-- ============================================================
-- 47_kb_stakeholder_permission_or_branches.sql
--
-- Refines the KB example so the permission table carries the expected
-- stakeholder role and each role branch becomes an OR candidate in the
-- dynamic VPD filter. Execute after 26 and 46 as ADMIN.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO OFF
SET FEEDBACK ON
SET DEFINE OFF

PROMPT === 1. Storing expected stakeholder role in example rules ===
UPDATE cb_permission_rule r
SET rule_value = CASE
  WHEN EXISTS (
    SELECT 1
    FROM cb_permission p
    JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE p.perm_id = r.perm_id
      AND ar.role_name = 'KB_DESIGNER_ROLE'
  ) THEN '설계사'
  WHEN EXISTS (
    SELECT 1
    FROM cb_permission p
    JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE p.perm_id = r.perm_id
      AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
  ) THEN '지점장'
END
WHERE r.rule_type IN ('STAKEHOLDER_SELF', 'STAKEHOLDER_CHANNEL')
  AND EXISTS (
    SELECT 1
    FROM cb_permission p
    JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE p.perm_id = r.perm_id
      AND ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
  );

PROMPT === 2. Adding an identity role so every stakeholder token can resolve itself ===
DECLARE
  v_role_id       NUMBER;
  v_permission_id NUMBER;
  v_count         NUMBER;
BEGIN
  BEGIN
    SELECT role_id INTO v_role_id
    FROM cb_app_role
    WHERE role_name = 'KB_STAKEHOLDER_IDENTITY_ROLE';
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT NVL(MAX(role_id), 0) + 1 INTO v_role_id FROM cb_app_role;
      INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
      VALUES (v_role_id, 'KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL');
  END;

  FOR u IN (
    SELECT user_id
    FROM cb_app_user
    WHERE stakeholder_user_id IS NOT NULL
      AND active = 'Y'
  ) LOOP
    SELECT COUNT(*) INTO v_count
    FROM cb_user_role
    WHERE user_id = u.user_id
      AND role_id = v_role_id;
    IF v_count = 0 THEN
      INSERT INTO cb_user_role(user_id, role_id) VALUES (u.user_id, v_role_id);
    END IF;
  END LOOP;

  BEGIN
    SELECT perm_id INTO v_permission_id
    FROM cb_permission
    WHERE role_id = v_role_id
      AND target_name = 'KB_STAKEHOLDERS'
      AND action_name = 'SELECT';
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
      INSERT INTO cb_permission(perm_id, role_id, target_name, action_name, permission_effect)
      VALUES (v_permission_id, v_role_id, 'KB_STAKEHOLDERS', 'SELECT', 'ALLOW');
      INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
      VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, 'USER_ID', 'TOKEN_SUBJECT', NULL);
  END;
END;
/
COMMIT;

PROMPT === 3. Result: role-specific permission branches ===
SELECT ar.role_name,
       p.target_name,
       r.rule_column,
       r.rule_type,
       NVL(r.rule_value, '(token role)') AS expected_stakeholder_role
FROM cb_permission p
JOIN cb_app_role ar ON ar.role_id = p.role_id
JOIN cb_permission_rule r ON r.perm_id = p.perm_id
WHERE ar.role_name IN (
  'KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE', 'KB_STAKEHOLDER_IDENTITY_ROLE'
)
ORDER BY ar.role_name, p.target_name, r.rule_id;

PROMPT === KB role branches are combined as OR by CB_AGENT_DOC_VPD_FILTER ===