joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refs #741 #742: reorganize repository by application

Browse Source
This commit is contained in:
devmrko
2026-08-03 10:20:36 +09:00
parent 2e44ed0b97
commit e9d50e6a32
445 changed files with 1523 additions and 1885 deletions
Download Patch File Download Diff File Expand all files Collapse all files

597
database/adb/72_hmm_leave_team_vpd.sql Normal file
View File

@@ -0,0 +1,597 @@
-- ============================================================
-- 72_hmm_leave_team_vpd.sql
--
-- HMM HR leave row security:
-- * HMM_HR_MANAGER -> self and directly managed employees
-- * HMM_HR_VIEWER -> self only
-- * HMM_HR_ADMIN -> all rows when the role is explicitly assigned
--
-- Run as ADMIN after the HMM access-management schema is installed.
-- This script is idempotent and never stores a plain bearer token.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO OFF
SET FEEDBACK ON
SET DEFINE OFF
ALTER SESSION DISABLE PARALLEL DML;
PROMPT === 1. Ensuring HMM roles and demo role assignments ===
MERGE INTO hmm_access_roles dst
USING (
SELECT 1 role_id, 'HMM_HR_VIEWER' role_name,
'HMM employee self-service leave access' description,
'PUBLIC' max_sensitivity_level FROM dual
UNION ALL
SELECT 2, 'HMM_HR_MANAGER',
'HMM manager access to self and direct reports',
'INTERNAL' FROM dual
UNION ALL
SELECT 3, 'HMM_HR_ADMIN',
'HMM HR administrator full leave access',
'CONFIDENTIAL' FROM dual
) src
ON (dst.role_name = src.role_name)
WHEN MATCHED THEN UPDATE SET
dst.description = src.description,
dst.max_sensitivity_level = src.max_sensitivity_level,
dst.active_yn = 'Y',
dst.updated_at = SYSTIMESTAMP
WHEN NOT MATCHED THEN INSERT (
role_id, role_name, description, max_sensitivity_level,
active_yn, created_at, updated_at
) VALUES (
src.role_id, src.role_name, src.description, src.max_sensitivity_level,
'Y', SYSTIMESTAMP, SYSTIMESTAMP
);
MERGE INTO hmm_employee_access_roles dst
USING (
SELECT e.employee_id, r.role_id
FROM hmm_hr_employees e
JOIN hmm_access_roles r ON r.role_name = 'HMM_HR_MANAGER'
WHERE e.employee_code = 'E1001'
AND e.employment_status = 'ACTIVE'
) src
ON (dst.employee_id = src.employee_id AND dst.role_id = src.role_id)
WHEN NOT MATCHED THEN INSERT (employee_id, role_id, created_at)
VALUES (src.employee_id, src.role_id, SYSTIMESTAMP);
MERGE INTO hmm_employee_access_roles dst
USING (
SELECT e.employee_id, r.role_id
FROM hmm_hr_employees e
JOIN hmm_access_roles r ON r.role_name = 'HMM_HR_VIEWER'
WHERE e.manager_employee_id = (
SELECT manager.employee_id
FROM hmm_hr_employees manager
WHERE manager.employee_code = 'E1001'
)
AND e.employment_status = 'ACTIVE'
) src
ON (dst.employee_id = src.employee_id AND dst.role_id = src.role_id)
WHEN NOT MATCHED THEN INSERT (employee_id, role_id, created_at)
VALUES (src.employee_id, src.role_id, SYSTIMESTAMP);
COMMIT;
PROMPT === 2. Ensuring protected leave objects and columns ===
DECLARE
PROCEDURE ensure_object(
p_object_name IN VARCHAR2,
p_description IN VARCHAR2
) AS
v_object_id NUMBER;
BEGIN
BEGIN
SELECT object_id
INTO v_object_id
FROM hmm_access_objects
WHERE owner = 'ADMIN'
