From 64965c294baffb8ddcbc71c0f0ac25b89b4d07c4 Mon Sep 17 00:00:00 2001
From: devmrko <devmrko@gmail.com>
Date: Wed, 22 Jul 2026 13:44:09 +0900
Subject: [PATCH] feat(backoffice): retain access policy with Smilegate tables

---
 sql/adb/71_sg_identity_administration.sql     | 51 +++++++++++++
 .../resources/mapper/PermissionMapper.xml     | 74 ++++++++++---------
 .../mapper/ProtectedObjectMapper.xml          | 40 +++++-----
 3 files changed, 112 insertions(+), 53 deletions(-)

diff --git a/sql/adb/71_sg_identity_administration.sql b/sql/adb/71_sg_identity_administration.sql
index f2a049c..2ce0649 100644
--- a/sql/adb/71_sg_identity_administration.sql
+++ b/sql/adb/71_sg_identity_administration.sql
@@ -79,6 +79,57 @@ begin
     created_at timestamp default systimestamp not null
   )');
   create_if_missing('create sequence sg_audit_event_seq start with 1 increment by 1 nocache');
+  create_if_missing('create table sg_protected_object (
+    object_id number primary key,
+    owner varchar2(128) not null,
+    object_name varchar2(128) not null,
+    ords_path varchar2(500),
+    enabled_yn char(1) default ''Y'' not null,
+    description varchar2(500),
+    created_at timestamp default systimestamp not null,
+    updated_at timestamp default systimestamp not null,
+    constraint sg_protected_object_uq unique (owner, object_name),
+    constraint sg_protected_object_enabled_ck check (enabled_yn in (''Y'', ''N''))
+  )');
+  create_if_missing('create table sg_protected_column (
+    column_id number primary key,
+    object_id number not null,
+    column_name varchar2(128) not null,
+    sensitive_yn char(1) default ''N'' not null,
+    visible_role_id number,
+    sensitivity_level varchar2(30) default ''PUBLIC'' not null,
+    redaction_method varchar2(30) default ''NONE'' not null,
+    constraint sg_protected_column_uq unique (object_id, column_name),
+    constraint sg_protected_column_object_fk foreign key (object_id) references sg_protected_object(object_id),
+    constraint sg_protected_column_role_fk foreign key (visible_role_id) references sg_app_role(role_id)
+  )');
+  create_if_missing('create table sg_permission (
+    perm_id number primary key,
+    role_id number not null,
+    target_name varchar2(128) not null,
+    action_name varchar2(30) not null,
+    permission_effect varchar2(30) default ''ALLOW'' not null,
+    created_at timestamp default systimestamp not null,
+    updated_at timestamp default systimestamp not null,
+    constraint sg_permission_role_fk foreign key (role_id) references sg_app_role(role_id),
+    constraint sg_permission_effect_ck check (permission_effect in (''ALLOW'', ''DENY''))
+  )');
+  create_if_missing('create table sg_permission_rule (
+    rule_id number primary key,
+    perm_id number not null,
+    rule_column varchar2(128),
+    rule_type varchar2(50) not null,
+    rule_value varchar2(2000),
+    constraint sg_permission_rule_perm_fk foreign key (perm_id) references sg_permission(perm_id)
+  )');
+  create_if_missing('create table sg_permission_column (
+    permission_id number not null,
+    column_name varchar2(128) not null,
+    constraint sg_permission_column_pk primary key (permission_id, column_name),
+    constraint sg_permission_column_perm_fk foreign key (permission_id) references sg_permission(perm_id)
+  )');
+  create_if_missing('create sequence sg_permission_seq start with 1 increment by 1 nocache');
+  create_if_missing('create sequence sg_permission_rule_seq start with 1 increment by 1 nocache');
 end;
 /
 
diff --git a/src/main/resources/mapper/PermissionMapper.xml b/src/main/resources/mapper/PermissionMapper.xml
index 8b9ef68..e2584ed 100644
--- a/src/main/resources/mapper/PermissionMapper.xml
+++ b/src/main/resources/mapper/PermissionMapper.xml
@@ -59,44 +59,52 @@
 
