598 lines
17 KiB
MySQL
598 lines
17 KiB
MySQL
-- ============================================================
|
|
-- 72_hmm_leave_team_vpd.sql
|
|
--
|
|
-- HMM HR leave row security:
|
|
-- * HMM_HR_MANAGER -> self and directly managed employees
|
|
-- * HMM_HR_VIEWER -> self only
|
|
-- * HMM_HR_ADMIN -> all rows when the role is explicitly assigned
|
|
--
|
|
-- Run as ADMIN after the HMM access-management schema is installed.
|
|
-- This script is idempotent and never stores a plain bearer token.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
SET DEFINE OFF
|
|
|
|
ALTER SESSION DISABLE PARALLEL DML;
|
|
|
|
PROMPT === 1. Ensuring HMM roles and demo role assignments ===
|
|
MERGE INTO hmm_access_roles dst
|
|
USING (
|
|
SELECT 1 role_id, 'HMM_HR_VIEWER' role_name,
|
|
'HMM employee self-service leave access' description,
|
|
'PUBLIC' max_sensitivity_level FROM dual
|
|
UNION ALL
|
|
SELECT 2, 'HMM_HR_MANAGER',
|
|
'HMM manager access to self and direct reports',
|
|
'INTERNAL' FROM dual
|
|
UNION ALL
|
|
SELECT 3, 'HMM_HR_ADMIN',
|
|
'HMM HR administrator full leave access',
|
|
'CONFIDENTIAL' FROM dual
|
|
) src
|
|
ON (dst.role_name = src.role_name)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
dst.description = src.description,
|
|
dst.max_sensitivity_level = src.max_sensitivity_level,
|
|
dst.active_yn = 'Y',
|
|
dst.updated_at = SYSTIMESTAMP
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
role_id, role_name, description, max_sensitivity_level,
|
|
active_yn, created_at, updated_at
|
|
) VALUES (
|
|
src.role_id, src.role_name, src.description, src.max_sensitivity_level,
|
|
'Y', SYSTIMESTAMP, SYSTIMESTAMP
|
|
);
|
|
|
|
MERGE INTO hmm_employee_access_roles dst
|
|
USING (
|
|
SELECT e.employee_id, r.role_id
|
|
FROM hmm_hr_employees e
|
|
JOIN hmm_access_roles r ON r.role_name = 'HMM_HR_MANAGER'
|
|
WHERE e.employee_code = 'E1001'
|
|
AND e.employment_status = 'ACTIVE'
|
|
) src
|
|
ON (dst.employee_id = src.employee_id AND dst.role_id = src.role_id)
|
|
WHEN NOT MATCHED THEN INSERT (employee_id, role_id, created_at)
|
|
VALUES (src.employee_id, src.role_id, SYSTIMESTAMP);
|
|
|
|
MERGE INTO hmm_employee_access_roles dst
|
|
USING (
|
|
SELECT e.employee_id, r.role_id
|
|
FROM hmm_hr_employees e
|
|
JOIN hmm_access_roles r ON r.role_name = 'HMM_HR_VIEWER'
|
|
WHERE e.manager_employee_id = (
|
|
SELECT manager.employee_id
|
|
FROM hmm_hr_employees manager
|
|
WHERE manager.employee_code = 'E1001'
|
|
)
|
|
AND e.employment_status = 'ACTIVE'
|
|
) src
|
|
ON (dst.employee_id = src.employee_id AND dst.role_id = src.role_id)
|
|
WHEN NOT MATCHED THEN INSERT (employee_id, role_id, created_at)
|
|
VALUES (src.employee_id, src.role_id, SYSTIMESTAMP);
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 2. Ensuring protected leave objects and columns ===
|
|
DECLARE
|
|
PROCEDURE ensure_object(
|
|
p_object_name IN VARCHAR2,
|
|
p_description IN VARCHAR2
|
|
) AS
|
|
v_object_id NUMBER;
|
|
BEGIN
|
|
BEGIN
|
|
SELECT object_id
|
|
INTO v_object_id