AND object_name = p_object_name;
UPDATE hmm_access_objects
SET enabled_yn = 'Y',
description = p_description,
ords_path = 'cb-ords/cb-object-query/admin/' || LOWER(p_object_name)
WHERE object_id = v_object_id;
EXCEPTION
WHEN NO_DATA_FOUND THEN
SELECT NVL(MAX(object_id), 0) + 1
INTO v_object_id
FROM hmm_access_objects;
INSERT INTO hmm_access_objects (
object_id, owner, object_name, ords_path, enabled_yn, description
) VALUES (
v_object_id,
'ADMIN',
p_object_name,
'cb-ords/cb-object-query/admin/' || LOWER(p_object_name),
'Y',
p_description
);
END;
FOR c IN (
SELECT column_name
FROM user_tab_columns
WHERE table_name = p_object_name
ORDER BY column_id
) LOOP
MERGE INTO hmm_access_object_columns dst
USING (
SELECT v_object_id object_id, c.column_name column_name
FROM dual
) src
ON (
dst.object_id = src.object_id
AND dst.column_name = src.column_name
)
WHEN NOT MATCHED THEN INSERT (
column_id, object_id, column_name, sensitive_yn,
sensitivity_level, redaction_method
) VALUES (
(SELECT NVL(MAX(column_id), 0) + 1 FROM hmm_access_object_columns),
src.object_id,
src.column_name,
'N',
'PUBLIC',
'NONE'
);
END LOOP;
END;
BEGIN
ensure_object(
'HMM_LEAVE_BALANCES',
'HMM employee leave balance protected by employee hierarchy'
);
ensure_object(
'HMM_LEAVE_REQUESTS',
'HMM employee leave requests protected by employee hierarchy'
);
END;
/
COMMIT;
PROMPT === 3. Ensuring role permission rules ===
DECLARE
PROCEDURE ensure_permission(
p_role_name IN VARCHAR2,
p_target_name IN VARCHAR2,
p_rule_type IN VARCHAR2
) AS
v_role_id NUMBER;
v_perm_id NUMBER;
BEGIN
SELECT role_id
INTO v_role_id
FROM hmm_access_roles
WHERE role_name = p_role_name
AND active_yn = 'Y';
BEGIN
SELECT perm_id
INTO v_perm_id
FROM hmm_access_permissions
WHERE role_id = v_role_id
AND target_name = p_target_name
AND action_name = 'SELECT';
UPDATE hmm_access_permissions
SET permission_effect = 'ALLOW'
WHERE perm_id = v_perm_id;
EXCEPTION
WHEN NO_DATA_FOUND THEN
SELECT cb_permission_seq.NEXTVAL
INTO v_perm_id
FROM dual;
INSERT INTO hmm_access_permissions (
perm_id, role_id, target_name, action_name, permission_effect
) VALUES (
v_perm_id, v_role_id, p_target_name, 'SELECT', 'ALLOW'
);
END;
DELETE FROM hmm_access_permission_rules
WHERE perm_id = v_perm_id;
INSERT INTO hmm_access_permission_rules (
rule_id, perm_id, rule_column, rule_type, rule_value
) VALUES (
cb_permission_rule_seq.NEXTVAL,
v_perm_id,
'EMPLOYEE_ID',
p_rule_type,
NULL
);
END;
BEGIN
ensure_permission('HMM_HR_VIEWER', 'HMM_LEAVE_BALANCES', 'SELF');
ensure_permission('HMM_HR_VIEWER', 'HMM_LEAVE_REQUESTS', 'SELF');
ensure_permission('HMM_HR_MANAGER', 'HMM_LEAVE_BALANCES', 'MANAGED_TEAM');
ensure_permission('HMM_HR_MANAGER', 'HMM_LEAVE_REQUESTS', 'MANAGED_TEAM');
ensure_permission('HMM_HR_ADMIN', 'HMM_LEAVE_BALANCES', 'ALL');
ensure_permission('HMM_HR_ADMIN', 'HMM_LEAVE_REQUESTS', 'ALL');
END;
/
COMMIT;
PROMPT === 4. Creating secure HMM access context ===
CREATE OR REPLACE PACKAGE hmm_access_ctx_pkg AUTHID DEFINER AS
PROCEDURE clear_user;
PROCEDURE set_user_by_bearer(p_bearer_token IN VARCHAR2);
END;
/
CREATE OR REPLACE PACKAGE BODY hmm_access_ctx_pkg AS
PROCEDURE clear_user AS
