199 lines
6.6 KiB
MySQL
199 lines
6.6 KiB
MySQL
-- ============================================================
|
|
-- 60_kb_vpd_admin_full_access_token.sql
|
|
--
|
|
-- Creates the KB_VPD_ADMIN application user and grants the explicit
|
|
-- physical condition STATIC_SQL / 1 = 1 for every KB protected object.
|
|
--
|
|
-- Execute as ADMIN using SQLcl with one positional argument: the newly
|
|
-- generated Bearer token. Do not print or commit that argument.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
SET DEFINE ON
|
|
SET VERIFY OFF
|
|
SET SERVEROUTPUT ON
|
|
|
|
DEFINE bearer_token = '&1'
|
|
|
|
DECLARE
|
|
c_stakeholder_user_id CONSTANT VARCHAR2(30) := 'KB_VPD_ADMIN';
|
|
c_role_name CONSTANT VARCHAR2(80) := 'KB_VPD_ADMIN_ROLE';
|
|
c_token_description CONSTANT VARCHAR2(200) := 'KB VPD admin full-access token';
|
|
|
|
v_admin_role_id NUMBER;
|
|
v_identity_role_id NUMBER;
|
|
v_app_user_id NUMBER;
|
|
v_permission_id NUMBER;
|
|
v_count NUMBER;
|
|
|
|
PROCEDURE ensure_role(
|
|
p_role_name IN VARCHAR2,
|
|
p_level IN VARCHAR2,
|
|
p_role_id OUT NUMBER
|
|
) IS
|
|
BEGIN
|
|
SELECT role_id INTO p_role_id
|
|
FROM cb_app_role
|
|
WHERE role_name = p_role_name;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(role_id), 0) + 1 INTO p_role_id FROM cb_app_role;
|
|
INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
|
|
VALUES (p_role_id, p_role_name, p_level);
|
|
END;
|
|
|
|
PROCEDURE ensure_user_role(p_user_id IN NUMBER, p_role_id IN NUMBER) IS
|
|
BEGIN
|
|
SELECT COUNT(*) INTO v_count
|
|
FROM cb_user_role
|
|
WHERE user_id = p_user_id AND role_id = p_role_id;
|
|
IF v_count = 0 THEN
|
|
INSERT INTO cb_user_role(user_id, role_id) VALUES (p_user_id, p_role_id);
|
|
END IF;
|
|
END;
|
|
|
|
PROCEDURE ensure_full_access(p_target_name IN VARCHAR2) IS
|
|
BEGIN
|
|
SELECT MIN(perm_id) INTO v_permission_id
|
|
FROM cb_permission
|
|
WHERE role_id = v_admin_role_id
|
|
AND target_name = p_target_name
|
|
AND action_name = 'SELECT';
|
|
|
|
IF v_permission_id IS NULL THEN
|
|
SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
|
|
INSERT INTO cb_permission(
|
|
perm_id, role_id, target_name, action_name, permission_effect
|
|
) VALUES (
|
|
v_permission_id, v_admin_role_id, p_target_name, 'SELECT', 'ALLOW'
|
|
);
|
|
ELSE
|
|
UPDATE cb_permission
|
|
SET permission_effect = 'ALLOW'
|
|
WHERE perm_id = v_permission_id;
|
|
END IF;
|
|
|
|
DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
|
|
INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
|
|
VALUES (
|
|
cb_permission_rule_seq.NEXTVAL, v_permission_id, NULL, 'STATIC_SQL', '1 = 1'
|
|
);
|
|
|
|
EXECUTE IMMEDIATE
|
|
'GRANT SELECT ON POC_2.' || DBMS_ASSERT.SIMPLE_SQL_NAME(p_target_name) || ' TO CB_ORDS';
|
|
END;
|
|
|
|
PROCEDURE allow_original_column(p_target_name IN VARCHAR2, p_column_name IN VARCHAR2) IS
|
|
BEGIN
|
|
SELECT MIN(perm_id) INTO v_permission_id
|
|
FROM cb_permission
|
|
WHERE role_id = v_admin_role_id
|
|
AND target_name = p_target_name
|
|
AND action_name = 'SELECT';
|
|
|
|
SELECT COUNT(*) INTO v_count
|
|
FROM cb_permission_column
|
|
WHERE permission_id = v_permission_id
|
|
AND column_name = p_column_name;
|
|
IF v_count = 0 THEN
|
|
INSERT INTO cb_permission_column(permission_id, column_name)
|
|
VALUES (v_permission_id, p_column_name);
|
|
END IF;
