From b39968d43f9120c03bcd67acc492cbc0fea1175d Mon Sep 17 00:00:00 2001 From: devmrko Date: Wed, 1 Jul 2026 15:11:25 +0900 Subject: [PATCH] [Developer] #567 show recent SQL cursor candidates --- docs/design/567-ords-vpd-sql-trace/README.md | 2 + .../domain/probe/ProbeResult.java | 27 +++++++++++--- .../domain/probe/SqlExecutionCandidate.java | 16 ++++++++ .../service/OrdsProbeService.java | 37 +++++++++++++++---- .../templates/fragments/probe-result.html | 23 ++++++++++++ .../domain/probe/ProbeResultTest.java | 24 ++++++++++++ .../web/GuidedFlowTemplateTest.java | 1 + .../web/ProbeResultTemplateRenderTest.java | 12 +++++- 8 files changed, 127 insertions(+), 15 deletions(-) create mode 100644 src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/SqlExecutionCandidate.java diff --git a/docs/design/567-ords-vpd-sql-trace/README.md b/docs/design/567-ords-vpd-sql-trace/README.md index 1e346e2..61fd85a 100644 --- a/docs/design/567-ords-vpd-sql-trace/README.md +++ b/docs/design/567-ords-vpd-sql-trace/README.md @@ -152,4 +152,6 @@ Oracle은 VPD의 내부 rewrite 결과를 별도 최종 SQL 문자열로 `V$SQL` 최근 SQL 매칭은 최신 10건과 보호 객체명으로 고르므로, 같은 객체를 동시에 호출하는 운영 환경에서는 다른 요청 cursor가 선택될 가능성이 있다. 현재 UI는 이를 “최근 실행 증적”으로 명시한다. 요청별 완전 상관이 필요해지면 ORDS Handler에 검증 요청 ID를 주입해 고유 SQL comment/module-action으로 cursor를 추적하는 후속 작업으로 확장한다. +매칭에 실패해도 후보를 버리지 않는다. 화면은 최신 10건의 `SQL_ID`, child cursor, parsing schema, 마지막 실행 시각, 원문 SQL을 그대로 보이며, Java가 보호 객체명과 일치시킨 후보에는 별도 배지를 표시한다. 운영자는 이 목록에서 실제 Handler SQL의 형태를 직접 확인할 수 있다. + 실행 증적 연결에는 최소한 `V$SQL`과 `DBMS_XPLAN.DISPLAY_CURSOR`를 조회할 수 있는 catalog 권한이 필요하다. 증적은 ORDS parsing schema가 아니라 화면을 표시하는 `BACKOFFICE_DB_USERNAME` 연결에서 조회한다. 실제 SQL 실행 계정과 진단 조회 계정은 달라도 된다. Autonomous의 일반 `ADMIN` 계정은 `SYS.V_$SQL` 권한을 다른 계정에 위임하지 못할 수 있으므로, 이 경우에는 DBA가 [34_agent_ords_execution_evidence_grant.sql](../../sql/adb/34_agent_ords_execution_evidence_grant.sql)을 실행해야 한다. cursor 미발견과 catalog 권한 미보유는 UI에서 서로 다른 안내로 표시하며, 어느 경우도 권한 검증 결과를 실패시키지 않는다. diff --git a/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResult.java b/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResult.java index e04e658..5cc3a65 100644 --- a/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResult.java +++ b/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResult.java @@ -18,7 +18,8 @@ public record ProbeResult( String vpdPredicate, String effectiveSql, SqlExecutionEvidence executionEvidence, - String executionEvidenceMessage + String executionEvidenceMessage, + List executionCandidates ) { public ProbeResult( @@ -49,7 +50,8 @@ public record ProbeResult( null, null, null, - null + null, + List.of() ); } @@ -83,7 +85,8 @@ public record ProbeResult( vpdPredicate, effectiveSql, null, - null + null, + List.of() ); } @@ -139,7 +142,8 @@ public record ProbeResult( predicate, sql, executionEvidence, - executionEvidenceMessage + executionEvidenceMessage, + executionCandidates ); } @@ -151,6 +155,14 @@ public record ProbeResult( public ProbeResult withExecutionEvidence( SqlExecutionEvidence evidence, String unavailableMessage + ) { + return withExecutionEvidence(evidence, unavailableMessage, List.of()); + } + + public ProbeResult withExecutionEvidence( + SqlExecutionEvidence evidence, + String unavailableMessage, + List