|
|
FROM hmm_access_objects
|
|
WHERE owner = 'ADMIN'
|
|
AND object_name = p_object_name;
|
|
|
|
UPDATE hmm_access_objects
|
|
SET enabled_yn = 'Y',
|
|
description = p_description,
|
|
ords_path = 'cb-ords/cb-object-query/admin/' || LOWER(p_object_name)
|
|
WHERE object_id = v_object_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(object_id), 0) + 1
|
|
INTO v_object_id
|
|
FROM hmm_access_objects;
|
|
|
|
INSERT INTO hmm_access_objects (
|
|
object_id, owner, object_name, ords_path, enabled_yn, description
|
|
) VALUES (
|
|
v_object_id,
|
|
'ADMIN',
|
|
p_object_name,
|
|
'cb-ords/cb-object-query/admin/' || LOWER(p_object_name),
|
|
'Y',
|
|
p_description
|
|
);
|
|
END;
|
|
|
|
FOR c IN (
|
|
SELECT column_name
|
|
FROM user_tab_columns
|
|
WHERE table_name = p_object_name
|
|
ORDER BY column_id
|
|
) LOOP
|
|
MERGE INTO hmm_access_object_columns dst
|
|
USING (
|
|
SELECT v_object_id object_id, c.column_name column_name
|
|
FROM dual
|
|
) src
|
|
ON (
|
|
dst.object_id = src.object_id
|
|
AND dst.column_name = src.column_name
|
|
)
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
column_id, object_id, column_name, sensitive_yn,
|
|
sensitivity_level, redaction_method
|
|
) VALUES (
|
|
(SELECT NVL(MAX(column_id), 0) + 1 FROM hmm_access_object_columns),
|
|
src.object_id,
|
|
src.column_name,
|
|
'N',
|
|
'PUBLIC',
|
|
'NONE'
|
|
);
|
|
END LOOP;
|
|
END;
|
|
BEGIN
|
|
ensure_object(
|
|
'HMM_LEAVE_BALANCES',
|
|
'HMM employee leave balance protected by employee hierarchy'
|
|
);
|
|
ensure_object(
|
|
'HMM_LEAVE_REQUESTS',
|
|
'HMM employee leave requests protected by employee hierarchy'
|
|
);
|
|
END;
|
|
/
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 3. Ensuring role permission rules ===
|
|
DECLARE
|
|
PROCEDURE ensure_permission(
|
|
p_role_name IN VARCHAR2,
|
|
p_target_name IN VARCHAR2,
|
|
p_rule_type IN VARCHAR2
|
|
) AS
|
|
v_role_id NUMBER;
|
|
v_perm_id NUMBER;
|
|
BEGIN
|
|
SELECT role_id
|
|
INTO v_role_id
|
|
FROM hmm_access_roles
|
|
WHERE role_name = p_role_name
|
|
AND active_yn = 'Y';
|
|
|
|
BEGIN
|
|
SELECT perm_id
|
|
INTO v_perm_id
|
|
FROM hmm_access_permissions
|
|
WHERE role_id = v_role_id
|
|
AND target_name = p_target_name
|
|
AND action_name = 'SELECT';
|
|
|
|
UPDATE hmm_access_permissions
|
|
SET permission_effect = 'ALLOW'
|
|
WHERE perm_id = v_perm_id;
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT cb_permission_seq.NEXTVAL
|
|
INTO v_perm_id
|
|
FROM dual;
|
|
|
|
INSERT INTO hmm_access_permissions (
|
|
perm_id, role_id, target_name, action_name, permission_effect
|
|
) VALUES (
|
|
v_perm_id, v_role_id, p_target_name, 'SELECT', 'ALLOW'
|
|
);
|
|
END;
|
|
|
|
DELETE FROM hmm_access_permission_rules
|
|
WHERE perm_id = v_perm_id;
|
|
|
|
INSERT INTO hmm_access_permission_rules (
|
|
rule_id, perm_id, rule_column, rule_type, rule_value
|
|
) VALUES (
|
|
cb_permission_rule_seq.NEXTVAL,
|
|
v_perm_id,
|
|
'EMPLOYEE_ID',
|
|
p_rule_type,
|
|
NULL
|
|
);
|
|
END;
|
|
BEGIN
|
|