   <select id="countPermissionsByRoleId" resultType="int">
     SELECT COUNT(*)
-    FROM dual
-    WHERE 1 = 0
+    FROM sg_permission
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
   </select>
 
   <select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
-    SELECT CAST(NULL AS NUMBER) AS permission_id,
-           CAST(NULL AS NUMBER) AS role_id,
-           CAST(NULL AS VARCHAR2(100)) AS role_name,
-           CAST(NULL AS NUMBER) AS object_id,
-           CAST(NULL AS VARCHAR2(200)) AS object_name,
-           CAST(NULL AS VARCHAR2(30)) AS action,
-           CAST(NULL AS VARCHAR2(30)) AS permission_effect,
-           CAST(NULL AS VARCHAR2(4000)) AS rules,
-           CAST(NULL AS VARCHAR2(4000)) AS visible_columns,
-           CAST(NULL AS VARCHAR2(4000)) AS filter_preview,
-           CAST(NULL AS VARCHAR2(4000)) AS null_policy_preview
-    FROM dual WHERE 1 = 0
+    SELECT p.perm_id AS permission_id,
+           r.role_id,
+           r.role_name,
+           NVL(o.object_id, -1) AS object_id,
+           p.target_name AS object_name,
+           p.action_name AS action,
+           NVL(p.permission_effect, 'ALLOW') AS permission_effect,
+           LISTAGG(NVL2(pr.rule_column, pr.rule_column || ' ', '') || pr.rule_type || NVL2(pr.rule_value, ' ' || pr.rule_value, ''), ', ')
+             WITHIN GROUP (ORDER BY pr.rule_id) AS rules,
+           (SELECT LISTAGG(pc.column_name, ', ') WITHIN GROUP (ORDER BY pc.column_name)
+              FROM sg_permission_column pc WHERE pc.permission_id = p.perm_id) AS visible_columns,
+           (SELECT LISTAGG(NVL2(pr2.rule_column, pr2.rule_column || ' ', '') || pr2.rule_type || NVL2(pr2.rule_value, ' ' || pr2.rule_value, ''), CHR(10) || 'AND ')
+              WITHIN GROUP (ORDER BY pr2.rule_id) FROM sg_permission_rule pr2 WHERE pr2.perm_id = p.perm_id) AS filter_preview,
+           'Game-data access policy' AS null_policy_preview
+    FROM sg_permission p
+    JOIN sg_app_role r ON r.role_id = p.role_id
+    LEFT JOIN sg_protected_object o ON o.object_name = p.target_name
+    LEFT JOIN sg_permission_rule pr ON pr.perm_id = p.perm_id
+    GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name, p.permission_effect
+    ORDER BY r.role_name, p.target_name
   </select>
 
   <select id="findPermissionId" resultType="long">
     SELECT p.perm_id
-    FROM cb_permission p
-    JOIN cb_protected_object o ON o.object_name = p.target_name
+    FROM sg_permission p
+    JOIN sg_protected_object o ON o.object_name = p.target_name
     WHERE p.role_id = #{roleId}
       AND o.object_id = #{objectId}
   </select>
 
   <select id="findObjectIdByPermissionId" resultType="long">
     SELECT o.object_id
-    FROM cb_permission p
-    JOIN cb_protected_object o ON o.object_name = p.target_name
+    FROM sg_permission p
+    JOIN sg_protected_object o ON o.object_name = p.target_name
     WHERE p.perm_id = #{permissionId}
   </select>
 
   <select id="countPermissionsByObjectId" resultType="int">
     SELECT COUNT(*)
-    FROM cb_permission p
-    JOIN cb_protected_object o ON o.object_name = p.target_name
+    FROM sg_permission p
+    JOIN sg_protected_object o ON o.object_name = p.target_name
     WHERE o.object_id = #{objectId}
   </select>
 
@@ -106,46 +114,46 @@
            o.object_id,
            p.action_name AS action,
            NVL(p.permission_effect, 'ALLOW') AS permission_effect
-    FROM cb_permission p
-    JOIN cb_protected_object o ON o.object_name = p.target_name
+    FROM sg_permission p
+    JOIN sg_protected_object o ON o.object_name = p.target_name
     WHERE p.role_id = #{roleId}
       AND o.object_id = #{objectId}
   </select>
 
