Consolidate data access control backoffice updates

src/test/java/com/cloudhandson/vpdbackoffice/service/SecuritySqlScriptServiceTest.java

@@ -0,0 +1,35 @@
+package com.cloudhandson.vpdbackoffice.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import org.junit.jupiter.api.Test;
+
+class SecuritySqlScriptServiceTest {
+
+  private final SecuritySqlScriptService service = new SecuritySqlScriptService();
+
+  @Test
+  void exposesOnlyTheCuratedGitTrackedSecurityScripts() {
+    assertThat(service.list())
+        .extracting(item -> item.fileName())
+        .containsExactly(
+            "62_kb_aso_masking_backoffice_metadata.sql",
+            "63_kb_aso_masking_rule_runtime.sql",
+            "64_kb_aso_masking_default_column_rules.sql",
+            "65_kb_select_ai_vpd_query_api.sql",
+            "66_kb_select_ai_vpd_query_ords.sql"
+        );
+
+    assertThat(service.find("select-ai-vpd-ords").source())
+        .contains("POST /ords/cb-ords/kb-select-ai-vpd/query")
+        .contains("Authorization: Bearer <VPD token>");
+  }
+
+  @Test
+  void rejectsUnknownScriptIdsInsteadOfResolvingAPathFromRequestInput() {
+    assertThatThrownBy(() -> service.find("../../etc/passwd"))
+        .isInstanceOf(AppException.class)
+        .hasMessageContaining("조회할 수 없는");
+  }
+}