역할을 생성합니다. 게임 서비스 사용자가 아닌 PoC 도구 운영 사용자입니다."
-      ),
-      new ScriptDefinition(
-          "smilegate-identity-administration",
-          "Smilegate 권한",
-          "71_sg_identity_administration.sql",
-          "사용자·그룹·역할 관리 모델",
-          "Smilegate PoC 운영 사용자, 그룹, 역할, 권한 메타데이터와 백오피스 호환 뷰를 생성합니다."
-      )
+  private static final Pattern SCRIPT_ID = Pattern.compile("[a-z][a-z0-9-]{0,63}");
+  private static final Pattern RESOURCE_PATH = Pattern.compile(
+      "(?:[A-Za-z0-9][A-Za-z0-9_-]*/)*[A-Za-z0-9][A-Za-z0-9._-]*\\.sql"
   );
+  private final List<ScriptDefinition> scripts;
+
+  public SecuritySqlScriptService(SecuritySqlScriptProperties properties, ObjectMapper objectMapper) {
+    scripts = parse(properties.scripts(), objectMapper);
+  }
 
   public List<SecuritySqlScriptSummary> list() {
-    return CURATED_SCRIPTS.stream()
+    return scripts.stream()
         .map(definition -> new SecuritySqlScriptSummary(
             definition.scriptId(),
             definition.category(),
@@ -47,7 +44,7 @@ public class SecuritySqlScriptService {
   }
 
   public SecuritySqlScript find(String scriptId) {
-    ScriptDefinition definition = CURATED_SCRIPTS.stream()
+    ScriptDefinition definition = scripts.stream()
         .filter(candidate -> candidate.scriptId().equals(scriptId))
         .findFirst()
         .orElseThrow(() -> new AppException("조회할 수 없는 보안 SQL 스크립트입니다."));
@@ -70,7 +67,36 @@ public class SecuritySqlScriptService {
     }
   }
 
-  private record ScriptDefinition(
+  private List<ScriptDefinition> parse(String raw, ObjectMapper objectMapper) {
+    if (raw == null || raw.isBlank()) {
+      return List.of();
+    }
+    try {
+      List<ScriptDefinition> parsed = objectMapper.readValue(raw, new TypeReference<>() {});
+      if (parsed.isEmpty() || parsed.stream().map(ScriptDefinition::scriptId).distinct().count() != parsed.size()) {
+        throw new IllegalArgumentException();
+      }
+      parsed.forEach(this::validate);
+      return List.copyOf(parsed);
+    } catch (Exception exception) {
+      throw new IllegalStateException("BACKOFFICE_SECURITY_SQL_SCRIPTS 설정을 확인하세요.", exception);
+    }
+  }
+
+  private void validate(ScriptDefinition definition) {
+    if (definition == null
+        || definition.scriptId() == null || !SCRIPT_ID.matcher(definition.scriptId()).matches()
+        || definition.fileName() == null || !RESOURCE_PATH.matcher(definition.fileName()).matches()
+        || blank(definition.category()) || blank(definition.title()) || blank(definition.description())) {
+      throw new IllegalArgumentException();
+    }
+  }
+
+  private boolean blank(String value) {
+    return value == null || value.isBlank();
+  }
+
+  public record ScriptDefinition(
       String scriptId,
       String category,
       String fileName,