ed91306ee3
Replaces the original APAC-vs-all 2-user demo (vpduser_a/b on KR_ANALYSTS/GLOBAL_ADMINS groups) with a 2x2 source-access matrix: vpduser_my -> MY_ONLY group -> MySQL view only vpduser_pg -> PG_ONLY group -> Postgres view only vpduser_both -> BOTH_SOURCES group -> both views vpduser_none -> (no group) -> nothing (default deny) Why: source-level segmentation is the more common production permission story than region-level filtering. Region filtering remains available as an opt-in variant via commented UPDATE in sql/adb/03_seed.sql. Key changes: - 03_seed.sql, 07_end_users.sql, 00_cleanup.sql, .env.example, run.sh updated for the new 4-user model. All 4 users get identical view GRANTs; the only differentiator is the permission table (proves the model is "data-driven, not GRANT-driven"). - 08-11 split into one file per user: my (+ 5 bypass attempts), pg, both, none (default-deny verification). - 12_tests_admin_audit.sql uses LEFT JOIN so vpduser_none shows up as NULL permissions, and filters by object_owner=USER to exclude cross-schema policies. - Removed inline "-- comment" after ";" lines in 03_seed.sql: SQL*Plus silently skipped the inserts (documented gotcha). - README.md + docs/01,02 updated for the 4-user matrix. docs/03 detailed guide keeps the region-filter example but now has a preface explaining it's a variant of the default 4-user model. - docs/04: db_type='mysql_community' note added (RDS MySQL). E2E verified: PG=0/MY=17, PG=12/MY=0, PG=12/MY=17, PG=0/MY=0 plus all 5 bypass attempts blocked. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
76 lines
2.5 KiB
SQL
76 lines
2.5 KiB
SQL
-- ============================================================
|
|
-- 08_tests_user_my.sql
|
|
-- Run as VPDUSER_MY (group MY_ONLY).
|
|
--
|
|
-- Expected:
|
|
-- - regions_pg = NULL -> policy returns '1=0' -> 0 rows from PG view
|
|
-- - regions_my = '*' -> policy returns NULL -> ALL rows from MySQL view
|
|
-- - email/full_name on MySQL view are unmasked ('*' bypasses redaction)
|
|
-- - all five bypass attempts fail (this is the full bypass-attempt suite;
|
|
-- the other three user tests rerun the most relevant subset only)
|
|
-- ============================================================
|
|
SET FEEDBACK ON
|
|
SET LINESIZE 200
|
|
SET PAGESIZE 100
|
|
|
|
PROMPT
|
|
PROMPT === Who am I, and what context did the LOGON trigger load? ===
|
|
SELECT USER AS session_user,
|
|
SYS_CONTEXT('VPD_CTX','USER_ID') AS app_user_id,
|
|
SYS_CONTEXT('VPD_CTX','V_CUSTOMERS_PG') AS regions_pg,
|
|
SYS_CONTEXT('VPD_CTX','V_CUSTOMERS_MY') AS regions_my
|
|
FROM dual;
|
|
|
|
PROMPT
|
|
PROMPT === Row counts (expect: PG=0, MY=17) ===
|
|
SELECT 'V_CUSTOMERS_PG' AS view_name, COUNT(*) AS rows_visible FROM admin.v_customers_pg
|
|
UNION ALL
|
|
SELECT 'V_CUSTOMERS_MY', COUNT(*) FROM admin.v_customers_my;
|
|
|
|
PROMPT
|
|
PROMPT === MySQL view sample (expect: ALL regions, UNMASKED email/full_name) ===
|
|
COLUMN customer_id FORMAT 9999
|
|
COLUMN full_name FORMAT A20
|
|
COLUMN email FORMAT A30
|
|
COLUMN region FORMAT A8
|
|
SELECT customer_id, full_name, email, region
|
|
FROM admin.v_customers_my
|
|
ORDER BY customer_id
|
|
FETCH FIRST 5 ROWS ONLY;
|
|
|
|
PROMPT
|
|
PROMPT === PG view sample (expect: NO ROWS — fail closed) ===
|
|
SELECT customer_id, full_name, email, region
|
|
FROM admin.v_customers_pg
|
|
ORDER BY customer_id;
|
|
|
|
PROMPT
|
|
PROMPT === BYPASS 1: query remote tables directly (expect ORA-00942 / privilege error) ===
|
|
WHENEVER SQLERROR CONTINUE;
|
|
SELECT COUNT(*) FROM "public"."customers"@RDS_POSTGRES_LINK;
|
|
SELECT COUNT(*) FROM "ecommerce_poc"."customers"@RDS_LINK;
|
|
|
|
PROMPT
|
|
PROMPT === BYPASS 2: try to spoof the context (expect ORA-01031) ===
|
|
BEGIN
|
|
DBMS_SESSION.SET_CONTEXT('VPD_CTX','V_CUSTOMERS_PG','*');
|
|
END;
|
|
/
|
|
|
|
PROMPT
|
|
PROMPT === BYPASS 3: try to drop the policy (expect ORA-00942 / privilege error) ===
|
|
BEGIN
|
|
DBMS_RLS.DROP_POLICY('ADMIN','V_CUSTOMERS_PG','CUSTOMERS_PG_POLICY');
|
|
END;
|
|
/
|
|
|
|
PROMPT
|
|
PROMPT === BYPASS 4: try to read the permission table (expect ORA-00942) ===
|
|
SELECT COUNT(*) FROM admin.permission;
|
|
|
|
PROMPT
|
|
PROMPT === BYPASS 5: try to read app_user (expect ORA-00942) ===
|
|
SELECT COUNT(*) FROM admin.app_user;
|
|
|
|
EXIT;
|