refs #742: merge HMM application layout into main

# Conflicts:
#	src/main/java/com/cloudhandson/vpdbackoffice/service/StructuredDataService.java
#	vpd-backoffice/src/main/java/com/cloudhandson/vpdbackoffice/service/SchemaMetadataService.java
#	vpd-backoffice/src/main/java/com/cloudhandson/vpdbackoffice/service/VectorKnowledgeService.java
#	vpd-backoffice/src/main/resources/mapper/MaskingRuleMapper.xml
#	vpd-backoffice/src/main/resources/templates/schema-metadata.html
#	vpd-backoffice/src/main/resources/templates/structured-data.html

database/adb/71_sg_identity_administration.sql

@@ -130,6 +130,69 @@ begin
   )');
   create_if_missing('create sequence sg_permission_seq start with 1 increment by 1 nocache');
   create_if_missing('create sequence sg_permission_rule_seq start with 1 increment by 1 nocache');
+  create_if_missing('create table sg_vpd_policy_note (
+    object_owner varchar2(128) not null,
+    object_name varchar2(128) not null,
+    policy_name varchar2(128) not null,
+    description varchar2(2000),
+    updated_at timestamp default systimestamp not null,
+    constraint sg_vpd_policy_note_pk primary key (object_owner, object_name, policy_name)
+  )');
+  create_if_missing('create table sg_vpd_filter_note (
+    function_owner varchar2(128) not null,
+    function_name varchar2(128) not null,
+    description varchar2(2000),
+    updated_at timestamp default systimestamp not null,
+    constraint sg_vpd_filter_note_pk primary key (function_owner, function_name)
+  )');
+  create_if_missing('create table sg_masking_rule (
+    rule_id number primary key,
+    rule_code varchar2(100) not null unique,
+    rule_name varchar2(200) not null,
+    template_code varchar2(100) not null,
+    description varchar2(2000),
+    enabled_yn char(1) default ''Y'' not null,
+    created_at timestamp default systimestamp not null,
+    updated_at timestamp default systimestamp not null,
+    constraint sg_masking_rule_enabled_ck check (enabled_yn in (''Y'', ''N''))
+  )');
+  create_if_missing('create table sg_access_bearer_token (
+    key_id number primary key, user_id number not null, key_prefix varchar2(100) not null,
+    key_hash varchar2(256) not null unique, expires_at timestamp not null, revoked_at timestamp,
+    description varchar2(500), created_at timestamp default systimestamp not null,
+    constraint sg_access_bearer_token_user_fk foreign key (user_id) references sg_app_user(user_id)
+  )');
+  create_if_missing('create table sg_backoffice_setting (
+    setting_key varchar2(200) primary key, setting_value varchar2(4000),
+    updated_at timestamp default systimestamp not null
+  )');
+  create_if_missing('create table sg_vector_document_chunk (
+    chunk_id number primary key, document_id varchar2(200) not null, chunk_no number not null,
+    content clob not null, embedding vector(1536, float32), created_at timestamp default systimestamp not null
+  )');
+  create_if_missing('create table sg_vector_document_tag (
+    chunk_id number not null, tech_tag varchar2(200) not null,
+    constraint sg_vector_document_tag_pk primary key (chunk_id, tech_tag),
+    constraint sg_vector_document_tag_chunk_fk foreign key (chunk_id) references sg_vector_document_chunk(chunk_id)
+  )');
+  create_if_missing('create sequence sg_vector_chunk_seq start with 1 increment by 1 nocache');
+  create_if_missing('create table sg_column_masking_rule (
+    column_id number primary key,
+    rule_id number not null,
+    updated_at timestamp default systimestamp not null,
+    constraint sg_column_masking_rule_column_fk foreign key (column_id) references sg_protected_column(column_id),
+    constraint sg_column_masking_rule_rule_fk foreign key (rule_id) references sg_masking_rule(rule_id)
+  )');
+  create_if_missing('create table sg_user_masking_rule (
+    user_id number not null,
+    column_id number not null,
+    decision varchar2(30) not null,
+    active_yn char(1) default ''Y'' not null,
+    updated_at timestamp default systimestamp not null,
+    constraint sg_user_masking_rule_pk primary key (user_id, column_id),
+    constraint sg_user_masking_rule_user_fk foreign key (user_id) references sg_app_user(user_id),
+    constraint sg_user_masking_rule_column_fk foreign key (column_id) references sg_protected_column(column_id)
+  )');
 end;
 /
 
