feat #466: add deny permission effect

src/main/resources/mapper/PermissionMapper.xml

@@ -35,6 +35,7 @@
            o.object_id,
            p.target_name AS object_name,
            p.action_name AS action,
+           NVL(p.permission_effect, 'ALLOW') AS permission_effect,
            LISTAGG(
              NVL2(pr.rule_column, pr.rule_column || ' ', '') ||
              pr.rule_type ||
@@ -74,7 +75,7 @@
     JOIN cb_app_role r ON r.role_id = p.role_id
     LEFT JOIN cb_protected_object o ON o.object_name = p.target_name
     LEFT JOIN cb_permission_rule pr ON pr.perm_id = p.perm_id
-    GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name
+    GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name, p.permission_effect
     ORDER BY r.role_name, p.target_name
   </select>
 
@@ -104,7 +105,8 @@
     SELECT p.perm_id AS permission_id,
            p.role_id,
            o.object_id,
-           p.action_name AS action
+           p.action_name AS action,
+           NVL(p.permission_effect, 'ALLOW') AS permission_effect
     FROM cb_permission p
     JOIN cb_protected_object o ON o.object_name = p.target_name
     WHERE p.role_id = #{roleId}
@@ -120,8 +122,8 @@
   </select>
 
   <insert id="insertPermission">
-    INSERT INTO cb_permission (perm_id, role_id, target_name, action_name)
-    SELECT #{permissionId}, #{roleId}, object_name, #{action}
+    INSERT INTO cb_permission (perm_id, role_id, target_name, action_name, permission_effect)
+    SELECT #{permissionId}, #{roleId}, object_name, #{action}, #{permissionEffect}
     FROM cb_protected_object
     WHERE object_id = #{objectId}
   </insert>
@@ -132,6 +134,12 @@
     WHERE perm_id = #{permissionId}
   </update>
 
+  <update id="updatePermissionEffect">
+    UPDATE cb_permission
+    SET permission_effect = #{permissionEffect}
+    WHERE perm_id = #{permissionId}
+  </update>
+
   <delete id="deleteRules">
     DELETE FROM cb_permission_rule
     WHERE perm_id = #{permissionId}

src/main/resources/templates/permissions.html

@@ -37,6 +37,13 @@
           </optgroup>
         </select>
       </label>
+      <label>
+        권한 효과
+        <select class="form-select" name="permissionEffect" required>
+          <option value="ALLOW">허용</option>
+          <option value="DENY">거부</option>
+        </select>
+      </label>
       <div class="span-2">
         <div class="field-block-title">행 규칙</div>
         <div id="rowRuleList" class="rule-list">
@@ -80,6 +87,7 @@
           <th>역할</th>
           <th>테이블/뷰</th>
           <th>Action</th>
+          <th>Effect</th>
           <th>행 규칙</th>
           <th>적용 필터</th>
           <th>NULL 제외 컬럼</th>
@@ -92,6 +100,11 @@
           <td th:text="${permission.roleName()}">HR_DEPT_ROLE</td>
           <td th:text="${permission.objectName()}">CB_V_SEARCH_DOCUMENTS</td>
           <td th:text="${permission.action()}">SELECT</td>
+          <td>
+            <span class="badge"
+                  th:classappend="${permission.permissionEffect() == 'DENY'} ? ' text-bg-danger' : ' text-bg-success'"
+                  th:text="${permission.permissionEffect()}">ALLOW</span>
+          </td>
           <td th:text="${permission.rules()} ?: '-'">ALL</td>
           <td><pre class="table-pre" th:text="${permission.filterPreview()} ?: '-'">ALL ROWS</pre></td>
           <td th:text="${permission.visibleColumns()} ?: '-'">CONTENTS</td>
@@ -104,7 +117,7 @@
           </td>
         </tr>
         <tr th:if="${#lists.isEmpty(permissions)}">
-          <td colspan="8" class="text-muted">등록된 권한이 없습니다.</td>
+          <td colspan="9" class="text-muted">등록된 권한이 없습니다.</td>
         </tr>
         </tbody>
       </table>