57 lines
2.0 KiB
SQL
57 lines
2.0 KiB
SQL
-- ============================================================
|
|
-- 01_perm_tables.sql
|
|
-- Permission model (the "policy plane"). All tables live in ADMIN.
|
|
-- Run as ADMIN.
|
|
-- ============================================================
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
|
|
PROMPT === Creating permission-model tables ===
|
|
|
|
CREATE TABLE app_customer (
|
|
customer_id NUMBER PRIMARY KEY,
|
|
customer_name VARCHAR2(80) NOT NULL UNIQUE
|
|
);
|
|
|
|
CREATE TABLE app_user (
|
|
user_id NUMBER PRIMARY KEY,
|
|
db_username VARCHAR2(30) NOT NULL UNIQUE, -- matches Oracle SESSION_USER (UPPER)
|
|
customer_id NUMBER NOT NULL REFERENCES app_customer(customer_id),
|
|
active CHAR(1) DEFAULT 'Y' CHECK (active IN ('Y','N'))
|
|
);
|
|
|
|
CREATE TABLE app_group (
|
|
group_id NUMBER PRIMARY KEY,
|
|
customer_id NUMBER NOT NULL REFERENCES app_customer(customer_id),
|
|
group_name VARCHAR2(60) NOT NULL,
|
|
UNIQUE (customer_id, group_name)
|
|
);
|
|
|
|
CREATE TABLE user_group (
|
|
user_id NUMBER NOT NULL REFERENCES app_user(user_id),
|
|
group_id NUMBER NOT NULL REFERENCES app_group(group_id),
|
|
PRIMARY KEY (user_id, group_id)
|
|
);
|
|
|
|
CREATE TABLE db_source (
|
|
source_id NUMBER PRIMARY KEY,
|
|
source_name VARCHAR2(60) NOT NULL UNIQUE, -- e.g. RDS_POSTGRES, RDS_MYSQL
|
|
source_type VARCHAR2(30) NOT NULL, -- 'DBLINK_PG','DBLINK_MY','EXTERNAL_TABLE',...
|
|
dblink_name VARCHAR2(128)
|
|
);
|
|
|
|
-- Each permission row says: this group, on this object of this source,
|
|
-- is allowed to see rows where region is in `allowed_regions`.
|
|
-- Convention: '*' means no restriction (full access).
|
|
CREATE TABLE permission (
|
|
perm_id NUMBER PRIMARY KEY,
|
|
group_id NUMBER NOT NULL REFERENCES app_group(group_id),
|
|
source_id NUMBER NOT NULL REFERENCES db_source(source_id),
|
|
object_name VARCHAR2(60) NOT NULL, -- the local view name, e.g. 'V_CUSTOMERS_PG'
|
|
allowed_regions VARCHAR2(200) NOT NULL, -- CSV: 'KR,APAC' or '*'
|
|
UNIQUE (group_id, source_id, object_name)
|
|
);
|
|
|
|
PROMPT === Permission tables created ===
|
|
EXIT;
|