refs #741 #742: reorganize repository by application

database/adb/48_kb_permission_condition_codes.sql

@@ -0,0 +1,137 @@
+-- ============================================================
+-- 48_kb_permission_condition_codes.sql
+--
+-- Replaces the first KB example's stakeholder-specific predicate types with
+-- policy condition codes. CB_AGENT_DOC_VPD_FILTER expands these codes into
+-- the target object's WHERE predicate.
+-- Execute as ADMIN after 25 and 46.
+-- ============================================================
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET ECHO OFF
+SET FEEDBACK ON
+SET DEFINE OFF
+
+ALTER SESSION DISABLE PARALLEL DML;
+
+PROMPT === 1. Replacing KB example rules with filter condition codes ===
+UPDATE cb_permission_rule r
+SET rule_type = CASE
+      WHEN EXISTS (
+        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_DESIGNER_ROLE'
+          AND p.target_name = 'KB_CONTRACTS'
+      ) THEN 'OWN_CONTRACT'
+      WHEN EXISTS (
+        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
+          AND p.target_name = 'KB_CONTRACTS'
+      ) THEN 'CHANNEL_CONTRACT'
+      WHEN EXISTS (
+        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_DESIGNER_ROLE'
+          AND p.target_name IN ('KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
+      ) THEN 'OWN_CUSTOMER'
+      WHEN EXISTS (
+        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
+          AND p.target_name IN ('KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
+      ) THEN 'CHANNEL_CUSTOMER'
+      ELSE r.rule_type
+    END,
+    rule_value = NULL
+WHERE r.rule_type IN ('STAKEHOLDER_SELF', 'STAKEHOLDER_CHANNEL')
+  AND EXISTS (
+    SELECT 1
+    FROM cb_permission p
+    JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE p.perm_id = r.perm_id
+      AND ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
+      AND p.target_name IN ('KB_CONTRACTS', 'KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
+  );
+
+COMMIT;
+
+PROMPT === 2. Keeping token subject access as an identity-only permission ===
+DECLARE
+  v_identity_role_id NUMBER;
+  v_permission_id    NUMBER;
+  v_count            NUMBER;
+BEGIN
+  BEGIN
+    SELECT role_id INTO v_identity_role_id
+    FROM cb_app_role
+    WHERE role_name = 'KB_STAKEHOLDER_IDENTITY_ROLE';
+  EXCEPTION
+    WHEN NO_DATA_FOUND THEN
+      SELECT NVL(MAX(role_id), 0) + 1 INTO v_identity_role_id FROM cb_app_role;
+      INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
+      VALUES (v_identity_role_id, 'KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL');
+  END;
+
+  FOR u IN (
+    SELECT user_id FROM cb_app_user
+    WHERE stakeholder_user_id IS NOT NULL AND active = 'Y'
+  ) LOOP
+    SELECT COUNT(*) INTO v_count
+    FROM cb_user_role
+    WHERE user_id = u.user_id AND role_id = v_identity_role_id;
+    IF v_count = 0 THEN
+      INSERT INTO cb_user_role(user_id, role_id) VALUES (u.user_id, v_identity_role_id);
+    END IF;
+  END LOOP;
+
+  -- Business roles do not need to grant the stakeholder source row. The
+  -- identity role alone lets a valid token resolve its own stakeholder row.
+  DELETE FROM cb_permission_column
+  WHERE permission_id IN (
+    SELECT p.perm_id
+    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
+      AND p.target_name = 'KB_STAKEHOLDERS'
+  );
+  DELETE FROM cb_permission_rule
+  WHERE perm_id IN (
+    SELECT p.perm_id
+    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
+      AND p.target_name = 'KB_STAKEHOLDERS'
+  );
+  DELETE FROM cb_permission
+  WHERE perm_id IN (
+    SELECT p.perm_id
+    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
+    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
+      AND p.target_name = 'KB_STAKEHOLDERS'
+  );
+
+  BEGIN
+    SELECT perm_id INTO v_permission_id
+    FROM cb_permission
+    WHERE role_id = v_identity_role_id
+      AND target_name = 'KB_STAKEHOLDERS'
+      AND action_name = 'SELECT';
+  EXCEPTION
+    WHEN NO_DATA_FOUND THEN
+      SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
+      INSERT INTO cb_permission(perm_id, role_id, target_name, action_name, permission_effect)
+      VALUES (v_permission_id, v_identity_role_id, 'KB_STAKEHOLDERS', 'SELECT', 'ALLOW');
+  END;
+
+  DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
+  INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
+  VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, 'USER_ID', 'TOKEN_SUBJECT', NULL);
+END;
+/
+COMMIT;
+
+PROMPT === 3. Condition codes consumed by the VPD filter ===
+SELECT ar.role_name, p.target_name, r.rule_column, r.rule_type
+FROM cb_permission p
+JOIN cb_app_role ar ON ar.role_id = p.role_id
+JOIN cb_permission_rule r ON r.perm_id = p.perm_id
+WHERE ar.role_name IN (
+  'KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE', 'KB_STAKEHOLDER_IDENTITY_ROLE'
+)
+ORDER BY ar.role_name, p.target_name, r.rule_id;
+
+PROMPT === KB permission condition codes ready ===