joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(backoffice): add Smilegate identity administration

Browse Source
This commit is contained in:
devmrko
2026-07-22 13:29:47 +09:00
parent 56b9b511c1
commit ea5a116203
10 changed files with 216 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/resources/mapper/AuditMapper.xml
View File

@@ -3,10 +3,10 @@
"https://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.cloudhandson.vpdbackoffice.mapper.AuditMapper">
<insert id="insert" parameterType="com.cloudhandson.vpdbackoffice.domain.audit.AuditEvent">
INSERT INTO cb_ords_probe_audit (
INSERT INTO sg_audit_event (
audit_id, event_type, key_id, object_id, status, row_count, error_code, message, created_at
) VALUES (
cb_ords_probe_audit_seq.NEXTVAL,
sg_audit_event_seq.NEXTVAL,
#{eventType,jdbcType=VARCHAR},
#{keyId,jdbcType=NUMERIC},
#{objectId,jdbcType=NUMERIC},

28
src/main/resources/mapper/GroupMapper.xml
View File

@@ -8,7 +8,7 @@
group_name,
description,
active_yn
FROM cb_app_group
FROM sg_app_group
ORDER BY group_code
</select>
@@ -18,9 +18,9 @@
g.group_name,
u.user_id,
u.user_name AS username
FROM cb_user_group ug
JOIN cb_app_group g ON g.group_id = ug.group_id
JOIN cb_app_user u ON u.user_id = ug.user_id
FROM sg_user_group ug
JOIN sg_app_group g ON g.group_id = ug.group_id
JOIN sg_app_user u ON u.user_id = ug.user_id
ORDER BY g.group_code, u.user_name
</select>
@@ -30,18 +30,18 @@
g.group_name,
r.role_id,
r.role_name
FROM cb_group_role gr
JOIN cb_app_group g ON g.group_id = gr.group_id
JOIN cb_app_role r ON r.role_id = gr.role_id
FROM sg_group_role gr
JOIN sg_app_group g ON g.group_id = gr.group_id
JOIN sg_app_role r ON r.role_id = gr.role_id
ORDER BY g.group_code, r.role_name
</select>
<select id="nextGroupId" resultType="long">
SELECT NVL(MAX(group_id), 0) + 1 FROM cb_app_group
SELECT NVL(MAX(group_id), 0) + 1 FROM sg_app_group
</select>
<insert id="insertGroup">
INSERT INTO cb_app_group (
INSERT INTO sg_app_group (
group_id, group_code, group_name, description, active_yn
) VALUES (
#{groupId,jdbcType=NUMERIC},
@@ -53,29 +53,29 @@
</insert>
<update id="updateActive">
UPDATE cb_app_group
UPDATE sg_app_group
SET active_yn = #{activeYn,jdbcType=VARCHAR}
WHERE group_id = #{groupId,jdbcType=NUMERIC}
</update>
<insert id="insertGroupUser">
INSERT INTO cb_user_group (group_id, user_id)
INSERT INTO sg_user_group (group_id, user_id)
VALUES (#{groupId,jdbcType=NUMERIC}, #{userId,jdbcType=NUMERIC})
</insert>
<delete id="deleteGroupUser">
DELETE FROM cb_user_group
DELETE FROM sg_user_group
WHERE group_id = #{groupId,jdbcType=NUMERIC}
AND user_id = #{userId,jdbcType=NUMERIC}
</delete>
<insert id="insertGroupRole">
INSERT INTO cb_group_role (group_id, role_id)
INSERT INTO sg_group_role (group_id, role_id)
VALUES (#{groupId,jdbcType=NUMERIC}, #{roleId,jdbcType=NUMERIC})
</insert>
<delete id="deleteGroupRole">
DELETE FROM cb_group_role
DELETE FROM sg_group_role
WHERE group_id = #{groupId,jdbcType=NUMERIC}
AND role_id = #{roleId,jdbcType=NUMERIC}
</delete>

