324 lines
9.6 KiB
MySQL
324 lines
9.6 KiB
MySQL
-- ============================================================
|
|
-- 84_hmm_carrier_team_vpd.sql
|
|
--
|
|
-- Row security for HMM_CARRIER_ASSIGNMENTS_V:
|
|
-- HMM_HR_VIEWER -> current employee only
|
|
-- HMM_HR_MANAGER -> current employee and direct reports
|
|
-- HMM_HR_ADMIN -> all assignments
|
|
--
|
|
-- Run as ADMIN after 72_hmm_leave_team_vpd.sql and
|
|
-- 81_hmm_carrier_access_groups.sql. Plain bearer tokens are
|
|
-- never stored by this script.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
SET DEFINE OFF
|
|
|
|
PROMPT === 1. Registering the protected carrier object ===
|
|
DECLARE
|
|
v_object_id NUMBER;
|
|
BEGIN
|
|
BEGIN
|
|
SELECT object_id
|
|
INTO v_object_id
|
|
FROM hmm_access_objects
|
|
WHERE owner = 'ADMIN'
|
|
AND object_name = 'HMM_CARRIER_ASSIGNMENTS_V';
|
|
|
|
UPDATE hmm_access_objects
|
|
SET enabled_yn = 'Y',
|
|
description = 'Employee-to-carrier assignments protected by employee hierarchy',
|
|
ords_path = 'cb-ords/cb-object-query/admin/hmm_carrier_assignments_v'
|
|
WHERE object_id = v_object_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(object_id), 0) + 1
|
|
INTO v_object_id
|
|
FROM hmm_access_objects;
|
|
|
|
INSERT INTO hmm_access_objects (
|
|
object_id, owner, object_name, ords_path, enabled_yn, description
|
|
) VALUES (
|
|
v_object_id,
|
|
'ADMIN',
|
|
'HMM_CARRIER_ASSIGNMENTS_V',
|
|
'cb-ords/cb-object-query/admin/hmm_carrier_assignments_v',
|
|
'Y',
|
|
'Employee-to-carrier assignments protected by employee hierarchy'
|
|
);
|
|
END;
|
|
|
|
FOR c IN (
|
|
SELECT column_name
|
|
FROM user_tab_columns
|
|
WHERE table_name = 'HMM_CARRIER_ASSIGNMENTS_V'
|
|
ORDER BY column_id
|
|
) LOOP
|
|
MERGE INTO hmm_access_object_columns dst
|
|
USING (
|
|
SELECT v_object_id object_id, c.column_name column_name FROM dual
|
|
) src
|
|
ON (dst.object_id = src.object_id AND dst.column_name = src.column_name)
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
column_id, object_id, column_name, sensitive_yn,
|
|
sensitivity_level, redaction_method
|
|
) VALUES (
|
|
(SELECT NVL(MAX(column_id), 0) + 1 FROM hmm_access_object_columns),
|
|
src.object_id, src.column_name, 'N', 'PUBLIC', 'NONE'
|
|
);
|
|
END LOOP;
|
|
END;
|
|
/
|
|
|
|
PROMPT === 2. Registering role rules ===
|
|
DECLARE
|
|
PROCEDURE ensure_permission(
|
|
p_role_name IN VARCHAR2,
|
|
p_rule_type IN VARCHAR2
|
|
) AS
|
|
v_role_id NUMBER;
|
|
v_perm_id NUMBER;
|
|
BEGIN
|
|
SELECT role_id
|
|
INTO v_role_id
|
|
FROM hmm_access_roles
|
|
WHERE role_name = p_role_name
|
|
AND active_yn = 'Y';
|
|
|
|
BEGIN
|
|
SELECT perm_id
|
|
INTO v_perm_id
|
|
FROM hmm_access_permissions
|
|
WHERE role_id = v_role_id
|
|
AND target_name = 'HMM_CARRIER_ASSIGNMENTS_V'
|
|
AND action_name = 'SELECT';
|
|
|
|
UPDATE hmm_access_permissions
|
|
SET permission_effect = 'ALLOW'
|
|
WHERE perm_id = v_perm_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT cb_permission_seq.NEXTVAL INTO v_perm_id FROM dual;
|
|
INSERT INTO hmm_access_permissions (
|
|
perm_id, role_id, target_name, action_name, permission_effect
|
|
) VALUES (
|
|
v_perm_id, v_role_id, 'HMM_CARRIER_ASSIGNMENTS_V', 'SELECT', 'ALLOW'
|
|
);
|
|
END;
|
|
|
|
DELETE FROM hmm_access_permission_rules WHERE perm_id = v_perm_id;
|
|
INSERT INTO hmm_access_permission_rules (
|
|
rule_id, perm_id, rule_column, rule_type, rule_value
|
|
) VALUES (
