-- ============================================================
-- 60_kb_vpd_admin_full_access_token.sql
--
-- Creates the KB_VPD_ADMIN application user and grants the explicit
-- physical condition STATIC_SQL / 1 = 1 for every KB protected object.
--
-- Execute as ADMIN using SQLcl with one positional argument: the newly
-- generated Bearer token. Do not print or commit that argument.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO OFF
SET FEEDBACK ON
SET DEFINE ON
SET VERIFY OFF
SET SERVEROUTPUT ON

DEFINE bearer_token = '&1'

DECLARE
  c_stakeholder_user_id CONSTANT VARCHAR2(30) := 'KB_VPD_ADMIN';
  c_role_name           CONSTANT VARCHAR2(80) := 'KB_VPD_ADMIN_ROLE';
  c_token_description   CONSTANT VARCHAR2(200) := 'KB VPD admin full-access token';

  v_admin_role_id       NUMBER;
  v_identity_role_id    NUMBER;
  v_app_user_id         NUMBER;
  v_permission_id       NUMBER;
  v_count               NUMBER;

  PROCEDURE ensure_role(
    p_role_name IN VARCHAR2,
    p_level     IN VARCHAR2,
    p_role_id   OUT NUMBER
  ) IS
  BEGIN
    SELECT role_id INTO p_role_id
    FROM cb_app_role
    WHERE role_name = p_role_name;
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT NVL(MAX(role_id), 0) + 1 INTO p_role_id FROM cb_app_role;
      INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
      VALUES (p_role_id, p_role_name, p_level);
  END;

  PROCEDURE ensure_user_role(p_user_id IN NUMBER, p_role_id IN NUMBER) IS
  BEGIN
    SELECT COUNT(*) INTO v_count
    FROM cb_user_role
    WHERE user_id = p_user_id AND role_id = p_role_id;
    IF v_count = 0 THEN
      INSERT INTO cb_user_role(user_id, role_id) VALUES (p_user_id, p_role_id);
    END IF;
  END;

  PROCEDURE ensure_full_access(p_target_name IN VARCHAR2) IS
  BEGIN
    SELECT MIN(perm_id) INTO v_permission_id
    FROM cb_permission
    WHERE role_id = v_admin_role_id
      AND target_name = p_target_name
      AND action_name = 'SELECT';

    IF v_permission_id IS NULL THEN
      SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
      INSERT INTO cb_permission(
        perm_id, role_id, target_name, action_name, permission_effect
      ) VALUES (
        v_permission_id, v_admin_role_id, p_target_name, 'SELECT', 'ALLOW'
      );
    ELSE
      UPDATE cb_permission
      SET permission_effect = 'ALLOW'
      WHERE perm_id = v_permission_id;
    END IF;

    DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
    INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
    VALUES (
      cb_permission_rule_seq.NEXTVAL, v_permission_id, NULL, 'STATIC_SQL', '1 = 1'
    );

    EXECUTE IMMEDIATE
      'GRANT SELECT ON POC_2.' || DBMS_ASSERT.SIMPLE_SQL_NAME(p_target_name) || ' TO CB_ORDS';
  END;

  PROCEDURE allow_original_column(p_target_name IN VARCHAR2, p_column_name IN VARCHAR2) IS
  BEGIN
    SELECT MIN(perm_id) INTO v_permission_id
    FROM cb_permission
    WHERE role_id = v_admin_role_id
      AND target_name = p_target_name
      AND action_name = 'SELECT';