@@ -168,3 +231,99 @@ merge into sg_group_role t using (select 2001 group_id, 3002 role_id from dual)
 on (t.group_id=s.group_id and t.role_id=s.role_id) when not matched then insert (group_id, role_id) values (s.group_id, s.role_id);
 
 commit;
+
+-- Compatibility layer for remaining backoffice modules.  The data is stored
+-- only in SG_* tables; these views prevent older controller paths from
+-- querying non-existent CB_* physical tables during the Smilegate transition.
+create or replace view cb_app_user as
+select user_id, user_name, employee_no, dept_code, can_read_contents, active from sg_app_user;
+create or replace view cb_app_group as
+select group_id, group_code, group_name, description, active_yn from sg_app_group;
+create or replace view cb_app_role as
+select role_id, role_name, max_sensitivity_level from sg_app_role;
+create or replace view cb_user_role as select user_id, role_id from sg_user_role;
+create or replace view cb_user_group as select group_id, user_id from sg_user_group;
+create or replace view cb_group_role as select group_id, role_id from sg_group_role;
+create or replace view cb_protected_object as
+select object_id, owner, object_name, ords_path, enabled_yn, description from sg_protected_object;
+create or replace view cb_protected_column as
+select column_id, object_id, column_name, sensitive_yn, visible_role_id, sensitivity_level, redaction_method from sg_protected_column;
+create or replace view cb_permission as
+select perm_id, role_id, target_name, action_name, permission_effect from sg_permission;
+create or replace view cb_permission_rule as
+select rule_id, perm_id, rule_column, rule_type, rule_value from sg_permission_rule;
+create or replace view cb_permission_column as
+select permission_id, column_name from sg_permission_column;
+create or replace view cb_vpd_policy_note as
+select object_owner, object_name, policy_name, description, updated_at from sg_vpd_policy_note;
+create or replace view cb_vpd_filter_note as
+select function_owner, function_name, description, updated_at from sg_vpd_filter_note;
+create or replace view cb_masking_rule as
+select rule_id, rule_code, rule_name, template_code, description, enabled_yn from sg_masking_rule;
+create or replace view cb_column_masking_rule as
+select column_id, rule_id, updated_at from sg_column_masking_rule;
+create or replace view cb_user_masking_rule as
+select user_id, column_id, decision, active_yn, updated_at from sg_user_masking_rule;
+create or replace view cb_ords_probe_audit as
+select audit_id, event_type, key_id, object_id, status, row_count, error_code, message, created_at from sg_audit_event;
+create or replace view cb_backoffice_setting as
+select setting_key, setting_value, updated_at from sg_backoffice_setting;
+
+-- PoC administrator access: both demo operators can manage and query every
+-- Smilegate game-data object registered in SGMP_POC.
+merge into sg_app_role t
+using (select 3099 role_id, 'DATA_AI_POC_ADMIN' role_name,
+              'Full access to all Smilegate PoC game-data objects' description,
+              'RESTRICTED' max_sensitivity_level from dual) s
+on (t.role_id = s.role_id)
+when matched then update set t.role_name=s.role_name, t.description=s.description,
+                             t.max_sensitivity_level=s.max_sensitivity_level, t.updated_at=systimestamp
+when not matched then insert (role_id, role_name, description, max_sensitivity_level)
+values (s.role_id, s.role_name, s.description, s.max_sensitivity_level);
+
+merge into sg_user_role t
+using (select 1001 user_id, 3099 role_id from dual union all select 1002, 3099 from dual) s
+on (t.user_id=s.user_id and t.role_id=s.role_id)
+when not matched then insert (user_id, role_id) values (s.user_id, s.role_id);
+
+declare
+  l_object_id number;
+  l_permission_id number;
+begin
+  for source_object in (
+    select table_name
+    from all_tables
+    where owner = 'SGMP_POC'
+      and table_name not in ('SEMANTIC_METADATA_CHANGE_LOG', 'SGMP_TERM_CONTEXT_CACHE',
+                             'SGMP_TERM_DICTIONARY', 'SGMP_TERM_SEARCH_LOG', 'SGMP_TERM_SYNONYM')
+    order by table_name
+  ) loop
+    begin
+      select object_id into l_object_id
+      from sg_protected_object
+      where owner = 'SGMP_POC' and object_name = source_object.table_name;
+    exception
+      when no_data_found then
+        select nvl(max(object_id), 0) + 1 into l_object_id from sg_protected_object;
+        insert into sg_protected_object (object_id, owner, object_name, ords_path, enabled_yn, description)
+        values (l_object_id, 'SGMP_POC', source_object.table_name,
+                '/sgmp-poc/' || lower(source_object.table_name), 'Y',
+                'Smilegate PoC game-data object');
+    end;
+
+    begin
+      select perm_id into l_permission_id
+      from sg_permission
+      where role_id = 3099 and target_name = source_object.table_name;
+    exception
+      when no_data_found then
+        l_permission_id := sg_permission_seq.nextval;
+        insert into sg_permission (perm_id, role_id, target_name, action_name, permission_effect)
+        values (l_permission_id, 3099, source_object.table_name, 'SELECT', 'ALLOW');
+        insert into sg_permission_rule (rule_id, perm_id, rule_column, rule_type, rule_value)
+        values (sg_permission_rule_seq.nextval, l_permission_id, null, 'ALL', null);
+    end;
+  end loop;
+  commit;
+end;
+/

vpd-backoffice/src/main/java/com/cloudhandson/vpdbackoffice/config/SecurityConfig.java

@@ -37,7 +37,7 @@ public class SecurityConfig {
           .rememberMeCookieName("VPD_REMEMBER_ME")
           .tokenValiditySeconds(security.rememberMeValiditySeconds())
           .useSecureCookie(true)
-          .alwaysRemember(false));
+          .alwaysRemember(true));
     }
 
     return http