joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidate data access control backoffice updates

Browse Source
This commit is contained in:
devmrko
2026-07-13 23:06:23 +09:00
parent 403298d474
commit e18b30feab
181 changed files with 11571 additions and 954 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/assets/agent-ords-security-audit-screen.svg Normal file
View File

@@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-labelledby="title desc">
<title id="title">보안 인벤토리 확인 화면</title>
<desc id="desc">VPD, Redaction, DDS 권한 적용 현황을 확인하는 화면.</desc>
<rect width="1120" height="620" fill="#f4f6f8"/>
<rect x="34" y="30" width="1052" height="560" rx="10" fill="#1f2937"/>
<circle cx="68" cy="58" r="7" fill="#ef4444"/>
<circle cx="92" cy="58" r="7" fill="#f59e0b"/>
<circle cx="116" cy="58" r="7" fill="#22c55e"/>
<text x="150" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">ADMIN Inventory - Policy and Data Grant Matrix</text>
<text x="58" y="112" fill="#fde68a" font-family="Menlo, Consolas, monospace" font-size="20">=== VPD / Redaction 적용 객체 ===</text>
<text x="58" y="160" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">OBJECT_NAME POLICY ENABLE</text>
<line x1="58" y1="182" x2="1038" y2="182" stroke="#4b5563" stroke-width="2"/>
<text x="58" y="222" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">CB_V_SEARCH_DOCUMENTS CB_AGENT_DOC_POLICY YES</text>
<text x="58" y="262" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">CB_V_SEARCH_DOCUMENTS CB_CONTENTS_REDACT YES</text>
<text x="58" y="302" fill="#fde68a" font-family="Menlo, Consolas, monospace" font-size="20">=== DDS END USER -> DATA ROLE -> DATA GRANT ===</text>
<text x="58" y="342" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">cb_dds_hr CB_DDS_HR_ROLE dept_code='HR' EXCEPT CONTENTS</text>
<text x="58" y="382" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">cb_dds_fin CB_DDS_FIN_ROLE dept_code='FIN' EXCEPT CONTENTS</text>
<text x="58" y="422" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">cb_dds_all CB_DDS_ALL_ROLE 1=1 ALL COLUMNS</text>
<text x="58" y="462" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">cb_dds_none CONNECT_ONLY no DATA GRANT ORA-00942</text>
<text x="58" y="524" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">확인 SQL: DBA_POLICIES, REDACTION_POLICIES, DBA_DATA_GRANTS</text>
<text x="58" y="558" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="18">결과: 객체별 정책과 End User별 Grant를 한 번에 대조</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.5 KiB

22
docs/assets/agent-ords-security-bearer-key-screen.svg Normal file
View File

@@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-labelledby="title desc">
<title id="title">Bearer Key ORDS 요청 화면</title>
<desc id="desc">ORDS Bearer Key 조회, 사용자 매핑, 필터링된 검색 결과 요약 화면.</desc>
<rect width="1120" height="620" fill="#f4f6f8"/>
<rect x="34" y="30" width="1052" height="560" rx="10" fill="#172033"/>
<circle cx="68" cy="58" r="7" fill="#ef4444"/>
<circle cx="92" cy="58" r="7" fill="#f59e0b"/>
<circle cx="116" cy="58" r="7" fill="#22c55e"/>
<text x="150" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">ORDS - Header Bearer Key 사용자 매핑</text>
<text x="58" y="112" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 수신 요청 ===</text>
<text x="58" y="154" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">POST /ords/cb-ords/cb-agent-security/vpd/documents</text>
<text x="58" y="188" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">Authorization: Bearer cb_hr_key</text>
<text x="58" y="246" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== ORDS 처리 로직: 필수값 확인 ===</text>
<text x="58" y="288" fill="#fca5a5" font-family="Menlo, Consolas, monospace" font-size="18">Authorization Header 필수. 없으면 ORA-20101 또는 401/403</text>
<text x="58" y="336" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== ORDS 처리 로직: Key 매핑 ===</text>
<text x="58" y="376" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">1. Key Hash 계산 -> SHA256: 4A91...7C20</text>
<text x="58" y="410" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">2. CB_AGENT_BEARER_KEY 조회 -> USER_ID=101, KEY_ID=1</text>
<text x="58" y="444" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">3. Context reset + set -> EMP_NO=E10234, DEPT_CODE=HR</text>
<text x="58" y="496" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 보호 객체 조회 ===</text>
<text x="58" y="532" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">CB_V_SEARCH_DOCUMENTS 조회 -> HR 행 3건, CONTENTS=NULL</text>
<text x="58" y="566" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="18">결과: ORDS 처리 로직이 Header Key를 사용자로 매핑</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.4 KiB

