[Developer] #424 improve role permission probe workflows

Refs #424

src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeCommand.java

@@ -6,7 +6,6 @@ import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Positive;
 
 public record ProbeCommand(
-    @Positive long keyId,
     @Positive long objectId,
     @NotBlank String bearerToken,
     @Min(1) @Max(500) int limit

src/main/java/com/cloudhandson/vpdbackoffice/domain/protectedobject/DatabaseObjectOption.java

@@ -0,0 +1,16 @@
+package com.cloudhandson.vpdbackoffice.domain.protectedobject;
+
+public record DatabaseObjectOption(
+    String owner,
+    String objectName,
+    String objectType
+) {
+
+  public String value() {
+    return owner + "." + objectName;
+  }
+
+  public String label() {
+    return owner + "." + objectName + " (" + objectType + ")";
+  }
+}

src/main/java/com/cloudhandson/vpdbackoffice/mapper/BearerTokenMapper.java

@@ -13,6 +13,8 @@ public interface BearerTokenMapper {
 
   BearerTokenRecord findById(@Param("keyId") long keyId);
 
+  BearerTokenRecord findByHash(@Param("keyHash") String keyHash);
+
   long nextKeyId();
 
   void insertToken(BearerTokenRecord token);

src/main/java/com/cloudhandson/vpdbackoffice/mapper/PermissionMapper.java

@@ -15,6 +15,14 @@ public interface PermissionMapper {
 
   AppRole findRole(@Param("roleId") long roleId);
 
+  long nextRoleId();
+
+  void insertRole(@Param("roleId") long roleId,
+                  @Param("roleName") String roleName,
+                  @Param("description") String description);
+
+  int deleteRole(@Param("roleId") long roleId);
+
   List<PermissionView> findPermissionViews();
 
   PermissionSet findPermissionSet(@Param("roleId") long roleId, @Param("objectId") long objectId);

src/main/java/com/cloudhandson/vpdbackoffice/mapper/ProtectedObjectMapper.java

@@ -1,5 +1,6 @@
 package com.cloudhandson.vpdbackoffice.mapper;
 
+import com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObjectCreateCommand;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject;
@@ -14,8 +15,14 @@ public interface ProtectedObjectMapper {
 
   ProtectedObject findById(@Param("objectId") long objectId);
 
+  ProtectedObject findByOwnerAndName(@Param("owner") String owner, @Param("objectName") String objectName);
+
   List<ProtectedColumn> findColumns(@Param("objectId") long objectId);
 
+  List<DatabaseObjectOption> findDatabaseObjects();
+
+  List<String> findDatabaseColumns(@Param("owner") String owner, @Param("objectName") String objectName);
+
   long nextObjectId();
 
   long nextColumnId();

src/main/java/com/cloudhandson/vpdbackoffice/service/BearerTokenService.java

@@ -53,6 +53,13 @@ public class BearerTokenService {
     return tokenMapper.findById(keyId);
   }
 
+  public BearerTokenRecord findByPlainToken(String plainToken) {
+    if (plainToken == null || plainToken.isBlank()) {
+      return null;
+    }
+    return tokenMapper.findByHash(tokenHasher.sha256(plainToken));
+  }
+
   public boolean matches(BearerTokenRecord record, String plainToken) {
     if (record == null || plainToken == null || plainToken.isBlank()) {
       return false;

src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java

@@ -75,7 +75,7 @@ public class OrdsProbeService {
       ));
     }
 
-    BearerTokenRecord token = tokenService.findById(command.keyId());
+    BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
     if (token == null) {
       return auditAndReturn(command, ProbeResult.blocked(
           ProbeStatus.TOKEN_NOT_FOUND, "TOKEN_NOT_FOUND", "토큰을 찾을 수 없습니다."));
@@ -84,11 +84,6 @@ public class OrdsProbeService {
       return auditAndReturn(command, ProbeResult.blocked(
           ProbeStatus.TOKEN_INACTIVE, "TOKEN_INACTIVE", "만료되었거나 회수된 토큰입니다."));
     }
-    if (!tokenService.matches(token, command.bearerToken())) {
-      return auditAndReturn(command, ProbeResult.blocked(
-          ProbeStatus.INVALID_TOKEN, "INVALID_TOKEN", "입력한 Bearer Token이 선택한 key와 일치하지 않습니다."));
-    }
-
     ProtectedObject object;
     try {
       object = protectedObjectService.assertEnabled(command.objectId());
@@ -227,7 +222,7 @@ public class OrdsProbeService {
   private ProbeResult auditAndReturn(ProbeCommand command, ProbeResult result) {
     auditService.record(new AuditEvent(
         "ORDS_PROBE",
-        command.keyId(),
+        tokenKeyId(command),
         command.objectId(),
         result.status().name(),
         result.rowCount(),
@@ -237,6 +232,11 @@ public class OrdsProbeService {
     return result;
   }
 