ensure_permission('HMM_HR_VIEWER', 'HMM_LEAVE_BALANCES', 'SELF');
|
|
ensure_permission('HMM_HR_VIEWER', 'HMM_LEAVE_REQUESTS', 'SELF');
|
|
ensure_permission('HMM_HR_MANAGER', 'HMM_LEAVE_BALANCES', 'MANAGED_TEAM');
|
|
ensure_permission('HMM_HR_MANAGER', 'HMM_LEAVE_REQUESTS', 'MANAGED_TEAM');
|
|
ensure_permission('HMM_HR_ADMIN', 'HMM_LEAVE_BALANCES', 'ALL');
|
|
ensure_permission('HMM_HR_ADMIN', 'HMM_LEAVE_REQUESTS', 'ALL');
|
|
END;
|
|
/
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 4. Creating secure HMM access context ===
|
|
CREATE OR REPLACE PACKAGE hmm_access_ctx_pkg AUTHID DEFINER AS
|
|
PROCEDURE clear_user;
|
|
PROCEDURE set_user_by_bearer(p_bearer_token IN VARCHAR2);
|
|
END;
|
|
/
|
|
|
|
CREATE OR REPLACE PACKAGE BODY hmm_access_ctx_pkg AS
|
|
PROCEDURE clear_user AS
|
|
BEGIN
|
|
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_ID', NULL);
|
|
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_CODE', NULL);
|
|
DBMS_SESSION.SET_CONTEXT('HMM_ACCESS_CTX', 'TEAM_ID', NULL);
|
|
END;
|
|
|
|
PROCEDURE set_user_by_bearer(p_bearer_token IN VARCHAR2) AS
|
|
v_employee_id hmm_hr_employees.employee_id%TYPE;
|
|
v_employee_code hmm_hr_employees.employee_code%TYPE;
|
|
v_team_id hmm_hr_employees.team_id%TYPE;
|
|
BEGIN
|
|
IF p_bearer_token IS NULL OR TRIM(p_bearer_token) IS NULL THEN
|
|
clear_user;
|
|
RAISE_APPLICATION_ERROR(-20101, 'Bearer token is required');
|
|
END IF;
|
|
|
|
SELECT e.employee_id,
|
|
e.employee_code,
|
|
e.team_id
|
|
INTO v_employee_id,
|
|
v_employee_code,
|
|
v_team_id
|
|
FROM hmm_access_bearer_tokens t
|
|
JOIN hmm_hr_employees e
|
|
ON e.employee_id = t.employee_id
|
|
WHERE t.key_hash = STANDARD_HASH(p_bearer_token, 'SHA256')
|
|
AND t.revoked_at IS NULL
|
|
AND t.expires_at > CAST(SYSTIMESTAMP AS TIMESTAMP)
|
|
AND e.employment_status = 'ACTIVE';
|
|
|
|
DBMS_SESSION.SET_CONTEXT(
|
|
'HMM_ACCESS_CTX', 'EMPLOYEE_ID', TO_CHAR(v_employee_id)
|
|
);
|
|
DBMS_SESSION.SET_CONTEXT(
|
|
'HMM_ACCESS_CTX', 'EMPLOYEE_CODE', v_employee_code
|
|
);
|
|
DBMS_SESSION.SET_CONTEXT(
|
|
'HMM_ACCESS_CTX', 'TEAM_ID', TO_CHAR(v_team_id)
|
|
);
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
clear_user;
|
|
RAISE_APPLICATION_ERROR(-20102, 'Invalid or expired bearer token');
|
|
WHEN TOO_MANY_ROWS THEN
|
|
clear_user;
|
|
RAISE_APPLICATION_ERROR(-20103, 'Bearer token mapping is not unique');
|
|
END;
|
|
END;
|
|
/
|
|
|
|
CREATE OR REPLACE CONTEXT hmm_access_ctx USING hmm_access_ctx_pkg;
|
|
|
|
PROMPT === 5. Creating the HMM leave VPD filter ===
|
|
CREATE OR REPLACE FUNCTION hmm_leave_vpd_filter(
|
|
p_schema IN VARCHAR2,
|
|
p_object IN VARCHAR2
|
|
) RETURN VARCHAR2
|
|
AUTHID DEFINER
|
|
AS
|
|
v_employee_id NUMBER;
|
|
v_target VARCHAR2(128);
|
|
v_allow_predicate VARCHAR2(32767);
|
|
v_deny_predicate VARCHAR2(32767);
|
|
v_permission_clause VARCHAR2(32767);
|
|
|
|
FUNCTION quote_literal(p_value IN VARCHAR2) RETURN VARCHAR2 IS
|
|
BEGIN
|
|
RETURN '''' || REPLACE(NVL(p_value, ''), '''', '''''') || '''';
|
|
END;
|
|
|
|