105
src/main/resources/mapper/PermissionMapper.xml
View File

@@ -5,132 +5,77 @@
<select id="findRoles" resultType="com.cloudhandson.vpdbackoffice.domain.permission.AppRole">
SELECT role_id,
role_name,
CAST(NULL AS VARCHAR2(200)) AS description,
description,
NVL(max_sensitivity_level, 'PUBLIC') AS max_sensitivity_level
FROM cb_app_role
FROM sg_app_role
ORDER BY role_name
</select>
<select id="findRole" resultType="com.cloudhandson.vpdbackoffice.domain.permission.AppRole">
SELECT role_id,
role_name,
CAST(NULL AS VARCHAR2(200)) AS description,
description,
NVL(max_sensitivity_level, 'PUBLIC') AS max_sensitivity_level
FROM cb_app_role
FROM sg_app_role
WHERE role_id = #{roleId}
</select>
<select id="nextRoleId" resultType="long">
SELECT NVL(MAX(role_id), 0) + 1 FROM cb_app_role
SELECT NVL(MAX(role_id), 0) + 1 FROM sg_app_role
</select>
<insert id="insertRole">
INSERT INTO cb_app_role (role_id, role_name, max_sensitivity_level)
INSERT INTO sg_app_role (role_id, role_name, description, max_sensitivity_level)
VALUES (
#{roleId,jdbcType=NUMERIC},
UPPER(#{roleName,jdbcType=VARCHAR}),
#{description,jdbcType=VARCHAR},
#{maxSensitivityLevel,jdbcType=VARCHAR}
)
</insert>
<update id="updateRoleMaxSensitivity">
UPDATE cb_app_role
UPDATE sg_app_role
SET max_sensitivity_level = #{maxSensitivityLevel,jdbcType=VARCHAR}
WHERE role_id = #{roleId,jdbcType=NUMERIC}
</update>
<delete id="deleteRole">
DELETE FROM cb_app_role
DELETE FROM sg_app_role
WHERE role_id = #{roleId,jdbcType=NUMERIC}
</delete>
<select id="countUserRolesByRoleId" resultType="int">
SELECT COUNT(*)
FROM cb_user_role
FROM sg_user_role
WHERE role_id = #{roleId,jdbcType=NUMERIC}
</select>
<select id="countGroupRolesByRoleId" resultType="int">
SELECT COUNT(*)
FROM cb_group_role
FROM sg_group_role
WHERE role_id = #{roleId,jdbcType=NUMERIC}
</select>
<select id="countPermissionsByRoleId" resultType="int">
SELECT COUNT(*)
FROM cb_permission
WHERE role_id = #{roleId,jdbcType=NUMERIC}
FROM dual
WHERE 1 = 0
</select>
<select id="findPermissionViews" resultType="com.cloudhandson.vpdbackoffice.domain.permission.PermissionView">
SELECT p.perm_id AS permission_id,
r.role_id,
r.role_name,
NVL(o.object_id, -1) AS object_id,
p.target_name AS object_name,
p.action_name AS action,
NVL(p.permission_effect, 'ALLOW') AS permission_effect,
LISTAGG(
NVL2(pr.rule_column, pr.rule_column || ' ', '') ||
pr.rule_type ||
NVL2(pr.rule_value, ' ' || pr.rule_value, ''),
', '
)
WITHIN GROUP (ORDER BY pr.rule_id) AS rules,
(
SELECT LISTAGG(pc.column_name, ', ') WITHIN GROUP (ORDER BY pc.column_name)
FROM cb_permission_column pc
WHERE pc.permission_id = p.perm_id
) AS visible_columns,
(
SELECT LISTAGG(
CASE
WHEN pr2.rule_type = 'ALL' THEN 'ALL ROWS'
WHEN pr2.rule_type = 'MY_DEPT' THEN NVL(pr2.rule_column, 'DEPT_CODE') || ' = SYS_CONTEXT(CB_AGENT_CTX.DEPT_CODE)'