72
docs/assets/agent-ords-security-dds-bearer-probe.svg Normal file
View File

@@ -0,0 +1,72 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1240" height="700" viewBox="0 0 1240 700" role="img" aria-labelledby="title desc">
<title id="title">DDS Bearer Key 처리 검증</title>
<desc id="desc">ORDS Handler가 Bearer Key를 읽어도 DDS EndUserSecurityContext가 붙지 않으면 DATA GRANT가 Key 사용자를 인식하지 못하는 흐름.</desc>
<rect width="1240" height="700" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 35px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
.mono-small { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2.2; }
.ok { fill: #ecfdf5; stroke: #059669; stroke-width: 2.2; }
.warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2.2; }
.bad { fill: #fef2f2; stroke: #dc2626; stroke-width: 2.2; }
.driver { fill: #eff6ff; stroke: #2563eb; stroke-width: 2.2; }
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
.dash { stroke: #94a3b8; stroke-width: 2.2; stroke-dasharray: 8 7; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="42" y="56" class="h1">DDS Bearer Key 검증 결과</text>
<text x="42" y="90" class="sub">ORDS Handler의 Header 매핑과 DDS EndUserSecurityContext 전파는 별도 단계</text>
<rect x="42" y="126" width="320" height="122" rx="10" class="card"/>
<text x="68" y="166" class="title">1. Agent 요청</text>
<text x="68" y="204" class="mono">Authorization:</text>
<text x="68" y="230" class="mono">Bearer cb_hr_key</text>
<line x1="362" y1="187" x2="432" y2="187" class="arrow"/>
<rect x="448" y="126" width="344" height="122" rx="10" class="ok"/>
<text x="474" y="166" class="title">2. ORDS Handler</text>
<text x="474" y="204" class="text">Header 필수값 확인</text>
<text x="474" y="230" class="text">Key를 내부 사용자로 매핑</text>
<line x1="792" y1="187" x2="862" y2="187" class="arrow"/>
<rect x="878" y="126" width="320" height="122" rx="10" class="warn"/>
<text x="904" y="166" class="title">3. DB Session</text>
<text x="904" y="204" class="mono">SESSION_USER = CB_ORDS</text>
<text x="904" y="230" class="mono">DDS username = null</text>
<path d="M 1038 248 C 1038 302, 620 302, 620 346" class="arrow"/>
<rect x="448" y="346" width="344" height="142" rx="10" class="bad"/>
<text x="474" y="386" class="title">검증된 차단 결과</text>
<text x="474" y="424" class="mono-small">mapped_end_user=cb_dds_hr</text>
<text x="474" y="452" class="mono">dds_context_username=null</text>
<text x="474" y="480" class="mono">ORA-00942 / EXPECTED_BLOCKED</text>
<path d="M 448 417 C 344 417, 318 312, 250 260" class="dash"/>
<text x="82" y="310" class="text">Key 사용자명을 변수로</text>
<text x="82" y="335" class="text">보관하는 것만으로는</text>
<text x="82" y="360" class="text">DDS 사용자가 되지 않음</text>
<rect x="42" y="540" width="530" height="104" rx="10" class="driver"/>
<text x="68" y="580" class="title">DDS로 Bearer 적용 시 필요한 경로</text>
<text x="68" y="610" class="text">지원 드라이버 또는 호출 앱 계층이</text>
<text x="68" y="634" class="text">DB 호출 전에 EndUserSecurityContext Attach</text>
<line x1="572" y1="592" x2="642" y2="592" class="arrow"/>
<rect x="658" y="540" width="540" height="104" rx="10" class="ok"/>
<text x="684" y="580" class="title">DDS DATA GRANT 적용</text>
<text x="684" y="610" class="text">DB가 End-user Identity와 DATA ROLE 인식</text>
<text x="684" y="634" class="text">보호 객체(VIEW/TABLE) 조회 허용</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 4.2 KiB

88
docs/assets/agent-ords-security-dds-object-model.svg Normal file
View File

@@ -0,0 +1,88 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="760" viewBox="0 0 1280 760" role="img" aria-labelledby="title desc">
<title id="title">DDS 보안 오브젝트 모델</title>
<desc id="desc">END USER, APPLICATION IDENTITY, DATA ROLE, DATA GRANT, 보호 객체와 중앙 확인 뷰의 관계.</desc>
<rect width="1280" height="760" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="8" markerHeight="8" refX="7" refY="4" orient="auto">
<path d="M 0 0 L 8 4 L 0 8 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 34px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 19px; fill: #475569; }
.label { font-family: Arial, Helvetica, sans-serif; font-size: 15px; font-weight: 700; fill: #475569; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 22px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.identity { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
.role { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
.grant { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.object { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
.audit { fill: #eef2ff; stroke: #4f46e5; stroke-width: 2; }
.deny { fill: #fef2f2; stroke: #dc2626; stroke-width: 2; }
.chip { fill: #ffffff; stroke: #bbf7d0; stroke-width: 1.5; }
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
.dash { stroke: #64748b; stroke-width: 2; stroke-dasharray: 7 6; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="48" y="58" class="h1">DDS 보안 오브젝트 모델</text>
<text x="48" y="90" class="sub">권한은 업무 매핑 테이블이 아니라 Oracle 보안 오브젝트와 DATA GRANT로 선언</text>
<text x="48" y="130" class="label">사용자 식별</text>
<rect x="48" y="146" width="270" height="132" rx="8" class="identity"/>
<text x="74" y="184" class="title">END USER</text>
<text x="74" y="222" class="text">스키마를 소유하지 않는</text>
<text x="74" y="248" class="text">DDS 보안 사용자</text>
<rect x="48" y="330" width="270" height="112" rx="8" class="card"/>
<text x="74" y="366" class="title">APPLICATION IDENTITY</text>
<text x="74" y="402" class="text">애플리케이션 자체 권한이</text>
<text x="74" y="426" class="text">필요할 때 쓰는 확장</text>
<text x="390" y="130" class="label">역할 묶음</text>
<rect x="390" y="146" width="270" height="132" rx="8" class="role"/>
<text x="416" y="184" class="title">DATA ROLE</text>
<text x="416" y="222" class="text">데이터 권한 묶음</text>
<text x="416" y="248" class="mono">CB_DDS_HR_ROLE</text>
<text x="730" y="130" class="label">권한 선언</text>
<rect x="730" y="118" width="420" height="244" rx="8" class="grant"/>
<text x="760" y="158" class="title">DATA GRANT</text>
<text x="760" y="194" class="text">보호 객체에 대한 작업, 행, 컬럼 범위</text>
<rect x="760" y="218" width="358" height="36" rx="6" class="chip"/>
<text x="780" y="242" class="mono">AS SELECT</text>
<rect x="760" y="264" width="358" height="36" rx="6" class="chip"/>
<text x="780" y="288" class="mono">WHERE dept_code = 'HR'</text>
<rect x="760" y="310" width="358" height="36" rx="6" class="chip"/>
<text x="780" y="334" class="mono">ALL COLUMNS EXCEPT contents</text>
<text x="730" y="410" class="label">보호 대상</text>
<rect x="730" y="426" width="420" height="114" rx="8" class="object"/>
<text x="760" y="466" class="title">VIEW / TABLE</text>
<text x="760" y="502" class="mono">ADMIN.CB_DDS_V_SEARCH_DOCUMENTS</text>
<text x="760" y="526" class="text">DATA GRANT가 있는 범위만 조회 가능</text>
<line x1="318" y1="212" x2="382" y2="212" class="arrow"/>
<text x="326" y="197" class="label">GRANT</text>
<path d="M 318 386 C 350 386, 356 246, 382 230" class="dash"/>
<text x="330" y="352" class="label">선택 확장</text>
<line x1="660" y1="212" x2="722" y2="212" class="arrow"/>
<text x="684" y="197" class="label">TO</text>
<path d="M 940 362 L 940 418" class="arrow"/>
<text x="954" y="398" class="label">ON</text>
<rect x="48" y="574" width="540" height="104" rx="8" class="deny"/>
<text x="74" y="614" class="title">DATA GRANT 없음</text>
<text x="74" y="650" class="text">권한 미부여 END USER에게는 객체 자체가 보이지 않음</text>
<text x="74" y="674" class="mono">ORA-00942</text>
<rect x="640" y="574" width="510" height="104" rx="8" class="audit"/>
<text x="666" y="614" class="title">중앙 확인</text>
<text x="666" y="650" class="mono">DBA_DATA_ROLE_GRANTS</text>
<text x="666" y="674" class="mono">DBA_DATA_GRANTS / DBA_DATA_ROLES</text>
<rect x="48" y="704" width="1102" height="42" rx="8" fill="#ecfdf5" stroke="#059669" stroke-width="2"/>
<text x="74" y="731" class="text">요점: DDS는 사용자별 권한을 DATA ROLE과 DATA GRANT로 선언하고, Dictionary View로 적용 상태를 확인한다.</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 5.2 KiB

