joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Developer] #424 improve role permission probe workflows

Browse Source 
Refs #424
This commit is contained in:
devmrko
2026-06-23 13:52:50 +09:00
parent b6fcc768a3
commit 97bb0357f9
23 changed files with 368 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeCommand.java
View File

@@ -6,7 +6,6 @@ import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Positive;
public record ProbeCommand(
@Positive long keyId,
@Positive long objectId,
@NotBlank String bearerToken,
@Min(1) @Max(500) int limit

16
src/main/java/com/cloudhandson/vpdbackoffice/domain/protectedobject/DatabaseObjectOption.java Normal file
View File

@@ -0,0 +1,16 @@
package com.cloudhandson.vpdbackoffice.domain.protectedobject;
public record DatabaseObjectOption(
String owner,
String objectName,
String objectType
) {
public String value() {
return owner + "." + objectName;
}
public String label() {
return owner + "." + objectName + " (" + objectType + ")";
}
}

2
src/main/java/com/cloudhandson/vpdbackoffice/mapper/BearerTokenMapper.java
View File

@@ -13,6 +13,8 @@ public interface BearerTokenMapper {
BearerTokenRecord findById(@Param("keyId") long keyId);
BearerTokenRecord findByHash(@Param("keyHash") String keyHash);
long nextKeyId();
void insertToken(BearerTokenRecord token);

8
src/main/java/com/cloudhandson/vpdbackoffice/mapper/PermissionMapper.java
View File

@@ -15,6 +15,14 @@ public interface PermissionMapper {
AppRole findRole(@Param("roleId") long roleId);
long nextRoleId();
void insertRole(@Param("roleId") long roleId,
@Param("roleName") String roleName,
@Param("description") String description);
int deleteRole(@Param("roleId") long roleId);
List<PermissionView> findPermissionViews();
PermissionSet findPermissionSet(@Param("roleId") long roleId, @Param("objectId") long objectId);

7
src/main/java/com/cloudhandson/vpdbackoffice/mapper/ProtectedObjectMapper.java
View File

@@ -1,5 +1,6 @@
package com.cloudhandson.vpdbackoffice.mapper;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObjectCreateCommand;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject;
@@ -14,8 +15,14 @@ public interface ProtectedObjectMapper {
ProtectedObject findById(@Param("objectId") long objectId);
ProtectedObject findByOwnerAndName(@Param("owner") String owner, @Param("objectName") String objectName);
List<ProtectedColumn> findColumns(@Param("objectId") long objectId);
List<DatabaseObjectOption> findDatabaseObjects();
List<String> findDatabaseColumns(@Param("owner") String owner, @Param("objectName") String objectName);
long nextObjectId();
long nextColumnId();

7
src/main/java/com/cloudhandson/vpdbackoffice/service/BearerTokenService.java
View File

@@ -53,6 +53,13 @@ public class BearerTokenService {
return tokenMapper.findById(keyId);
}
public BearerTokenRecord findByPlainToken(String plainToken) {
if (plainToken == null || plainToken.isBlank()) {
return null;
}
return tokenMapper.findByHash(tokenHasher.sha256(plainToken));
}
public boolean matches(BearerTokenRecord record, String plainToken) {
if (record == null || plainToken == null || plainToken.isBlank()) {
return false;

14
src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java
View File

@@ -75,7 +75,7 @@ public class OrdsProbeService {
));
}
BearerTokenRecord token = tokenService.findById(command.keyId());
BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
if (token == null) {
return auditAndReturn(command, ProbeResult.blocked(
ProbeStatus.TOKEN_NOT_FOUND, "TOKEN_NOT_FOUND", "토큰을 찾을 수 없습니다."));
@@ -84,11 +84,6 @@ public class OrdsProbeService {
return auditAndReturn(command, ProbeResult.blocked(
ProbeStatus.TOKEN_INACTIVE, "TOKEN_INACTIVE", "만료되었거나 회수된 토큰입니다."));
}
if (!tokenService.matches(token, command.bearerToken())) {
return auditAndReturn(command, ProbeResult.blocked(
ProbeStatus.INVALID_TOKEN, "INVALID_TOKEN", "입력한 Bearer Token이 선택한 key와 일치하지 않습니다."));
}
ProtectedObject object;
try {
object = protectedObjectService.assertEnabled(command.objectId());
@@ -227,7 +222,7 @@ public class OrdsProbeService {
private ProbeResult auditAndReturn(ProbeCommand command, ProbeResult result) {
auditService.record(new AuditEvent(
"ORDS_PROBE",
command.keyId(),
tokenKeyId(command),
command.objectId(),
result.status().name(),
result.rowCount(),
@@ -237,6 +232,11 @@ public class OrdsProbeService {
return result;
}
private Long tokenKeyId(ProbeCommand command) {
BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
return token == null ? null : token.keyId();
}
private ProbeStatus classifyResourceAccess(ResourceAccessException exception) {
if (errorClassifier.isTimeout(exception)) {
return ProbeStatus.ORDS_TIMEOUT;

