[Developer] #424 improve role permission probe workflows

Refs #424

src/main/java/com/cloudhandson/vpdbackoffice/service/BearerTokenService.java

@@ -53,6 +53,13 @@ public class BearerTokenService {
     return tokenMapper.findById(keyId);
   }
 
+  public BearerTokenRecord findByPlainToken(String plainToken) {
+    if (plainToken == null || plainToken.isBlank()) {
+      return null;
+    }
+    return tokenMapper.findByHash(tokenHasher.sha256(plainToken));
+  }
+
   public boolean matches(BearerTokenRecord record, String plainToken) {
     if (record == null || plainToken == null || plainToken.isBlank()) {
       return false;

src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java

@@ -75,7 +75,7 @@ public class OrdsProbeService {
       ));
     }
 
-    BearerTokenRecord token = tokenService.findById(command.keyId());
+    BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
     if (token == null) {
       return auditAndReturn(command, ProbeResult.blocked(
           ProbeStatus.TOKEN_NOT_FOUND, "TOKEN_NOT_FOUND", "토큰을 찾을 수 없습니다."));
@@ -84,11 +84,6 @@ public class OrdsProbeService {
       return auditAndReturn(command, ProbeResult.blocked(
           ProbeStatus.TOKEN_INACTIVE, "TOKEN_INACTIVE", "만료되었거나 회수된 토큰입니다."));
     }
-    if (!tokenService.matches(token, command.bearerToken())) {
-      return auditAndReturn(command, ProbeResult.blocked(
-          ProbeStatus.INVALID_TOKEN, "INVALID_TOKEN", "입력한 Bearer Token이 선택한 key와 일치하지 않습니다."));
-    }
-
     ProtectedObject object;
     try {
       object = protectedObjectService.assertEnabled(command.objectId());
@@ -227,7 +222,7 @@ public class OrdsProbeService {
   private ProbeResult auditAndReturn(ProbeCommand command, ProbeResult result) {
     auditService.record(new AuditEvent(
         "ORDS_PROBE",
-        command.keyId(),
+        tokenKeyId(command),
         command.objectId(),
         result.status().name(),
         result.rowCount(),
@@ -237,6 +232,11 @@ public class OrdsProbeService {
     return result;
   }
 
+  private Long tokenKeyId(ProbeCommand command) {
+    BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
+    return token == null ? null : token.keyId();
+  }
+
   private ProbeStatus classifyResourceAccess(ResourceAccessException exception) {
     if (errorClassifier.isTimeout(exception)) {
       return ProbeStatus.ORDS_TIMEOUT;

src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java

@@ -43,6 +43,25 @@ public class PermissionService {
     return permissionMapper.findPermissionViews();
   }
 
+  @Transactional
+  public void createRole(String roleName, String description) {
+    if (roleName == null || roleName.isBlank()) {
+      throw new AppException("역할명은 필수입니다.");
+    }
+    long roleId = permissionMapper.nextRoleId();
+    permissionMapper.insertRole(roleId, roleName.trim(), description);
+    auditService.record(new AuditEvent("ROLE_CREATED", null, null, "SUCCESS", null, null, roleName));
+  }
+
+  @Transactional
+  public void deleteRole(long roleId) {
+    int deleted = permissionMapper.deleteRole(roleId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 역할을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("ROLE_DELETED", null, null, "SUCCESS", null, null, "roleId=" + roleId));
+  }
+
   @Transactional
   public PermissionSet savePermissionSet(PermissionSetCommand command) {
     if (!"SELECT".equalsIgnoreCase(command.action())) {

src/main/java/com/cloudhandson/vpdbackoffice/service/ProtectedObjectService.java

@@ -1,6 +1,7 @@
 package com.cloudhandson.vpdbackoffice.service;
 
 import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent;
+import com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObjectCreateCommand;
@@ -28,6 +29,10 @@ public class ProtectedObjectService {
     return mapper.findEnabled();
   }
 
+  public List<DatabaseObjectOption> findDatabaseObjects() {
+    return mapper.findDatabaseObjects();
+  }
+
   public ProtectedObject assertEnabled(long objectId) {
     ProtectedObject object = mapper.findById(objectId);
     if (object == null || !object.enabled()) {
@@ -52,6 +57,37 @@ public class ProtectedObjectService {
         command.objectName()));
   }
 
+  @Transactional
+  public ProtectedObject ensureProtectedObject(String owner, String objectName) {
+    ProtectedObject existing = mapper.findByOwnerAndName(owner, objectName);
+    if (existing != null) {
+      return existing;
+    }
+    List<String> columns = mapper.findDatabaseColumns(owner, objectName);
+    if (columns.isEmpty()) {
+      throw new AppException("DB 객체 컬럼을 찾을 수 없습니다: " + owner + "." + objectName);
+    }
+    long objectId = mapper.nextObjectId();
+    mapper.insertObject(objectId, new ProtectedObjectCreateCommand(
+        owner,
+        objectName,
+        defaultOrdsPath(owner, objectName),
+        String.join(",", columns),
+        ""
+    ));
+    for (String column : columns) {
+      mapper.insertColumn(mapper.nextColumnId(), objectId, column, "N");
+    }
+    auditService.record(new AuditEvent("PROTECTED_OBJECT_CREATED", null, objectId, "SUCCESS", null, null,
+        owner + "." + objectName));
+    return mapper.findById(objectId);
+  }
+
+  private String defaultOrdsPath(String owner, String objectName) {
+    String schemaPath = owner.equalsIgnoreCase("CB_ORDS") ? "cb-ords" : owner.toLowerCase(Locale.ROOT);
+    return schemaPath + "/" + objectName.toLowerCase(Locale.ROOT);
+  }
+
   @Transactional
   public void disableObject(long objectId) {
     int updated = mapper.disableObject(objectId);