22
docs/assets/agent-ords-security-dds-screen.svg Normal file
View File

@@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-labelledby="title desc">
<title id="title">DDS 결과 화면</title>
<desc id="desc">DDS 권한이 없을 때 조회 대상이 보이지 않는 흐름을 요약한 화면.</desc>
<rect width="1120" height="620" fill="#f4f6f8"/>
<rect x="34" y="30" width="1052" height="560" rx="10" fill="#0f172a"/>
<circle cx="68" cy="58" r="7" fill="#ef4444"/>
<circle cx="92" cy="58" r="7" fill="#f59e0b"/>
<circle cx="116" cy="58" r="7" fill="#22c55e"/>
<text x="150" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">sqlplus - DDS DATA GRANT 테스트</text>
<text x="58" y="112" fill="#a7f3d0" font-family="Menlo, Consolas, monospace" font-size="20">=== DDS 사용자 확인 ===</text>
<text x="58" y="154" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">END_USER_NAME</text>
<text x="58" y="188" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">"cb_dds_hr"</text>
<text x="58" y="246" fill="#a7f3d0" font-family="Menlo, Consolas, monospace" font-size="20">=== DDS 보호 객체 조회 결과 ===</text>
<text x="58" y="288" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">OBJECT_NAME ROWS_VISIBLE CONTENTS</text>
<text x="58" y="322" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">CB_DDS_V_SEARCH_DOCUMENTS 3 NULL</text>
<text x="58" y="356" fill="#fca5a5" font-family="Menlo, Consolas, monospace" font-size="18">cb_dds_none same object ORA-00942: 조회 대상 없음</text>
<text x="58" y="414" fill="#a7f3d0" font-family="Menlo, Consolas, monospace" font-size="20">=== 우회 시도 결과 ===</text>
<text x="58" y="456" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">ADMIN.CB_DDS_DOCUMENTS 직접 조회 - ORA-00942</text>
<text x="58" y="490" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">ADMIN.CB_SEARCH_DOCUMENTS 직접 조회 - ORA-00942</text>
<text x="58" y="524" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">ORDS Bearer 단독 DDS 검증 - EXPECTED_BLOCKED</text>
<text x="58" y="558" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="18">결과: DATA GRANT가 없으면 행 0건이 아니라 객체 자체가 숨겨짐</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.4 KiB

