-- ============================================================
-- 40_dds_protection_evidence.sql
-- Immutable DDS publication fingerprints and deterministic validation fixtures.
--
-- Prerequisite: 25, 32, 34. Run as ADMIN.
-- The script is idempotent and never prints a bearer secret.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO ON
SET FEEDBACK ON
SET DEFINE OFF

PROMPT === 1. Evidence metadata ===
BEGIN
  EXECUTE IMMEDIATE 'CREATE SEQUENCE cb_dds_protection_snapshot_seq START WITH 1 INCREMENT BY 1 NOCACHE';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE 'CREATE SEQUENCE cb_dds_validation_evidence_seq START WITH 1 INCREMENT BY 1 NOCACHE';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE q'[
    CREATE TABLE cb_dds_protection_snapshot (
      snapshot_id       NUMBER PRIMARY KEY,
      object_name       VARCHAR2(261) NOT NULL,
      enforcement_path  VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
      subject_key       VARCHAR2(100) NOT NULL,
      fingerprint       VARCHAR2(64) NOT NULL,
      actor             VARCHAR2(100) NOT NULL,
      note              VARCHAR2(500),
      published_at      TIMESTAMP DEFAULT SYSTIMESTAMP NOT NULL
    )]';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE q'[
    CREATE TABLE cb_dds_validation_fixture (
      fixture_id        VARCHAR2(100) PRIMARY KEY,
      enforcement_path  VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
      subject_key       VARCHAR2(100) NOT NULL,
      application_user_id NUMBER DEFAULT 0 NOT NULL,
      document_id       VARCHAR2(200) NOT NULL,
      expected_visible  CHAR(1) NOT NULL CHECK (expected_visible IN ('Y','N')),
      description       VARCHAR2(500) NOT NULL,
      active_yn         CHAR(1) DEFAULT 'Y' NOT NULL CHECK (active_yn IN ('Y','N')),
      fixture_version   VARCHAR2(40) DEFAULT 'v1' NOT NULL
    )]';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE q'[
    CREATE TABLE cb_dds_validation_evidence (
      evidence_id       NUMBER PRIMARY KEY,
      run_id            VARCHAR2(36) NOT NULL,
      fixture_id        VARCHAR2(100) NOT NULL,
      enforcement_path  VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
      subject_key       VARCHAR2(100) NOT NULL,
      expected_visible  CHAR(1) NOT NULL CHECK (expected_visible IN ('Y','N')),
      actual_visible    CHAR(1) NOT NULL CHECK (actual_visible IN ('Y','N')),
      outcome           VARCHAR2(20) NOT NULL CHECK (outcome IN ('PASSED','FAILED')),
      fingerprint       VARCHAR2(64) NOT NULL,
      created_at        TIMESTAMP DEFAULT SYSTIMESTAMP NOT NULL
    )]';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE 'CREATE INDEX cb_dds_snapshot_ix ON cb_dds_protection_snapshot (enforcement_path, subject_key, published_at)';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/
BEGIN
  EXECUTE IMMEDIATE 'CREATE INDEX cb_dds_validation_ix ON cb_dds_validation_evidence (enforcement_path, subject_key, created_at)';
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
/

PROMPT === 2. Deterministic SERVICE fixtures ===
MERGE INTO cb_app_user target
USING (SELECT 9904 user_id, 'dds_fixture_agent' user_name, 'E9904' employee_no,
              'DDS' dept_code, 'N' can_read_contents, 'Y' active FROM dual) source
ON (target.user_id = source.user_id)
WHEN MATCHED THEN UPDATE SET target.user_name = source.user_name, target.employee_no = source.employee_no,
  target.dept_code = source.dept_code, target.can_read_contents = source.can_read_contents, target.active = source.active
WHEN NOT MATCHED THEN INSERT (user_id, user_name, employee_no, dept_code, can_read_contents, active)
  VALUES (source.user_id, source.user_name, source.employee_no, source.dept_code, source.can_read_contents, source.active);

