-- DDS row/column verification fixtures. Run as ADMIN after 31 and 34.
CREATE TABLE admin.cb_dds_security_fixture (
  fixture_id NUMBER PRIMARY KEY,
  dept_code VARCHAR2(30) NOT NULL,
  owner_emp_no VARCHAR2(30) NOT NULL,
  tech_tag VARCHAR2(100) NOT NULL,
  title VARCHAR2(200) NOT NULL,
  contents VARCHAR2(2000) NOT NULL,
  public_summary VARCHAR2(500) NOT NULL
);

INSERT INTO admin.cb_dds_security_fixture VALUES (1,'SALES','E2001','SALES','영업 파이프라인','영업 원문','영업 요약');
INSERT INTO admin.cb_dds_security_fixture VALUES (2,'HR','E10234','HR','인사 운영','인사 원문','인사 요약');
INSERT INTO admin.cb_dds_security_fixture VALUES (3,'FIN','E99999','FINANCE','재무 마감','재무 원문','재무 요약');
COMMIT;

CREATE OR REPLACE DATA GRANT admin.dds_demo_token_fixture_grant
  AS SELECT (fixture_id, dept_code, owner_emp_no, tech_tag, title, public_summary)
  ON admin.cb_dds_security_fixture
  WHERE admin.cb_dds_vector_tag_allowed(tech_tag) = 1
  TO cb_dds_token_role;

-- Expected: token mapped to SALES sees row 1; HR/FIN rows are denied.
-- CONTENTS is deliberately excluded: this is the column-level deny case.