97
docs/assets/agent-ords-security-dds-setup-flow.svg Normal file
View File

@@ -0,0 +1,97 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="780" viewBox="0 0 1280 780" role="img" aria-labelledby="title desc">
<title id="title">DDS 설정과 확인 흐름</title>
<desc id="desc">DDS 보호 객체 준비, END USER와 DATA ROLE 생성, DATA GRANT 선언, 중앙 권한 인벤토리 확인 흐름.</desc>
<rect width="1280" height="780" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="8" markerHeight="8" refX="7" refY="4" orient="auto">
<path d="M 0 0 L 8 4 L 0 8 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 34px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 19px; fill: #475569; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
.head { font-family: Arial, Helvetica, sans-serif; font-size: 15px; font-weight: 700; fill: #334155; }
.cell { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.blue { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
.purple { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
.green { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.orange { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
.audit { fill: #eef2ff; stroke: #4f46e5; stroke-width: 2; }
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
.rule { stroke: #cbd5e1; stroke-width: 1.5; }
</style>
</defs>
<text x="48" y="58" class="h1">DDS 설정과 확인 흐름</text>
<text x="48" y="90" class="sub">적용은 DATA GRANT 단위로 선언하고, 확인은 Dictionary View에서 통합 조회</text>
<rect x="48" y="128" width="510" height="100" rx="8" class="blue"/>
<text x="74" y="164" class="title">1. 보호 객체 준비</text>
<text x="74" y="198" class="mono">CREATE VIEW / TABLE admin.cb_dds_v_search_documents</text>
<line x1="303" y1="228" x2="303" y2="252" class="arrow"/>
<rect x="48" y="260" width="510" height="112" rx="8" class="purple"/>
<text x="74" y="296" class="title">2. 사용자와 역할 생성</text>
<text x="74" y="330" class="mono">CREATE END USER "cb_dds_hr"</text>
<text x="74" y="356" class="mono">CREATE DATA ROLE cb_dds_hr_role</text>
<line x1="303" y1="372" x2="303" y2="396" class="arrow"/>
<rect x="48" y="404" width="510" height="178" rx="8" class="green"/>
<text x="74" y="440" class="title">3. DATA GRANT 선언</text>
<text x="74" y="474" class="mono">CREATE DATA GRANT admin.cb_dg_hr_docs</text>
<text x="74" y="500" class="mono">AS SELECT (ALL COLUMNS EXCEPT contents)</text>
<text x="74" y="526" class="mono">ON admin.cb_dds_v_search_documents</text>
<text x="74" y="552" class="mono">WHERE dept_code = 'HR' TO cb_dds_hr_role</text>
<line x1="303" y1="582" x2="303" y2="606" class="arrow"/>
<rect x="48" y="614" width="510" height="96" rx="8" class="orange"/>
<text x="74" y="650" class="title">4. 조회 시 자동 적용</text>
<text x="74" y="684" class="text">허용 행과 컬럼만 반환. 권한 미부여 시 ORA-00942.</text>
<rect x="638" y="128" width="582" height="582" rx="8" class="audit"/>
<text x="670" y="166" class="title">5. 권한 인벤토리 확인</text>
<text x="670" y="198" class="text">적용 상태는 아래 Dictionary View를 조합해 확인</text>
<rect x="670" y="224" width="250" height="64" rx="6" class="card"/>
<text x="692" y="250" class="mono">DBA_DATA_GRANTS</text>
<text x="692" y="274" class="text">객체, 조건, 컬럼 범위</text>
<rect x="948" y="224" width="250" height="64" rx="6" class="card"/>
<text x="970" y="250" class="mono">DBA_DATA_ROLE_GRANTS</text>
<text x="970" y="274" class="text">END USER와 역할 매핑</text>
<text x="670" y="332" class="head">END_USER</text>
<text x="832" y="332" class="head">DATA_ROLE</text>
<text x="1012" y="332" class="head">ROW / COLUMN</text>
<line x1="670" y1="346" x2="1198" y2="346" class="rule"/>
<text x="670" y="382" class="cell">cb_dds_hr</text>
<text x="832" y="382" class="cell">HR_ROLE</text>
<text x="1012" y="382" class="cell">HR / EXCEPT contents</text>
<line x1="670" y1="402" x2="1198" y2="402" class="rule"/>
<text x="670" y="438" class="cell">cb_dds_fin</text>
<text x="832" y="438" class="cell">FIN_ROLE</text>
<text x="1012" y="438" class="cell">FIN / EXCEPT contents</text>
<line x1="670" y1="458" x2="1198" y2="458" class="rule"/>
<text x="670" y="494" class="cell">cb_dds_all</text>
<text x="832" y="494" class="cell">ALL_ROLE</text>
<text x="1012" y="494" class="cell">ALL / ALL COLUMNS</text>
<line x1="670" y1="514" x2="1198" y2="514" class="rule"/>
<text x="670" y="550" class="cell">cb_dds_none</text>
<text x="832" y="550" class="cell">CONNECT_ONLY</text>
<text x="1012" y="550" class="cell">- / ORA-00942</text>
<rect x="670" y="610" width="528" height="72" rx="8" fill="#ffffff" stroke="#c7d2fe" stroke-width="2"/>
<text x="694" y="638" class="title">운영 포인트</text>
<text x="694" y="666" class="text">승인 사유와 ticket 번호는 별도 이력 테이블에 보관</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 5.4 KiB