WHEN pr2.rule_type = 'SELF' THEN NVL(pr2.rule_column, 'OWNER_EMP_NO') || ' = SYS_CONTEXT(CB_AGENT_CTX.EMP_NO)'
WHEN pr2.rule_type = 'DEPT' THEN NVL(pr2.rule_column, 'DEPT_CODE') || ' = ' || pr2.rule_value
WHEN pr2.rule_type = 'EMP_NO' THEN NVL(pr2.rule_column, 'OWNER_EMP_NO') || ' = ' || pr2.rule_value
WHEN pr2.rule_type = 'TAG' THEN 'REGEXP_LIKE(UPPER('
|| NVL(pr2.rule_column, 'TECH_TAG')
|| '), ''(^|,)' || REPLACE(UPPER(pr2.rule_value), '''', '''''') || '(,|$)'')'
WHEN pr2.rule_type = 'TOKEN_SUBJECT' THEN
pr2.rule_column || ' = SYS_CONTEXT(''CB_AGENT_CTX'', ''STAKEHOLDER_USER_ID'')'
WHEN pr2.rule_type = 'OWN_CONTRACT' THEN
pr2.rule_column || ' = SYS_CONTEXT(''CB_AGENT_CTX'', ''STAKEHOLDER_USER_ID'')'
WHEN pr2.rule_type = 'CHANNEL_CONTRACT' THEN
pr2.rule_column || ' = SYS_CONTEXT(''CB_AGENT_CTX'', ''STAKEHOLDER_CHANNEL'')'
WHEN pr2.rule_type = 'OWN_CUSTOMER' THEN
'EXISTS (SELECT 1 FROM (SELECT c.' || pr2.rule_column || ' AS access_key '
|| 'FROM POC_2.KB_CONTRACTS c '
|| 'WHERE c.FC_ID = SYS_CONTEXT(''CB_AGENT_CTX'', ''STAKEHOLDER_USER_ID'')) allowed_contract '
|| 'WHERE allowed_contract.access_key = ' || pr2.rule_column || ')'
WHEN pr2.rule_type = 'CHANNEL_CUSTOMER' THEN
'EXISTS (SELECT 1 FROM (SELECT c.' || pr2.rule_column || ' AS access_key '
|| 'FROM POC_2.KB_CONTRACTS c '
|| 'WHERE c.FC_CHANNEL = SYS_CONTEXT(''CB_AGENT_CTX'', ''STAKEHOLDER_CHANNEL'')) allowed_contract '
|| 'WHERE allowed_contract.access_key = ' || pr2.rule_column || ')'
WHEN pr2.rule_type = 'STATIC_SQL' THEN pr2.rule_value
ELSE pr2.rule_column || ' ' || pr2.rule_type || ' ' || pr2.rule_value
END,
CHR(10) || 'AND '
) WITHIN GROUP (ORDER BY pr2.rule_id)
FROM cb_permission_rule pr2
WHERE pr2.perm_id = p.perm_id
) AS filter_preview,
(
SELECT CASE
WHEN COUNT(*) = 0 THEN '컬럼 마스킹은 ASO에서 관리'
ELSE '레거시 권한별 컬럼 예외: ' || LISTAGG(pc2.column_name, ', ') WITHIN GROUP (ORDER BY pc2.column_name)
END
FROM cb_permission_column pc2
WHERE pc2.permission_id = p.perm_id
) AS null_policy_preview
FROM cb_permission p
JOIN cb_app_role r ON r.role_id = p.role_id
LEFT JOIN cb_protected_object o ON o.object_name = p.target_name
LEFT JOIN cb_permission_rule pr ON pr.perm_id = p.perm_id
GROUP BY p.perm_id, r.role_id, r.role_name, o.object_id, p.target_name, p.action_name, p.permission_effect
ORDER BY r.role_name, p.target_name
SELECT CAST(NULL AS NUMBER) AS permission_id,
CAST(NULL AS NUMBER) AS role_id,
CAST(NULL AS VARCHAR2(100)) AS role_name,
CAST(NULL AS NUMBER) AS object_id,
CAST(NULL AS VARCHAR2(200)) AS object_name,
CAST(NULL AS VARCHAR2(30)) AS action,
CAST(NULL AS VARCHAR2(30)) AS permission_effect,
CAST(NULL AS VARCHAR2(4000)) AS rules,
CAST(NULL AS VARCHAR2(4000)) AS visible_columns,
CAST(NULL AS VARCHAR2(4000)) AS filter_preview,
CAST(NULL AS VARCHAR2(4000)) AS null_policy_preview
FROM dual WHERE 1 = 0
</select>
<select id="findPermissionId" resultType="long">