MERGE INTO cb_app_role target
USING (SELECT 9904 role_id, 'DDS_FIXTURE_ALLOW_ROLE' role_name, 'INTERNAL' max_sensitivity_level FROM dual) source
ON (target.role_id = source.role_id)
WHEN MATCHED THEN UPDATE SET target.role_name = source.role_name, target.max_sensitivity_level = source.max_sensitivity_level
WHEN NOT MATCHED THEN INSERT (role_id, role_name, max_sensitivity_level)
  VALUES (source.role_id, source.role_name, source.max_sensitivity_level);

MERGE INTO cb_user_role target
USING (SELECT 9904 user_id, 9904 role_id FROM dual) source
ON (target.user_id = source.user_id AND target.role_id = source.role_id)
WHEN NOT MATCHED THEN INSERT (user_id, role_id) VALUES (source.user_id, source.role_id);

MERGE INTO cb_permission target
USING (SELECT 9904 perm_id, 9904 role_id, 'CB_VECTOR_SEARCH_DOCUMENTS' target_name,
              'SELECT' action_name, 'ALLOW' permission_effect FROM dual) source
ON (target.perm_id = source.perm_id)
WHEN MATCHED THEN UPDATE SET target.role_id = source.role_id, target.target_name = source.target_name,
  target.action_name = source.action_name, target.permission_effect = source.permission_effect
WHEN NOT MATCHED THEN INSERT (perm_id, role_id, target_name, action_name, permission_effect)
  VALUES (source.perm_id, source.role_id, source.target_name, source.action_name, source.permission_effect);

MERGE INTO cb_permission_rule target
USING (SELECT 9904 rule_id, 9904 perm_id, 'TECH_TAG' rule_column, 'TAG' rule_type,
              'DDS_VERIFY_ALLOW' rule_value FROM dual) source
ON (target.rule_id = source.rule_id)
WHEN MATCHED THEN UPDATE SET target.perm_id = source.perm_id, target.rule_column = source.rule_column,
  target.rule_type = source.rule_type, target.rule_value = source.rule_value
WHEN NOT MATCHED THEN INSERT (rule_id, perm_id, rule_column, rule_type, rule_value)
  VALUES (source.rule_id, source.perm_id, source.rule_column, source.rule_type, source.rule_value);

MERGE INTO cb_vector_document_chunk target
USING (SELECT 29040 chunk_id, 'dds-fixture-service-allow' document_id, 1 chunk_no,
              'DDS verification allow fixture' title, TO_CLOB('Deterministic allow fixture.') chunk_text,
              'fixture://dds/service/allow' source_uri, TO_VECTOR('[0.11,0.22,0.33,0.44]') embedding FROM dual) source
ON (target.chunk_id = source.chunk_id)
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
  target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
  VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);

MERGE INTO cb_vector_document_chunk target
USING (SELECT 29041 chunk_id, 'dds-fixture-service-deny' document_id, 1 chunk_no,
              'DDS verification deny fixture' title, TO_CLOB('Deterministic deny fixture.') chunk_text,
              'fixture://dds/service/deny' source_uri, TO_VECTOR('[0.12,0.23,0.34,0.45]') embedding FROM dual) source
ON (target.chunk_id = source.chunk_id)
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
  target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
  VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);

MERGE INTO cb_vector_document_chunk target
USING (SELECT 29042 chunk_id, 'dds-fixture-direct' document_id, 1 chunk_no,
              'DDS direct comparison fixture' title, TO_CLOB('Deterministic direct fixture.') chunk_text,
              'fixture://dds/direct' source_uri, TO_VECTOR('[0.13,0.24,0.35,0.46]') embedding FROM dual) source
ON (target.chunk_id = source.chunk_id)
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
  target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
  VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);