85
docs/assets/agent-ords-security-main-trunk.svg Normal file
View File

@@ -0,0 +1,85 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="720" viewBox="0 0 1280 720" role="img" aria-labelledby="title desc">
<title id="title">ORDS Agent 데이터 접근 통제 아키텍처</title>
<desc id="desc">Agent 요청에서 ORDS 사용자 식별, DB 보안 정책 적용, 허용 결과 반환까지의 아키텍처와 DB User, Bearer Key, VPD, DDS 적용 경로.</desc>
<rect width="1280" height="720" fill="#f8fafc"/>
<defs>
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
<path d="M 0 0 L 10 5 L 0 10 z" fill="#334155"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 36px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
.small { font-family: Arial, Helvetica, sans-serif; font-size: 15px; fill: #475569; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
.trunk { fill: #ffffff; stroke: #2563eb; stroke-width: 2; rx: 10; }
.branch { fill: #fefce8; stroke: #ca8a04; stroke-width: 2; rx: 10; }
.policy { fill: #ecfdf5; stroke: #059669; stroke-width: 2; rx: 10; }
.result { fill: #eef2ff; stroke: #4f46e5; stroke-width: 2; rx: 10; }
</style>
</defs>
<text x="54" y="62" class="h1">Agent 권한 매핑 및 데이터 접근 통제</text>
<text x="54" y="100" class="sub">사용자 식별 방식은 갈라지지만, 최종 데이터 제한은 보호 객체(VIEW/TABLE)에서 DB가 적용한다.</text>
<rect x="42" y="154" width="150" height="96" class="trunk"/>
<text x="66" y="192" class="title">1. Agent</text>
<text x="66" y="222" class="text">검색 요청</text>
<line x1="192" y1="202" x2="250" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
<rect x="252" y="154" width="160" height="96" class="trunk"/>
<text x="276" y="192" class="title">2. ORDS</text>
<text x="276" y="222" class="text">요청 수신</text>
<line x1="412" y1="202" x2="470" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
<rect x="472" y="154" width="190" height="96" class="trunk"/>
<text x="496" y="188" class="title">3. 사용자 식별</text>
<text x="496" y="218" class="text">DB User 또는 Key</text>
<line x1="662" y1="202" x2="720" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
<rect x="722" y="154" width="210" height="96" class="trunk"/>
<text x="746" y="188" class="title">4. 권한 기준 생성</text>
<text x="746" y="218" class="text">Context / DDS Identity</text>
<line x1="932" y1="202" x2="990" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
<rect x="992" y="154" width="230" height="96" class="trunk"/>
<text x="1016" y="188" class="title">5. 보호 객체</text>
<text x="1016" y="216" class="text">VIEW/TABLE 조회</text>
<text x="1016" y="239" class="text">정책 적용</text>
<rect x="446" y="318" width="245" height="126" class="branch"/>
<text x="474" y="356" class="title">식별 경로 A</text>
<text x="474" y="386" class="mono">SESSION_USER</text>
<text x="474" y="416" class="text">DB 계정으로 사용자 매핑</text>
<line x1="568" y1="318" x2="568" y2="250" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
<rect x="156" y="318" width="245" height="126" class="branch"/>
<text x="184" y="356" class="title">식별 경로 B</text>
<text x="184" y="386" class="mono">Authorization: Bearer</text>
<text x="184" y="416" class="text">Key로 내부 사용자 매핑</text>
<line x1="400" y1="372" x2="472" y2="235" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
<rect x="736" y="318" width="245" height="126" class="branch"/>
<text x="764" y="356" class="title">식별 경로 C</text>
<text x="764" y="386" class="mono">END USER</text>
<text x="764" y="416" class="text">DDS 보안 사용자</text>
<line x1="828" y1="318" x2="828" y2="250" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
<rect x="230" y="508" width="340" height="126" class="policy"/>
<text x="260" y="548" class="title">VPD 적용 경로</text>
<text x="260" y="578" class="text">SYS_CONTEXT + p_object + EXISTS</text>
<text x="260" y="606" class="small">권한 테이블 기반 행 제한</text>
<text x="260" y="626" class="small">Redaction 값 마스킹</text>
<line x1="570" y1="562" x2="746" y2="250" stroke="#059669" stroke-width="2.5" marker-end="url(#arrow)"/>
<rect x="710" y="508" width="340" height="126" class="policy"/>
<text x="740" y="548" class="title">DDS 적용 경로</text>
<text x="740" y="578" class="text">DATA ROLE + DATA GRANT</text>
<text x="740" y="606" class="small">행 / 컬럼 / 작업 통제</text>
<text x="740" y="626" class="small">선언형 제한</text>
<line x1="880" y1="508" x2="1048" y2="250" stroke="#059669" stroke-width="2.5" marker-end="url(#arrow)"/>
<rect x="368" y="654" width="544" height="48" class="result"/>
<text x="410" y="685" class="title">결과: 허용된 행과 컬럼만 반환</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 5.3 KiB

31
docs/assets/agent-ords-security-no-permission-screen.svg Normal file
View File

@@ -0,0 +1,31 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="760" viewBox="0 0 1280 760" role="img" aria-labelledby="title desc">
<title id="title">권한 미부여 및 차단 결과 화면</title>
<desc id="desc">권한 미부여 시 VPD 0건, DB 권한 오류, Bearer Key 오류가 어떻게 다른지 보여주는 화면.</desc>
<rect width="1280" height="760" fill="#f4f6f8"/>
<rect x="36" y="30" width="1208" height="700" rx="10" fill="#172033"/>
<circle cx="70" cy="58" r="7" fill="#ef4444"/>
<circle cx="94" cy="58" r="7" fill="#f59e0b"/>
<circle cx="118" cy="58" r="7" fill="#22c55e"/>
<text x="152" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">권한 미부여 및 차단 결과 비교</text>
<text x="60" y="116" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== Case A. DB SELECT Grant 있음 + VPD Policy 있음 + 매핑 없음 ===</text>
<text x="60" y="158" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">SELECT COUNT(*) FROM ADMIN.CB_V_SEARCH_DOCUMENTS;</text>
<text x="60" y="196" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="17">ROWS_VISIBLE</text>
<text x="60" y="226" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="17">0</text>
<text x="232" y="226" fill="#c7d2fe" font-family="Menlo, Consolas, monospace" font-size="17">해석: SQL은 실행되지만 VPD EXISTS가 통과하지 못함</text>
<text x="60" y="294" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== Case B. 보호 객체 DB 권한 미부여 ===</text>
<text x="60" y="336" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">SELECT COUNT(*) FROM ADMIN.CB_V_SEARCH_DOCUMENTS;</text>
<text x="60" y="374" fill="#fca5a5" font-family="Menlo, Consolas, monospace" font-size="17">ORA-00942: table or view does not exist</text>
<text x="472" y="374" fill="#c7d2fe" font-family="Menlo, Consolas, monospace" font-size="17">해석: VPD 판단 전 객체가 보이지 않음</text>
<text x="60" y="442" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== Case C. Bearer Key 누락 또는 형식 오류 ===</text>
<text x="60" y="484" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">Authorization Header 없음</text>
<text x="60" y="522" fill="#fca5a5" font-family="Menlo, Consolas, monospace" font-size="17">ORA-20101: Authorization header must be Bearer &lt;key&gt;</text>
<text x="628" y="522" fill="#c7d2fe" font-family="Menlo, Consolas, monospace" font-size="17">해석: ORDS Handler 필수값 차단</text>
<text x="60" y="590" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== Case D. Bearer Key가 틀리거나 만료됨 ===</text>
<text x="60" y="632" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">Authorization: Bearer invalid_key</text>
<text x="60" y="670" fill="#fca5a5" font-family="Menlo, Consolas, monospace" font-size="17">ORA-20002: Invalid or expired Bearer key</text>
<text x="472" y="670" fill="#c7d2fe" font-family="Menlo, Consolas, monospace" font-size="17">해석: Key Hash 매핑 실패, Context 초기화</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.2 KiB

29
docs/assets/agent-ords-security-permission-mapping-screen.svg Normal file
View File