20
src/main/resources/mapper/UserMapper.xml
View File

@@ -9,7 +9,7 @@
dept_code,
can_read_contents,
active AS active_yn
FROM cb_app_user
FROM sg_app_user
ORDER BY username
</select>
@@ -20,7 +20,7 @@
dept_code,
can_read_contents,
active AS active_yn
FROM cb_app_user
FROM sg_app_user
WHERE user_id = #{userId}
</select>
@@ -29,18 +29,18 @@
u.user_name AS username,
r.role_id,
r.role_name
FROM cb_user_role ur
JOIN cb_app_user u ON u.user_id = ur.user_id
JOIN cb_app_role r ON r.role_id = ur.role_id
FROM sg_user_role ur
JOIN sg_app_user u ON u.user_id = ur.user_id
JOIN sg_app_role r ON r.role_id = ur.role_id
ORDER BY u.user_name, r.role_name
</select>
<select id="nextUserId" resultType="long">
SELECT NVL(MAX(user_id), 0) + 1 FROM cb_app_user
SELECT NVL(MAX(user_id), 0) + 1 FROM sg_app_user
</select>
<insert id="insertUser">
INSERT INTO cb_app_user (
INSERT INTO sg_app_user (
user_id, user_name, employee_no, dept_code, can_read_contents, active
) VALUES (
#{userId},
@@ -53,18 +53,18 @@
</insert>
<update id="updateActive">
UPDATE cb_app_user
UPDATE sg_app_user
SET active = #{activeYn}
WHERE user_id = #{userId}
</update>
<insert id="insertUserRole">
INSERT INTO cb_user_role (user_id, role_id)
INSERT INTO sg_user_role (user_id, role_id)
VALUES (#{userId}, #{roleId})
</insert>
<delete id="deleteUserRole">
DELETE FROM cb_user_role
DELETE FROM sg_user_role
WHERE user_id = #{userId}
AND role_id = #{roleId}
</delete>

6
src/main/resources/templates/fragments/layout.html
View File

@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="backoffice-can-mutate" th:content="${canMutate}">
<meta name="backoffice-read-only" th:content="${readOnlyMode}">
<title th:text="${title == '데이터 접근 제어' ? title : title + ' · 데이터 접근 제어'}">데이터 접근 제어</title>
<title th:text="${title == 'SMILEGATE DATA & AI POC' ? title : title + ' · SMILEGATE DATA & AI POC'}">SMILEGATE DATA & AI POC</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
<link href="/css/app.css" rel="stylesheet">
<script src="https://unpkg.com/htmx.org@2.0.4"></script>
@@ -15,9 +15,9 @@
<body>
<nav th:fragment="nav" class="navbar rw-nav navbar-expand-lg" data-product-nav>
<div class="container rw-nav-top">
<a class="navbar-brand" href="/">데이터 접근 제어</a>
<a class="navbar-brand" href="/">SMILEGATE DATA &amp; AI POC</a>
<div class="rw-menu" aria-label="주요 메뉴">
<button class="rw-menu-trigger" type="button" data-submenu-trigger="access" aria-controls="submenu-access" aria-expanded="false">접근 제어</button>
<button class="rw-menu-trigger" type="button" data-submenu-trigger="access" aria-controls="submenu-access" aria-expanded="false">운영 사용자 관리</button>
<button class="rw-menu-trigger" type="button" data-submenu-trigger="protection" aria-controls="submenu-protection" aria-expanded="false">보호·검증</button>
<button class="rw-menu-trigger" type="button" data-submenu-trigger="integration" aria-controls="submenu-integration" aria-expanded="false">연동 도구</button>
<button class="rw-menu-trigger" type="button" data-submenu-trigger="operations" aria-controls="submenu-operations" aria-expanded="false">운영</button>

