Consolidate data access control backoffice updates

sql/adb/64_kb_aso_masking_default_column_rules.sql

@@ -0,0 +1,54 @@
+-- ============================================================
+-- 64_kb_aso_masking_default_column_rules.sql
+--
+-- Initial blacklist of KB columns subject to ASO masking.
+-- Run as ADMIN after 62. Execute 63 afterwards to apply the
+-- configured rules as DBMS_REDACT policies.
+-- ============================================================
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET DEFINE OFF
+SET FEEDBACK ON
+
+PROMPT === Assigning the KB masking target blacklist ===
+MERGE INTO cb_column_masking_rule dst
+USING (
+  SELECT protected_column.column_id,
+         masking_rule.rule_id
+  FROM cb_protected_column protected_column
+  JOIN cb_protected_object protected_object
+    ON protected_object.object_id = protected_column.object_id
+  JOIN cb_masking_rule masking_rule
+    ON masking_rule.rule_code = CASE
+      WHEN protected_object.object_name = 'KB_CUSTOMERS'
+       AND protected_column.column_name = 'RRN_MASKED'
+        THEN 'MASK_RRN_PARTIAL'
+      ELSE 'MASK_NULLIFY'
+    END
+  WHERE (protected_object.object_name = 'KB_CUSTOMERS'
+         AND protected_column.column_name IN ('RRN_MASKED'))
+     OR (protected_object.object_name = 'KB_CLAIMS'
+         AND protected_column.column_name IN ('CLAIM_AMT', 'PAID_AMT'))
+     OR (protected_object.object_name = 'KB_EXTERNAL_HOLDINGS'
+         AND protected_column.column_name IN ('EXT_INSURER', 'EXT_PRODUCT_GRP', 'EXT_PRODUCT_TYPE'))
+) src
+ON (dst.column_id = src.column_id)
+WHEN MATCHED THEN
+  UPDATE SET dst.rule_id = src.rule_id, dst.updated_at = SYSTIMESTAMP
+WHEN NOT MATCHED THEN
+  INSERT (column_id, rule_id, updated_at)
+  VALUES (src.column_id, src.rule_id, SYSTIMESTAMP);
+COMMIT;
+
+PROMPT === Configured masking target blacklist ===
+SELECT protected_object.owner,
+       protected_object.object_name,
+       protected_column.column_name,
+       masking_rule.rule_code,
+       masking_rule.rule_name,
+       masking_rule.template_code
+FROM cb_column_masking_rule link
+JOIN cb_protected_column protected_column ON protected_column.column_id = link.column_id
+JOIN cb_protected_object protected_object ON protected_object.object_id = protected_column.object_id
+JOIN cb_masking_rule masking_rule ON masking_rule.rule_id = link.rule_id
+ORDER BY protected_object.object_name, protected_column.column_name;
+EXIT