   <select id="nextPermissionId" resultType="long">
-    SELECT cb_permission_seq.NEXTVAL FROM dual
+    SELECT sg_permission_seq.NEXTVAL FROM dual
   </select>
 
   <select id="nextRuleId" resultType="long">
-    SELECT cb_permission_rule_seq.NEXTVAL FROM dual
+    SELECT sg_permission_rule_seq.NEXTVAL FROM dual
   </select>
 
   <insert id="insertPermission">
-    INSERT INTO cb_permission (perm_id, role_id, target_name, action_name, permission_effect)
+    INSERT INTO sg_permission (perm_id, role_id, target_name, action_name, permission_effect)
     SELECT #{permissionId}, #{roleId}, object_name, #{action}, #{permissionEffect}
-    FROM cb_protected_object
+    FROM sg_protected_object
     WHERE object_id = #{objectId}
   </insert>
 
   <update id="updatePermissionAction">
-    UPDATE cb_permission
+    UPDATE sg_permission
     SET action_name = #{action}
     WHERE perm_id = #{permissionId}
   </update>
 
   <update id="updatePermissionEffect">
-    UPDATE cb_permission
+    UPDATE sg_permission
     SET permission_effect = #{permissionEffect}
     WHERE perm_id = #{permissionId}
   </update>
 
   <delete id="deleteRules">
-    DELETE FROM cb_permission_rule
+    DELETE FROM sg_permission_rule
     WHERE perm_id = #{permissionId}
   </delete>
 
   <insert id="insertRule" parameterType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionRule">
-    INSERT INTO cb_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
+    INSERT INTO sg_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
     VALUES (
       #{ruleId,jdbcType=NUMERIC},
       #{permissionId,jdbcType=NUMERIC},
@@ -156,17 +164,17 @@
   </insert>
 
   <delete id="deleteVisibleColumns">
-    DELETE FROM cb_permission_column
+    DELETE FROM sg_permission_column
     WHERE permission_id = #{permissionId}
   </delete>
 
   <insert id="insertVisibleColumn">
-    INSERT INTO cb_permission_column (permission_id, column_name)
+    INSERT INTO sg_permission_column (permission_id, column_name)
     VALUES (#{permissionId}, #{columnName})
   </insert>
 
   <delete id="deletePermission">
-    DELETE FROM cb_permission
+    DELETE FROM sg_permission
     WHERE perm_id = #{permissionId}
   </delete>
 </mapper>
diff --git a/src/main/resources/mapper/ProtectedObjectMapper.xml b/src/main/resources/mapper/ProtectedObjectMapper.xml
index 2e10bed..0a7bfae 100644
--- a/src/main/resources/mapper/ProtectedObjectMapper.xml
+++ b/src/main/resources/mapper/ProtectedObjectMapper.xml
@@ -4,28 +4,28 @@
 <mapper namespace="com.cloudhandson.vpdbackoffice.mapper.ProtectedObjectMapper">
   <select id="findEnabled" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
     SELECT object_id, owner, object_name, ords_path, enabled_yn, description
-    FROM cb_protected_object
+    FROM sg_protected_object
     WHERE enabled_yn = 'Y'
     ORDER BY owner, object_name
   </select>
 
   <select id="findEnabledWithPermissions" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
     SELECT DISTINCT po.object_id, po.owner, po.object_name, po.ords_path, po.enabled_yn, po.description
-    FROM cb_protected_object po
-    JOIN cb_permission p ON p.target_name = po.object_name
+    FROM sg_protected_object po
+    JOIN sg_permission p ON p.target_name = po.object_name
     WHERE po.enabled_yn = 'Y'
     ORDER BY po.owner, po.object_name
   </select>
 
   <select id="findById" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
     SELECT object_id, owner, object_name, ords_path, enabled_yn, description
-    FROM cb_protected_object
+    FROM sg_protected_object
     WHERE object_id = #{objectId}
   </select>
 
