feat: enforce DDS token access through common grants

scripts/setup-dds-token-data-grant.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Apply the single-technical-user DDS token path.
+# The password is supplied through the environment and is never printed.
+set -Eeuo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+if [[ -f /home/opc/apps/vpd-backoffice/.env ]]; then
+  set -a
+  . /home/opc/apps/vpd-backoffice/.env
+  set +a
+fi
+
+: "${ADB_USER:?ADB_USER is required}"
+: "${ADB_PASSWORD:?ADB_PASSWORD is required}"
+: "${ADB_TNS:?ADB_TNS is required}"
+: "${DDSUSER_TOKEN_PASSWORD:?DDSUSER_TOKEN_PASSWORD is required}"
+
+sqlplus -S -L "${ADB_USER}/${ADB_PASSWORD}@${ADB_TNS}" <<SQL
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET DEFINE ON
+DEFINE DDSUSER_TOKEN_PASSWORD = "${DDSUSER_TOKEN_PASSWORD}"
+@${ROOT}/sql/adb/34_dds_token_data_grant_common_auth.sql
+SQL
+
+echo "DDS token DATA GRANT setup complete (technical user: dds_demo_token)"