vpd-permission-poc/database/adb/36_dds_sales_knowledge_scenario.sql

-- ============================================================
-- 36_dds_sales_knowledge_scenario.sql
-- Business scenario fixture: a sales employee searches only SALES-tagged
-- vector knowledge with a bearer token.
--
-- The access value is stored in CB_VECTOR_DOCUMENT_TAG.TECH_TAG.  The
-- existing DDS token Data Grant (34_...) reads the common CB_* permission
-- tables at query time, so this script only adds the business user, role,
-- permission rule, sample chunk, and a short-lived demo token.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO ON
SET FEEDBACK ON
SET DEFINE OFF

PROMPT === 1. Adding the sales business user and role ===
MERGE INTO cb_app_user target
USING (
  SELECT 104 user_id, 'agent_sales' user_name, 'E3001' employee_no,
         'SALES' dept_code, 'N' can_read_contents, 'Y' active
  FROM dual
) source
ON (target.user_id = source.user_id)
WHEN MATCHED THEN UPDATE SET
  target.user_name = source.user_name,
  target.employee_no = source.employee_no,
  target.dept_code = source.dept_code,
  target.can_read_contents = source.can_read_contents,
  target.active = source.active
WHEN NOT MATCHED THEN INSERT (
  user_id, user_name, employee_no, dept_code, can_read_contents, active
) VALUES (
  source.user_id, source.user_name, source.employee_no,
  source.dept_code, source.can_read_contents, source.active
);

MERGE INTO cb_app_role target
USING (
  SELECT 40 role_id, 'SALES_KNOWLEDGE_ROLE' role_name,
         'INTERNAL' max_sensitivity_level
  FROM dual
) source
ON (target.role_id = source.role_id)
WHEN MATCHED THEN UPDATE SET
  target.role_name = source.role_name,
  target.max_sensitivity_level = source.max_sensitivity_level
WHEN NOT MATCHED THEN INSERT (
  role_id, role_name, max_sensitivity_level
) VALUES (
  source.role_id, source.role_name, source.max_sensitivity_level
);

MERGE INTO cb_user_role target
USING (SELECT 104 user_id, 40 role_id FROM dual) source
ON (target.user_id = source.user_id AND target.role_id = source.role_id)
WHEN NOT MATCHED THEN INSERT (user_id, role_id)
VALUES (source.user_id, source.role_id);

PROMPT === 2. Registering SALES as the allowed knowledge value ===
MERGE INTO cb_permission target
USING (
  SELECT 400 perm_id, 40 role_id, 'CB_VECTOR_SEARCH_DOCUMENTS' target_name,
         'SELECT' action_name, 'ALLOW' permission_effect
  FROM dual
) source
ON (target.perm_id = source.perm_id)
WHEN MATCHED THEN UPDATE SET
  target.role_id = source.role_id,
  target.target_name = source.target_name,
  target.action_name = source.action_name,
  target.permission_effect = source.permission_effect
WHEN NOT MATCHED THEN INSERT (
  perm_id, role_id, target_name, action_name, permission_effect
) VALUES (
  source.perm_id, source.role_id, source.target_name,
  source.action_name, source.permission_effect
);

MERGE INTO cb_permission_rule target
USING (
  SELECT 4000 rule_id, 400 perm_id, 'TECH_TAG' rule_column,
         'TAG' rule_type, 'SALES' rule_value
  FROM dual
) source
ON (target.rule_id = source.rule_id)
WHEN MATCHED THEN UPDATE SET
  target.perm_id = source.perm_id,
  target.rule_column = source.rule_column,
  target.rule_type = source.rule_type,
  target.rule_value = source.rule_value
WHEN NOT MATCHED THEN INSERT (
  rule_id, perm_id, rule_column, rule_type, rule_value
) VALUES (
  source.rule_id, source.perm_id, source.rule_column,
  source.rule_type, source.rule_value
);

PROMPT === 3. Adding a SALES-tagged vector knowledge chunk ===
MERGE INTO cb_vector_document_chunk target
USING (
  SELECT 28004 chunk_id, 'knowledge-sales-001' document_id, 1 chunk_no,
         '세일즈 파이프라인 운영 가이드' title,
         TO_CLOB('세일즈 파이프라인 단계별 관리 기준과 영업 담당자용 고객 후속 조치 가이드입니다.') chunk_text,
         'kb://business/sales/pipeline' source_uri,
         TO_VECTOR('[0.65,0.25,0.15,0.10]') embedding
  FROM dual
) source
ON (target.chunk_id = source.chunk_id)
WHEN MATCHED THEN UPDATE SET
  target.document_id = source.document_id,
  target.chunk_no = source.chunk_no,
  target.title = source.title,
  target.chunk_text = source.chunk_text,
  target.source_uri = source.source_uri,
  target.embedding = source.embedding
WHEN NOT MATCHED THEN INSERT (
  chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding
) VALUES (
  source.chunk_id, source.document_id, source.chunk_no, source.title,
  source.chunk_text, source.source_uri, source.embedding
);

MERGE INTO cb_vector_document_tag target
USING (SELECT 28004 chunk_id, 'SALES' tech_tag FROM dual) source
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag)
VALUES (source.chunk_id, source.tech_tag);

MERGE INTO cb_vector_document_tag target
USING (SELECT 28004 chunk_id, 'INTERNAL' tech_tag FROM dual) source
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag)
VALUES (source.chunk_id, source.tech_tag);

PROMPT === 4. Issuing a short-lived demo token ===
DECLARE
  v_key_id NUMBER;
BEGIN
  UPDATE cb_agent_bearer_key
  SET    user_id = 104,
         key_hash = STANDARD_HASH('dds_sales_demo_token', 'SHA256'),
         active = 'Y',
         revoked_at = NULL,
         expires_at = SYSDATE + (1 / 24)
  WHERE  key_prefix = 'sales_demo';

  IF SQL%ROWCOUNT = 0 THEN
    SELECT NVL(MAX(key_id), 0) + 1 INTO v_key_id FROM cb_agent_bearer_key;
    INSERT INTO cb_agent_bearer_key (
      key_id, user_id, key_hash, key_prefix, issued_at,
      expires_at, revoked_at, active
    ) VALUES (
      v_key_id, 104, STANDARD_HASH('dds_sales_demo_token', 'SHA256'),
      'sales_demo', SYSDATE, SYSDATE + (1 / 24), NULL, 'Y'
    );
  END IF;
END;
/

COMMIT;

SELECT u.user_name, u.dept_code, r.role_name,
       p.target_name, pr.rule_column, pr.rule_value,
       'dds_sales_demo_token' AS demo_token
FROM   cb_app_user u
JOIN   cb_user_role ur ON ur.user_id = u.user_id
JOIN   cb_app_role r ON r.role_id = ur.role_id
JOIN   cb_permission p ON p.role_id = r.role_id
JOIN   cb_permission_rule pr ON pr.perm_id = p.perm_id
WHERE  u.user_id = 104;

PROMPT Sales scenario ready: use dds_sales_demo_token in the DDS token search.
EXIT;