candidates ) { return new ProbeResult( status, @@ -167,10 +179,15 @@ public record ProbeResult( vpdPredicate, effectiveSql, evidence, - unavailableMessage + unavailableMessage, + candidates == null ? List.of() : List.copyOf(candidates) ); } + public boolean hasExecutionCandidates() { + return executionCandidates != null && !executionCandidates.isEmpty(); + } + public String title() { return switch (status) { case SUCCESS -> "권한에 따라 데이터를 볼 수 있습니다."; diff --git a/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/SqlExecutionCandidate.java b/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/SqlExecutionCandidate.java new file mode 100644 index 0000000..9027e1f --- /dev/null +++ b/src/main/java/com/cloudhandson/vpdbackoffice/domain/probe/SqlExecutionCandidate.java @@ -0,0 +1,16 @@ +package com.cloudhandson.vpdbackoffice.domain.probe; + +/** + * One of the most recently active database cursors shown verbatim during a + * probe. The match flag is calculated in Java, not by SQL text filtering in + * the database. + */ +public record SqlExecutionCandidate( + String sqlId, + int childNumber, + String parsingSchema, + String originalSql, + String lastActiveAt, + boolean matchesProtectedObject +) { +} diff --git a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java index 862a540..8cccda4 100644 --- a/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java +++ b/src/main/java/com/cloudhandson/vpdbackoffice/service/OrdsProbeService.java @@ -4,6 +4,7 @@ import com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent; import com.cloudhandson.vpdbackoffice.domain.probe.ProbeCommand; import com.cloudhandson.vpdbackoffice.domain.probe.ProbeResult; import com.cloudhandson.vpdbackoffice.domain.probe.ProbeStatus; +import com.cloudhandson.vpdbackoffice.domain.probe.SqlExecutionCandidate; import com.cloudhandson.vpdbackoffice.domain.probe.SqlExecutionEvidence; import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn; import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedObject; @@ -49,6 +50,7 @@ public class OrdsProbeService { private record ExecutionEvidenceLookup( SqlExecutionEvidence evidence, + List candidates, boolean sqlCatalogAccessUnavailable ) { } @@ -56,6 +58,7 @@ public class OrdsProbeService { private record RecentSqlCursor( String sqlId, int childNumber, + String parsingSchema, String sqlFulltext, String lastActiveAt, long executions, @@ -270,30 +273,33 @@ public class OrdsProbeService { if (lookup.sqlCatalogAccessUnavailable()) { return result.withExecutionEvidence(null, "백오피스 DB 연결이 실제 DB cursor SQL을 읽지 못했습니다. 현재 권한 검증 결과는 정상입니다. " - + "V$SQL과 DBMS_XPLAN은 일반 데이터 접근과 별도인 SYS 진단 권한입니다."); + + "V$SQL과 DBMS_XPLAN은 일반 데이터 접근과 별도인 SYS 진단 권한입니다.", + lookup.candidates()); } return result.withExecutionEvidence(null, "최근 15분의 최신 실행 cursor 10건에서 이 보호 대상을 찾지 못했습니다. " - + "ORDS 응답 지연 또는 shared pool 교체로 증적이 남지 않았을 수 있습니다."); + + "아래 원문 SQL을 직접 확인하세요.", + lookup.candidates()); } String message = evidence.hasPredicatePlan() ? null : "SQL_ID는 찾았지만 DBMS_XPLAN Predicate Information을 읽지 못했습니다. " + "백오피스 DB 계정에 V$SQL/DBMS_XPLAN 조회 권한이 필요합니다."; - return result.withExecutionEvidence(evidence, message); + return result.withExecutionEvidence(evidence, message, lookup.candidates()); } catch (RuntimeException exception) { log.debug("Recent SQL execution evidence unavailable for {}.