refs #741 #742: reorganize repository by application

database/adb/03_seed.sql

@@ -0,0 +1,87 @@
+-- ============================================================
+-- 03_seed.sql
+-- Seed FOUR end-users to demonstrate a 2x2 source-access matrix:
+--
+--   user           PG view      MySQL view    VPD predicate effect
+--   -------------  -----------  ------------  ---------------------------
+--   VPDUSER_MY     blocked      ALL rows      PG='1=0'   / MY=NULL(='*')
+--   VPDUSER_PG     ALL rows     blocked       PG=NULL    / MY='1=0'
+--   VPDUSER_BOTH   ALL rows     ALL rows      PG=NULL    / MY=NULL
+--   VPDUSER_NONE   blocked      blocked       PG='1=0'   / MY='1=0'
+--
+-- The `permission` table grants per (group, source/view).
+-- For this simplified demo every grant uses allowed_regions='*'
+-- (full visibility within the source). Row-level region filtering
+-- is still supported by the policy function — see commented examples
+-- at the bottom of this file for how to layer it in.
+--
+-- Run as ADMIN.
+-- ============================================================
+SET ECHO OFF
+SET FEEDBACK ON
+
+PROMPT === Seeding permission data ===
+
+-- Tenant (kept generic — multi-tenant hook for future use).
+INSERT INTO app_customer (customer_id, customer_name) VALUES (1, 'Acme Corp');
+
+-- Four end-users, each Oracle SESSION_USER value (uppercased).
+INSERT INTO app_user (user_id, db_username, customer_id) VALUES (1, 'VPDUSER_MY',   1);
+INSERT INTO app_user (user_id, db_username, customer_id) VALUES (2, 'VPDUSER_PG',   1);
+INSERT INTO app_user (user_id, db_username, customer_id) VALUES (3, 'VPDUSER_BOTH', 1);
+INSERT INTO app_user (user_id, db_username, customer_id) VALUES (4, 'VPDUSER_NONE', 1);
+
+-- One group per access pattern (1:1 in this demo; in production one
+-- group typically aggregates many users).
+INSERT INTO app_group (group_id, customer_id, group_name) VALUES (10, 1, 'MY_ONLY');
+INSERT INTO app_group (group_id, customer_id, group_name) VALUES (20, 1, 'PG_ONLY');
+INSERT INTO app_group (group_id, customer_id, group_name) VALUES (30, 1, 'BOTH_SOURCES');
+-- (No group is needed for VPDUSER_NONE — absence of grants == fail-closed.)
+
+-- (VPDUSER_NONE deliberately has no user_group row -> fail-closed.)
+INSERT INTO user_group (user_id, group_id) VALUES (1, 10);
+INSERT INTO user_group (user_id, group_id) VALUES (2, 20);
+INSERT INTO user_group (user_id, group_id) VALUES (3, 30);
+
+-- Source registry.
+INSERT INTO db_source (source_id, source_name, source_type, dblink_name)
+  VALUES (100, 'RDS_POSTGRES', 'DBLINK_PG', 'RDS_POSTGRES_LINK');
+INSERT INTO db_source (source_id, source_name, source_type, dblink_name)
+  VALUES (200, 'RDS_MYSQL',    'DBLINK_MY', 'RDS_LINK');
+
+-- Permissions: '*' means no row filter (full visibility on that view).
+-- Mapping (group -> view):
+--   MY_ONLY(10)      -> V_CUSTOMERS_MY
+--   PG_ONLY(20)      -> V_CUSTOMERS_PG
+--   BOTH_SOURCES(30) -> V_CUSTOMERS_PG + V_CUSTOMERS_MY
+-- (VPDUSER_NONE has no group, hence no permission row.)
+INSERT INTO permission (perm_id, group_id, source_id, object_name, allowed_regions)
+  VALUES (1, 10, 200, 'V_CUSTOMERS_MY', '*');
+INSERT INTO permission (perm_id, group_id, source_id, object_name, allowed_regions)
+  VALUES (2, 20, 100, 'V_CUSTOMERS_PG', '*');
+INSERT INTO permission (perm_id, group_id, source_id, object_name, allowed_regions)
+  VALUES (3, 30, 100, 'V_CUSTOMERS_PG', '*');
+INSERT INTO permission (perm_id, group_id, source_id, object_name, allowed_regions)
+  VALUES (4, 30, 200, 'V_CUSTOMERS_MY', '*');
+
+COMMIT;
+
+-- ------------------------------------------------------------
+-- HOW TO LAYER IN ROW-LEVEL REGION FILTERS (uncomment to try)
+-- ------------------------------------------------------------
+-- 'BOTH_SOURCES' showing only APAC from PG instead of '*':
+--   UPDATE permission SET allowed_regions = 'APAC'
+--    WHERE group_id = 30 AND object_name = 'V_CUSTOMERS_PG';
+--   COMMIT;
+--
+-- Multi-region (CSV) example for the same group on MySQL:
+--   UPDATE permission SET allowed_regions = 'APAC,EMEA'
+--    WHERE group_id = 30 AND object_name = 'V_CUSTOMERS_MY';
+--   COMMIT;
+--
+-- The policy function vpd_region_filter handles CSV → IN-list
+-- conversion automatically. See database/adb/06_policy.sql.
+-- ------------------------------------------------------------
+
+PROMPT === Seed complete ===
+EXIT;