fix #494: add delete impact confirmations

src/main/java/com/cloudhandson/vpdbackoffice/mapper/PermissionMapper.java

@@ -27,6 +27,12 @@ public interface PermissionMapper {
 
   int deleteRole(@Param("roleId") long roleId);
 
+  int countUserRolesByRoleId(@Param("roleId") long roleId);
+
+  int countGroupRolesByRoleId(@Param("roleId") long roleId);
+
+  int countPermissionsByRoleId(@Param("roleId") long roleId);
+
   List<PermissionView> findPermissionViews();
 
   PermissionSet findPermissionSet(@Param("roleId") long roleId, @Param("objectId") long objectId);

src/main/java/com/cloudhandson/vpdbackoffice/service/GroupService.java

@@ -42,6 +42,14 @@ public class GroupService {
 
   @Transactional
   public void setActive(long groupId, boolean active) {
+    setActive(groupId, active, true);
+  }
+
+  @Transactional
+  public void setActive(long groupId, boolean active, boolean confirmImpact) {
+    if (!active && !confirmImpact) {
+      throw new AppException("그룹 비활성화 전 영향 확인이 필요합니다.");
+    }
     int updated = groupMapper.updateActive(groupId, active ? "Y" : "N");
     if (updated == 0) {
       throw new AppException("그룹을 찾을 수 없습니다.");
@@ -59,6 +67,14 @@ public class GroupService {
 
   @Transactional
   public void removeUser(long groupId, long userId) {
+    removeUser(groupId, userId, true);
+  }
+
+  @Transactional
+  public void removeUser(long groupId, long userId, boolean confirmImpact) {
+    if (!confirmImpact) {
+      throw new AppException("그룹 사용자 해제 전 영향 확인이 필요합니다.");
+    }
     int deleted = groupMapper.deleteGroupUser(groupId, userId);
     if (deleted == 0) {
       throw new AppException("삭제할 그룹 사용자 매핑을 찾을 수 없습니다.");
@@ -76,6 +92,14 @@ public class GroupService {
 
   @Transactional
   public void removeRole(long groupId, long roleId) {
+    removeRole(groupId, roleId, true);
+  }
+
+  @Transactional
+  public void removeRole(long groupId, long roleId, boolean confirmImpact) {
+    if (!confirmImpact) {
+      throw new AppException("그룹 역할 해제 전 영향 확인이 필요합니다.");
+    }
     int deleted = groupMapper.deleteGroupRole(groupId, roleId);
     if (deleted == 0) {
       throw new AppException("삭제할 그룹 역할 매핑을 찾을 수 없습니다.");

src/main/java/com/cloudhandson/vpdbackoffice/service/PermissionService.java

@@ -76,6 +76,22 @@ public class PermissionService {
 
   @Transactional
   public void deleteRole(long roleId) {
+    deleteRole(roleId, true);
+  }
+
+  @Transactional
+  public void deleteRole(long roleId, boolean confirmImpact) {
+    if (!confirmImpact) {
+      throw new AppException("역할 삭제 전 영향 확인이 필요합니다.");
+    }
+    int userRoleCount = permissionMapper.countUserRolesByRoleId(roleId);
+    int groupRoleCount = permissionMapper.countGroupRolesByRoleId(roleId);
+    int permissionCount = permissionMapper.countPermissionsByRoleId(roleId);
+    if (userRoleCount + groupRoleCount + permissionCount > 0) {
+      throw new AppException("연결된 사용자/그룹/권한이 있는 역할은 삭제할 수 없습니다. 사용자 역할 "
+          + userRoleCount + "건, 그룹 역할 " + groupRoleCount + "건, 권한 " + permissionCount
+          + "건을 먼저 해제하세요.");
+    }
     int deleted = permissionMapper.deleteRole(roleId);
     if (deleted == 0) {
       throw new AppException("삭제할 역할을 찾을 수 없습니다.");
@@ -133,6 +149,14 @@ public class PermissionService {
 
   @Transactional
   public void deletePermission(long permissionId) {
+    deletePermission(permissionId, true);
+  }
+
+  @Transactional
+  public void deletePermission(long permissionId, boolean confirmImpact) {
+    if (!confirmImpact) {
+      throw new AppException("권한 삭제 전 영향 확인이 필요합니다.");
+    }
     Long objectId = permissionMapper.findObjectIdByPermissionId(permissionId);
     permissionMapper.deleteRules(permissionId);
     permissionMapper.deleteVisibleColumns(permissionId);
@@ -147,6 +171,10 @@ public class PermissionService {
         "permissionId=" + permissionId));
   }
 
+  public int countPermissionsByObjectId(long objectId) {
+    return permissionMapper.countPermissionsByObjectId(objectId);
+  }
+
   private void validateRules(long objectId, List<RuleCommand> rules) {
     if (rules == null || rules.isEmpty()) {
       throw new AppException("행 규칙은 하나 이상 필요합니다.");

src/main/java/com/cloudhandson/vpdbackoffice/web/GroupController.java

@@ -1,9 +1,15 @@
 package com.cloudhandson.vpdbackoffice.web;
 