19
src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java
View File

@@ -43,6 +43,25 @@ public class PermissionService {
return permissionMapper.findPermissionViews();
}
@Transactional
public void createRole(String roleName, String description) {
if (roleName == null || roleName.isBlank()) {
throw new AppException("역할명은 필수입니다.");
}
long roleId = permissionMapper.nextRoleId();
permissionMapper.insertRole(roleId, roleName.trim(), description);
auditService.record(new AuditEvent("ROLE_CREATED", null, null, "SUCCESS", null, null, roleName));
}
@Transactional
public void deleteRole(long roleId) {
int deleted = permissionMapper.deleteRole(roleId);
if (deleted == 0) {
throw new AppException("삭제할 역할을 찾을 수 없습니다.");
}
auditService.record(new AuditEvent("ROLE_DELETED", null, null, "SUCCESS", null, null, "roleId=" + roleId));
}
@Transactional
public PermissionSet savePermissionSet(PermissionSetCommand command) {
if (!"SELECT".equalsIgnoreCase(command.action())) {

36
src/main/java/com/cloudhandson/vpdbackoffice/service/ProtectedObjectService.java
View File

@@ -1,6 +1,7 @@
package com.cloudhandson.vpdbackoffice.service;
import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject;
import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObjectCreateCommand;
@@ -28,6 +29,10 @@ public class ProtectedObjectService {
return mapper.findEnabled();
}
public List<DatabaseObjectOption> findDatabaseObjects() {
return mapper.findDatabaseObjects();
}
public ProtectedObject assertEnabled(long objectId) {
ProtectedObject object = mapper.findById(objectId);
if (object == null || !object.enabled()) {
@@ -52,6 +57,37 @@ public class ProtectedObjectService {
command.objectName()));
}
@Transactional
public ProtectedObject ensureProtectedObject(String owner, String objectName) {
ProtectedObject existing = mapper.findByOwnerAndName(owner, objectName);
if (existing != null) {
return existing;
}
List<String> columns = mapper.findDatabaseColumns(owner, objectName);
if (columns.isEmpty()) {
throw new AppException("DB 객체 컬럼을 찾을 수 없습니다: " + owner + "." + objectName);
}
long objectId = mapper.nextObjectId();
mapper.insertObject(objectId, new ProtectedObjectCreateCommand(
owner,
objectName,
defaultOrdsPath(owner, objectName),
String.join(",", columns),
""
));
for (String column : columns) {
mapper.insertColumn(mapper.nextColumnId(), objectId, column, "N");
}
auditService.record(new AuditEvent("PROTECTED_OBJECT_CREATED", null, objectId, "SUCCESS", null, null,
owner + "." + objectName));
return mapper.findById(objectId);
}
private String defaultOrdsPath(String owner, String objectName) {
String schemaPath = owner.equalsIgnoreCase("CB_ORDS") ? "cb-ords" : owner.toLowerCase(Locale.ROOT);
return schemaPath + "/" + objectName.toLowerCase(Locale.ROOT);
}
@Transactional
public void disableObject(long objectId) {
int updated = mapper.disableObject(objectId);

