joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(backoffice): retain access policy with Smilegate tables

Browse Source
This commit is contained in:
devmrko
2026-07-22 13:44:09 +09:00
parent 0b55e5b16b
commit 64965c294b
3 changed files with 112 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
sql/adb/71_sg_identity_administration.sql
View File

@@ -79,6 +79,57 @@ begin
created_at timestamp default systimestamp not null
)');
create_if_missing('create sequence sg_audit_event_seq start with 1 increment by 1 nocache');
create_if_missing('create table sg_protected_object (
object_id number primary key,
owner varchar2(128) not null,
object_name varchar2(128) not null,
ords_path varchar2(500),
enabled_yn char(1) default ''Y'' not null,
description varchar2(500),
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_protected_object_uq unique (owner, object_name),
constraint sg_protected_object_enabled_ck check (enabled_yn in (''Y'', ''N''))
)');
create_if_missing('create table sg_protected_column (
column_id number primary key,
object_id number not null,
column_name varchar2(128) not null,
sensitive_yn char(1) default ''N'' not null,
visible_role_id number,
sensitivity_level varchar2(30) default ''PUBLIC'' not null,
redaction_method varchar2(30) default ''NONE'' not null,
constraint sg_protected_column_uq unique (object_id, column_name),
constraint sg_protected_column_object_fk foreign key (object_id) references sg_protected_object(object_id),
constraint sg_protected_column_role_fk foreign key (visible_role_id) references sg_app_role(role_id)
)');
create_if_missing('create table sg_permission (
perm_id number primary key,
role_id number not null,
target_name varchar2(128) not null,
action_name varchar2(30) not null,
permission_effect varchar2(30) default ''ALLOW'' not null,
created_at timestamp default systimestamp not null,
updated_at timestamp default systimestamp not null,
constraint sg_permission_role_fk foreign key (role_id) references sg_app_role(role_id),
constraint sg_permission_effect_ck check (permission_effect in (''ALLOW'', ''DENY''))
)');
create_if_missing('create table sg_permission_rule (
rule_id number primary key,
perm_id number not null,
rule_column varchar2(128),
rule_type varchar2(50) not null,
rule_value varchar2(2000),
constraint sg_permission_rule_perm_fk foreign key (perm_id) references sg_permission(perm_id)
)');
create_if_missing('create table sg_permission_column (
permission_id number not null,
column_name varchar2(128) not null,
constraint sg_permission_column_pk primary key (permission_id, column_name),
constraint sg_permission_column_perm_fk foreign key (permission_id) references sg_permission(perm_id)
)');
create_if_missing('create sequence sg_permission_seq start with 1 increment by 1 nocache');
create_if_missing('create sequence sg_permission_rule_seq start with 1 increment by 1 nocache');
end;
/