@@ -0,0 +1,29 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="760" viewBox="0 0 1280 760" role="img" aria-labelledby="title desc">
<title id="title">권한 등록 매핑 화면</title>
<desc id="desc">Bearer Key 사용자를 Role, Permission, 행 규칙으로 등록하는 운영 화면.</desc>
<rect width="1280" height="760" fill="#f4f6f8"/>
<rect x="36" y="30" width="1208" height="700" rx="10" fill="#111827"/>
<circle cx="70" cy="58" r="7" fill="#ef4444"/>
<circle cx="94" cy="58" r="7" fill="#f59e0b"/>
<circle cx="118" cy="58" r="7" fill="#22c55e"/>
<text x="152" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">ADMIN - Agent 권한 등록 매핑</text>
<text x="60" y="112" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 1. 내부 사용자와 Bearer Key 등록 ===</text>
<text x="60" y="154" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">APP_USER: USER_ID=101, USER_NAME=agent_hr, EMP_NO=E10234, DEPT_CODE=HR, READ_CONTENTS=N</text>
<text x="60" y="188" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">AGENT_BEARER_KEY: KEY_ID=1, USER_ID=101, KEY_HASH=SHA256(cb_hr_key), ACTIVE=Y</text>
<text x="60" y="244" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 2. 사용자 -> 역할 -> 보호 객체 권한 ===</text>
<text x="60" y="286" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">USER_ROLE: USER_ID=101 -> ROLE_ID=10</text>
<text x="60" y="320" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">APP_ROLE: ROLE_ID=10 -> HR_SEARCH_ROLE</text>
<text x="60" y="354" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">PERMISSION: ROLE_ID=10 -> TARGET_NAME=CB_V_SEARCH_DOCUMENTS, ACTION=SELECT</text>
<text x="60" y="410" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 3. 행 / 컬럼 제한 ===</text>
<text x="60" y="452" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">PERMISSION_RULE: PERM_ID=100, RULE_TYPE=MY_DEPT, RULE_VALUE=HR</text>
<text x="60" y="486" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="17">COLUMN RULE: APP_USER.CAN_READ_CONTENTS=N -> DBMS_REDACT가 CONTENTS를 NULL 처리</text>
<text x="60" y="542" fill="#bfdbfe" font-family="Menlo, Consolas, monospace" font-size="20">=== 4. 조회 시 VPD 매칭 ===</text>
<text x="60" y="584" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="17">p_object=CB_V_SEARCH_DOCUMENTS</text>
<text x="60" y="618" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="17">permission.target_name=CB_V_SEARCH_DOCUMENTS</text>
<text x="60" y="652" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="17">rule_type=MY_DEPT + SYS_CONTEXT(DEPT_CODE)=HR -> HR 행만 반환</text>
<text x="60" y="696" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="18">결과: Key User의 role/permission/rule이 있어야 행이 반환됨</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.0 KiB

60
docs/assets/agent-ords-security-sys-context-flow.svg Normal file
View File

@@ -0,0 +1,60 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="700" viewBox="0 0 1280 700" role="img" aria-labelledby="title desc">
<title id="title">SYS_CONTEXT 동작 방식</title>
<desc id="desc">ORDS 처리 로직이 DB 세션에 값을 저장하고 VPD 함수가 SYS_CONTEXT로 값을 읽어 EXISTS 권한 조회에 사용하는 흐름.</desc>
<rect width="1280" height="700" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 39px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 21px; fill: #475569; }
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.blue { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
.purple { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
.green { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 24px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 18px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
.arrow { stroke: #475569; stroke-width: 2.5; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="48" y="58" class="h1">SYS_CONTEXT 동작 방식</text>
<text x="48" y="94" class="sub">현재 DB 세션에 저장된 요청자 값을 읽어 권한 테이블 EXISTS 조회에 사용</text>
<rect x="48" y="142" width="320" height="152" rx="16" class="blue"/>
<text x="76" y="184" class="title">1. ORDS 처리 로직</text>
<text x="76" y="224" class="text">DB 계정 또는 Bearer Key로</text>
<text x="76" y="252" class="text">요청자를 식별</text>
<line x1="368" y1="218" x2="438" y2="218" class="arrow"/>
<rect x="450" y="142" width="360" height="152" rx="16" class="purple"/>
<text x="478" y="184" class="title">2. DB 세션에 값 저장</text>
<text x="478" y="224" class="mono">DBMS_SESSION.SET_CONTEXT</text>
<text x="478" y="252" class="mono">AGENT_CTX.EMP_NO = E10234</text>
<text x="478" y="278" class="mono">AGENT_CTX.DEPT_CODE = HR</text>
<line x1="810" y1="218" x2="850" y2="218" class="arrow"/>
<rect x="862" y="142" width="370" height="152" rx="10" class="green"/>
<text x="890" y="184" class="title">3. EXISTS 조회에 사용</text>
<text x="890" y="224" class="mono">SYS_CONTEXT('AGENT_CTX','EMP_NO')</text>
<text x="890" y="252" class="mono">SYS_CONTEXT('AGENT_CTX','DEPT_CODE')</text>
<rect x="118" y="380" width="500" height="126" rx="10" class="card"/>
<text x="150" y="424" class="title">같은 DB 세션 안에서만 유효</text>
<text x="150" y="462" class="text">요청마다 기존 값을 지우고 새 값을 저장</text>
<text x="150" y="490" class="text">다른 요청자 정보가 섞이지 않도록 처리</text>
<rect x="682" y="380" width="500" height="126" rx="10" class="warn"/>
<text x="714" y="424" class="title">직접 조작 방지</text>
<text x="714" y="462" class="text">CONTEXT는 지정된 패키지를 통해서만 설정</text>
<text x="714" y="490" class="text">일반 사용자가 임의로 값을 바꾸지 못하게 구성</text>
<rect x="220" y="574" width="840" height="54" rx="14" fill="#eef2ff" stroke="#4f46e5" stroke-width="2.5"/>
<text x="250" y="609" class="title">요점: SET_CONTEXT는 저장, SYS_CONTEXT는 조회, EXISTS가 권한 판단</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.6 KiB