+  private Long tokenKeyId(ProbeCommand command) {
+    BearerTokenRecord token = tokenService.findByPlainToken(command.bearerToken());
+    return token == null ? null : token.keyId();
+  }
+
   private ProbeStatus classifyResourceAccess(ResourceAccessException exception) {
     if (errorClassifier.isTimeout(exception)) {
       return ProbeStatus.ORDS_TIMEOUT;

src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java

@@ -43,6 +43,25 @@ public class PermissionService {
     return permissionMapper.findPermissionViews();
   }
 
+  @Transactional
+  public void createRole(String roleName, String description) {
+    if (roleName == null || roleName.isBlank()) {
+      throw new AppException("역할명은 필수입니다.");
+    }
+    long roleId = permissionMapper.nextRoleId();
+    permissionMapper.insertRole(roleId, roleName.trim(), description);
+    auditService.record(new AuditEvent("ROLE_CREATED", null, null, "SUCCESS", null, null, roleName));
+  }
+
+  @Transactional
+  public void deleteRole(long roleId) {
+    int deleted = permissionMapper.deleteRole(roleId);
+    if (deleted == 0) {
+      throw new AppException("삭제할 역할을 찾을 수 없습니다.");
+    }
+    auditService.record(new AuditEvent("ROLE_DELETED", null, null, "SUCCESS", null, null, "roleId=" + roleId));
+  }
+
   @Transactional
   public PermissionSet savePermissionSet(PermissionSetCommand command) {
     if (!"SELECT".equalsIgnoreCase(command.action())) {

src/main/java/com/cloudhandson/vpdbackoffice/service/ProtectedObjectService.java

@@ -1,6 +1,7 @@
 package com.cloudhandson.vpdbackoffice.service;
 
 import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent;
+import com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObjectCreateCommand;
@@ -28,6 +29,10 @@ public class ProtectedObjectService {
     return mapper.findEnabled();
   }
 
+  public List<DatabaseObjectOption> findDatabaseObjects() {
+    return mapper.findDatabaseObjects();
+  }
+
   public ProtectedObject assertEnabled(long objectId) {
     ProtectedObject object = mapper.findById(objectId);
     if (object == null || !object.enabled()) {
@@ -52,6 +57,37 @@ public class ProtectedObjectService {
         command.objectName()));
   }
 
+  @Transactional
+  public ProtectedObject ensureProtectedObject(String owner, String objectName) {
+    ProtectedObject existing = mapper.findByOwnerAndName(owner, objectName);
+    if (existing != null) {
+      return existing;
+    }
+    List<String> columns = mapper.findDatabaseColumns(owner, objectName);
+    if (columns.isEmpty()) {
+      throw new AppException("DB 객체 컬럼을 찾을 수 없습니다: " + owner + "." + objectName);
+    }
+    long objectId = mapper.nextObjectId();
+    mapper.insertObject(objectId, new ProtectedObjectCreateCommand(
+        owner,
+        objectName,
+        defaultOrdsPath(owner, objectName),
+        String.join(",", columns),
+        ""
+    ));
+    for (String column : columns) {
+      mapper.insertColumn(mapper.nextColumnId(), objectId, column, "N");
+    }
+    auditService.record(new AuditEvent("PROTECTED_OBJECT_CREATED", null, objectId, "SUCCESS", null, null,
+        owner + "." + objectName));
+    return mapper.findById(objectId);
+  }
+
+  private String defaultOrdsPath(String owner, String objectName) {
+    String schemaPath = owner.equalsIgnoreCase("CB_ORDS") ? "cb-ords" : owner.toLowerCase(Locale.ROOT);
+    return schemaPath + "/" + objectName.toLowerCase(Locale.ROOT);
+  }
+
   @Transactional
   public void disableObject(long objectId) {
     int updated = mapper.disableObject(objectId);