|
|
cb_permission_rule_seq.NEXTVAL,
|
|
v_perm_id,
|
|
'EMPLOYEE_ID',
|
|
p_rule_type,
|
|
NULL
|
|
);
|
|
END;
|
|
BEGIN
|
|
ensure_permission('HMM_HR_VIEWER', 'SELF');
|
|
ensure_permission('HMM_HR_MANAGER', 'MANAGED_TEAM');
|
|
ensure_permission('HMM_HR_ADMIN', 'ALL');
|
|
END;
|
|
/
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 3. Creating the carrier VPD predicate ===
|
|
CREATE OR REPLACE FUNCTION hmm_carrier_vpd_filter(
|
|
p_schema IN VARCHAR2,
|
|
p_object IN VARCHAR2
|
|
) RETURN VARCHAR2
|
|
AUTHID DEFINER
|
|
AS
|
|
v_employee_id NUMBER;
|
|
v_all_rule NUMBER := 0;
|
|
v_team_rule NUMBER := 0;
|
|
v_self_rule NUMBER := 0;
|
|
BEGIN
|
|
IF UPPER(TRIM(p_schema)) != 'ADMIN'
|
|
OR UPPER(TRIM(p_object)) != 'HMM_CARRIER_ASSIGNMENTS_V' THEN
|
|
RETURN '1 = 0';
|
|
END IF;
|
|
|
|
BEGIN
|
|
v_employee_id := TO_NUMBER(
|
|
SYS_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_ID')
|
|
);
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
RETURN '1 = 0';
|
|
END;
|
|
|
|
IF v_employee_id IS NULL THEN
|
|
RETURN '1 = 0';
|
|
END IF;
|
|
|
|
SELECT NVL(MAX(CASE WHEN rule.rule_type = 'ALL' THEN 1 ELSE 0 END), 0),
|
|
NVL(MAX(CASE WHEN rule.rule_type = 'MANAGED_TEAM' THEN 1 ELSE 0 END), 0),
|
|
NVL(MAX(CASE WHEN rule.rule_type = 'SELF' THEN 1 ELSE 0 END), 0)
|
|
INTO v_all_rule, v_team_rule, v_self_rule
|
|
FROM (
|
|
SELECT employee_role.role_id
|
|
FROM hmm_employee_access_roles employee_role
|
|
WHERE employee_role.employee_id = v_employee_id
|
|
UNION
|
|
SELECT group_role.role_id
|
|
FROM hmm_access_group_members group_member
|
|
JOIN hmm_access_groups access_group
|
|
ON access_group.group_id = group_member.group_id
|
|
AND access_group.active_yn = 'Y'
|
|
JOIN hmm_group_access_roles group_role
|
|
ON group_role.group_id = group_member.group_id
|
|
WHERE group_member.employee_id = v_employee_id
|
|
) effective_role
|
|
JOIN hmm_access_roles role
|
|
ON role.role_id = effective_role.role_id
|
|
AND role.active_yn = 'Y'
|
|
JOIN hmm_access_permissions permission
|
|
ON permission.role_id = role.role_id
|
|
AND permission.target_name = 'HMM_CARRIER_ASSIGNMENTS_V'
|
|
AND permission.action_name = 'SELECT'
|
|
AND permission.permission_effect = 'ALLOW'
|
|
JOIN hmm_access_permission_rules rule
|
|
ON rule.perm_id = permission.perm_id
|
|
AND UPPER(TRIM(rule.rule_column)) = 'EMPLOYEE_ID';
|
|
|
|
IF v_all_rule = 1 THEN
|
|
RETURN '1 = 1';
|
|
END IF;
|
|
|
|
IF v_team_rule = 1 THEN
|
|
RETURN 'EMPLOYEE_ID IN ('
|
|
|| 'SELECT employee.employee_id '
|
|
|| 'FROM ADMIN.HMM_HR_EMPLOYEES employee '
|
|
|| 'WHERE employee.employee_id = '
|
|
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID'')) '
|
|
|| 'OR employee.manager_employee_id = '
|
|
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))'
|
|
|| ')';
|
|
END IF;
|
|
|
|
IF v_self_rule = 1 THEN
|
|
RETURN 'EMPLOYEE_ID = TO_NUMBER('
|
|
|| 'SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))';
|
|
END IF;
|
|
|
|
RETURN '1 = 0';
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
RETURN '1 = 0';
|
|
END;
|
|
/
|
|
|
|
SHOW ERRORS FUNCTION hmm_carrier_vpd_filter
|
|
|
|
PROMPT === 4. Attaching the VPD policy ===
|
|
BEGIN
|
|
BEGIN
|
|
DBMS_RLS.DROP_POLICY(
|
|
object_schema => 'ADMIN',
|
|
object_name => 'HMM_CARRIER_ASSIGNMENTS_V',
|
|
policy_name => 'HMM_CARRIER_SCOPE_POLICY'
|
|
);
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
IF SQLCODE != -28102 THEN
