fix #494: add delete impact confirmations

src/main/resources/mapper/PermissionMapper.xml

@@ -44,6 +44,24 @@
     WHERE role_id = #{roleId,jdbcType=NUMERIC}
   </delete>
 
+  <select id="countUserRolesByRoleId" resultType="int">
+    SELECT COUNT(*)
+    FROM cb_user_role
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
+  </select>
+
+  <select id="countGroupRolesByRoleId" resultType="int">
+    SELECT COUNT(*)
+    FROM cb_group_role
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
+  </select>
+
+  <select id="countPermissionsByRoleId" resultType="int">
+    SELECT COUNT(*)
+    FROM cb_permission
+    WHERE role_id = #{roleId,jdbcType=NUMERIC}
+  </select>
+
   <select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
     SELECT p.perm_id AS permission_id,
            r.role_id,

src/main/resources/static/css/app.css

@@ -638,6 +638,46 @@ body {
   overflow-wrap: anywhere;
 }
 
+.delete-impact {
+  color: var(--rw-text);
+  max-width: 24rem;
+  min-width: 14rem;
+  overflow-wrap: anywhere;
+}
+
+.delete-impact div + div {
+  margin-top: .35rem;
+}
+
+.delete-impact span,
+.delete-impact small {
+  color: var(--rw-muted);
+  display: block;
+  font-size: .76rem;
+  line-height: 1.35;
+}
+
+.delete-impact strong {
+  display: block;
+  font-weight: 800;
+  line-height: 1.35;
+}
+
+.delete-confirm {
+  align-items: center;
+  color: var(--rw-muted);
+  display: inline-flex;
+  font-size: .76rem;
+  font-weight: 700;
+  gap: .25rem;
+  margin: 0 .35rem .25rem 0;
+  white-space: nowrap;
+}
+
+.delete-confirm.disabled {
+  opacity: .55;
+}
+
 .policy-apply-flow {
   align-items: center;
   display: flex;

src/main/resources/templates/groups.html

@@ -10,6 +10,7 @@
   </div>
 
   <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+  <div class="alert alert-danger" th:if="${error}" th:text="${error}"></div>
 