74
src/main/resources/mapper/PermissionMapper.xml
View File

@@ -59,44 +59,52 @@
<select id="countPermissionsByRoleId" resultType="int">
SELECT COUNT(*)
FROM dual
WHERE 1 = 0
FROM sg_permission
WHERE role_id = #{roleId,jdbcType=NUMERIC}
</select>
<select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
SELECT CAST(NULL AS NUMBER) AS permission_id,
CAST(NULL AS NUMBER) AS role_id,
CAST(NULL AS VARCHAR2(100)) AS role_name,
CAST(NULL AS NUMBER) AS object_id,
CAST(NULL AS VARCHAR2(200)) AS object_name,
CAST(NULL AS VARCHAR2(30)) AS action,
CAST(NULL AS VARCHAR2(30)) AS permission_effect,
CAST(NULL AS VARCHAR2(4000)) AS rules,
CAST(NULL AS VARCHAR2(4000)) AS visible_columns,
CAST(NULL AS VARCHAR2(4000)) AS filter_preview,
CAST(NULL AS VARCHAR2(4000)) AS null_policy_preview
FROM dual WHERE 1 = 0
SELECT p.perm_id AS permission_id,
r.role_id,
r.role_name,
NVL(o.object_id, -1) AS object_id,
p.target_name AS object_name,
p.action_name AS action,
NVL(p.permission_effect, 'ALLOW') AS permission_effect,
LISTAGG(NVL2(pr.rule_column, pr.rule_column || ' ', '') || pr.rule_type || NVL2(pr.rule_value, ' ' || pr.rule_value, ''), ', ')
WITHIN GROUP (ORDER BY pr.rule_id) AS rules,
(SELECT LISTAGG(pc.column_name, ', ') WITHIN GROUP (ORDER BY pc.column_name)
FROM sg_permission_column pc WHERE pc.permission_id = p.perm_id) AS visible_columns,
(SELECT LISTAGG(NVL2(pr2.rule_column, pr2.rule_column || ' ', '') || pr2.rule_type || NVL2(pr2.rule_value, ' ' || pr2.rule_value, ''), CHR(10) || 'AND ')
WITHIN GROUP (ORDER BY pr2.rule_id) FROM sg_permission_rule pr2 WHERE pr2.perm_id = p.perm_id) AS filter_preview,
'Game-data access policy' AS null_policy_preview
FROM sg_permission p
JOIN sg_app_role r ON r.role_id = p.role_id
LEFT JOIN sg_protected_object o ON o.object_name = p.target_name
LEFT JOIN sg_permission_rule pr ON pr.perm_id = p.perm_id
GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name, p.permission_effect
ORDER BY r.role_name, p.target_name
</select>
<select id="findPermissionId" resultType="long">
SELECT p.perm_id
FROM cb_permission p
JOIN cb_protected_object o ON o.object_name = p.target_name
FROM sg_permission p
JOIN sg_protected_object o ON o.object_name = p.target_name
WHERE p.role_id = #{roleId}
AND o.object_id = #{objectId}
</select>
<select id="findObjectIdByPermissionId" resultType="long">
SELECT o.object_id
FROM cb_permission p
JOIN cb_protected_object o ON o.object_name = p.target_name
FROM sg_permission p
JOIN sg_protected_object o ON o.object_name = p.target_name
WHERE p.perm_id = #{permissionId}
</select>
<select id="countPermissionsByObjectId" resultType="int">
SELECT COUNT(*)
FROM cb_permission p
JOIN cb_protected_object o ON o.object_name = p.target_name
FROM sg_permission p
JOIN sg_protected_object o ON o.object_name = p.target_name
WHERE o.object_id = #{objectId}
</select>
@@ -106,46 +114,46 @@
o.object_id,
p.action_name AS action,
NVL(p.permission_effect, 'ALLOW') AS permission_effect
FROM cb_permission p
JOIN cb_protected_object o ON o.object_name = p.target_name
FROM sg_permission p
JOIN sg_protected_object o ON o.object_name = p.target_name
WHERE p.role_id = #{roleId}
AND o.object_id = #{objectId}
</select>
<select id="nextPermissionId" resultType="long">
SELECT cb_permission_seq.NEXTVAL FROM dual
SELECT sg_permission_seq.NEXTVAL FROM dual
</select>
<select id="nextRuleId" resultType="long">
SELECT cb_permission_rule_seq.NEXTVAL FROM dual
SELECT sg_permission_rule_seq.NEXTVAL FROM dual
</select>
<insert id="insertPermission">
INSERT INTO cb_permission (perm_id, role_id, target_name, action_name, permission_effect)
INSERT INTO sg_permission (perm_id, role_id, target_name, action_name, permission_effect)
SELECT #{permissionId}, #{roleId}, object_name, #{action}, #{permissionEffect}
FROM cb_protected_object
FROM sg_protected_object
WHERE object_id = #{objectId}
</insert>
<update id="updatePermissionAction">
UPDATE cb_permission
UPDATE sg_permission
SET action_name = #{action}
WHERE perm_id = #{permissionId}
</update>
<update id="updatePermissionEffect">
UPDATE cb_permission
UPDATE sg_permission
SET permission_effect = #{permissionEffect}
WHERE perm_id = #{permissionId}
</update>
<delete id="deleteRules">
DELETE FROM cb_permission_rule
DELETE FROM sg_permission_rule
WHERE perm_id = #{permissionId}
</delete>
<insert id="insertRule" parameterType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionRule">
INSERT INTO cb_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
INSERT INTO sg_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
VALUES (
#{ruleId,jdbcType=NUMERIC},
#{permissionId,jdbcType=NUMERIC},
@@ -156,17 +164,17 @@
</insert>
<delete id="deleteVisibleColumns">
DELETE FROM cb_permission_column
DELETE FROM sg_permission_column
WHERE permission_id = #{permissionId}
</delete>
<insert id="insertVisibleColumn">
INSERT INTO cb_permission_column (permission_id, column_name)
INSERT INTO sg_permission_column (permission_id, column_name)
VALUES (#{permissionId}, #{columnName})
</insert>
<delete id="deletePermission">
DELETE FROM cb_permission
DELETE FROM sg_permission
WHERE perm_id = #{permissionId}
</delete>
</mapper>