|
|
END;
|
|
BEGIN
|
|
MERGE INTO poc_2.kb_stakeholders target
|
|
USING (
|
|
SELECT c_stakeholder_user_id AS user_id,
|
|
'VPD 관리자' AS user_nm,
|
|
'관리자' AS role,
|
|
'관리자채널' AS channel,
|
|
'전체 KB 원장 및 민감 컬럼 접근' AS access_scope,
|
|
'모든 보호 객체에 STATIC_SQL / 1 = 1 적용' AS rls_filter
|
|
FROM dual
|
|
) source
|
|
ON (target.user_id = source.user_id)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
target.user_nm = source.user_nm,
|
|
target.role = source.role,
|
|
target.channel = source.channel,
|
|
target.access_scope = source.access_scope,
|
|
target.rls_filter = source.rls_filter
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
user_id, user_nm, role, channel, access_scope, rls_filter
|
|
) VALUES (
|
|
source.user_id, source.user_nm, source.role, source.channel,
|
|
source.access_scope, source.rls_filter
|
|
);
|
|
|
|
BEGIN
|
|
SELECT user_id INTO v_app_user_id
|
|
FROM cb_app_user
|
|
WHERE stakeholder_user_id = c_stakeholder_user_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(user_id), 0) + 1 INTO v_app_user_id FROM cb_app_user;
|
|
INSERT INTO cb_app_user(
|
|
user_id, user_name, employee_no, dept_code,
|
|
stakeholder_user_id, can_read_contents, active
|
|
) VALUES (
|
|
v_app_user_id, 'VPD 관리자', c_stakeholder_user_id, '관리자채널',
|
|
c_stakeholder_user_id, 'Y', 'Y'
|
|
);
|
|
END;
|
|
|
|
UPDATE cb_app_user
|
|
SET user_name = 'VPD 관리자',
|
|
employee_no = c_stakeholder_user_id,
|
|
dept_code = '관리자채널',
|
|
can_read_contents = 'Y',
|
|
active = 'Y'
|
|
WHERE user_id = v_app_user_id;
|
|
|
|
ensure_role(c_role_name, 'RESTRICTED', v_admin_role_id);
|
|
ensure_role('KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL', v_identity_role_id);
|
|
ensure_user_role(v_app_user_id, v_admin_role_id);
|
|
ensure_user_role(v_app_user_id, v_identity_role_id);
|
|
|
|
FOR object_name IN (
|
|
SELECT column_value
|
|
FROM TABLE(sys.odcivarchar2list(
|
|
'KB_STAKEHOLDERS', 'KB_CLAIMS', 'KB_CONTRACTS', 'KB_COVERAGES',
|
|
'KB_CUSTOMERS', 'KB_EXTERNAL_HOLDINGS', 'KB_PRODUCTS'
|
|
))
|
|
) LOOP
|
|
ensure_full_access(object_name.column_value);
|
|
END LOOP;
|
|
|
|
allow_original_column('KB_CUSTOMERS', 'CUST_NM');
|
|
allow_original_column('KB_CUSTOMERS', 'RRN_MASKED');
|
|
allow_original_column('KB_CLAIMS', 'CLAIM_AMT');
|
|
allow_original_column('KB_CLAIMS', 'PAID_AMT');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_INSURER');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_GRP');
|
|
allow_original_column('KB_EXTERNAL_HOLDINGS', 'EXT_PRODUCT_TYPE');
|
|
|
|
UPDATE cb_agent_bearer_key
|
|
SET active = 'N', revoked_at = SYSDATE
|
|
WHERE stakeholder_user_id = c_stakeholder_user_id
|
|
AND active = 'Y';
|
|
|
|
INSERT INTO cb_agent_bearer_key(
|
|
key_id, user_id, stakeholder_user_id, key_prefix, key_hash,
|
|
issued_at, expires_at, revoked_at, active, description
|
|
) VALUES (
|
|
cb_agent_bearer_key_seq.NEXTVAL, v_app_user_id, c_stakeholder_user_id,
|
|
'kbvpdadm', STANDARD_HASH('&&bearer_token', 'SHA256'),
|
|
SYSDATE, ADD_MONTHS(SYSDATE, 12), NULL, 'Y', c_token_description
|
|
);
|
|
|
|
COMMIT;
|
|
DBMS_OUTPUT.PUT_LINE('STAKEHOLDER_USER_ID=' || c_stakeholder_user_id);
|
|
DBMS_OUTPUT.PUT_LINE('ROLE_NAME=' || c_role_name);
|
|
DBMS_OUTPUT.PUT_LINE('OBJECT_PERMISSION_COUNT=7');
|
|
END;
|
|
/
|
|
|
|
UNDEFINE bearer_token
|
|
EXIT
|