BEGIN
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_ID', NULL);
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_CODE', NULL);
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'TEAM_ID', NULL);
END;
PROCEDURE set_user_by_bearer(p_bearer_token IN VARCHAR2) AS
v_employee_id hmm_hr_employees.employee_id%TYPE;
v_employee_code hmm_hr_employees.employee_code%TYPE;
v_team_id hmm_hr_employees.team_id%TYPE;
BEGIN
IF p_bearer_token IS NULL OR TRIM(p_bearer_token) IS NULL THEN
clear_user;
RAISE_APPLICATION_ERROR(-20101, 'Bearer token is required');
END IF;
SELECT e.employee_id,
e.employee_code,
e.team_id
INTO v_employee_id,
v_employee_code,
v_team_id
FROM hmm_access_bearer_tokens t
JOIN hmm_hr_employees e
ON e.employee_id = t.employee_id
WHERE t.key_hash = STANDARD_HASH(p_bearer_token, 'SHA256')
AND t.revoked_at IS NULL
AND t.expires_at > CAST(SYSTIMESTAMP AS TIMESTAMP)
AND e.employment_status = 'ACTIVE';
DBMS_SESSION.SET_CONTEXT(
'HMM_ACCESS_CTX', 'EMPLOYEE_ID', TO_CHAR(v_employee_id)
);
DBMS_SESSION.SET_CONTEXT(
'HMM_ACCESS_CTX', 'EMPLOYEE_CODE', v_employee_code
);
DBMS_SESSION.SET_CONTEXT(
'HMM_ACCESS_CTX', 'TEAM_ID', TO_CHAR(v_team_id)
);
EXCEPTION
WHEN NO_DATA_FOUND THEN
clear_user;
RAISE_APPLICATION_ERROR(-20102, 'Invalid or expired bearer token');
WHEN TOO_MANY_ROWS THEN
clear_user;
RAISE_APPLICATION_ERROR(-20103, 'Bearer token mapping is not unique');
END;
END;
/
CREATE OR REPLACE CONTEXT hmm_access_ctx USING hmm_access_ctx_pkg;
PROMPT === 5. Creating the HMM leave VPD filter ===
CREATE OR REPLACE FUNCTION hmm_leave_vpd_filter(
p_schema IN VARCHAR2,
p_object IN VARCHAR2
) RETURN VARCHAR2
AUTHID DEFINER
AS
v_employee_id NUMBER;
v_target VARCHAR2(128);
v_allow_predicate VARCHAR2(32767);
v_deny_predicate VARCHAR2(32767);
v_permission_clause VARCHAR2(32767);
FUNCTION quote_literal(p_value IN VARCHAR2) RETURN VARCHAR2 IS
BEGIN
RETURN '''' || REPLACE(NVL(p_value, ''), '''', '''''') || '''';
END;
FUNCTION safe_column(p_column_name IN VARCHAR2) RETURN VARCHAR2 IS
v_column VARCHAR2(128);
v_count NUMBER;
BEGIN
v_column := DBMS_ASSERT.SIMPLE_SQL_NAME(UPPER(TRIM(p_column_name)));
SELECT COUNT(*)
INTO v_count
FROM all_tab_columns
WHERE owner = UPPER(p_schema)
AND table_name = UPPER(p_object)
AND column_name = v_column;
RETURN CASE WHEN v_count = 1 THEN v_column ELSE NULL END;
EXCEPTION
WHEN OTHERS THEN
RETURN NULL;
END;
PROCEDURE append_and(p_clause IN VARCHAR2) IS
BEGIN
IF p_clause IS NULL THEN
v_permission_clause := NULL;
ELSIF v_permission_clause IS NULL THEN
v_permission_clause := '(' || p_clause || ')';
ELSE
v_permission_clause := v_permission_clause || ' AND (' || p_clause || ')';
END IF;
END;
PROCEDURE append_permission(
p_effect IN VARCHAR2,
p_clause IN VARCHAR2
) IS
BEGIN
IF p_clause IS NULL THEN
RETURN;
END IF;
IF p_effect = 'DENY' THEN
IF v_deny_predicate IS NULL THEN
v_deny_predicate := '(' || p_clause || ')';
ELSE
v_deny_predicate := v_deny_predicate || ' OR (' || p_clause || ')';
END IF;
ELSIF v_allow_predicate IS NULL THEN
v_allow_predicate := '(' || p_clause || ')';
ELSE
v_allow_predicate := v_allow_predicate || ' OR (' || p_clause || ')';
END IF;