   <select id="findByOwnerAndName" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
     SELECT object_id, owner, object_name, ords_path, enabled_yn, description
-    FROM cb_protected_object
+    FROM sg_protected_object
     WHERE owner = UPPER(#{owner,jdbcType=VARCHAR})
       AND object_name = UPPER(#{objectName,jdbcType=VARCHAR})
   </select>
@@ -38,8 +38,8 @@
       AND object_name NOT LIKE 'BIN$%'
       AND NOT EXISTS (
         SELECT 1
-        FROM cb_protected_object po
-        JOIN cb_permission p ON p.target_name = po.object_name
+        FROM sg_protected_object po
+        JOIN sg_permission p ON p.target_name = po.object_name
         WHERE po.owner = all_objects.owner
           AND po.object_name = all_objects.object_name
           AND po.enabled_yn = 'Y'
@@ -64,7 +64,7 @@
            visible_role_id,
            NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
            NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
-    FROM cb_protected_column
+    FROM sg_protected_column
     WHERE object_id = #{objectId}
     ORDER BY column_id
   </select>
@@ -77,7 +77,7 @@
            visible_role_id,
            NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
            NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
-    FROM cb_protected_column
+    FROM sg_protected_column
     WHERE object_id IN
     <foreach collection="objectIds" item="objectId" open="(" separator="," close=")">
       #{objectId,jdbcType=NUMERIC}
@@ -93,7 +93,7 @@
            visible_role_id,
            NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
            NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
-    FROM cb_protected_column
+    FROM sg_protected_column
     WHERE column_id = #{columnId}
   </select>
 
@@ -105,21 +105,21 @@
            visible_role_id,
            NVL(sensitivity_level, CASE sensitive_yn WHEN 'Y' THEN 'CONFIDENTIAL' ELSE 'PUBLIC' END) AS sensitivity_level,
            NVL(redaction_method, CASE sensitive_yn WHEN 'Y' THEN 'NULLIFY' ELSE 'NONE' END) AS redaction_method
-    FROM cb_protected_column
+    FROM sg_protected_column
     WHERE object_id = #{objectId}
       AND column_name = UPPER(#{columnName,jdbcType=VARCHAR})
   </select>
 
   <select id="nextObjectId" resultType="long">
-    SELECT NVL(MAX(object_id), 0) + 1 FROM cb_protected_object
+    SELECT NVL(MAX(object_id), 0) + 1 FROM sg_protected_object
   </select>
 
   <select id="nextColumnId" resultType="long">
-    SELECT NVL(MAX(column_id), 0) + 1 FROM cb_protected_column
+    SELECT NVL(MAX(column_id), 0) + 1 FROM sg_protected_column
   </select>
 
   <insert id="insertObject">
-    INSERT INTO cb_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
+    INSERT INTO sg_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
     VALUES (
       #{objectId},
       UPPER(#{command.owner}),
@@ -131,7 +131,7 @@
   </insert>
 
   <insert id="insertColumn">
-    INSERT INTO cb_protected_column (
+    INSERT INTO sg_protected_column (
       column_id, object_id, column_name, sensitive_yn, sensitivity_level, redaction_method
     )
     VALUES (
@@ -140,7 +140,7 @@
   </insert>
 
   <update id="updateColumnPolicy">
-    UPDATE cb_protected_column
+    UPDATE sg_protected_column
     SET sensitivity_level = #{sensitivityLevel,jdbcType=VARCHAR},
         redaction_method = #{redactionMethod,jdbcType=VARCHAR},
         sensitive_yn = CASE
@@ -152,25 +152,25 @@
   </update>
 
   <update id="updateOrdsPath">
-    UPDATE cb_protected_object
+    UPDATE sg_protected_object
     SET ords_path = #{ordsPath,jdbcType=VARCHAR}
     WHERE object_id = #{objectId,jdbcType=NUMERIC}
   </update>
 
   <update id="updateDescription">
-    UPDATE cb_protected_object
+    UPDATE sg_protected_object
     SET description = #{description,jdbcType=VARCHAR}
     WHERE object_id = #{objectId,jdbcType=NUMERIC}
   </update>
 
   <update id="enableObject">
-    UPDATE cb_protected_object
+    UPDATE sg_protected_object
     SET enabled_yn = 'Y'
     WHERE object_id = #{objectId}
   </update>
 
   <update id="disableObject">
-    UPDATE cb_protected_object
+    UPDATE sg_protected_object
     SET enabled_yn = 'N'
     WHERE object_id = #{objectId}
   </update>