src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java

@@ -31,6 +31,7 @@ public class PermissionController {
   public String permissions(Model model) {
     model.addAttribute("roles", permissionService.findRoles());
     model.addAttribute("objects", protectedObjectService.findEnabled());
+    model.addAttribute("dbObjects", protectedObjectService.findDatabaseObjects());
     model.addAttribute("permissions", permissionService.findPermissionViews());
     return "permissions";
   }
@@ -38,12 +39,13 @@ public class PermissionController {
   @PostMapping("/permissions")
   public String save(
       @RequestParam long roleId,
-      @RequestParam long objectId,
+      @RequestParam String objectRef,
       @RequestParam String ruleType,
       @RequestParam(required = false) String ruleValue,
       @RequestParam(required = false) String visibleColumns,
       RedirectAttributes redirectAttributes
   ) {
+    long objectId = resolveObjectId(objectRef);
     permissionService.savePermissionSet(new PermissionSetCommand(
         roleId,
         objectId,
@@ -55,6 +57,24 @@ public class PermissionController {
     return "redirect:/permissions";
   }
 
+  private long resolveObjectId(String objectRef) {
+    if (objectRef == null || objectRef.isBlank()) {
+      throw new IllegalArgumentException("보호 객체를 선택하세요.");
+    }
+    if (objectRef.startsWith("protected:")) {
+      return Long.parseLong(objectRef.substring("protected:".length()));
+    }
+    if (objectRef.startsWith("db:")) {
+      String value = objectRef.substring("db:".length());
+      int dot = value.indexOf('.');
+      if (dot < 1 || dot == value.length() - 1) {
+        throw new IllegalArgumentException("DB 객체 형식이 올바르지 않습니다.");
+      }
+      return protectedObjectService.ensureProtectedObject(value.substring(0, dot), value.substring(dot + 1)).objectId();
+    }
+    throw new IllegalArgumentException("보호 객체 형식이 올바르지 않습니다.");
+  }
+
   private List<String> splitColumns(String visibleColumns) {
     if (visibleColumns == null || visibleColumns.isBlank()) {
       return List.of();

src/main/java/com/cloudhandson/vpdbackoffice/web/ProbeController.java

@@ -1,7 +1,6 @@
 package com.cloudhandson.vpdbackoffice.web;
 
 import com.cloudhandson.vpdbackoffice.domain.probe.ProbeCommand;
-import com.cloudhandson.vpdbackoffice.service.BearerTokenService;
 import com.cloudhandson.vpdbackoffice.service.OrdsProbeService;
 import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
 import org.springframework.stereotype.Controller;
@@ -14,35 +13,30 @@ import org.springframework.web.bind.annotation.RequestParam;
 public class ProbeController {
 
   private final OrdsProbeService probeService;
-  private final BearerTokenService tokenService;
   private final ProtectedObjectService protectedObjectService;
 
   public ProbeController(
       OrdsProbeService probeService,
-      BearerTokenService tokenService,
       ProtectedObjectService protectedObjectService
   ) {
     this.probeService = probeService;
-    this.tokenService = tokenService;
     this.protectedObjectService = protectedObjectService;
   }
 
   @GetMapping("/probe")
   public String probe(Model model) {
-    model.addAttribute("tokens", tokenService.findAll());
     model.addAttribute("objects", protectedObjectService.findEnabled());
     return "probe";
   }
 
   @PostMapping("/probe")
   public String run(
-      @RequestParam long keyId,
       @RequestParam long objectId,
       @RequestParam String bearerToken,
       @RequestParam(defaultValue = "50") int limit,
       Model model
   ) {
-    model.addAttribute("result", probeService.runProbe(new ProbeCommand(keyId, objectId, bearerToken, limit)));
+    model.addAttribute("result", probeService.runProbe(new ProbeCommand(objectId, bearerToken, limit)));
     return "fragments/probe-result :: result";
   }
 }

src/main/java/com/cloudhandson/vpdbackoffice/web/RoleController.java

@@ -0,0 +1,43 @@
+package com.cloudhandson.vpdbackoffice.web;
+
+import com.cloudhandson.vpdbackoffice.service.PermissionService;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+@Controller
+public class RoleController {
+
+  private final PermissionService permissionService;
+
+  public RoleController(PermissionService permissionService) {
+    this.permissionService = permissionService;
+  }
+
+  @GetMapping("/roles")
+  public String roles(Model model) {
+    model.addAttribute("roles", permissionService.findRoles());
+    return "roles";
+  }
+
+  @PostMapping("/roles")
+  public String create(
+      @RequestParam String roleName,
+      @RequestParam(required = false) String description,
+      RedirectAttributes redirectAttributes
+  ) {
+    permissionService.createRole(roleName, description);
+    redirectAttributes.addFlashAttribute("message", "역할을 추가했습니다.");
+    return "redirect:/roles";
+  }
+
+  @PostMapping("/roles/delete")
+  public String delete(@RequestParam long roleId, RedirectAttributes redirectAttributes) {
+    permissionService.deleteRole(roleId);
+    redirectAttributes.addFlashAttribute("message", "역할을 삭제했습니다.");
+    return "redirect:/roles";
+  }
+}