2
src/main/resources/templates/groups.html
View File

@@ -8,7 +8,7 @@
<h1>그룹</h1>
<details class="explanation-details">
<summary>도움말</summary>
<p>사용자 그룹을 만들고 그룹에 사용자와 역할을 부여합니다. 권한은 역할에 연결되고, 사용자는 직접 역할과 그룹 역할을 함께 상속합니다.</p>
<p>PoC 운영 그룹을 만들고 그룹에 사용자와 역할을 부여합니다. 사용자는 직접 부여된 역할과 그룹 역할을 함께 사용합니다.</p>
</details>
</div>

12
src/main/resources/templates/roles.html
View File

@@ -8,7 +8,7 @@
<h1>역할</h1>
<details class="explanation-details">
<summary>도움말</summary>
<p>사용자에게 부여할 역할을 관리합니다. 표시 보호 등급 상한은 허용된 행에서 원문으로 볼 수 있는 컬럼 등급의 참고값이며, 행 접근 권한은 행 접근 규칙과 Oracle VPD 정책에서 결정합니다.</p>
<p>스마일게이트 Data & AI PoC 운영 역할을 관리합니다. 역할은 사용자에게 직접 부여하거나 그룹을 통해 부여할 수 있습니다.</p>
</details>
</div>
@@ -28,14 +28,14 @@
<input class="form-control" name="description" maxlength="200">
</label>
<label>
표시 보호 등급 상한 (참고)
데이터 취급 등급
<select class="form-select" name="maxSensitivityLevel">
<option value="PUBLIC">PUBLIC</option>
<option value="INTERNAL">INTERNAL</option>
<option value="CONFIDENTIAL">CONFIDENTIAL</option>
<option value="RESTRICTED">RESTRICTED</option>
</select>
<span class="form-hint">이 역할이 허용된 행에서 원문으로 볼 수 있는 컬럼 등급의 참고 상한입니다. 행을 볼 수 있는지는 행 접근 규칙과 Oracle VPD 정책이 결정하며, 이 값은 행 권한을 부여하지 않습니다.</span>
<span class="form-hint">PoC 운영 시 역할별 데이터 취급 기준을 표현하는 분류값입니다.</span>
</label>
<button class="btn rw-btn-primary" type="submit">추가</button>
</form>
@@ -49,7 +49,7 @@
<tr>
<th>ID</th>
<th>역할명</th>
<th>표시 보호 등급 상한</th>
<th>데이터 취급 등급</th>
<th>삭제 영향</th>
<th></th>
</tr>
@@ -61,7 +61,7 @@
<td th:text="${role.roleId()}">10</td>
<td th:text="${role.roleName()}">HR_DEPT_ROLE</td>
<td>
<span class="badge text-bg-light" th:title="${'허용된 행의 컬럼 표시 상한: ' + role.maxSensitivityLevel()}"
<span class="badge text-bg-light" th:title="${'역할 데이터 취급 등급: ' + role.maxSensitivityLevel()}"
th:text="${role.maxSensitivityLevel()}">PUBLIC</span>
<form method="post" action="/roles/max-sensitivity" class="inline-form">
<input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}">
@@ -74,7 +74,7 @@
</select>
<button class="btn btn-sm btn-outline-primary" type="submit">저장</button>
</form>
<small class="text-muted d-block mt-1">행 접근 권한과 별개인 표시 보호 상한</small>
<small class="text-muted d-block mt-1">PoC 운영 기준 분류값</small>
</td>
<td class="delete-impact">
<div>

2
src/main/resources/templates/users.html
View File

@@ -8,7 +8,7 @@
<h1>사용자</h1>
<details class="explanation-details">
<summary>도움말</summary>
<p>Bearer Token과 권한 매핑에 사용할 내부 사용자를 관리합니다. 여기의 사용자는 Oracle DB schema 계정이 아니라 권한체계에서 식별하는 application user입니다.</p>
<p>스마일게이트 Data & AI PoC 도구를 사용할 운영 사용자를 관리합니다. 게임 서비스 이용자나 Oracle DB 계정과는 별개의 백오피스 관리 대상입니다.</p>
</details>
</div>