   <section class="content-band">
     <h2>그룹 추가</h2>
@@ -41,28 +42,44 @@
           <th>코드</th>
           <th>그룹명</th>
           <th>설명</th>
+          <th>비활성 영향</th>
           <th>상태</th>
           <th></th>
         </tr>
         </thead>
         <tbody>
-        <tr th:each="group : ${groups}">
+        <tr th:each="group : ${groups}" th:with="impact=${groupImpactByGroupId[group.groupId()]}">
           <td th:text="${group.groupId()}">1</td>
           <td><code th:text="${group.groupCode()}">SALES_TEAM</code></td>
           <td th:text="${group.groupName()}">영업팀</td>
           <td th:text="${group.description()}">설명</td>
+          <td class="delete-impact">
+            <div>
+              <span>사용자</span>
+              <strong th:text="${impact == null || #lists.isEmpty(impact.users()) ? '0명' : #lists.size(impact.users()) + '명'}">0명</strong>
+            </div>
+            <div>
+              <span>역할</span>
+              <strong th:text="${impact == null || #lists.isEmpty(impact.roles()) ? '0개' : #lists.size(impact.roles()) + '개'}">0개</strong>
+            </div>
+            <small th:text="${impact == null || #lists.isEmpty(impact.objectNames()) ? '상속 권한 없음' : #strings.listJoin(impact.objectNames(), ', ')}">상속 권한 없음</small>
+          </td>
           <td><span class="badge" th:classappend="${group.active()} ? ' text-bg-success' : ' text-bg-secondary'" th:text="${group.activeYn()}">Y</span></td>
           <td>
             <form method="post" action="/groups/active" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
               <input type="hidden" name="groupId" th:value="${group.groupId()}">
               <input type="hidden" name="active" th:value="${!group.active()}">
+              <label class="delete-confirm" th:if="${group.active()}">
+                <input type="checkbox" name="confirmImpact" value="true" required>
+                영향 확인
+              </label>
               <button class="btn btn-sm btn-outline-secondary" type="submit" th:text="${group.active()} ? '비활성화' : '활성화'">변경</button>
             </form>
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(groups)}">
-          <td colspan="6" class="text-muted">등록된 그룹이 없습니다.</td>
+          <td colspan="7" class="text-muted">등록된 그룹이 없습니다.</td>
         </tr>
         </tbody>
       </table>
@@ -95,24 +112,33 @@
         <tr>
           <th>그룹</th>
           <th>사용자</th>
+          <th>해제 영향</th>
           <th></th>
         </tr>
         </thead>
         <tbody>
-        <tr th:each="mapping : ${groupUsers}" th:attr="data-group-id=${mapping.groupId()}">
+        <tr th:each="mapping : ${groupUsers}" th:attr="data-group-id=${mapping.groupId()}" th:with="impact=${groupImpactByGroupId[mapping.groupId()]}">
           <td><code th:text="${mapping.groupCode()}">SALES_TEAM</code></td>
           <td th:text="${mapping.username()}">agent_sales</td>
+          <td class="delete-impact">
+            <span>이 사용자는 그룹 역할을 더 이상 상속하지 않습니다.</span>
+            <strong th:text="${impact == null || #lists.isEmpty(impact.roles()) ? '그룹 역할 없음' : #strings.listJoin(impact.roles(), ', ')}">그룹 역할 없음</strong>
+          </td>
           <td>
             <form method="post" action="/groups/users/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
               <input type="hidden" name="groupId" th:value="${mapping.groupId()}">
               <input type="hidden" name="userId" th:value="${mapping.userId()}">
+              <label class="delete-confirm">
+                <input type="checkbox" name="confirmImpact" value="true" required>
+                영향 확인
+              </label>
               <button class="btn btn-sm btn-outline-danger" type="submit">해제</button>
             </form>
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(groupUsers)}">
-          <td colspan="3" class="text-muted">등록된 그룹 사용자가 없습니다.</td>
+          <td colspan="4" class="text-muted">등록된 그룹 사용자가 없습니다.</td>
         </tr>
         </tbody>
       </table>
@@ -145,24 +171,35 @@
         <tr>
           <th>그룹</th>
           <th>역할</th>
+          <th>해제 영향</th>
           <th></th>
         </tr>
         </thead>
         <tbody>
-        <tr th:each="mapping : ${groupRoles}" th:attr="data-group-id=${mapping.groupId()}">
+        <tr th:each="mapping : ${groupRoles}" th:attr="data-group-id=${mapping.groupId()}"
+            th:with="groupImpact=${groupImpactByGroupId[mapping.groupId()]},roleImpact=${roleImpactByRoleId[mapping.roleId()]}">
           <td><code th:text="${mapping.groupCode()}">SALES_TEAM</code></td>
           <td th:text="${mapping.roleName()}">SALES_ROLE</td>
+          <td class="delete-impact">
+            <span>그룹 사용자가 이 역할 권한을 잃습니다.</span>
+            <strong th:text="${groupImpact == null || #lists.isEmpty(groupImpact.users()) ? '영향 사용자 없음' : #strings.listJoin(groupImpact.users(), ', ')}">영향 사용자 없음</strong>
+            <small th:text="${roleImpact == null || #lists.isEmpty(roleImpact.objectNames()) ? '권한 객체 없음' : #strings.listJoin(roleImpact.objectNames(), ', ')}">권한 객체 없음</small>
+          </td>
           <td>
             <form method="post" action="/groups/roles/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
               <input type="hidden" name="groupId" th:value="${mapping.groupId()}">
               <input type="hidden" name="roleId" th:value="${mapping.roleId()}">
+              <label class="delete-confirm">
+                <input type="checkbox" name="confirmImpact" value="true" required>
+                영향 확인
+              </label>
               <button class="btn btn-sm btn-outline-danger" type="submit">해제</button>
             </form>
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(groupRoles)}">
-          <td colspan="3" class="text-muted">등록된 그룹 역할이 없습니다.</td>
+          <td colspan="4" class="text-muted">등록된 그룹 역할이 없습니다.</td>
         </tr>
         </tbody>
       </table>

src/main/resources/templates/permissions.html

@@ -12,6 +12,7 @@
   <section th:replace="~{fragments/layout :: architectureStrip('permission')}"></section>
 
   <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+  <div class="alert alert-danger" th:if="${error}" th:text="${error}"></div>
 