22
src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java
View File

@@ -31,6 +31,7 @@ public class PermissionController {
public String permissions(Model model) {
model.addAttribute("roles", permissionService.findRoles());
model.addAttribute("objects", protectedObjectService.findEnabled());
model.addAttribute("dbObjects", protectedObjectService.findDatabaseObjects());
model.addAttribute("permissions", permissionService.findPermissionViews());
return "permissions";
}
@@ -38,12 +39,13 @@ public class PermissionController {
@PostMapping("/permissions")
public String save(
@RequestParam long roleId,
@RequestParam long objectId,
@RequestParam String objectRef,
@RequestParam String ruleType,
@RequestParam(required = false) String ruleValue,
@RequestParam(required = false) String visibleColumns,
RedirectAttributes redirectAttributes
) {
long objectId = resolveObjectId(objectRef);
permissionService.savePermissionSet(new PermissionSetCommand(
roleId,
objectId,
@@ -55,6 +57,24 @@ public class PermissionController {
return "redirect:/permissions";
}
private long resolveObjectId(String objectRef) {
if (objectRef == null || objectRef.isBlank()) {
throw new IllegalArgumentException("보호 객체를 선택하세요.");
}
if (objectRef.startsWith("protected:")) {
return Long.parseLong(objectRef.substring("protected:".length()));
}
if (objectRef.startsWith("db:")) {
String value = objectRef.substring("db:".length());
int dot = value.indexOf('.');
if (dot < 1 || dot == value.length() - 1) {
throw new IllegalArgumentException("DB 객체 형식이 올바르지 않습니다.");
}
return protectedObjectService.ensureProtectedObject(value.substring(0, dot), value.substring(dot + 1)).objectId();
}
throw new IllegalArgumentException("보호 객체 형식이 올바르지 않습니다.");
}
private List<String> splitColumns(String visibleColumns) {
if (visibleColumns == null || visibleColumns.isBlank()) {
return List.of();

8
src/main/java/com/cloudhandson/vpdbackoffice/web/ProbeController.java
View File

@@ -1,7 +1,6 @@
package com.cloudhandson.vpdbackoffice.web;
import com.cloudhandson.vpdbackoffice.domain.probe.ProbeCommand;
import com.cloudhandson.vpdbackoffice.service.BearerTokenService;
import com.cloudhandson.vpdbackoffice.service.OrdsProbeService;
import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
import org.springframework.stereotype.Controller;
@@ -14,35 +13,30 @@ import org.springframework.web.bind.annotation.RequestParam;
public class ProbeController {
private final OrdsProbeService probeService;
private final BearerTokenService tokenService;
private final ProtectedObjectService protectedObjectService;
public ProbeController(
OrdsProbeService probeService,
BearerTokenService tokenService,
ProtectedObjectService protectedObjectService
) {
this.probeService = probeService;
this.tokenService = tokenService;
this.protectedObjectService = protectedObjectService;
}
@GetMapping("/probe")
public String probe(Model model) {
model.addAttribute("tokens", tokenService.findAll());
model.addAttribute("objects", protectedObjectService.findEnabled());
return "probe";
}
@PostMapping("/probe")
public String run(
@RequestParam long keyId,
@RequestParam long objectId,
@RequestParam String bearerToken,
@RequestParam(defaultValue = "50") int limit,
Model model
) {
model.addAttribute("result", probeService.runProbe(new ProbeCommand(keyId, objectId, bearerToken, limit)));
model.addAttribute("result", probeService.runProbe(new ProbeCommand(objectId, bearerToken, limit)));
return "fragments/probe-result :: result";
}
}

43
src/main/java/com/cloudhandson/vpdbackoffice/web/RoleController.java Normal file
View File

@@ -0,0 +1,43 @@
package com.cloudhandson.vpdbackoffice.web;
import com.cloudhandson.vpdbackoffice.service.PermissionService;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.mvc.support.RedirectAttributes;
@Controller
public class RoleController {
private final PermissionService permissionService;
public RoleController(PermissionService permissionService) {
this.permissionService = permissionService;
}
@GetMapping("/roles")
public String roles(Model model) {
model.addAttribute("roles", permissionService.findRoles());
return "roles";
}
@PostMapping("/roles")
public String create(
@RequestParam String roleName,
@RequestParam(required = false) String description,
RedirectAttributes redirectAttributes
) {
permissionService.createRole(roleName, description);
redirectAttributes.addFlashAttribute("message", "역할을 추가했습니다.");
return "redirect:/roles";
}
@PostMapping("/roles/delete")
public String delete(@RequestParam long roleId, RedirectAttributes redirectAttributes) {
permissionService.deleteRole(roleId);
redirectAttributes.addFlashAttribute("message", "역할을 삭제했습니다.");
return "redirect:/roles";
}
}