src/main/resources/mapper/BearerTokenMapper.xml

@@ -18,6 +18,14 @@
     WHERE k.key_id = #{keyId}
   </select>
 
+  <select id="findByHash" resultType="com.cloudhandson.vpdbackoffice.domain.token.BearerTokenRecord">
+    SELECT k.key_id, k.user_id, u.user_name AS username, k.key_prefix, k.key_hash,
+           k.expires_at, k.revoked_at, k.description
+    FROM cb_agent_bearer_key k
+    JOIN cb_app_user u ON u.user_id = k.user_id
+    WHERE k.key_hash = #{keyHash,jdbcType=VARCHAR}
+  </select>
+
   <select id="nextKeyId" resultType="long">
     SELECT cb_agent_bearer_key_seq.NEXTVAL FROM dual
   </select>

src/main/resources/mapper/PermissionMapper.xml

@@ -14,6 +14,20 @@
     WHERE role_id = #{roleId}
   </select>
 
+  <select id="nextRoleId" resultType="long">
+    SELECT NVL(MAX(role_id), 0) + 1 FROM cb_app_role
+  </select>
+
+  <insert id="insertRole">
+    INSERT INTO cb_app_role (role_id, role_name)
+    VALUES (#{roleId,jdbcType=NUMERIC}, UPPER(#{roleName,jdbcType=VARCHAR}))
+  </insert>
+
+  <delete id="deleteRole">
+    DELETE FROM cb_app_role
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
+  </delete>
+
   <select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
     SELECT p.perm_id AS permission_id,
            r.role_id,

src/main/resources/mapper/ProtectedObjectMapper.xml

@@ -15,6 +15,31 @@
     WHERE object_id = #{objectId}
   </select>
 
+  <select id="findByOwnerAndName" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject">
+    SELECT object_id, owner, object_name, ords_path, enabled_yn
+    FROM cb_protected_object
+    WHERE owner = UPPER(#{owner,jdbcType=VARCHAR})
+      AND object_name = UPPER(#{objectName,jdbcType=VARCHAR})
+  </select>
+
+  <select id="findDatabaseObjects" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.DatabaseObjectOption">
+    SELECT owner, object_name, object_type
+    FROM all_objects
+    WHERE object_type IN ('TABLE', 'VIEW')
+      AND owner NOT IN ('SYS', 'SYSTEM', 'ORDS_METADATA', 'ORDS_PUBLIC_USER')
+      AND object_name NOT LIKE 'BIN$%'
+    ORDER BY owner, object_type, object_name
+    FETCH FIRST 500 ROWS ONLY
+  </select>
+
+  <select id="findDatabaseColumns" resultType="string">
+    SELECT column_name
+    FROM all_tab_columns
+    WHERE owner = UPPER(#{owner,jdbcType=VARCHAR})
+      AND table_name = UPPER(#{objectName,jdbcType=VARCHAR})
+    ORDER BY column_id
+  </select>
+
   <select id="findColumns" resultType="com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn">
     SELECT column_id, object_id, column_name, sensitive_yn, visible_role_id
     FROM cb_protected_column

src/main/resources/static/css/app.css

@@ -163,6 +163,11 @@ body {
   margin-bottom: .75rem;
 }
 
+.master-detail {
+  border-bottom: 1px solid var(--rw-border);
+  padding-bottom: 1rem;
+}
+
 .rw-btn,
 .btn {
   border-radius: 999px;