MERGE INTO cb_vector_document_tag target USING (SELECT 29040 chunk_id, 'DDS_VERIFY_ALLOW' tech_tag FROM dual) source
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);
MERGE INTO cb_vector_document_tag target USING (SELECT 29041 chunk_id, 'DDS_VERIFY_DENY' tech_tag FROM dual) source
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);
MERGE INTO cb_vector_document_tag target USING (SELECT 29042 chunk_id, 'ORACLE_DDS' tech_tag FROM dual) source
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);

PROMPT === 3. Registering fixture manifest ===
MERGE INTO cb_dds_validation_fixture target
USING (SELECT 'SERVICE_ALLOW' fixture_id, 'SERVICE' enforcement_path, 'service' subject_key, 9904 application_user_id,
              'dds-fixture-service-allow' document_id, 'Y' expected_visible, 'Temporary token sees allowed tag' description FROM dual) source
ON (target.fixture_id = source.fixture_id)
WHEN MATCHED THEN UPDATE SET target.enforcement_path = source.enforcement_path, target.subject_key = source.subject_key,
  target.application_user_id = source.application_user_id, target.document_id = source.document_id,
  target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
  VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
MERGE INTO cb_dds_validation_fixture target
USING (SELECT 'SERVICE_DENY' fixture_id, 'SERVICE' enforcement_path, 'service' subject_key, 9904 application_user_id,
              'dds-fixture-service-deny' document_id, 'N' expected_visible, 'Temporary token cannot see denied tag' description FROM dual) source
ON (target.fixture_id = source.fixture_id)
WHEN MATCHED THEN UPDATE SET target.enforcement_path = source.enforcement_path, target.subject_key = source.subject_key,
  target.application_user_id = source.application_user_id, target.document_id = source.document_id,
  target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
  VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
MERGE INTO cb_dds_validation_fixture target
USING (SELECT 'DIRECT_ALLOW' fixture_id, 'DIRECT' enforcement_path, 'both' subject_key, 0 application_user_id,
              'dds-fixture-direct' document_id, 'Y' expected_visible, 'Combined DDS profile sees direct fixture' description FROM dual) source
ON (target.fixture_id = source.fixture_id)
WHEN MATCHED THEN UPDATE SET target.subject_key = source.subject_key, target.document_id = source.document_id,
  target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
  VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
MERGE INTO cb_dds_validation_fixture target
USING (SELECT 'DIRECT_DENY' fixture_id, 'DIRECT' enforcement_path, 'none' subject_key, 0 application_user_id,
              'dds-fixture-direct' document_id, 'N' expected_visible, 'Default deny DDS profile cannot see fixture' description FROM dual) source
ON (target.fixture_id = source.fixture_id)
WHEN MATCHED THEN UPDATE SET target.subject_key = source.subject_key, target.document_id = source.document_id,
  target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
  VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);

PROMPT === 4. Recording the service baseline ===
MERGE INTO cb_dds_protection_snapshot target
USING (
  SELECT 'SERVICE' enforcement_path, 'service' subject_key,
         STANDARD_HASH('SERVICE|ADMIN.CB_DDS_VECTOR_SEARCH_DOCUMENTS|CB_DDS_TOKEN_ROLE|DDS_DEMO_TOKEN_VECTOR_GRANT|ADMIN.CB_DDS_VECTOR_TAG_ALLOWED', 'SHA256') fingerprint
  FROM dual
) source
ON (target.enforcement_path = source.enforcement_path AND target.subject_key = source.subject_key)
WHEN NOT MATCHED THEN INSERT (snapshot_id, object_name, enforcement_path, subject_key, fingerprint, actor, note, published_at)
  VALUES (cb_dds_protection_snapshot_seq.NEXTVAL, 'ADMIN.CB_DDS_VECTOR_SEARCH_DOCUMENTS', source.enforcement_path,
          source.subject_key, source.fingerprint, 'DDS migration', 'Initial token-service baseline', SYSTIMESTAMP);

COMMIT;

SELECT fixture_id, enforcement_path, subject_key, expected_visible
FROM cb_dds_validation_fixture
ORDER BY fixture_id;

PROMPT === DDS protection evidence setup complete ===
EXIT;