105
docs/assets/agent-ords-security-two-scenarios.svg Normal file
View File

@@ -0,0 +1,105 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="800" viewBox="0 0 1280 800" role="img" aria-labelledby="title desc">
<title id="title">두 가지 사용자 식별 및 권한 매핑 시나리오</title>
<desc id="desc">DB User 기반과 Bearer Key 기반의 사용자 식별 차이와 공통 DB 보안 적용 흐름.</desc>
<rect width="1280" height="800" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 36px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
.panel { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.panel-a { fill: #f8fbff; stroke: #2563eb; stroke-width: 2; }
.panel-b { fill: #fffaf5; stroke: #ea580c; stroke-width: 2; }
.shared { fill: #f7f5ff; stroke: #7c3aed; stroke-width: 2; }
.result { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 24px; font-weight: 700; fill: #0f172a; }
.label { font-family: Arial, Helvetica, sans-serif; font-size: 18px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
.small { font-family: Arial, Helvetica, sans-serif; font-size: 16px; fill: #475569; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
.warn { font-family: Arial, Helvetica, sans-serif; font-size: 16px; font-weight: 700; fill: #b91c1c; }
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="48" y="58" class="h1">두 가지 사용자 식별 시나리오</text>
<text x="48" y="94" class="sub">사용자 식별 방식은 다르고, 권한 적용은 DB 보안 정책에서 동일하게 수행</text>
<rect x="48" y="128" width="572" height="292" rx="10" class="panel-a"/>
<text x="76" y="176" class="title">시나리오 1 - DB User 기반</text>
<rect x="76" y="204" width="156" height="118" rx="10" class="panel"/>
<text x="96" y="240" class="label">DB 접속 계정</text>
<text x="96" y="276" class="mono">SESSION_USER</text>
<text x="96" y="304" class="mono">AGENT_HR_001</text>
<line x1="232" y1="263" x2="270" y2="263" class="arrow"/>
<rect x="276" y="204" width="164" height="118" rx="10" class="panel"/>
<text x="296" y="240" class="label">사용자 매핑</text>
<text x="296" y="276" class="mono">app_user</text>
<text x="296" y="304" class="mono">user_role</text>
<line x1="440" y1="263" x2="478" y2="263" class="arrow"/>
<rect x="484" y="204" width="88" height="118" rx="10" class="panel"/>
<text x="506" y="240" class="label">식별</text>
<text x="504" y="276" class="mono">사번</text>
<text x="504" y="304" class="mono">부서</text>
<rect x="76" y="346" width="496" height="42" rx="8" fill="#eff6ff" stroke="#bfdbfe" stroke-width="2"/>
<text x="96" y="374" class="small">DB 계정별 권한 등록. DBA가 사용자-역할-권한 테이블 관리</text>
<rect x="660" y="128" width="572" height="292" rx="10" class="panel-b"/>
<text x="688" y="176" class="title">시나리오 2 - Bearer Key 기반</text>
<rect x="688" y="204" width="156" height="118" rx="10" class="panel"/>
<text x="708" y="240" class="label">ORDS Header</text>
<text x="708" y="276" class="mono">Bearer Key</text>
<text x="708" y="304" class="warn">없으면 차단</text>
<line x1="844" y1="263" x2="882" y2="263" class="arrow"/>
<rect x="888" y="204" width="164" height="118" rx="10" class="panel"/>
<text x="908" y="240" class="label">Key 검증</text>
<text x="908" y="276" class="mono">key_hash</text>
<text x="908" y="304" class="mono">agent_key</text>
<line x1="1052" y1="263" x2="1090" y2="263" class="arrow"/>
<rect x="1096" y="204" width="88" height="118" rx="10" class="panel"/>
<text x="1118" y="240" class="label">식별</text>
<text x="1116" y="276" class="mono">사번</text>
<text x="1116" y="304" class="mono">부서</text>
<rect x="688" y="346" width="496" height="42" rx="8" fill="#fff7ed" stroke="#fed7aa" stroke-width="2"/>
<text x="708" y="374" class="small">ORDS 처리 로직이 Header 값을 받아 내부 사용자로 매핑</text>
<path d="M 334 420 C 334 452, 438 468, 520 492" class="arrow"/>
<path d="M 946 420 C 946 452, 842 468, 760 492" class="arrow"/>
<rect x="178" y="494" width="430" height="110" rx="10" class="shared"/>
<text x="214" y="538" class="title">현재 요청 사용자 정보</text>
<text x="214" y="574" class="text">USER_ID / 사번 / 부서 저장</text>
<rect x="672" y="494" width="450" height="110" rx="10" class="shared"/>
<text x="708" y="538" class="title">보호 객체 조회</text>
<text x="708" y="574" class="text">VIEW 또는 TABLE에 연결된 정책 적용</text>
<line x1="640" y1="604" x2="640" y2="636" class="arrow"/>
<rect x="178" y="638" width="450" height="76" rx="14" class="shared"/>
<text x="212" y="684" class="label">VPD: WHERE 조건 자동 추가</text>
<rect x="672" y="638" width="450" height="76" rx="14" class="shared"/>
<text x="706" y="684" class="label">DDS: DATA GRANT WHERE 적용</text>
<line x1="628" y1="676" x2="672" y2="676" class="arrow"/>
<line x1="640" y1="714" x2="640" y2="732" class="arrow"/>
<rect x="420" y="730" width="440" height="48" rx="12" class="result"/>
<text x="512" y="762" class="label">결과: 권한 범위 데이터만 반환</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 5.6 KiB