src/main/resources/static/js/app.js

@@ -4,3 +4,34 @@ document.body.addEventListener('htmx:responseError', (event) => {
     target.innerHTML = '<div class="alert alert-danger">요청 처리 중 오류가 발생했습니다.</div>';
   }
 });
+
+function filterUserRoleDetail() {
+  const master = document.getElementById('userRoleMaster');
+  const table = document.getElementById('userRoleDetail');
+  if (!master || !table) {
+    return;
+  }
+  const selected = master.value;
+  let shown = 0;
+  table.querySelectorAll('tbody tr[data-user-id]').forEach((row) => {
+    const visible = row.dataset.userId === selected;
+    row.hidden = !visible;
+    shown += visible ? 1 : 0;
+  });
+  let empty = table.querySelector('tbody tr.empty-user-role-runtime');
+  if (!empty) {
+    empty = document.createElement('tr');
+    empty.className = 'empty-user-role-runtime';
+    empty.innerHTML = '<td colspan="3" class="text-muted">선택한 사용자에게 부여된 역할이 없습니다.</td>';
+    table.querySelector('tbody').appendChild(empty);
+  }
+  empty.hidden = shown !== 0;
+}
+
+document.addEventListener('DOMContentLoaded', () => {
+  const master = document.getElementById('userRoleMaster');
+  if (master) {
+    master.addEventListener('change', filterUserRoleDetail);
+    filterUserRoleDetail();
+  }
+});

src/main/resources/templates/fragments/layout.html

@@ -16,6 +16,7 @@
     <a class="navbar-brand" href="/">VPD Backoffice</a>
     <div class="navbar-nav">
       <a class="nav-link" href="/users">사용자</a>
+      <a class="nav-link" href="/roles">역할</a>
       <a class="nav-link" href="/permissions">권한</a>
       <a class="nav-link" href="/objects">테이블/뷰</a>
       <a class="nav-link" href="/tokens">토큰</a>

src/main/resources/templates/permissions.html

@@ -23,8 +23,17 @@
       </label>
       <label>
         보호 객체
-        <select class="form-select" name="objectId" required>
+        <select class="form-select" name="objectRef" required>
-          <option th:each="object : ${objects}" th:value="${object.objectId()}" th:text="${object.displayName()}"></option>
+          <optgroup label="등록된 보호 객체">
+            <option th:each="object : ${objects}"
+                    th:value="${'protected:' + object.objectId()}"
+                    th:text="${object.displayName()}"></option>
+          </optgroup>
+          <optgroup label="DB 스키마 객체">
+            <option th:each="dbObject : ${dbObjects}"
+                    th:value="${'db:' + dbObject.value()}"
+                    th:text="${dbObject.label()}"></option>
+          </optgroup>
         </select>
       </label>
       <label>
@@ -41,7 +50,7 @@
         <input class="form-control" name="ruleValue" placeholder="APAC 또는 HR">
       </label>
       <label>
-        표시 컬럼
+        NULL 제외 컬럼
         <input class="form-control" name="visibleColumns" placeholder="CONTENTS">
       </label>
       <button class="btn btn-primary" type="submit">저장</button>
@@ -59,7 +68,7 @@
           <th>테이블/뷰</th>
           <th>Action</th>
           <th>행 규칙</th>
-          <th>표시 컬럼</th>
+          <th>NULL 제외 컬럼</th>
           <th></th>
         </tr>
         </thead>

src/main/resources/templates/probe.html

@@ -12,20 +12,16 @@
   <section class="content-band">
     <form hx-post="/probe" hx-target="#probe-result" hx-swap="innerHTML" class="form-grid">
       <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
-      <label>
-        Token ID
-        <select class="form-select" name="keyId" required>
-          <option th:each="token : ${tokens}" th:value="${token.keyId()}" th:text="${token.keyPrefix()}"></option>
-        </select>
-      </label>
       <label>
         Bearer Token 원문
         <input class="form-control" name="bearerToken" type="password" autocomplete="off" required>
       </label>
       <label>
-        보호 객체
+        ORDS 트랙
         <select class="form-select" name="objectId" required>
-          <option th:each="object : ${objects}" th:value="${object.objectId()}" th:text="${object.displayName()}"></option>
+          <option th:each="object : ${objects}"
+                  th:value="${object.objectId()}"
+                  th:text="${object.displayName() + ' / ' + object.ordsPath()}"></option>
         </select>
       </label>
       <label>

