Consolidate data access control backoffice updates

scripts/enqueue.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# 새 작업을 파이프라인 큐에 투입 = 01-Planner/신규 Redmine 이슈 생성.
+# 사용법: ./scripts/enqueue.sh "제목" ["요구사항"]
+set -euo pipefail
+cd "$(dirname "$0")/.."
+set -a; . ./.env; set +a
+SUBJECT="${1:?사용법: enqueue.sh \"제목\" [\"요구\"]}"; BODY="${2:-}"
+PLANNER=$(curl -s -H "X-Redmine-API-Key: $REDMINE_API_KEY" \
+  "$REDMINE_URL/projects/$REDMINE_PROJECT/issue_categories.json" \
+  | python3 -c "import sys,json;[print(c['id']) for c in json.load(sys.stdin)['issue_categories'] if c['name']=='01-Planner']")
+DESC=$(printf '## [AI] Planner\n\n(요구사항)\n%s\n\n---\nWorking dir: %s' "$BODY" "$(pwd)")
+python3 - "$REDMINE_URL" "$REDMINE_API_KEY" "$REDMINE_PROJECT" "$SUBJECT" "$DESC" "$PLANNER" <<'PY'
+import sys,json,urllib.request
+base,key,proj,subject,desc,cat=sys.argv[1:7]
+p={"issue":{"project_id":proj,"tracker_id":2,"subject":subject,"description":desc,
+   "category_id":int(cat),"status_id":1}}
+r=urllib.request.Request(base+"/issues.json",data=json.dumps(p).encode(),
+  headers={"X-Redmine-API-Key":key,"Content-Type":"application/json"},method="POST")
+i=json.load(urllib.request.urlopen(r))["issue"]
+print(f"enqueued #{i['id']}: {i['subject']} -> 01-Planner/신규")
+PY

scripts/provision-dds-token-search.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Provisions the single DDS technical END USER used by business-user searches.
+# Required environment: DDS_ADMIN_DB_URL, DDS_ADMIN_USERNAME,
+# DDS_ADMIN_PASSWORD, DDS_TOKEN_PASSWORD.
+set -Eeuo pipefail
+
+: "${DDS_ADMIN_DB_URL:?set DDS_ADMIN_DB_URL}"
+: "${DDS_ADMIN_USERNAME:?set DDS_ADMIN_USERNAME}"
+: "${DDS_ADMIN_PASSWORD:?set DDS_ADMIN_PASSWORD}"
+: "${DDS_TOKEN_PASSWORD:?set DDS_TOKEN_PASSWORD}"
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+connect="${DDS_ADMIN_USERNAME}/${DDS_ADMIN_PASSWORD}@${DDS_ADMIN_DB_URL}"
+
+sqlplus -s "$connect" <<SQL
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+DEFINE DDSUSER_TOKEN_PASSWORD = '${DDS_TOKEN_PASSWORD}'
+@${root}/sql/adb/34_dds_token_data_grant_common_auth.sql
+@${root}/sql/adb/42_dds_fga_execution_evidence.sql
+
+PROMPT === DDS token search verification ===
+SELECT username FROM dba_users WHERE username = 'dds_demo_token';
+SELECT grant_name, object_name, grantee
+  FROM dba_data_grants
+ WHERE grant_name = 'DDS_DEMO_TOKEN_VECTOR_GRANT';
+EXIT
+SQL
+
+echo 'Provisioning completed. Configure only these server Secret values:'
+echo '  DDS_BACKOFFICE_DB_URL=<DB JDBC URL>'
+echo '  DDS_BACKOFFICE_TOKEN_USERNAME=dds_demo_token'
+echo '  DDS_BACKOFFICE_TOKEN_PASSWORD=<DDS_TOKEN_PASSWORD value>'

scripts/run_agent_ords_security_adb_local.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# ============================================================
+# Agent ORDS security ADB local-only executable example.
+#
+# This script does not call RDS, DB Link, Postgres, or MySQL.
+# It creates local ADB tables/views and verifies VPD + DDS.
+# ============================================================
+set -Eeuo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+if [[ ! -f "$ROOT/.env" ]]; then
+  echo "[FAIL] .env not found. Copy .env.example to .env and fill ADB_* values." >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1091
+. "$ROOT/.env"
+set +a
+
+run_admin() {
+  local sql_file="$1"
+  echo
+  echo "[ADMIN] @$sql_file"
+  sqlplus -S -L "${ADB_USER}/${ADB_PASSWORD}@${ADB_TNS}" @"$sql_file"
+}
+
+run_as() {
+  local user="$1" password="$2" sql_file="$3"
+  echo
+  echo "[$user] @$sql_file"
+  sqlplus -S -L "${user}/${password}@${ADB_TNS}" @"$sql_file"
+}
+
+run_admin "$ROOT/sql/adb/16_agent_ords_security_local_cleanup.sql"
+run_admin "$ROOT/sql/adb/17_agent_ords_security_local_vpd_setup.sql"
+run_admin "$ROOT/sql/adb/19_agent_ords_security_local_dds_setup.sql"
+run_admin "$ROOT/sql/adb/21_agent_ords_security_ords_enable_schema.sql"
+run_as "cb_ords" "CbOrdS#2026Local1" "$ROOT/sql/adb/22_agent_ords_security_ords_handler_setup.sql"
+run_admin "$ROOT/sql/adb/24_agent_ords_security_inventory.sql"
+
+run_as "cb_ords" "CbOrdS#2026Local1" "$ROOT/sql/adb/18_agent_ords_security_local_vpd_test.sql"
+run_as "cb_ords" "CbOrdS#2026Local1" "$ROOT/sql/adb/23_agent_ords_security_ords_handler_test.sql"
+
+run_as '"cb_dds_hr"' "CbDds#Hr2026Local1" "$ROOT/sql/adb/20_agent_ords_security_local_dds_test.sql"
+run_as '"cb_dds_fin"' "CbDds#Fin2026Local1" "$ROOT/sql/adb/20_agent_ords_security_local_dds_test.sql"
+run_as '"cb_dds_all"' "CbDds#All2026Local1" "$ROOT/sql/adb/20_agent_ords_security_local_dds_test.sql"
+run_as '"cb_dds_none"' "CbDds#None2026Local1" "$ROOT/sql/adb/20_agent_ords_security_local_dds_test.sql"
+
+echo
+echo "[OK] Agent ORDS security ADB local-only VPD + DDS executable example complete"