Files
vpd-permission-poc/docs/assets/agent-ords-security-sys-context-flow.svg

61 lines
3.6 KiB
XML

<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="700" viewBox="0 0 1280 700" role="img" aria-labelledby="title desc">
<title id="title">SYS_CONTEXT 동작 방식</title>
<desc id="desc">ORDS 처리 로직이 DB 세션에 값을 저장하고 VPD 함수가 SYS_CONTEXT로 값을 읽어 EXISTS 권한 조회에 사용하는 흐름.</desc>
<rect width="1280" height="700" fill="#f8fafc"/>
<defs>
<marker id="arrow" markerWidth="9" markerHeight="9" refX="7.5" refY="4.5" orient="auto">
<path d="M 0 0 L 9 4.5 L 0 9 z" fill="#475569"/>
</marker>
<style>
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 39px; font-weight: 700; fill: #0f172a; }
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 21px; fill: #475569; }
.card { fill: #ffffff; stroke: #cbd5e1; stroke-width: 2; }
.blue { fill: #eff6ff; stroke: #2563eb; stroke-width: 2; }
.purple { fill: #f5f3ff; stroke: #7c3aed; stroke-width: 2; }
.green { fill: #ecfdf5; stroke: #059669; stroke-width: 2; }
.warn { fill: #fff7ed; stroke: #ea580c; stroke-width: 2; }
.title { font-family: Arial, Helvetica, sans-serif; font-size: 24px; font-weight: 700; fill: #0f172a; }
.text { font-family: Arial, Helvetica, sans-serif; font-size: 18px; fill: #334155; }
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #0f172a; }
.arrow { stroke: #475569; stroke-width: 2.5; marker-end: url(#arrow); fill: none; }
</style>
</defs>
<text x="48" y="58" class="h1">SYS_CONTEXT 동작 방식</text>
<text x="48" y="94" class="sub">현재 DB 세션에 저장된 요청자 값을 읽어 권한 테이블 EXISTS 조회에 사용</text>
<rect x="48" y="142" width="320" height="152" rx="16" class="blue"/>
<text x="76" y="184" class="title">1. ORDS 처리 로직</text>
<text x="76" y="224" class="text">DB 계정 또는 Bearer Key로</text>
<text x="76" y="252" class="text">요청자를 식별</text>
<line x1="368" y1="218" x2="438" y2="218" class="arrow"/>
<rect x="450" y="142" width="360" height="152" rx="16" class="purple"/>
<text x="478" y="184" class="title">2. DB 세션에 값 저장</text>
<text x="478" y="224" class="mono">DBMS_SESSION.SET_CONTEXT</text>
<text x="478" y="252" class="mono">AGENT_CTX.EMP_NO = E10234</text>
<text x="478" y="278" class="mono">AGENT_CTX.DEPT_CODE = HR</text>
<line x1="810" y1="218" x2="850" y2="218" class="arrow"/>
<rect x="862" y="142" width="370" height="152" rx="10" class="green"/>
<text x="890" y="184" class="title">3. EXISTS 조회에 사용</text>
<text x="890" y="224" class="mono">SYS_CONTEXT('AGENT_CTX','EMP_NO')</text>
<text x="890" y="252" class="mono">SYS_CONTEXT('AGENT_CTX','DEPT_CODE')</text>
<rect x="118" y="380" width="500" height="126" rx="10" class="card"/>
<text x="150" y="424" class="title">같은 DB 세션 안에서만 유효</text>
<text x="150" y="462" class="text">요청마다 기존 값을 지우고 새 값을 저장</text>
<text x="150" y="490" class="text">다른 요청자 정보가 섞이지 않도록 처리</text>
<rect x="682" y="380" width="500" height="126" rx="10" class="warn"/>
<text x="714" y="424" class="title">직접 조작 방지</text>
<text x="714" y="462" class="text">CONTEXT는 지정된 패키지를 통해서만 설정</text>
<text x="714" y="490" class="text">일반 사용자가 임의로 값을 바꾸지 못하게 구성</text>
<rect x="220" y="574" width="840" height="54" rx="14" fill="#eef2ff" stroke="#4f46e5" stroke-width="2.5"/>
<text x="250" y="609" class="title">요점: SET_CONTEXT는 저장, SYS_CONTEXT는 조회, EXISTS가 권한 판단</text>
</svg>