40
src/main/resources/mapper/ProtectedObjectMapper.xml
View File

@@ -4,28 +4,28 @@
<mapper namespace="com.cloudhandson.vpdbackoffice.mapper.ProtectedObjectMapper">
<select id="findEnabled" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
FROM sg_protected_object
WHERE enabled_yn = 'Y'
ORDER BY owner, object_name
</select>
<select id="findEnabledWithPermissions" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT DISTINCT po.object_id, po.owner, po.object_name, po.ords_path, po.enabled_yn, po.description
FROM cb_protected_object po
JOIN cb_permission p ON p.target_name = po.object_name
FROM sg_protected_object po
JOIN sg_permission p ON p.target_name = po.object_name
WHERE po.enabled_yn = 'Y'
ORDER BY po.owner, po.object_name
</select>
<select id="findById" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
FROM sg_protected_object
WHERE object_id = #{objectId}
</select>
<select id="findByOwnerAndName" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
FROM sg_protected_object
WHERE owner = UPPER(#{owner,jdbcType=VARCHAR})
AND object_name = UPPER(#{objectName,jdbcType=VARCHAR})
</select>
@@ -38,8 +38,8 @@
AND object_name NOT LIKE 'BIN$%'
AND NOT EXISTS (
SELECT 1
FROM cb_protected_object po
JOIN cb_permission p ON p.target_name = po.object_name
FROM sg_protected_object po
JOIN sg_permission p ON p.target_name = po.object_name
WHERE po.owner = all_objects.owner
AND po.object_name = all_objects.object_name
AND po.enabled_yn = 'Y'
@@ -64,7 +64,7 @@
visible_role_id,
NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
FROM cb_protected_column
FROM sg_protected_column
WHERE object_id = #{objectId}
ORDER BY column_id
</select>
@@ -77,7 +77,7 @@
visible_role_id,
NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
FROM cb_protected_column
FROM sg_protected_column
WHERE object_id IN
<foreach collection="objectIds" item="objectId" open="(" separator="," close=")">
#{objectId,jdbcType=NUMERIC}
@@ -93,7 +93,7 @@
visible_role_id,
NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
FROM cb_protected_column
FROM sg_protected_column
WHERE column_id = #{columnId}
</select>
@@ -105,21 +105,21 @@
visible_role_id,
NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
FROM cb_protected_column
FROM sg_protected_column
WHERE object_id = #{objectId}
AND column_name = UPPER(#{columnName,jdbcType=VARCHAR})
</select>
<select id="nextObjectId" resultType="long">
SELECT NVL(MAX(object_id), 0) + 1 FROM cb_protected_object
SELECT NVL(MAX(object_id), 0) + 1 FROM sg_protected_object
</select>
<select id="nextColumnId" resultType="long">
SELECT NVL(MAX(column_id), 0) + 1 FROM cb_protected_column
SELECT NVL(MAX(column_id), 0) + 1 FROM sg_protected_column
</select>
<insert id="insertObject">
INSERT INTO cb_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
INSERT INTO sg_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
VALUES (
#{objectId},
UPPER(#{command.owner}),
@@ -131,7 +131,7 @@
</insert>
<insert id="insertColumn">
INSERT INTO cb_protected_column (
INSERT INTO sg_protected_column (
column_id, object_id, column_name, sensitive_yn, sensitivity_level, redaction_method
)
VALUES (
@@ -140,7 +140,7 @@
</insert>
<update id="updateColumnPolicy">
UPDATE cb_protected_column
UPDATE sg_protected_column
SET sensitivity_level = #{sensitivityLevel,jdbcType=VARCHAR},
redaction_method = #{redactionMethod,jdbcType=VARCHAR},
sensitive_yn = CASE
@@ -152,25 +152,25 @@
</update>
<update id="updateOrdsPath">
UPDATE cb_protected_object
UPDATE sg_protected_object
SET ords_path = #{ordsPath,jdbcType=VARCHAR}
WHERE object_id = #{objectId,jdbcType=NUMERIC}
</update>
<update id="updateDescription">
UPDATE cb_protected_object
UPDATE sg_protected_object
SET description = #{description,jdbcType=VARCHAR}
WHERE object_id = #{objectId,jdbcType=NUMERIC}
</update>
<update id="enableObject">
UPDATE cb_protected_object
UPDATE sg_protected_object
SET enabled_yn = 'Y'
WHERE object_id = #{objectId}
</update>
<update id="disableObject">
UPDATE cb_protected_object
UPDATE sg_protected_object
SET enabled_yn = 'N'
WHERE object_id = #{objectId}
</update>