refs #741 #742: reorganize repository by application

database/adb/42_dds_fga_execution_evidence.sql

@@ -0,0 +1,32 @@
+-- DDS execution evidence: durable FGA audit for the protected vector view.
+-- Run as ADMIN/AUDIT_ADMIN. In unified auditing the records are queried from
+-- UNIFIED_AUDIT_TRAIL with AUDIT_TYPE = 'FineGrainedAudit'.
+BEGIN
+  DBMS_FGA.DROP_POLICY(
+    object_schema => 'ADMIN', object_name => 'CB_DDS_VECTOR_SEARCH_DOCUMENTS',
+    policy_name => 'DDS_VECTOR_EXECUTION_EVIDENCE');
+EXCEPTION WHEN OTHERS THEN
+  IF SQLCODE != -28102 THEN RAISE; END IF;
+END;
+/
+BEGIN
+  DBMS_FGA.ADD_POLICY(
+    object_schema => 'ADMIN',
+    object_name => 'CB_DDS_VECTOR_SEARCH_DOCUMENTS',
+    policy_name => 'DDS_VECTOR_EXECUTION_EVIDENCE',
+    audit_condition => NULL,
+    audit_column => NULL,
+    statement_types => 'SELECT',
+    audit_trail => DBMS_FGA.DB_EXTENDED,
+    enable => TRUE);
+END;
+/
+-- Evidence lookup (grant AUDIT_VIEWER or expose a definer-rights reader view
+-- to the backoffice; never grant this to DDS END USER accounts):
+-- SELECT event_timestamp, client_identifier, dbusername, object_name,
+--        return_code, sql_text, application_contexts
+-- FROM unified_audit_trail
+-- WHERE audit_type = 'FineGrainedAudit'
+--   AND object_schema = 'ADMIN'
+--   AND object_name = 'CB_DDS_VECTOR_SEARCH_DOCUMENTS'
+-- ORDER BY event_timestamp DESC;