FUNCTION safe_column(p_column_name IN VARCHAR2) RETURN VARCHAR2 IS
|
|
v_column VARCHAR2(128);
|
|
v_count NUMBER;
|
|
BEGIN
|
|
v_column := DBMS_ASSERT.SIMPLE_SQL_NAME(UPPER(TRIM(p_column_name)));
|
|
|
|
SELECT COUNT(*)
|
|
INTO v_count
|
|
FROM all_tab_columns
|
|
WHERE owner = UPPER(p_schema)
|
|
AND table_name = UPPER(p_object)
|
|
AND column_name = v_column;
|
|
|
|
RETURN CASE WHEN v_count = 1 THEN v_column ELSE NULL END;
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
RETURN NULL;
|
|
END;
|
|
|
|
PROCEDURE append_and(p_clause IN VARCHAR2) IS
|
|
BEGIN
|
|
IF p_clause IS NULL THEN
|
|
v_permission_clause := NULL;
|
|
ELSIF v_permission_clause IS NULL THEN
|
|
v_permission_clause := '(' || p_clause || ')';
|
|
ELSE
|
|
v_permission_clause := v_permission_clause || ' AND (' || p_clause || ')';
|
|
END IF;
|
|
END;
|
|
|
|
PROCEDURE append_permission(
|
|
p_effect IN VARCHAR2,
|
|
p_clause IN VARCHAR2
|
|
) IS
|
|
BEGIN
|
|
IF p_clause IS NULL THEN
|
|
RETURN;
|
|
END IF;
|
|
|
|
IF p_effect = 'DENY' THEN
|
|
IF v_deny_predicate IS NULL THEN
|
|
v_deny_predicate := '(' || p_clause || ')';
|
|
ELSE
|
|
v_deny_predicate := v_deny_predicate || ' OR (' || p_clause || ')';
|
|
END IF;
|
|
ELSIF v_allow_predicate IS NULL THEN
|
|
v_allow_predicate := '(' || p_clause || ')';
|
|
ELSE
|
|
v_allow_predicate := v_allow_predicate || ' OR (' || p_clause || ')';
|
|
END IF;
|
|
END;
|
|
BEGIN
|
|
BEGIN
|
|
v_employee_id := TO_NUMBER(
|
|
SYS_CONTEXT('HMM_ACCESS_CTX', 'EMPLOYEE_ID')
|
|
);
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
RETURN '1 = 0';
|
|
END;
|
|
|
|
IF v_employee_id IS NULL OR p_schema IS NULL OR p_object IS NULL THEN
|
|
RETURN '1 = 0';
|
|
END IF;
|
|
|
|
v_target := UPPER(TRIM(p_object));
|
|
IF v_target NOT IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS') THEN
|
|
RETURN '1 = 0';
|
|
END IF;
|
|
|
|
FOR permission_row IN (
|
|
SELECT DISTINCT
|
|
p.perm_id,
|
|
NVL(UPPER(TRIM(p.permission_effect)), 'ALLOW') permission_effect
|
|
FROM (
|
|
SELECT er.role_id
|
|
FROM hmm_employee_access_roles er
|
|
WHERE er.employee_id = v_employee_id
|
|
UNION
|
|
SELECT gr.role_id
|
|
FROM hmm_access_group_members gm
|
|
JOIN hmm_access_groups g
|
|
ON g.group_id = gm.group_id
|
|
AND g.active_yn = 'Y'
|
|
JOIN hmm_group_access_roles gr
|
|
ON gr.group_id = gm.group_id
|
|
WHERE gm.employee_id = v_employee_id
|
|
) effective_role
|
|
JOIN hmm_access_roles role
|
|
ON role.role_id = effective_role.role_id
|
|
AND role.active_yn = 'Y'
|
|
JOIN hmm_access_permissions p
|
|
ON p.role_id = role.role_id
|
|
AND p.target_name = v_target
|
|
AND p.action_name = 'SELECT'
|
|
ORDER BY p.perm_id
|
|
) LOOP
|
|
v_permission_clause := NULL;
|
|
|
|
FOR rule_row IN (
|
|
SELECT UPPER(TRIM(rule_type)) rule_type,
|
|
UPPER(TRIM(rule_column)) rule_column,
|
|
rule_value
|
|
FROM hmm_access_permission_rules
|
|
WHERE perm_id = permission_row.perm_id
|
|
ORDER BY rule_id
|
|
) LOOP
|
|
DECLARE
|
|
v_column VARCHAR2(128);
|
|
v_clause VARCHAR2(32767);
|
|
BEGIN
|
|