{}: {}", object.owner(), object.objectName(), exception.getMessage()); return result.withExecutionEvidence(null, - "DB 실행 증적을 읽지 못했습니다. 백오피스 DB 계정에 V$SQL과 DBMS_XPLAN 조회 권한이 필요합니다."); + "DB 실행 증적을 읽지 못했습니다. 백오피스 DB 계정에 V$SQL과 DBMS_XPLAN 조회 권한이 필요합니다.", + List.of()); } } private ExecutionEvidenceLookup findRecentExecutionEvidence(ProtectedObject object) { try { - return new ExecutionEvidenceLookup(findRecentExecutionEvidence(jdbcTemplate, object), false); + return findRecentExecutionEvidence(jdbcTemplate, object); } catch (RuntimeException exception) { log.debug("Backoffice cursor evidence is unavailable: {}", exception.getMessage()); - return new ExecutionEvidenceLookup(null, isSqlCatalogAccessUnavailable(exception)); + return new ExecutionEvidenceLookup(null, List.of(), isSqlCatalogAccessUnavailable(exception)); } } @@ -308,13 +314,14 @@ public class OrdsProbeService { || normalized.contains("V$SQL"); } - private SqlExecutionEvidence findRecentExecutionEvidence( + private ExecutionEvidenceLookup findRecentExecutionEvidence( JdbcTemplate evidenceJdbcTemplate, ProtectedObject object ) { List candidates = evidenceJdbcTemplate.query(""" SELECT sql_id, child_number, + parsing_schema_name, sql_fulltext, last_active_time, executions, @@ -324,6 +331,7 @@ public class OrdsProbeService { FROM ( SELECT sql_id, child_number, + parsing_schema_name, sql_fulltext, last_active_time, executions, @@ -338,6 +346,7 @@ public class OrdsProbeService { """, (resultSet, rowNum) -> new RecentSqlCursor( resultSet.getString("sql_id"), resultSet.getInt("child_number"), + resultSet.getString("parsing_schema_name"), resultSet.getString("sql_fulltext"), resultSet.getTimestamp("last_active_time") == null ? null : resultSet.getTimestamp("last_active_time").toLocalDateTime().toString(), @@ -347,7 +356,18 @@ public class OrdsProbeService { resultSet.getLong("buffer_gets") ), EXECUTION_EVIDENCE_LOOKBACK_MINUTES); - return candidates.stream() + List candidateViews = candidates.stream() + .map(candidate -> new SqlExecutionCandidate( + candidate.sqlId(), + candidate.childNumber(), + candidate.parsingSchema(), + candidate.sqlFulltext(), + candidate.lastActiveAt(), + referencesProtectedObject(candidate.sqlFulltext(), object) + )) + .toList(); + + SqlExecutionEvidence evidence = candidates.stream() .filter(candidate -> referencesProtectedObject(candidate.sqlFulltext(), object)) .findFirst() .map(candidate -> new SqlExecutionEvidence( @@ -362,6 +382,7 @@ public class OrdsProbeService { findPredicatePlan(evidenceJdbcTemplate, candidate.sqlId(), candidate.childNumber()) )) .orElse(null); + return new ExecutionEvidenceLookup(evidence, candidateViews, false); } static boolean referencesProtectedObject(String sqlFulltext, ProtectedObject object) { diff --git a/src/main/resources/templates/fragments/probe-result.html b/src/main/resources/templates/fragments/probe-result.html index bdb6abd..a071fc4 100644 --- a/src/main/resources/templates/fragments/probe-result.html +++ b/src/main/resources/templates/fragments/probe-result.html @@ -142,6 +142,29 @@ th:text="${result.executionEvidenceMessage()}"> +
+
+
+