+import com.cloudhandson.vpdbackoffice.domain.effective.GroupEffectiveAccessView;
+import com.cloudhandson.vpdbackoffice.domain.effective.RoleEffectiveImpactView;
 import com.cloudhandson.vpdbackoffice.domain.group.GroupCreateCommand;
+import com.cloudhandson.vpdbackoffice.service.AppException;
+import com.cloudhandson.vpdbackoffice.service.EffectiveMatrixService;
 import com.cloudhandson.vpdbackoffice.service.GroupService;
 import com.cloudhandson.vpdbackoffice.service.PermissionService;
 import com.cloudhandson.vpdbackoffice.service.UserService;
+import java.util.Map;
+import java.util.stream.Collectors;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -17,20 +23,32 @@ public class GroupController {
   private final GroupService groupService;
   private final UserService userService;
   private final PermissionService permissionService;
+  private final EffectiveMatrixService effectiveMatrixService;
 
-  public GroupController(GroupService groupService, UserService userService, PermissionService permissionService) {
+  public GroupController(
+      GroupService groupService,
+      UserService userService,
+      PermissionService permissionService,
+      EffectiveMatrixService effectiveMatrixService
+  ) {
     this.groupService = groupService;
     this.userService = userService;
     this.permissionService = permissionService;
+    this.effectiveMatrixService = effectiveMatrixService;
   }
 
   @GetMapping("/groups")
   public String groups(Model model) {
+    var matrix = effectiveMatrixService.matrix();
     model.addAttribute("groups", groupService.findAll());
     model.addAttribute("users", userService.findAll());
     model.addAttribute("roles", permissionService.findRoles());
     model.addAttribute("groupUsers", groupService.findGroupUsers());
     model.addAttribute("groupRoles", groupService.findGroupRoles());
+    model.addAttribute("groupImpactByGroupId", matrix.groups().stream()
+        .collect(Collectors.toMap(GroupEffectiveAccessView::groupId, impact -> impact)));
+    model.addAttribute("roleImpactByRoleId", matrix.roles().stream()
+        .collect(Collectors.toMap(RoleEffectiveImpactView::roleId, impact -> impact)));
     return "groups";
   }
 
@@ -50,10 +68,15 @@ public class GroupController {
   public String active(
       @RequestParam long groupId,
       @RequestParam boolean active,
+      @RequestParam(defaultValue = "false") boolean confirmImpact,
       RedirectAttributes redirectAttributes
   ) {
-    groupService.setActive(groupId, active);
-    redirectAttributes.addFlashAttribute("message", "그룹 상태를 변경했습니다.");
+    try {
+      groupService.setActive(groupId, active, active || confirmImpact);
+      redirectAttributes.addFlashAttribute("message", "그룹 상태를 변경했습니다.");
+    } catch (AppException exception) {
+      redirectAttributes.addFlashAttribute("error", exception.getMessage());
+    }
     return "redirect:/groups";
   }
 
@@ -72,10 +95,15 @@ public class GroupController {
   public String removeUser(
       @RequestParam long groupId,
       @RequestParam long userId,
+      @RequestParam(defaultValue = "false") boolean confirmImpact,
       RedirectAttributes redirectAttributes
   ) {
-    groupService.removeUser(groupId, userId);
-    redirectAttributes.addFlashAttribute("message", "그룹 사용자를 해제했습니다.");
+    try {
+      groupService.removeUser(groupId, userId, confirmImpact);
+      redirectAttributes.addFlashAttribute("message", "그룹 사용자를 해제했습니다.");
+    } catch (AppException exception) {
+      redirectAttributes.addFlashAttribute("error", exception.getMessage());
+    }
     return "redirect:/groups";
   }
 
@@ -94,10 +122,15 @@ public class GroupController {
   public String removeRole(
       @RequestParam long groupId,
       @RequestParam long roleId,
+      @RequestParam(defaultValue = "false") boolean confirmImpact,
       RedirectAttributes redirectAttributes
   ) {
-    groupService.removeRole(groupId, roleId);
-    redirectAttributes.addFlashAttribute("message", "그룹 역할을 해제했습니다.");
+    try {
+      groupService.removeRole(groupId, roleId, confirmImpact);
+      redirectAttributes.addFlashAttribute("message", "그룹 역할을 해제했습니다.");
+    } catch (AppException exception) {
+      redirectAttributes.addFlashAttribute("error", exception.getMessage());
+    }
     return "redirect:/groups";
   }
 }