v_column := safe_column(NVL(rule_row.rule_column, 'EMPLOYEE_ID'));
|
|
v_clause := NULL;
|
|
|
|
IF rule_row.rule_type = 'ALL' THEN
|
|
v_clause := '1 = 1';
|
|
ELSIF rule_row.rule_type = 'SELF' AND v_column IS NOT NULL THEN
|
|
v_clause := v_column
|
|
|| ' = TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))';
|
|
ELSIF rule_row.rule_type = 'MANAGED_TEAM' AND v_column IS NOT NULL THEN
|
|
v_clause := v_column || ' IN ('
|
|
|| 'SELECT employee.employee_id '
|
|
|| 'FROM ADMIN.HMM_HR_EMPLOYEES employee '
|
|
|| 'WHERE employee.employee_id = '
|
|
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID'')) '
|
|
|| 'OR employee.manager_employee_id = '
|
|
|| 'TO_NUMBER(SYS_CONTEXT(''HMM_ACCESS_CTX'', ''EMPLOYEE_ID''))'
|
|
|| ')';
|
|
ELSIF rule_row.rule_type = '='
|
|
AND v_column IS NOT NULL
|
|
AND rule_row.rule_value IS NOT NULL THEN
|
|
v_clause := 'TO_CHAR(' || v_column || ') = '
|
|
|| quote_literal(rule_row.rule_value);
|
|
ELSIF rule_row.rule_type IN ('!=', '<>')
|
|
AND v_column IS NOT NULL
|
|
AND rule_row.rule_value IS NOT NULL THEN
|
|
v_clause := 'TO_CHAR(' || v_column || ') <> '
|
|
|| quote_literal(rule_row.rule_value);
|
|
END IF;
|
|
|
|
IF v_clause IS NULL THEN
|
|
v_permission_clause := NULL;
|
|
EXIT;
|
|
END IF;
|
|
append_and(v_clause);
|
|
END;
|
|
END LOOP;
|
|
|
|
append_permission(
|
|
permission_row.permission_effect,
|
|
v_permission_clause
|
|
);
|
|
END LOOP;
|
|
|
|
IF v_allow_predicate IS NULL THEN
|
|
RETURN '1 = 0';
|
|
END IF;
|
|
|
|
IF v_deny_predicate IS NULL THEN
|
|
RETURN v_allow_predicate;
|
|
END IF;
|
|
|
|
RETURN '((' || v_allow_predicate || ') AND NOT ('
|
|
|| v_deny_predicate || '))';
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
RETURN '1 = 0';
|
|
END;
|
|
/
|
|
|
|
SHOW ERRORS PACKAGE hmm_access_ctx_pkg
|
|
SHOW ERRORS PACKAGE BODY hmm_access_ctx_pkg
|
|
SHOW ERRORS FUNCTION hmm_leave_vpd_filter
|
|
|
|
PROMPT === 6. Attaching context-sensitive VPD policies ===
|
|
DECLARE
|
|
PROCEDURE replace_policy(p_object_name IN VARCHAR2) AS
|
|
BEGIN
|
|
BEGIN
|
|
DBMS_RLS.DROP_POLICY(
|
|
object_schema => 'ADMIN',
|
|
object_name => p_object_name,
|
|
policy_name => 'HMM_LEAVE_SCOPE_POLICY'
|
|
);
|
|
EXCEPTION
|
|
WHEN OTHERS THEN
|
|
IF SQLCODE != -28102 THEN
|
|
RAISE;
|
|
END IF;
|
|
END;
|
|
|
|
DBMS_RLS.ADD_POLICY(
|
|
object_schema => 'ADMIN',
|
|
object_name => p_object_name,
|
|
policy_name => 'HMM_LEAVE_SCOPE_POLICY',
|
|
function_schema => 'ADMIN',
|
|
policy_function => 'HMM_LEAVE_VPD_FILTER',
|
|
statement_types => 'SELECT',
|
|
update_check => FALSE,
|
|
enable => TRUE,
|
|
policy_type => DBMS_RLS.CONTEXT_SENSITIVE
|
|
);
|
|
END;
|
|
BEGIN
|
|
replace_policy('HMM_LEAVE_BALANCES');
|
|
replace_policy('HMM_LEAVE_REQUESTS');
|
|
END;
|
|
/
|
|
|
|
PROMPT === 7. Recording backoffice descriptions ===
|
|
MERGE INTO hmm_access_vpd_filter_notes dst
|
|
USING (
|
|
SELECT 'ADMIN' function_owner,
|
|
'HMM_LEAVE_VPD_FILTER' function_name,
|
|
'Builds self, managed-team, and administrator leave predicates from HMM roles and access rules.'