END;
BEGIN
BEGIN
v_employee_id := TO_NUMBER(
SYS_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_ID')
);
EXCEPTION
WHEN OTHERS THEN
RETURN '1 = 0';
END;
IF v_employee_id IS NULL OR p_schema IS NULL OR p_object IS NULL THEN
RETURN '1 = 0';
END IF;
v_target := UPPER(TRIM(p_object));
IF v_target NOT IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS') THEN
RETURN '1 = 0';
END IF;
FOR permission_row IN (
SELECT DISTINCT
p.perm_id,
NVL(UPPER(TRIM(p.permission_effect)), 'ALLOW') permission_effect
FROM (
SELECT er.role_id
FROM hmm_employee_access_roles er
WHERE er.employee_id = v_employee_id
UNION
SELECT gr.role_id
FROM hmm_access_group_members gm
JOIN hmm_access_groups g
ON g.group_id = gm.group_id
AND g.active_yn = 'Y'
JOIN hmm_group_access_roles gr
ON gr.group_id = gm.group_id
WHERE gm.employee_id = v_employee_id
) effective_role
JOIN hmm_access_roles role
ON role.role_id = effective_role.role_id
AND role.active_yn = 'Y'
JOIN hmm_access_permissions p
ON p.role_id = role.role_id
AND p.target_name = v_target
AND p.action_name = 'SELECT'
ORDER BY p.perm_id
) LOOP
v_permission_clause := NULL;
FOR rule_row IN (
SELECT UPPER(TRIM(rule_type)) rule_type,
UPPER(TRIM(rule_column)) rule_column,
rule_value
FROM hmm_access_permission_rules
WHERE perm_id = permission_row.perm_id
ORDER BY rule_id
) LOOP
DECLARE
v_column VARCHAR2(128);
v_clause VARCHAR2(32767);
BEGIN
v_column := safe_column(NVL(rule_row.rule_column, 'EMPLOYEE_ID'));
v_clause := NULL;
IF rule_row.rule_type = 'ALL' THEN
v_clause := '1 = 1';
ELSIF rule_row.rule_type = 'SELF' AND v_column IS NOT NULL THEN
v_clause := v_column
|| ' = TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))';
ELSIF rule_row.rule_type = 'MANAGED_TEAM' AND v_column IS NOT NULL THEN
v_clause := v_column || ' IN ('
|| 'SELECT employee.employee_id '
|| 'FROM ADMIN.HMM_HR_EMPLOYEES employee '
|| 'WHERE employee.employee_id = '
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID'')) '
|| 'OR employee.manager_employee_id = '
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))'
|| ')';
ELSIF rule_row.rule_type = '='
AND v_column IS NOT NULL
AND rule_row.rule_value IS NOT NULL THEN
v_clause := 'TO_CHAR(' || v_column || ') = '
|| quote_literal(rule_row.rule_value);
ELSIF rule_row.rule_type IN ('!=', '<>')
AND v_column IS NOT NULL
AND rule_row.rule_value IS NOT NULL THEN
v_clause := 'TO_CHAR(' || v_column || ') <> '
|| quote_literal(rule_row.rule_value);
END IF;
IF v_clause IS NULL THEN
v_permission_clause := NULL;
EXIT;
END IF;
append_and(v_clause);
END;
END LOOP;
append_permission(
permission_row.permission_effect,
v_permission_clause
);
END LOOP;
IF v_allow_predicate IS NULL THEN
RETURN '1 = 0';
END IF;
IF v_deny_predicate IS NULL THEN
RETURN v_allow_predicate;
END IF;
RETURN '((' || v_allow_predicate || ') AND NOT ('
|| v_deny_predicate || '))';
EXCEPTION
WHEN OTHERS THEN
RETURN '1 = 0';
END;
/
SHOW ERRORS PACKAGE hmm_access_ctx_pkg
SHOW ERRORS PACKAGE BODY hmm_access_ctx_pkg
SHOW ERRORS FUNCTION hmm_leave_vpd_filter
PROMPT === 6. Attaching context-sensitive VPD policies ===
DECLARE
PROCEDURE replace_policy(p_object_name IN VARCHAR2) AS