src/main/java/com/cloudhandson/vpdbackoffice/web/PermissionController.java

@@ -4,6 +4,7 @@ import com.cloudhandson.vpdbackoffice.domain.permission.AppRole;
 import com.cloudhandson.vpdbackoffice.domain.permission.PermissionSetCommand;
 import com.cloudhandson.vpdbackoffice.domain.permission.RuleCommand;
 import com.cloudhandson.vpdbackoffice.domain.protectedobject.ProtectedColumn;
+import com.cloudhandson.vpdbackoffice.service.AppException;
 import com.cloudhandson.vpdbackoffice.service.GroupService;
 import com.cloudhandson.vpdbackoffice.service.PermissionService;
 import com.cloudhandson.vpdbackoffice.service.ProtectedObjectService;
@@ -111,6 +112,14 @@ public class PermissionController {
     var dbObjects = protectedObjectService.findDatabaseObjects();
     long dbObjectsAt = System.nanoTime();
     var permissions = permissionService.findPermissionViews();
+    var lastPermissionByPermissionId = permissions.stream()
+        .collect(Collectors.toMap(
+            permission -> permission.permissionId(),
+            permission -> permission.objectId() > 0
+                && permissionService.countPermissionsByObjectId(permission.objectId()) <= 1,
+            (left, right) -> left,
+            LinkedHashMap::new
+        ));
     long permissionsAt = System.nanoTime();
     log.info("permissions page timings: objects={}ms roles={}ms roleImpact={}ms columns={}ms dbObjects={}ms permissions={}ms total={}ms",
         elapsedMillis(started, objectsAt),
@@ -130,6 +139,7 @@ public class PermissionController {
     model.addAttribute("groupUsersByRole", roleImpact.groupUsersByRole());
     model.addAttribute("dbObjects", dbObjects);
     model.addAttribute("permissions", permissions);
+    model.addAttribute("lastPermissionByPermissionId", lastPermissionByPermissionId);
     return "permissions";
   }
 
@@ -257,9 +267,17 @@ public class PermissionController {
   }
 
   @PostMapping("/permissions/delete")
-  public String delete(@RequestParam long permissionId, RedirectAttributes redirectAttributes) {
-    permissionService.deletePermission(permissionId);
-    redirectAttributes.addFlashAttribute("message", "권한을 삭제했습니다.");
+  public String delete(
+      @RequestParam long permissionId,
+      @RequestParam(defaultValue = "false") boolean confirmImpact,
+      RedirectAttributes redirectAttributes
+  ) {
+    try {
+      permissionService.deletePermission(permissionId, confirmImpact);
+      redirectAttributes.addFlashAttribute("message", "권한을 삭제했습니다.");
+    } catch (AppException exception) {
+      redirectAttributes.addFlashAttribute("error", exception.getMessage());
+    }
     return "redirect:/permissions";
   }
 }

src/main/java/com/cloudhandson/vpdbackoffice/web/RoleController.java

@@ -1,6 +1,11 @@
 package com.cloudhandson.vpdbackoffice.web;
 
+import com.cloudhandson.vpdbackoffice.domain.effective.RoleEffectiveImpactView;
+import com.cloudhandson.vpdbackoffice.service.AppException;
+import com.cloudhandson.vpdbackoffice.service.EffectiveMatrixService;
 import com.cloudhandson.vpdbackoffice.service.PermissionService;
+import java.util.Map;
+import java.util.stream.Collectors;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -12,14 +17,19 @@ import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 public class RoleController {
 
   private final PermissionService permissionService;
+  private final EffectiveMatrixService effectiveMatrixService;
 
-  public RoleController(PermissionService permissionService) {
+  public RoleController(PermissionService permissionService, EffectiveMatrixService effectiveMatrixService) {
     this.permissionService = permissionService;
+    this.effectiveMatrixService = effectiveMatrixService;
   }
 
   @GetMapping("/roles")
   public String roles(Model model) {
     model.addAttribute("roles", permissionService.findRoles());
+    Map<Long, RoleEffectiveImpactView> roleImpactByRoleId = effectiveMatrixService.matrix().roles().stream()
+        .collect(Collectors.toMap(RoleEffectiveImpactView::roleId, impact -> impact));
+    model.addAttribute("roleImpactByRoleId", roleImpactByRoleId);
     return "roles";
   }
 
@@ -47,9 +57,17 @@ public class RoleController {
   }
 
   @PostMapping("/roles/delete")
-  public String delete(@RequestParam long roleId, RedirectAttributes redirectAttributes) {
-    permissionService.deleteRole(roleId);
-    redirectAttributes.addFlashAttribute("message", "역할을 삭제했습니다.");
+  public String delete(
+      @RequestParam long roleId,
+      @RequestParam(defaultValue = "false") boolean confirmImpact,
+      RedirectAttributes redirectAttributes
+  ) {
+    try {
+      permissionService.deleteRole(roleId, confirmImpact);
+      redirectAttributes.addFlashAttribute("message", "역할을 삭제했습니다.");
+    } catch (AppException exception) {
+      redirectAttributes.addFlashAttribute("error", exception.getMessage());
+    }
     return "redirect:/roles";
   }
 }