    SELECT COUNT(*) INTO v_count
    FROM cb_permission_column
    WHERE permission_id = v_permission_id
      AND column_name = p_column_name;
    IF v_count = 0 THEN
      INSERT INTO cb_permission_column(permission_id, column_name)
      VALUES (v_permission_id, p_column_name);
    END IF;
  END;
BEGIN
  MERGE INTO poc_2.kb_stakeholders target
  USING (
    SELECT c_stakeholder_user_id AS user_id,
           'VPD 관리자' AS user_nm,
           '관리자' AS role,
           '관리자채널' AS channel,
           '전체 KB 원장 및 민감 컬럼 접근' AS access_scope,
           '모든 보호 객체에 STATIC_SQL / 1 = 1 적용' AS rls_filter
    FROM dual
  ) source
  ON (target.user_id = source.user_id)
  WHEN MATCHED THEN UPDATE SET
    target.user_nm = source.user_nm,
    target.role = source.role,
    target.channel = source.channel,
    target.access_scope = source.access_scope,
    target.rls_filter = source.rls_filter
  WHEN NOT MATCHED THEN INSERT (
    user_id, user_nm, role, channel, access_scope, rls_filter
  ) VALUES (
    source.user_id, source.user_nm, source.role, source.channel,
    source.access_scope, source.rls_filter
  );

  BEGIN
    SELECT user_id INTO v_app_user_id
    FROM cb_app_user
    WHERE stakeholder_user_id = c_stakeholder_user_id;
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT NVL(MAX(user_id), 0) + 1 INTO v_app_user_id FROM cb_app_user;
      INSERT INTO cb_app_user(
        user_id, user_name, employee_no, dept_code,
        stakeholder_user_id, can_read_contents, active
      ) VALUES (
        v_app_user_id, 'VPD 관리자', c_stakeholder_user_id, '관리자채널',
        c_stakeholder_user_id, 'Y', 'Y'
      );
  END;

  UPDATE cb_app_user
  SET user_name = 'VPD 관리자',
      employee_no = c_stakeholder_user_id,
      dept_code = '관리자채널',
      can_read_contents = 'Y',
      active = 'Y'
  WHERE user_id = v_app_user_id;

  ensure_role(c_role_name, 'RESTRICTED', v_admin_role_id);
  ensure_role('KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL', v_identity_role_id);
  ensure_user_role(v_app_user_id, v_admin_role_id);
  ensure_user_role(v_app_user_id, v_identity_role_id);

  FOR object_name IN (
    SELECT column_value
    FROM TABLE(sys.odcivarchar2list(
      'KB_STAKEHOLDERS', 'KB_CLAIMS', 'KB_CONTRACTS', 'KB_COVERAGES',
      'KB_CUSTOMERS', 'KB_EXTERNAL_HOLDINGS', 'KB_PRODUCTS'
    ))
  ) LOOP
    ensure_full_access(object_name.column_value);
  END LOOP;

  allow_original_column('KB_CUSTOMERS', 'CUST_NM');
  allow_original_column('KB_CUSTOMERS', 'RRN_MASKED');
  allow_original_column('KB_CLAIMS', 'CLAIM_AMT');
  allow_original_column('KB_CLAIMS', 'PAID_AMT');
  allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_INSURER');
  allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_GRP');
  allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_TYPE');

  UPDATE cb_agent_bearer_key
  SET active = 'N', revoked_at = SYSDATE
  WHERE stakeholder_user_id = c_stakeholder_user_id
    AND active = 'Y';

  INSERT INTO cb_agent_bearer_key(
    key_id, user_id, stakeholder_user_id, key_prefix, key_hash,
    issued_at, expires_at, revoked_at, active, description
  ) VALUES (
    cb_agent_bearer_key_seq.NEXTVAL, v_app_user_id, c_stakeholder_user_id,
    'kbvpdadm', STANDARD_HASH('&&bearer_token', 'SHA256'),
    SYSDATE, ADD_MONTHS(SYSDATE, 12), NULL, 'Y', c_token_description
  );

  COMMIT;
  DBMS_OUTPUT.PUT_LINE('STAKEHOLDER_USER_ID=' || c_stakeholder_user_id);
  DBMS_OUTPUT.PUT_LINE('ROLE_NAME=' || c_role_name);
  DBMS_OUTPUT.PUT_LINE('OBJECT_PERMISSION_COUNT=7');
END;
/

UNDEFINE bearer_token
EXIT