BEGIN
BEGIN
DBMS_RLS.DROP_POLICY(
object_schema => 'ADMIN',
object_name => p_object_name,
policy_name => 'HMM_LEAVE_SCOPE_POLICY'
);
EXCEPTION
WHEN OTHERS THEN
IF SQLCODE != -28102 THEN
RAISE;
END IF;
END;
DBMS_RLS.ADD_POLICY(
object_schema => 'ADMIN',
object_name => p_object_name,
policy_name => 'HMM_LEAVE_SCOPE_POLICY',
function_schema => 'ADMIN',
policy_function => 'HMM_LEAVE_VPD_FILTER',
statement_types => 'SELECT',
update_check => FALSE,
enable => TRUE,
policy_type => DBMS_RLS.CONTEXT_SENSITIVE
);
END;
BEGIN
replace_policy('HMM_LEAVE_BALANCES');
replace_policy('HMM_LEAVE_REQUESTS');
END;
/
PROMPT === 7. Recording backoffice descriptions ===
MERGE INTO hmm_access_vpd_filter_notes dst
USING (
SELECT 'ADMIN' function_owner,
'HMM_LEAVE_VPD_FILTER' function_name,
'Builds self, managed-team, and administrator leave predicates from HMM roles and access rules.'
description
FROM dual
) src
ON (
dst.function_owner = src.function_owner
AND dst.function_name = src.function_name
)
WHEN MATCHED THEN UPDATE SET
dst.description = src.description,
dst.updated_at = SYSTIMESTAMP
WHEN NOT MATCHED THEN INSERT (
function_owner, function_name, description, updated_at
) VALUES (
src.function_owner, src.function_name, src.description, SYSTIMESTAMP
);
MERGE INTO hmm_access_vpd_policy_notes dst
USING (
SELECT 'ADMIN' object_owner,
object_name,
'HMM_LEAVE_SCOPE_POLICY' policy_name,
'Restricts leave rows to self, direct reports, or explicit HR administrator access.'
description
FROM (
SELECT 'HMM_LEAVE_BALANCES' object_name FROM dual
UNION ALL
SELECT 'HMM_LEAVE_REQUESTS' FROM dual
)
) src
ON (
dst.object_owner = src.object_owner
AND dst.object_name = src.object_name
AND dst.policy_name = src.policy_name
)
WHEN MATCHED THEN UPDATE SET
dst.description = src.description,
dst.updated_at = SYSTIMESTAMP
WHEN NOT MATCHED THEN INSERT (
object_owner, object_name, policy_name, description, updated_at
) VALUES (
src.object_owner, src.object_name, src.policy_name,
src.description, SYSTIMESTAMP
);
COMMIT;
PROMPT === 8. Deployment inventory ===
SELECT object_name, object_type, status
FROM user_objects
WHERE object_name IN (
'HMM_ACCESS_CTX',
'HMM_ACCESS_CTX_PKG',
'HMM_LEAVE_VPD_FILTER'
)
ORDER BY object_name, object_type;
SELECT object_name, policy_name, function, sel, enable, policy_type
FROM all_policies
WHERE object_owner = 'ADMIN'
AND object_name IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS')
AND policy_name = 'HMM_LEAVE_SCOPE_POLICY'
ORDER BY object_name;
SELECT e.employee_code, r.role_name
FROM hmm_employee_access_roles er
JOIN hmm_hr_employees e ON e.employee_id = er.employee_id
JOIN hmm_access_roles r ON r.role_id = er.role_id
WHERE r.role_name IN ('HMM_HR_VIEWER', 'HMM_HR_MANAGER')
ORDER BY e.employee_code, r.role_name;
SELECT r.role_name,
p.target_name,
pr.rule_column,
pr.rule_type
FROM hmm_access_permissions p
JOIN hmm_access_roles r ON r.role_id = p.role_id
JOIN hmm_access_permission_rules pr ON pr.perm_id = p.perm_id
WHERE p.target_name IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS')
ORDER BY r.role_name, p.target_name;
PROMPT === HMM leave team VPD ready ===