refs #741 #742: reorganize repository by application

database/adb/02_perm_tables.sql

@@ -0,0 +1,56 @@
+-- ============================================================
+-- 01_perm_tables.sql
+-- Permission model (the "policy plane"). All tables live in ADMIN.
+-- Run as ADMIN.
+-- ============================================================
+SET ECHO OFF
+SET FEEDBACK ON
+
+PROMPT === Creating permission-model tables ===
+
+CREATE TABLE app_customer (
+  customer_id   NUMBER       PRIMARY KEY,
+  customer_name VARCHAR2(80) NOT NULL UNIQUE
+);
+
+CREATE TABLE app_user (
+  user_id       NUMBER       PRIMARY KEY,
+  db_username   VARCHAR2(30) NOT NULL UNIQUE,   -- matches Oracle SESSION_USER (UPPER)
+  customer_id   NUMBER       NOT NULL REFERENCES app_customer(customer_id),
+  active        CHAR(1)      DEFAULT 'Y' CHECK (active IN ('Y','N'))
+);
+
+CREATE TABLE app_group (
+  group_id      NUMBER       PRIMARY KEY,
+  customer_id   NUMBER       NOT NULL REFERENCES app_customer(customer_id),
+  group_name    VARCHAR2(60) NOT NULL,
+  UNIQUE (customer_id, group_name)
+);
+
+CREATE TABLE user_group (
+  user_id       NUMBER NOT NULL REFERENCES app_user(user_id),
+  group_id      NUMBER NOT NULL REFERENCES app_group(group_id),
+  PRIMARY KEY (user_id, group_id)
+);
+
+CREATE TABLE db_source (
+  source_id     NUMBER       PRIMARY KEY,
+  source_name   VARCHAR2(60) NOT NULL UNIQUE,   -- e.g. RDS_POSTGRES, RDS_MYSQL
+  source_type   VARCHAR2(30) NOT NULL,          -- 'DBLINK_PG','DBLINK_MY','EXTERNAL_TABLE',...
+  dblink_name   VARCHAR2(128)
+);
+
+-- Each permission row says: this group, on this object of this source,
+-- is allowed to see rows where region is in `allowed_regions`.
+-- Convention: '*' means no restriction (full access).
+CREATE TABLE permission (
+  perm_id          NUMBER        PRIMARY KEY,
+  group_id         NUMBER        NOT NULL REFERENCES app_group(group_id),
+  source_id        NUMBER        NOT NULL REFERENCES db_source(source_id),
+  object_name      VARCHAR2(60)  NOT NULL,   -- the local view name, e.g. 'V_CUSTOMERS_PG'
+  allowed_regions  VARCHAR2(200) NOT NULL,   -- CSV: 'KR,APAC' or '*'
+  UNIQUE (group_id, source_id, object_name)
+);
+
+PROMPT === Permission tables created ===
+EXIT;