Consolidate data access control backoffice updates

docs/assets/agent-ords-security-dds-bearer-probe.svg

@@ -0,0 +1,72 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1240" height="700" viewBox="0 0 1240 700" role="img" aria-labelledby="title desc">
+  <title id="title">DDS Bearer Key 처리 검증</title>
+  <desc id="desc">ORDS Handler가 Bearer Key를 읽어도 DDS EndUserSecurityContext가 붙지 않으면 DATA GRANT가 Key 사용자를 인식하지 못하는 흐름.</desc>
+  <rect width="1240" height="700" fill="#f8fafc"/>
+  <defs>
+    <marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
+      <path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
+    </marker>
+    <style>
+      .h1 { font-family: Arial, Helvetica, sans-serif; font-size: 35px; font-weight: 700; fill: #0f172a; }
+      .sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
+      .title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
+      .text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
+      .mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
+      .mono-small { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
+      .card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2.2; }
+      .ok { fill: #ecfdf5; stroke: #059669; stroke-width: 2.2; }
+      .warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2.2; }
+      .bad { fill: #fef2f2; stroke: #dc2626; stroke-width: 2.2; }
+      .driver { fill: #eff6ff; stroke: #2563eb; stroke-width: 2.2; }
+      .arrow { stroke: #475569; stroke-width: 2.2; marker-end: url(#arrow); fill: none; }
+      .dash { stroke: #94a3b8; stroke-width: 2.2; stroke-dasharray: 8 7; marker-end: url(#arrow); fill: none; }
+    </style>
+  </defs>
+
+  <text x="42" y="56" class="h1">DDS Bearer Key 검증 결과</text>
+  <text x="42" y="90" class="sub">ORDS Handler의 Header 매핑과 DDS EndUserSecurityContext 전파는 별도 단계</text>
+
+  <rect x="42" y="126" width="320" height="122" rx="10" class="card"/>
+  <text x="68" y="166" class="title">1. Agent 요청</text>
+  <text x="68" y="204" class="mono">Authorization:</text>
+  <text x="68" y="230" class="mono">Bearer cb_hr_key</text>
+
+  <line x1="362" y1="187" x2="432" y2="187" class="arrow"/>
+
+  <rect x="448" y="126" width="344" height="122" rx="10" class="ok"/>
+  <text x="474" y="166" class="title">2. ORDS Handler</text>
+  <text x="474" y="204" class="text">Header 필수값 확인</text>
+  <text x="474" y="230" class="text">Key를 내부 사용자로 매핑</text>
+
+  <line x1="792" y1="187" x2="862" y2="187" class="arrow"/>
+
+  <rect x="878" y="126" width="320" height="122" rx="10" class="warn"/>
+  <text x="904" y="166" class="title">3. DB Session</text>
+  <text x="904" y="204" class="mono">SESSION_USER = CB_ORDS</text>
+  <text x="904" y="230" class="mono">DDS username = null</text>
+
+  <path d="M 1038 248 C 1038 302, 620 302, 620 346" class="arrow"/>
+
+  <rect x="448" y="346" width="344" height="142" rx="10" class="bad"/>
+  <text x="474" y="386" class="title">검증된 차단 결과</text>
+  <text x="474" y="424" class="mono-small">mapped_end_user=cb_dds_hr</text>
+  <text x="474" y="452" class="mono">dds_context_username=null</text>
+  <text x="474" y="480" class="mono">ORA-00942 / EXPECTED_BLOCKED</text>
+
+  <path d="M 448 417 C 344 417, 318 312, 250 260" class="dash"/>
+  <text x="82" y="310" class="text">Key 사용자명을 변수로</text>
+  <text x="82" y="335" class="text">보관하는 것만으로는</text>
+  <text x="82" y="360" class="text">DDS 사용자가 되지 않음</text>
+
+  <rect x="42" y="540" width="530" height="104" rx="10" class="driver"/>
+  <text x="68" y="580" class="title">DDS로 Bearer 적용 시 필요한 경로</text>
+  <text x="68" y="610" class="text">지원 드라이버 또는 호출 앱 계층이</text>
+  <text x="68" y="634" class="text">DB 호출 전에 EndUserSecurityContext Attach</text>
+
+  <line x1="572" y1="592" x2="642" y2="592" class="arrow"/>
+
+  <rect x="658" y="540" width="540" height="104" rx="10" class="ok"/>
+  <text x="684" y="580" class="title">DDS DATA GRANT 적용</text>
+  <text x="684" y="610" class="text">DB가 End-user Identity와 DATA ROLE 인식</text>
+  <text x="684" y="634" class="text">보호 객체(VIEW/TABLE) 조회 허용</text>
+</svg>