최근 DB cursor 10건

+

백오피스 DB 연결이 읽은 최신 cursor입니다. 보호 대상과 일치한 SQL은 초록 배지로 표시합니다.

+
+ 10건 +
+
+
+
+

SQL_ID

+

최근 실행

+
+ 다른 SQL +
+ 
SELECT ...
+
+
+
diff --git a/src/test/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResultTest.java b/src/test/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResultTest.java index 1c1208f..50dd88d 100644 --- a/src/test/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResultTest.java +++ b/src/test/java/com/cloudhandson/vpdbackoffice/domain/probe/ProbeResultTest.java @@ -156,4 +156,28 @@ class ProbeResultTest { assertThat(result.executionEvidence().hasPredicatePlan()).isTrue(); assertThat(result.effectiveSql()).contains("WHERE"); } + + @Test + void keepsRecentCursorCandidatesWhenNoObjectMatchWasFound() { + ProbeResult result = new ProbeResult( + ProbeStatus.SUCCESS, + List.of(), + List.of(), + 0, + List.of(), + null, + null, + null, + null, + null, + null + ).withExecutionEvidence(null, "최근 cursor를 찾지 못했습니다.", List.of( + new SqlExecutionCandidate( + "candidate1", 0, "CB_ORDS", "SELECT 1 FROM dual", "2026-07-01T15:00", false) + )); + + assertThat(result.hasExecutionEvidence()).isFalse(); + assertThat(result.hasExecutionCandidates()).isTrue(); + assertThat(result.executionCandidates()).hasSize(1); + } } diff --git a/src/test/java/com/cloudhandson/vpdbackoffice/web/GuidedFlowTemplateTest.java b/src/test/java/com/cloudhandson/vpdbackoffice/web/GuidedFlowTemplateTest.java index a2752d4..07b7361 100644 --- a/src/test/java/com/cloudhandson/vpdbackoffice/web/GuidedFlowTemplateTest.java +++ b/src/test/java/com/cloudhandson/vpdbackoffice/web/GuidedFlowTemplateTest.java @@ -110,6 +110,7 @@ class GuidedFlowTemplateTest { assertThat(result) .contains("적용된 사용자와 권한") .contains("DB 실행 증적") + .contains("최근 DB cursor 10건") .contains("실행 요청 SQL") .contains("실제 DB cursor SQL") .contains("set_vpd_context 사용자 컨텍스트") diff --git a/src/test/java/com/cloudhandson/vpdbackoffice/web/ProbeResultTemplateRenderTest.java b/src/test/java/com/cloudhandson/vpdbackoffice/web/ProbeResultTemplateRenderTest.java index cc81fff..32e2392 100644 --- a/src/test/java/com/cloudhandson/vpdbackoffice/web/ProbeResultTemplateRenderTest.java +++ b/src/test/java/com/cloudhandson/vpdbackoffice/web/ProbeResultTemplateRenderTest.java @@ -4,6 +4,7 @@ import static org.assertj.core.api.Assertions.assertThat; import com.cloudhandson.vpdbackoffice.domain.probe.ProbeResult; import com.cloudhandson.vpdbackoffice.domain.probe.ProbeStatus; +import com.cloudhandson.vpdbackoffice.domain.probe.SqlExecutionCandidate; import java.nio.file.Path; import java.util.List; import java.util.Locale; @@ -38,7 +39,10 @@ class ProbeResultTemplateRenderTest { "{}", "{}" ).withExecutionEvidence(null, - "백오피스 DB 연결이 실제 DB cursor SQL을 읽지 못했습니다. 현재 권한 검증 결과는 정상입니다."); + "최근 cursor를 찾지 못했습니다.", + List.of(new SqlExecutionCandidate( + "4f2jz7n2k0s3p", 0, "CB_ORDS", + "SELECT * FROM ADMIN.CB_V_SEARCH_DOCUMENTS", "2026-07-01T15:00", true))); var context = new Context(Locale.KOREAN); context.setVariable("result", result); context.setVariable("vectorSearch", false); @@ -47,6 +51,10 @@ class ProbeResultTemplateRenderTest { String rendered = engine.process("fragments/probe-result", context); - assertThat(rendered).contains("백오피스 DB 연결이 실제 DB cursor SQL을 읽지 못했습니다."); + assertThat(rendered) + .contains("최근 cursor를 찾지 못했습니다.") + .contains("최근 DB cursor 10건") + .contains("4f2jz7n2k0s3p") + .contains("보호 대상 일치"); } }