[Developer] #424 move sensitive column access to permissions

Refs #424

src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/PermissionView.java

@@ -7,6 +7,7 @@ public record PermissionView(
     long objectId,
     String objectName,
     String action,
-    String rules
+    String rules,
+    String visibleColumns
 ) {
 }

src/main/java/com/cloudhandson/vpdbackoffice/domain/user/UserCreateCommand.java

@@ -5,7 +5,6 @@ import jakarta.validation.constraints.NotBlank;
 public record UserCreateCommand(
     @NotBlank String username,
     @NotBlank String empNo,
-    @NotBlank String deptCode,
-    boolean canReadContents
+    @NotBlank String deptCode
 ) {
 }

src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java

@@ -4,6 +4,7 @@ import com.cloudhandson.vpdbackoffice.domain.permission.PermissionSetCommand;
 import com.cloudhandson.vpdbackoffice.domain.permission.RuleCommand;
 import com.cloudhandson.vpdbackoffice.service.PermissionService;
 import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
+import java.util.Arrays;
 import java.util.List;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -40,7 +41,7 @@ public class PermissionController {
       @RequestParam long objectId,
       @RequestParam String ruleType,
       @RequestParam(required = false) String ruleValue,
-      @RequestParam(required = false) List<String> visibleColumns,
+      @RequestParam(required = false) String visibleColumns,
       RedirectAttributes redirectAttributes
   ) {
     permissionService.savePermissionSet(new PermissionSetCommand(
@@ -48,12 +49,22 @@ public class PermissionController {
         objectId,
         "SELECT",
         List.of(new RuleCommand(ruleType, ruleValue)),
-        visibleColumns == null ? List.of() : visibleColumns
+        splitColumns(visibleColumns)
     ));
     redirectAttributes.addFlashAttribute("message", "권한을 저장했습니다.");
     return "redirect:/permissions";
   }
 
+  private List<String> splitColumns(String visibleColumns) {
+    if (visibleColumns == null || visibleColumns.isBlank()) {
+      return List.of();
+    }
+    return Arrays.stream(visibleColumns.split(","))
+        .map(String::trim)
+        .filter(value -> !value.isBlank())
+        .toList();
+  }
+
   @PostMapping("/permissions/delete")
   public String delete(@RequestParam long permissionId, RedirectAttributes redirectAttributes) {
     permissionService.deletePermission(permissionId);

src/main/java/com/cloudhandson/vpdbackoffice/web/UserController.java

@@ -34,10 +34,9 @@ public class UserController {
       @RequestParam String username,
       @RequestParam String empNo,
       @RequestParam String deptCode,
-      @RequestParam(defaultValue = "false") boolean canReadContents,
       RedirectAttributes redirectAttributes
   ) {
-    userService.createUser(new UserCreateCommand(username, empNo, deptCode, canReadContents));
+    userService.createUser(new UserCreateCommand(username, empNo, deptCode));
     redirectAttributes.addFlashAttribute("message", "사용자를 추가했습니다.");
     return "redirect:/users";
   }

src/main/resources/mapper/PermissionMapper.xml

@@ -22,7 +22,12 @@
            p.target_name AS object_name,
            p.action_name AS action,
            LISTAGG(pr.rule_type || NVL2(pr.rule_value, ':' || pr.rule_value, ''), ', ')
-             WITHIN GROUP (ORDER BY pr.rule_id) AS rules
+             WITHIN GROUP (ORDER BY pr.rule_id) AS rules,
+           (
+             SELECT LISTAGG(pc.column_name, ', ') WITHIN GROUP (ORDER BY pc.column_name)
+             FROM cb_permission_column pc
+             WHERE pc.permission_id = p.perm_id
+           ) AS visible_columns
     FROM cb_permission p
     JOIN cb_app_role r ON r.role_id = p.role_id
     LEFT JOIN cb_protected_object o ON o.object_name = p.target_name

src/main/resources/mapper/UserMapper.xml

@@ -47,10 +47,7 @@
       #{command.username},
       #{command.empNo},
       #{command.deptCode},
-      <choose>
-        <when test="command.canReadContents"> 'Y' </when>
-        <otherwise> 'N' </otherwise>
-      </choose>,
+      'N',
       'Y'
     )
   </insert>

src/main/resources/templates/permissions.html

@@ -40,6 +40,10 @@
         규칙 값
         <input class="form-control" name="ruleValue" placeholder="APAC 또는 HR">
       </label>
+      <label>
+        표시 컬럼
+        <input class="form-control" name="visibleColumns" placeholder="CONTENTS">
+      </label>
       <button class="btn btn-primary" type="submit">저장</button>
     </form>
   </section>
@@ -55,6 +59,7 @@
           <th>테이블/뷰</th>
           <th>Action</th>
           <th>행 규칙</th>
+          <th>표시 컬럼</th>
           <th></th>
         </tr>
         </thead>
@@ -65,6 +70,7 @@
           <td th:text="${permission.objectName()}">CB_V_SEARCH_DOCUMENTS</td>
           <td th:text="${permission.action()}">SELECT</td>
           <td th:text="${permission.rules()} ?: '-'">ALL</td>
+          <td th:text="${permission.visibleColumns()} ?: '-'">CONTENTS</td>
           <td>
             <form method="post" action="/permissions/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
@@ -74,7 +80,7 @@
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(permissions)}">
-          <td colspan="6" class="text-muted">등록된 권한이 없습니다.</td>
+          <td colspan="7" class="text-muted">등록된 권한이 없습니다.</td>
         </tr>
         </tbody>
       </table>

src/main/resources/templates/users.html

@@ -27,10 +27,6 @@
         부서코드
         <input class="form-control" name="deptCode" required>
       </label>
-      <label class="form-check form-switch switch-field">
-        <input class="form-check-input" name="canReadContents" type="checkbox" value="true">
-        <span class="form-check-label">민감 컬럼 표시</span>
-      </label>
       <button class="btn btn-primary" type="submit">추가</button>
     </form>
   </section>
@@ -45,7 +41,6 @@
           <th>사용자명</th>
           <th>사번</th>
           <th>부서</th>
-          <th>민감 컬럼</th>
           <th>상태</th>
           <th></th>
         </tr>
@@ -56,7 +51,6 @@
           <td th:text="${user.username()}">agent_hr</td>
           <td th:text="${user.empNo()}">E10234</td>
           <td th:text="${user.deptCode()}">HR</td>
-          <td><span class="badge" th:classappend="${user.canReadContents() == 'Y'} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${user.canReadContents()}">N</span></td>
           <td><span class="badge" th:classappend="${user.active()} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${user.activeYn()}">Y</span></td>
           <td>
             <form method="post" action="/users/active" class="inline-form">
@@ -68,7 +62,7 @@
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(users)}">
-          <td colspan="7" class="text-muted">등록된 사용자가 없습니다.</td>
+          <td colspan="6" class="text-muted">등록된 사용자가 없습니다.</td>
         </tr>
         </tbody>
       </table>