22
docs/assets/agent-ords-security-vpd-screen.svg Normal file
View File

@@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-labelledby="title desc">
<title id="title">VPD 결과 화면</title>
<desc id="desc">VPD 행 필터링과 우회 시도 차단 결과를 요약한 화면.</desc>
<rect width="1120" height="620" fill="#f4f6f8"/>
<rect x="34" y="30" width="1052" height="560" rx="10" fill="#111827"/>
<circle cx="68" cy="58" r="7" fill="#ef4444"/>
<circle cx="92" cy="58" r="7" fill="#f59e0b"/>
<circle cx="116" cy="58" r="7" fill="#22c55e"/>
<text x="150" y="64" fill="#d1d5db" font-family="Menlo, Consolas, monospace" font-size="18">sqlplus - VPD 보안 정책 테스트</text>
<text x="58" y="112" fill="#93c5fd" font-family="Menlo, Consolas, monospace" font-size="20">=== DB 세션과 Key User Context ===</text>
<text x="58" y="154" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">DB_USER KEY_USER_ID EMP_NO DEPT_CODE READ_CONTENTS</text>
<text x="58" y="188" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">CB_ORDS 101 E10234 HR N</text>
<text x="58" y="246" fill="#93c5fd" font-family="Menlo, Consolas, monospace" font-size="20">=== CB_V_SEARCH_DOCUMENTS 조회 결과 ===</text>
<text x="58" y="288" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">KEY ROWS_VISIBLE CONTENTS</text>
<text x="58" y="322" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">cb_hr_key 3 NULL</text>
<text x="58" y="356" fill="#f9fafb" font-family="Menlo, Consolas, monospace" font-size="18">cb_all_key 6 원문 표시</text>
<text x="58" y="414" fill="#93c5fd" font-family="Menlo, Consolas, monospace" font-size="20">=== 우회 시도 결과 ===</text>
<text x="58" y="456" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">read ADMIN.CB_SEARCH_DOCUMENTS - ORA-00942</text>
<text x="58" y="490" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">read ADMIN.CB_AGENT_BEARER_KEY - ORA-00942</text>
<text x="58" y="524" fill="#e5e7eb" font-family="Menlo, Consolas, monospace" font-size="18">Invalid Bearer Key - ORA-20002</text>
<text x="58" y="558" fill="#86efac" font-family="Menlo, Consolas, monospace" font-size="18">결과: Agent가 아니라 DB가 최종 필터링</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 2.4 KiB

73
docs/assets/agent-ords-security-vpd-where-flow.svg Normal file
View File

@@ -0,0 +1,73 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="760" viewBox="0 0 1280 760" role="img" aria-labelledby="title desc">
<title id="title">VPD EXISTS 권한 조건 적용 흐름</title>
<desc id="desc">ORDS 조회 SQL에 VPD가 p_object 기준 EXISTS 권한 조건을 추가해 VIEW/TABLE 접근과 행 접근을 판단하는 흐름.</desc>
<rect width="1280" height="760" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 36px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
.panel { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.blue { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
.purple { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
.green { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 23px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 18px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 17px; fill: #0f172a; }
.mono-small { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
.arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="48" y="58" class="h1">VPD: EXISTS로 권한 테이블 확인</text>
<text x="48" y="94" class="sub">p_object는 현재 조회 대상, SYS_CONTEXT는 요청자 식별값, EXISTS는 실제 권한 판단</text>
<rect x="48" y="138" width="360" height="276" rx="10" class="blue"/>
<text x="76" y="184" class="title">1. ORDS가 실행한 SQL</text>
<text x="76" y="228" class="text">권한 조건 없음</text>
<text x="76" y="278" class="mono">SELECT doc_id, title</text>
<text x="76" y="306" class="mono">FROM app.v_search_documents</text>
<text x="76" y="334" class="mono">WHERE contains_text = :q;</text>
<line x1="408" y1="276" x2="468" y2="276" class="arrow"/>
<rect x="480" y="138" width="360" height="276" rx="10" class="purple"/>
<text x="508" y="184" class="title">2. VPD 정책 함수</text>
<text x="508" y="226" class="text">조회 대상과 요청자 확인</text>
<text x="508" y="264" class="mono">p_object = 현재 VIEW/TABLE</text>
<text x="508" y="292" class="mono">USER_ID = SYS_CONTEXT(...)</text>
<text x="508" y="344" class="mono-small">RETURN EXISTS (...)</text>
<text x="508" y="370" class="mono-small">target_name = p_object</text>
<line x1="840" y1="276" x2="900" y2="276" class="arrow"/>
<rect x="912" y="138" width="360" height="276" rx="10" class="green"/>
<text x="940" y="184" class="title">3. DB가 합쳐서 적용</text>
<text x="940" y="226" class="text">조회 SQL 뒤에 권한 조건 추가</text>
<text x="940" y="276" class="mono-small">WHERE contains_text = :q</text>
<text x="940" y="304" class="mono-small">AND EXISTS (</text>
<text x="940" y="332" class="mono-small"> permission.target = p_object</text>
<text x="940" y="360" class="mono-small"> row rule matched)</text>
<rect x="74" y="486" width="360" height="118" rx="10" class="panel"/>
<text x="106" y="530" class="title">VIEW/TABLE 접근 판단</text>
<text x="106" y="568" class="text">target_name = p_object</text>
<text x="106" y="594" class="text">없으면 결과 0건</text>
<rect x="460" y="486" width="360" height="118" rx="10" class="panel"/>
<text x="492" y="530" class="title">행 접근 판단</text>
<text x="492" y="568" class="text">permission_rule이 행 컬럼과 일치</text>
<text x="492" y="594" class="text">조건에 맞는 행만 반환</text>
<rect x="846" y="486" width="360" height="118" rx="10" class="warn"/>
<text x="878" y="530" class="title">권한 매핑 없음</text>
<text x="878" y="568" class="text">EXISTS가 false</text>
<text x="878" y="594" class="text">해당 행은 제외</text>
<rect x="190" y="650" width="900" height="58" rx="10" fill="#eef2ff" stroke="#4f46e5" stroke-width="2"/>
<text x="236" y="686" class="title">요점: p_object는 조회 대상, SYS_CONTEXT는 요청자, EXISTS가 권한 판단</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 4.4 KiB