refs #741 #742: reorganize repository by application

database/adb/47_kb_stakeholder_permission_or_branches.sql

@@ -0,0 +1,104 @@
+-- ============================================================
+-- 47_kb_stakeholder_permission_or_branches.sql
+--
+-- Refines the KB example so the permission table carries the expected
+-- stakeholder role and each role branch becomes an OR candidate in the
+-- dynamic VPD filter. Execute after 26 and 46 as ADMIN.
+-- ============================================================
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET ECHO OFF
+SET FEEDBACK ON
+SET DEFINE OFF
+
+PROMPT === 1. Storing expected stakeholder role in example rules ===
+UPDATE cb_permission_rule r
+SET rule_value = CASE
+  WHEN EXISTS (
+    SELECT 1
+    FROM cb_permission p
+    JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE p.perm_id = r.perm_id
+      AND ar.role_name = 'KB_DESIGNER_ROLE'
+  ) THEN '설계사'
+  WHEN EXISTS (
+    SELECT 1
+    FROM cb_permission p
+    JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE p.perm_id = r.perm_id
+      AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
+  ) THEN '지점장'
+END
+WHERE r.rule_type IN ('STAKEHOLDER_SELF', 'STAKEHOLDER_CHANNEL')
+  AND EXISTS (
+    SELECT 1
+    FROM cb_permission p
+    JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE p.perm_id = r.perm_id
+      AND ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
+  );
+
+PROMPT === 2. Adding an identity role so every stakeholder token can resolve itself ===
+DECLARE
+  v_role_id       NUMBER;
+  v_permission_id NUMBER;
+  v_count         NUMBER;
+BEGIN
+  BEGIN
+    SELECT role_id INTO v_role_id
+    FROM cb_app_role
+    WHERE role_name = 'KB_STAKEHOLDER_IDENTITY_ROLE';
+  EXCEPTION
+    WHEN NO_DATA_FOUND THEN
+      SELECT NVL(MAX(role_id), 0) + 1 INTO v_role_id FROM cb_app_role;
+      INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
+      VALUES (v_role_id, 'KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL');
+  END;
+
+  FOR u IN (
+    SELECT user_id
+    FROM cb_app_user
+    WHERE stakeholder_user_id IS NOT NULL
+      AND active = 'Y'
+  ) LOOP
+    SELECT COUNT(*) INTO v_count
+    FROM cb_user_role
+    WHERE user_id = u.user_id
+      AND role_id = v_role_id;
+    IF v_count = 0 THEN
+      INSERT INTO cb_user_role(user_id, role_id) VALUES (u.user_id, v_role_id);
+    END IF;
+  END LOOP;
+
+  BEGIN
+    SELECT perm_id INTO v_permission_id
+    FROM cb_permission
+    WHERE role_id = v_role_id
+      AND target_name = 'KB_STAKEHOLDERS'
+      AND action_name = 'SELECT';
+  EXCEPTION
+    WHEN NO_DATA_FOUND THEN
+      SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
+      INSERT INTO cb_permission(perm_id, role_id, target_name, action_name, permission_effect)
+      VALUES (v_permission_id, v_role_id, 'KB_STAKEHOLDERS', 'SELECT', 'ALLOW');
+      INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
+      VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, 'USER_ID', 'TOKEN_SUBJECT', NULL);
+  END;
+END;
+/
+COMMIT;
+
+PROMPT === 3. Result: role-specific permission branches ===
+SELECT ar.role_name,
+       p.target_name,
+       r.rule_column,
+       r.rule_type,
+       NVL(r.rule_value, '(token role)') AS expected_stakeholder_role
+FROM cb_permission p
+JOIN cb_app_role ar ON ar.role_id = p.role_id
+JOIN cb_permission_rule r ON r.perm_id = p.perm_id
+WHERE ar.role_name IN (
+  'KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE', 'KB_STAKEHOLDER_IDENTITY_ROLE'
+)
+ORDER BY ar.role_name, p.target_name, r.rule_id;
+
+PROMPT === KB role branches are combined as OR by CB_AGENT_DOC_VPD_FILTER ===