[Developer] #424 move sensitive column access to permissions

Refs #424

src/main/java/com/cloudhandson/vpdbackoffice/domain/permission/PermissionView.java

@@ -7,6 +7,7 @@ public record PermissionView(
     long objectId,
     String objectName,
     String action,
-    String rules
+    String rules,
+    String visibleColumns
 ) {
 }

src/main/java/com/cloudhandson/vpdbackoffice/domain/user/UserCreateCommand.java

@@ -5,7 +5,6 @@ import jakarta.validation.constraints.NotBlank;
 public record UserCreateCommand(
     @NotBlank String username,
     @NotBlank String empNo,
-    @NotBlank String deptCode,
-    boolean canReadContents
+    @NotBlank String deptCode
 ) {
 }

src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java

@@ -4,6 +4,7 @@ import com.cloudhandson.vpdbackoffice.domain.permission.PermissionSetCommand;
 import com.cloudhandson.vpdbackoffice.domain.permission.RuleCommand;
 import com.cloudhandson.vpdbackoffice.service.PermissionService;
 import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
+import java.util.Arrays;
 import java.util.List;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -40,7 +41,7 @@ public class PermissionController {
       @RequestParam long objectId,
       @RequestParam String ruleType,
       @RequestParam(required = false) String ruleValue,
-      @RequestParam(required = false) List<String> visibleColumns,
+      @RequestParam(required = false) String visibleColumns,
       RedirectAttributes redirectAttributes
   ) {
     permissionService.savePermissionSet(new PermissionSetCommand(
@@ -48,12 +49,22 @@ public class PermissionController {
         objectId,
         "SELECT",
         List.of(new RuleCommand(ruleType, ruleValue)),
-        visibleColumns == null ? List.of() : visibleColumns
+        splitColumns(visibleColumns)
     ));
     redirectAttributes.addFlashAttribute("message", "권한을 저장했습니다.");
     return "redirect:/permissions";
   }
 
+  private List<String> splitColumns(String visibleColumns) {
+    if (visibleColumns == null || visibleColumns.isBlank()) {
+      return List.of();
+    }
+    return Arrays.stream(visibleColumns.split(","))
+        .map(String::trim)
+        .filter(value -> !value.isBlank())
+        .toList();
+  }
+
   @PostMapping("/permissions/delete")
   public String delete(@RequestParam long permissionId, RedirectAttributes redirectAttributes) {
     permissionService.deletePermission(permissionId);

src/main/java/com/cloudhandson/vpdbackoffice/web/UserController.java

@@ -34,10 +34,9 @@ public class UserController {
       @RequestParam String username,
       @RequestParam String empNo,
       @RequestParam String deptCode,
-      @RequestParam(defaultValue = "false") boolean canReadContents,
       RedirectAttributes redirectAttributes
   ) {
-    userService.createUser(new UserCreateCommand(username, empNo, deptCode, canReadContents));
+    userService.createUser(new UserCreateCommand(username, empNo, deptCode));
     redirectAttributes.addFlashAttribute("message", "사용자를 추가했습니다.");
     return "redirect:/users";
   }