   <section class="content-band">
     <div class="section-heading">
@@ -222,11 +223,13 @@
           <th>행 규칙</th>
           <th>적용 필터</th>
           <th>원문 표시 허용 컬럼</th>
+          <th>삭제 영향</th>
           <th></th>
         </tr>
         </thead>
         <tbody>
-        <tr th:each="permission : ${permissions}">
+        <tr th:each="permission : ${permissions}"
+            th:with="lastPermission=${lastPermissionByPermissionId[permission.permissionId()]}">
           <td th:text="${permission.permissionId()}">100</td>
           <td th:text="${permission.roleName()}">HR_DEPT_ROLE</td>
           <td th:text="${permission.objectName()}">CB_V_SEARCH_DOCUMENTS</td>
@@ -239,16 +242,26 @@
           <td th:text="${permission.rules()} ?: '-'">ALL</td>
           <td><pre class="table-pre" th:text="${permission.filterPreview()} ?: '-'">ALL ROWS</pre></td>
           <td th:text="${permission.visibleColumns()} ?: '-'">CONTENTS</td>
+          <td class="delete-impact">
+            <span>역할이 이 TABLE/VIEW의 SELECT 권한을 잃습니다.</span>
+            <strong th:text="${permission.roleName() + ' -> ' + permission.objectName()}">ROLE -> OBJECT</strong>
+            <small th:if="${lastPermission}" class="text-danger">이 객체의 마지막 권한입니다. 삭제 후 보호 객체가 비활성화됩니다.</small>
+            <small th:unless="${lastPermission}">같은 객체에 다른 역할 권한이 남아 있습니다.</small>
+          </td>
           <td>
             <form method="post" action="/permissions/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
               <input type="hidden" name="permissionId" th:value="${permission.permissionId()}">
+              <label class="delete-confirm">
+                <input type="checkbox" name="confirmImpact" value="true" required>
+                영향 확인
+              </label>
               <button class="btn btn-sm btn-outline-danger" type="submit">삭제</button>
             </form>
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(permissions)}">
-          <td colspan="9" class="text-muted">등록된 권한이 없습니다.</td>
+          <td colspan="10" class="text-muted">등록된 권한이 없습니다.</td>
         </tr>
         </tbody>
       </table>

src/main/resources/templates/roles.html

@@ -10,6 +10,7 @@
   </div>
 
   <div class="alert alert-success" th:if="${message}" th:text="${message}"></div>
+  <div class="alert alert-danger" th:if="${error}" th:text="${error}"></div>
 
   <section class="content-band">
     <h2>역할 추가</h2>
@@ -45,11 +46,14 @@
           <th>ID</th>
           <th>역할명</th>
           <th>민감도 허용 상한</th>
+          <th>삭제 영향</th>
           <th></th>
         </tr>
         </thead>
         <tbody>
-        <tr th:each="role : ${roles}">
+        <tr th:each="role : ${roles}"
+            th:with="impact=${roleImpactByRoleId[role.roleId()]},
+                     hasDependencies=${impact != null && (!#lists.isEmpty(impact.directUsers()) || !#lists.isEmpty(impact.groups()) || impact.permissionCount() > 0)}">
           <td th:text="${role.roleId()}">10</td>
           <td th:text="${role.roleName()}">HR_DEPT_ROLE</td>
           <td>
@@ -65,16 +69,42 @@
               <button class="btn btn-sm btn-outline-primary" type="submit">저장</button>
             </form>
           </td>
+          <td class="delete-impact">
+            <div>
+              <span>직접 사용자</span>
+              <strong th:text="${impact == null || #lists.isEmpty(impact.directUsers()) ? '없음' : #strings.listJoin(impact.directUsers(), ', ')}">없음</strong>
+            </div>
+            <div>
+              <span>연결 그룹</span>
+              <strong th:text="${impact == null || #lists.isEmpty(impact.groups()) ? '없음' : #strings.listJoin(impact.groups(), ', ')}">없음</strong>
+            </div>
+            <div>
+              <span>영향 사용자</span>
+              <strong th:text="${impact == null || #lists.isEmpty(impact.affectedUsers()) ? '없음' : #strings.listJoin(impact.affectedUsers(), ', ')}">없음</strong>
+            </div>
+            <div>
+              <span>권한/객체</span>
+              <strong th:text="${impact == null ? '0건' : impact.permissionCount() + '건'}">0건</strong>
+              <small th:text="${impact == null || #lists.isEmpty(impact.objectNames()) ? '보호 객체 없음' : #strings.listJoin(impact.objectNames(), ', ')}">보호 객체 없음</small>
+            </div>
+            <p class="text-danger small mb-0" th:if="${hasDependencies}">연결을 먼저 해제해야 역할을 삭제할 수 있습니다.</p>
+          </td>
           <td>
             <form method="post" action="/roles/delete" class="inline-form">
               <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
               <input type="hidden" name="roleId" th:value="${role.roleId()}">
-              <button class="btn btn-sm btn-outline-danger" type="submit">삭제</button>
+              <label class="delete-confirm" th:classappend="${hasDependencies} ? ' disabled'">
+                <input type="checkbox" name="confirmImpact" value="true" required th:disabled="${hasDependencies}">
+                영향 확인
+              </label>
+              <button class="btn btn-sm btn-outline-danger" type="submit"
+                      th:disabled="${hasDependencies}"
+                      th:text="${hasDependencies} ? '연결 해제 필요' : '삭제'">삭제</button>
             </form>
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(roles)}">
-          <td colspan="4" class="text-muted">등록된 역할이 없습니다.</td>
+          <td colspan="5" class="text-muted">등록된 역할이 없습니다.</td>
         </tr>
         </tbody>
       </table>