[Developer] #567 record actual VPD execution with FGA

This commit is contained in:
devmrko
2026-07-01 16:02:03 +09:00
parent 57d77d2df2
commit ebcce66bf7
17 changed files with 532 additions and 220 deletions

View File

@@ -0,0 +1,20 @@
package com.cloudhandson.vpdbackoffice.domain.probe;
/**
* Durable, database-generated FGA evidence for a protected-object SELECT.
* SQL text and RLS information come from Oracle's audit trail, not from a
* re-evaluation of the VPD policy function.
*/
public record FgaExecutionEvidence(
String eventAt,
String dbUser,
String clientId,
String statementType,
String sqlText,
String rlsInfo
) {
public boolean hasRlsInfo() {
return rlsInfo != null && !rlsInfo.isBlank();
}
}

View File

@@ -19,7 +19,9 @@ public record ProbeResult(
String effectiveSql,
SqlExecutionEvidence executionEvidence,
String executionEvidenceMessage,
List<SqlExecutionCandidate> executionCandidates
List<SqlExecutionCandidate> executionCandidates,
FgaExecutionEvidence fgaExecutionEvidence,
String fgaExecutionEvidenceMessage
) {
public ProbeResult(
@@ -51,7 +53,9 @@ public record ProbeResult(
null,
null,
null,
List.of()
List.of(),
null,
null
);
}
@@ -86,7 +90,9 @@ public record ProbeResult(
effectiveSql,
null,
null,
List.of()
List.of(),
null,
null
);
}
@@ -143,7 +149,9 @@ public record ProbeResult(
sql,
executionEvidence,
executionEvidenceMessage,
executionCandidates
executionCandidates,
fgaExecutionEvidence,
fgaExecutionEvidenceMessage
);
}
@@ -180,7 +188,9 @@ public record ProbeResult(
effectiveSql,
evidence,
unavailableMessage,
candidates == null ? List.of() : List.copyOf(candidates)
candidates == null ? List.of() : List.copyOf(candidates),
fgaExecutionEvidence,
fgaExecutionEvidenceMessage
);
}
@@ -188,6 +198,37 @@ public record ProbeResult(
return executionCandidates != null && !executionCandidates.isEmpty();
}
public boolean hasFgaExecutionEvidence() {
return fgaExecutionEvidence != null && fgaExecutionEvidence.sqlText() != null
&& !fgaExecutionEvidence.sqlText().isBlank();
}
public ProbeResult withFgaExecutionEvidence(
FgaExecutionEvidence evidence,
String unavailableMessage
) {
return new ProbeResult(
status,
columns,
rows,
rowCount,
maskedColumns,
errorCode,
errorMessage,
requestHeaders,
requestPayload,
responseHeaders,
responseBody,
vpdPredicate,
effectiveSql,
executionEvidence,
executionEvidenceMessage,
executionCandidates,
evidence,
unavailableMessage
);
}
public String title() {
return switch (status) {
case SUCCESS -> "권한에 따라 데이터를 볼 수 있습니다.";