|
|
RAISE;
|
|
END IF;
|
|
END;
|
|
|
|
DBMS_RLS.ADD_POLICY(
|
|
object_schema => 'ADMIN',
|
|
object_name => 'HMM_CARRIER_ASSIGNMENTS_V',
|
|
policy_name => 'HMM_CARRIER_SCOPE_POLICY',
|
|
function_schema => 'ADMIN',
|
|
policy_function => 'HMM_CARRIER_VPD_FILTER',
|
|
statement_types => 'SELECT',
|
|
update_check => FALSE,
|
|
enable => TRUE,
|
|
policy_type => DBMS_RLS.CONTEXT_SENSITIVE
|
|
);
|
|
END;
|
|
/
|
|
|
|
PROMPT === 5. Granting the non-exempt runtime read boundary ===
|
|
GRANT SELECT ON hmm_carrier_assignments_v TO cb_ords;
|
|
GRANT SELECT ON hmm_rds_carriers_v TO cb_ords;
|
|
GRANT SELECT ON hmm_rds_carrier_perf_v TO cb_ords;
|
|
GRANT SELECT ON hmm_rds_carrier_latest_v TO cb_ords;
|
|
|
|
CREATE OR REPLACE SYNONYM cb_ords.hmm_carrier_assignments_v
|
|
FOR admin.hmm_carrier_assignments_v;
|
|
CREATE OR REPLACE SYNONYM cb_ords.hmm_rds_carriers_v
|
|
FOR admin.hmm_rds_carriers_v;
|
|
CREATE OR REPLACE SYNONYM cb_ords.hmm_rds_carrier_perf_v
|
|
FOR admin.hmm_rds_carrier_perf_v;
|
|
CREATE OR REPLACE SYNONYM cb_ords.hmm_rds_carrier_latest_v
|
|
FOR admin.hmm_rds_carrier_latest_v;
|
|
|
|
PROMPT === 6. Recording policy notes ===
|
|
MERGE INTO hmm_access_vpd_filter_notes dst
|
|
USING (
|
|
SELECT 'ADMIN' function_owner,
|
|
'HMM_CARRIER_VPD_FILTER' function_name,
|
|
'Filters carrier assignments by the authenticated employee role and employee hierarchy.' description
|
|
FROM dual
|
|
) src
|
|
ON (dst.function_owner = src.function_owner AND dst.function_name = src.function_name)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
dst.description = src.description,
|
|
dst.updated_at = SYSTIMESTAMP
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
function_owner, function_name, description, updated_at
|
|
) VALUES (
|
|
src.function_owner, src.function_name, src.description, SYSTIMESTAMP
|
|
);
|
|
|
|
MERGE INTO hmm_access_vpd_policy_notes dst
|
|
USING (
|
|
SELECT 'ADMIN' object_owner,
|
|
'HMM_CARRIER_ASSIGNMENTS_V' object_name,
|
|
'HMM_CARRIER_SCOPE_POLICY' policy_name,
|
|
'Restricts carrier assignments to self, direct reports, or explicit HR administrator access.' description
|
|
FROM dual
|
|
) src
|
|
ON (
|
|
dst.object_owner = src.object_owner
|
|
AND dst.object_name = src.object_name
|
|
AND dst.policy_name = src.policy_name
|
|
)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
dst.description = src.description,
|
|
dst.updated_at = SYSTIMESTAMP
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
object_owner, object_name, policy_name, description, updated_at
|
|
) VALUES (
|
|
src.object_owner, src.object_name, src.policy_name,
|
|
src.description, SYSTIMESTAMP
|
|
);
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 7. Verification inventory ===
|
|
SELECT object_name, policy_name, function, sel, enable, policy_type
|
|
FROM all_policies
|
|
WHERE object_owner = 'ADMIN'
|
|
AND object_name = 'HMM_CARRIER_ASSIGNMENTS_V'
|
|
AND policy_name = 'HMM_CARRIER_SCOPE_POLICY';
|
|
|
|
SELECT role.role_name,
|
|
permission.target_name,
|
|
rule.rule_column,
|
|
rule.rule_type
|
|
FROM hmm_access_permissions permission
|
|
JOIN hmm_access_roles role ON role.role_id = permission.role_id
|
|
JOIN hmm_access_permission_rules rule ON rule.perm_id = permission.perm_id
|
|
WHERE permission.target_name = 'HMM_CARRIER_ASSIGNMENTS_V'
|
|
ORDER BY role.role_name;
|
|
|
|
PROMPT === HMM carrier team VPD ready ===
|