src/main/resources/templates/roles.html

@@ -0,0 +1,62 @@
+<!doctype html>
+<html lang="ko" xmlns:th="http://www.thymeleaf.org">
+<head th:replace="~{fragments/layout :: head('역할 관리')}"></head>
+<body>
+<nav th:replace="~{fragments/layout :: nav}"></nav>
+<main class="container py-4">
+  <div class="page-title">
+    <h1>역할 관리</h1>
+    <p>사용자에게 부여할 역할을 관리합니다.</p>
+  </div>
+
+  <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+
+  <section class="content-band">
+    <h2>역할 추가</h2>
+    <form method="post" action="/roles" class="form-grid">
+      <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+      <label>
+        역할명
+        <input class="form-control" name="roleName" placeholder="HR_DEPT_ROLE" required>
+      </label>
+      <label>
+        설명
+        <input class="form-control" name="description" maxlength="200">
+      </label>
+      <button class="btn rw-btn-primary" type="submit">추가</button>
+    </form>
+  </section>
+
+  <section class="content-band">
+    <h2>역할 목록</h2>
+    <div class="table-responsive">
+      <table class="table table-sm align-middle">
+        <thead>
+        <tr>
+          <th>ID</th>
+          <th>역할명</th>
+          <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        <tr th:each="role : ${roles}">
+          <td th:text="${role.roleId()}">10</td>
+          <td th:text="${role.roleName()}">HR_DEPT_ROLE</td>
+          <td>
+            <form method="post" action="/roles/delete" class="inline-form">
+              <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
+              <input type="hidden" name="roleId" th:value="${role.roleId()}">
+              <button class="btn btn-sm btn-outline-danger" type="submit">삭제</button>
+            </form>
+          </td>
+        </tr>
+        <tr th:if="${#lists.isEmpty(roles)}">
+          <td colspan="3" class="text-muted">등록된 역할이 없습니다.</td>
+        </tr>
+        </tbody>
+      </table>
+    </div>
+  </section>
+</main>
+</body>
+</html>

src/main/resources/templates/users.html

@@ -69,30 +69,30 @@
     </div>
   </section>
 
-  <section class="content-band">
+  <section class="content-band user-role-master">
-    <h2>역할 부여</h2>
+    <h2>사용자 역할 부여</h2>
+    <div class="master-detail">
       <form method="post" action="/users/roles" class="form-grid">
         <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
         <label>
           사용자
-        <select class="form-select" name="userId" required>
+          <select class="form-select" id="userRoleMaster" name="userId" required>
             <option th:each="user : ${users}" th:value="${user.userId()}" th:text="${user.username()}"></option>
           </select>
         </label>
         <label>
-        역할
+          부여할 역할
           <select class="form-select" name="roleId" required>
             <option th:each="role : ${roles}" th:value="${role.roleId()}" th:text="${role.roleName()}"></option>
           </select>
         </label>
-      <button class="btn btn-primary" type="submit">부여</button>
+        <button class="btn rw-btn-primary" type="submit">부여</button>
       </form>
-  </section>
+    </div>
 
-  <section class="content-band">
+    <h2 class="mt-4">선택 사용자 역할</h2>
-    <h2>사용자 역할 목록</h2>
     <div class="table-responsive">
-      <table class="table table-sm align-middle">
+      <table class="table table-sm align-middle" id="userRoleDetail">
         <thead>
         <tr>
           <th>사용자</th>
@@ -101,7 +101,7 @@
         </tr>
         </thead>
         <tbody>
-        <tr th:each="mapping : ${userRoles}">
+        <tr th:each="mapping : ${userRoles}" th:attr="data-user-id=${mapping.userId()}">
           <td th:text="${mapping.username()}">agent_hr</td>
           <td th:text="${mapping.roleName()}">HR_DEPT_ROLE</td>
           <td>
@@ -113,7 +113,7 @@
             </form>
           </td>
         </tr>
-        <tr th:if="${#lists.isEmpty(userRoles)}">
+        <tr class="empty-user-role-row" th:if="${#lists.isEmpty(userRoles)}">
           <td colspan="3" class="text-muted">부여된 역할이 없습니다.</td>
         </tr>
         </tbody>

src/test/java/com/cloudhandson/vpdbackoffice/service/PermissionServiceTest.java

@@ -88,6 +88,20 @@ class PermissionServiceTest {
       return roleId == 10L ? new AppRole(10L, "HR_DEPT_ROLE", null) : null;
     }
 
+    @Override
+    public long nextRoleId() {
+      return 40L;
+    }
+
+    @Override
+    public void insertRole(long roleId, String roleName, String description) {
+    }
+
+    @Override
+    public int deleteRole(long roleId) {
+      return 1;
+    }
+
     @Override
     public List<PermissionView> findPermissionViews() {
       return List.of();