|
|
description
|
|
FROM dual
|
|
) src
|
|
ON (
|
|
dst.function_owner = src.function_owner
|
|
AND dst.function_name = src.function_name
|
|
)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
dst.description = src.description,
|
|
dst.updated_at = SYSTIMESTAMP
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
function_owner, function_name, description, updated_at
|
|
) VALUES (
|
|
src.function_owner, src.function_name, src.description, SYSTIMESTAMP
|
|
);
|
|
|
|
MERGE INTO hmm_access_vpd_policy_notes dst
|
|
USING (
|
|
SELECT 'ADMIN' object_owner,
|
|
object_name,
|
|
'HMM_LEAVE_SCOPE_POLICY' policy_name,
|
|
'Restricts leave rows to self, direct reports, or explicit HR administrator access.'
|
|
description
|
|
FROM (
|
|
SELECT 'HMM_LEAVE_BALANCES' object_name FROM dual
|
|
UNION ALL
|
|
SELECT 'HMM_LEAVE_REQUESTS' FROM dual
|
|
)
|
|
) src
|
|
ON (
|
|
dst.object_owner = src.object_owner
|
|
AND dst.object_name = src.object_name
|
|
AND dst.policy_name = src.policy_name
|
|
)
|
|
WHEN MATCHED THEN UPDATE SET
|
|
dst.description = src.description,
|
|
dst.updated_at = SYSTIMESTAMP
|
|
WHEN NOT MATCHED THEN INSERT (
|
|
object_owner, object_name, policy_name, description, updated_at
|
|
) VALUES (
|
|
src.object_owner, src.object_name, src.policy_name,
|
|
src.description, SYSTIMESTAMP
|
|
);
|
|
|
|
COMMIT;
|
|
|
|
PROMPT === 8. Deployment inventory ===
|
|
SELECT object_name, object_type, status
|
|
FROM user_objects
|
|
WHERE object_name IN (
|
|
'HMM_ACCESS_CTX',
|
|
'HMM_ACCESS_CTX_PKG',
|
|
'HMM_LEAVE_VPD_FILTER'
|
|
)
|
|
ORDER BY object_name, object_type;
|
|
|
|
SELECT object_name, policy_name, function, sel, enable, policy_type
|
|
FROM all_policies
|
|
WHERE object_owner = 'ADMIN'
|
|
AND object_name IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS')
|
|
AND policy_name = 'HMM_LEAVE_SCOPE_POLICY'
|
|
ORDER BY object_name;
|
|
|
|
SELECT e.employee_code, r.role_name
|
|
FROM hmm_employee_access_roles er
|
|
JOIN hmm_hr_employees e ON e.employee_id = er.employee_id
|
|
JOIN hmm_access_roles r ON r.role_id = er.role_id
|
|
WHERE r.role_name IN ('HMM_HR_VIEWER', 'HMM_HR_MANAGER')
|
|
ORDER BY e.employee_code, r.role_name;
|
|
|
|
SELECT r.role_name,
|
|
p.target_name,
|
|
pr.rule_column,
|
|
pr.rule_type
|
|
FROM hmm_access_permissions p
|
|
JOIN hmm_access_roles r ON r.role_id = p.role_id
|
|
JOIN hmm_access_permission_rules pr ON pr.perm_id = p.perm_id
|
|
WHERE p.target_name IN ('HMM_LEAVE_BALANCES', 'HMM_LEAVE_REQUESTS')
|
|
ORDER BY r.role_name, p.target_name;
|
|
|
|
PROMPT === HMM leave team VPD ready ===
|