joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix #557: guide permission-driven VPD flow

Browse Source
This commit is contained in:
devmrko
2026-06-29 12:11:25 +09:00
parent fbe3d4682b
commit 908ac9a386
57 changed files with 1952 additions and 312 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/resources/mapper/BearerTokenMapper.xml
View File

@@ -7,6 +7,8 @@
k.expires_at, k.revoked_at, k.description
FROM cb_agent_bearer_key k
JOIN cb_app_user u ON u.user_id = k.user_id
WHERE #{includeInactive} = 1
OR (k.revoked_at IS NULL AND k.expires_at > SYSTIMESTAMP)
ORDER BY k.key_id DESC
</select>

3
src/main/resources/mapper/PermissionMapper.xml
View File

@@ -90,6 +90,9 @@
WHEN pr2.rule_type = 'SELF' THEN NVL(pr2.rule_column, 'OWNER_EMP_NO') || ' = SYS_CONTEXT(CB_AGENT_CTX.EMP_NO)'
WHEN pr2.rule_type = 'DEPT' THEN NVL(pr2.rule_column, 'DEPT_CODE') || ' = ' || pr2.rule_value
WHEN pr2.rule_type = 'EMP_NO' THEN NVL(pr2.rule_column, 'OWNER_EMP_NO') || ' = ' || pr2.rule_value
WHEN pr2.rule_type = 'TAG' THEN 'REGEXP_LIKE(UPPER('
|| NVL(pr2.rule_column, 'TECH_TAG')
|| '), ''(^|,)' || REPLACE(UPPER(pr2.rule_value), '''', '''''') || '(,|$)'')'
ELSE pr2.rule_column || ' ' || pr2.rule_type || ' ' || pr2.rule_value
END,
CHR(10) || 'AND '

19
src/main/resources/mapper/ProtectedObjectMapper.xml
View File

@@ -3,14 +3,14 @@
"https://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.cloudhandson.vpdbackoffice.mapper.ProtectedObjectMapper">
<select id="findEnabled" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
WHERE enabled_yn = 'Y'
ORDER BY owner, object_name
</select>
<select id="findEnabledWithPermissions" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT DISTINCT po.object_id, po.owner, po.object_name, po.ords_path, po.enabled_yn
SELECT DISTINCT po.object_id, po.owner, po.object_name, po.ords_path, po.enabled_yn, po.description
FROM cb_protected_object po
JOIN cb_permission p ON p.target_name = po.object_name
WHERE po.enabled_yn = 'Y'
@@ -18,13 +18,13 @@
</select>
<select id="findById" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
WHERE object_id = #{objectId}
</select>
<select id="findByOwnerAndName" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
SELECT object_id, owner, object_name, ords_path, enabled_yn
SELECT object_id, owner, object_name, ords_path, enabled_yn, description
FROM cb_protected_object
WHERE owner = UPPER(#{owner,jdbcType=VARCHAR})
AND object_name = UPPER(#{objectName,jdbcType=VARCHAR})
@@ -78,13 +78,14 @@
</select>
<insert id="insertObject">
INSERT INTO cb_protected_object (object_id, owner, object_name, ords_path, enabled_yn)
INSERT INTO cb_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
VALUES (
#{objectId},
UPPER(#{command.owner}),
UPPER(#{command.objectName}),
#{command.ordsPath},
'Y'
'Y',
#{command.description,jdbcType=VARCHAR}
)
</insert>
@@ -115,6 +116,12 @@
WHERE object_id = #{objectId,jdbcType=NUMERIC}
</update>
<update id="updateDescription">
UPDATE cb_protected_object
SET description = #{description,jdbcType=VARCHAR}
WHERE object_id = #{objectId,jdbcType=NUMERIC}
</update>
<update id="enableObject">
UPDATE cb_protected_object
SET enabled_yn = 'Y'

49
src/main/resources/mapper/VpdPolicyMapper.xml
View File

@@ -62,6 +62,7 @@
o.object_type,
CASE WHEN po.object_id IS NULL THEN 'N' ELSE po.enabled_yn END AS protected_yn,
po.ords_path,
po.description,
COUNT(p.policy_name) AS policy_count,
LISTAGG(p.policy_name, ', ') WITHIN GROUP (ORDER BY p.policy_name) AS policy_names,
LISTAGG(
@@ -78,7 +79,7 @@
LEFT JOIN all_policies p
ON p.object_owner = o.owner
AND p.object_name = o.object_name
GROUP BY o.owner, o.object_name, o.object_type, po.object_id, po.enabled_yn, po.ords_path
GROUP BY o.owner, o.object_name, o.object_type, po.object_id, po.enabled_yn, po.ords_path, po.description
ORDER BY CASE WHEN COUNT(p.policy_name) > 0 THEN 0 ELSE 1 END,
o.owner,
o.object_type,
@@ -278,4 +279,50 @@
AND name = UPPER(#{objectName,jdbcType=VARCHAR})
AND type = UPPER(#{objectType,jdbcType=VARCHAR})
</select>
<select id="findPolicyDescription" resultType="string">
SELECT description
FROM cb_vpd_policy_note
WHERE object_owner = UPPER(#{objectOwner,jdbcType=VARCHAR})
AND object_name = UPPER(#{objectName,jdbcType=VARCHAR})
AND policy_name = UPPER(#{policyName,jdbcType=VARCHAR})
</select>
<select id="findFilterDescription" resultType="string">
SELECT description
FROM cb_vpd_filter_note
WHERE function_owner = UPPER(#{functionOwner,jdbcType=VARCHAR})
AND function_name = UPPER(#{functionName,jdbcType=VARCHAR})
</select>
<update id="upsertPolicyDescription">
MERGE INTO cb_vpd_policy_note dst
USING (
SELECT UPPER(#{objectOwner,jdbcType=VARCHAR}) object_owner,
UPPER(#{objectName,jdbcType=VARCHAR}) object_name,
UPPER(#{policyName,jdbcType=VARCHAR}) policy_name,
#{description,jdbcType=VARCHAR} description
FROM dual
) src
ON (dst.object_owner = src.object_owner
AND dst.object_name = src.object_name
AND dst.policy_name = src.policy_name)
WHEN MATCHED THEN UPDATE SET dst.description = src.description, dst.updated_at = SYSTIMESTAMP
WHEN NOT MATCHED THEN INSERT (object_owner, object_name, policy_name, description, updated_at)
VALUES (src.object_owner, src.object_name, src.policy_name, src.description, SYSTIMESTAMP)
</update>
<update id="upsertFilterDescription">
MERGE INTO cb_vpd_filter_note dst
USING (
SELECT UPPER(#{functionOwner,jdbcType=VARCHAR}) function_owner,
UPPER(#{functionName,jdbcType=VARCHAR}) function_name,
#{description,jdbcType=VARCHAR} description
FROM dual
) src
ON (dst.function_owner = src.function_owner AND dst.function_name = src.function_name)
WHEN MATCHED THEN UPDATE SET dst.description = src.description, dst.updated_at = SYSTIMESTAMP
WHEN NOT MATCHED THEN INSERT (function_owner, function_name, description, updated_at)
VALUES (src.function_owner, src.function_name, src.description, SYSTIMESTAMP)
</update>
</mapper>