212 lines
14 KiB
MySQL
212 lines
14 KiB
MySQL
-- ============================================================
|
|
-- 40_dds_protection_evidence.sql
|
|
-- Immutable DDS publication fingerprints and deterministic validation fixtures.
|
|
--
|
|
-- Prerequisite: 25, 32, 34. Run as ADMIN.
|
|
-- The script is idempotent and never prints a bearer secret.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO ON
|
|
SET FEEDBACK ON
|
|
SET DEFINE OFF
|
|
|
|
PROMPT === 1. Evidence metadata ===
|
|
BEGIN
|
|
EXECUTE IMMEDIATE 'CREATE SEQUENCE cb_dds_protection_snapshot_seq START WITH 1 INCREMENT BY 1 NOCACHE';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE 'CREATE SEQUENCE cb_dds_validation_evidence_seq START WITH 1 INCREMENT BY 1 NOCACHE';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE q'[
|
|
CREATE TABLE cb_dds_protection_snapshot (
|
|
snapshot_id NUMBER PRIMARY KEY,
|
|
object_name VARCHAR2(261) NOT NULL,
|
|
enforcement_path VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
|
|
subject_key VARCHAR2(100) NOT NULL,
|
|
fingerprint VARCHAR2(64) NOT NULL,
|
|
actor VARCHAR2(100) NOT NULL,
|
|
note VARCHAR2(500),
|
|
published_at TIMESTAMP DEFAULT SYSTIMESTAMP NOT NULL
|
|
)]';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE q'[
|
|
CREATE TABLE cb_dds_validation_fixture (
|
|
fixture_id VARCHAR2(100) PRIMARY KEY,
|
|
enforcement_path VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
|
|
subject_key VARCHAR2(100) NOT NULL,
|
|
application_user_id NUMBER DEFAULT 0 NOT NULL,
|
|
document_id VARCHAR2(200) NOT NULL,
|
|
expected_visible CHAR(1) NOT NULL CHECK (expected_visible IN ('Y','N')),
|
|
description VARCHAR2(500) NOT NULL,
|
|
active_yn CHAR(1) DEFAULT 'Y' NOT NULL CHECK (active_yn IN ('Y','N')),
|
|
fixture_version VARCHAR2(40) DEFAULT 'v1' NOT NULL
|
|
)]';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE q'[
|
|
CREATE TABLE cb_dds_validation_evidence (
|
|
evidence_id NUMBER PRIMARY KEY,
|
|
run_id VARCHAR2(36) NOT NULL,
|
|
fixture_id VARCHAR2(100) NOT NULL,
|
|
enforcement_path VARCHAR2(20) NOT NULL CHECK (enforcement_path IN ('SERVICE','DIRECT')),
|
|
subject_key VARCHAR2(100) NOT NULL,
|
|
expected_visible CHAR(1) NOT NULL CHECK (expected_visible IN ('Y','N')),
|
|
actual_visible CHAR(1) NOT NULL CHECK (actual_visible IN ('Y','N')),
|
|
outcome VARCHAR2(20) NOT NULL CHECK (outcome IN ('PASSED','FAILED')),
|
|
fingerprint VARCHAR2(64) NOT NULL,
|
|
created_at TIMESTAMP DEFAULT SYSTIMESTAMP NOT NULL
|
|
)]';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE 'CREATE INDEX cb_dds_snapshot_ix ON cb_dds_protection_snapshot (enforcement_path, subject_key, published_at)';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
BEGIN
|
|
EXECUTE IMMEDIATE 'CREATE INDEX cb_dds_validation_ix ON cb_dds_validation_evidence (enforcement_path, subject_key, created_at)';
|
|
EXCEPTION WHEN OTHERS THEN IF SQLCODE <> -955 THEN RAISE; END IF; END;
|
|
/
|
|
|
|
PROMPT === 2. Deterministic SERVICE fixtures ===
|
|
MERGE INTO cb_app_user target
|
|
USING (SELECT 9904 user_id, 'dds_fixture_agent' user_name, 'E9904' employee_no,
|
|
'DDS' dept_code, 'N' can_read_contents, 'Y' active FROM dual) source
|
|
ON (target.user_id = source.user_id)
|
|
WHEN MATCHED THEN UPDATE SET target.user_name = source.user_name, target.employee_no = source.employee_no,
|
|
target.dept_code = source.dept_code, target.can_read_contents = source.can_read_contents, target.active = source.active
|
|
WHEN NOT MATCHED THEN INSERT (user_id, user_name, employee_no, dept_code, can_read_contents, active)
|
|
VALUES (source.user_id, source.user_name, source.employee_no, source.dept_code, source.can_read_contents, source.active);
|
|
|
|
MERGE INTO cb_app_role target
|
|
USING (SELECT 9904 role_id, 'DDS_FIXTURE_ALLOW_ROLE' role_name, 'INTERNAL' max_sensitivity_level FROM dual) source
|
|
ON (target.role_id = source.role_id)
|
|
WHEN MATCHED THEN UPDATE SET target.role_name = source.role_name, target.max_sensitivity_level = source.max_sensitivity_level
|
|
WHEN NOT MATCHED THEN INSERT (role_id, role_name, max_sensitivity_level)
|
|
VALUES (source.role_id, source.role_name, source.max_sensitivity_level);
|
|
|
|
MERGE INTO cb_user_role target
|
|
USING (SELECT 9904 user_id, 9904 role_id FROM dual) source
|
|
ON (target.user_id = source.user_id AND target.role_id = source.role_id)
|
|
WHEN NOT MATCHED THEN INSERT (user_id, role_id) VALUES (source.user_id, source.role_id);
|
|
|
|
MERGE INTO cb_permission target
|
|
USING (SELECT 9904 perm_id, 9904 role_id, 'CB_VECTOR_SEARCH_DOCUMENTS' target_name,
|
|
'SELECT' action_name, 'ALLOW' permission_effect FROM dual) source
|
|
ON (target.perm_id = source.perm_id)
|
|
WHEN MATCHED THEN UPDATE SET target.role_id = source.role_id, target.target_name = source.target_name,
|
|
target.action_name = source.action_name, target.permission_effect = source.permission_effect
|
|
WHEN NOT MATCHED THEN INSERT (perm_id, role_id, target_name, action_name, permission_effect)
|
|
VALUES (source.perm_id, source.role_id, source.target_name, source.action_name, source.permission_effect);
|
|
|
|
MERGE INTO cb_permission_rule target
|
|
USING (SELECT 9904 rule_id, 9904 perm_id, 'TECH_TAG' rule_column, 'TAG' rule_type,
|
|
'DDS_VERIFY_ALLOW' rule_value FROM dual) source
|
|
ON (target.rule_id = source.rule_id)
|
|
WHEN MATCHED THEN UPDATE SET target.perm_id = source.perm_id, target.rule_column = source.rule_column,
|
|
target.rule_type = source.rule_type, target.rule_value = source.rule_value
|
|
WHEN NOT MATCHED THEN INSERT (rule_id, perm_id, rule_column, rule_type, rule_value)
|
|
VALUES (source.rule_id, source.perm_id, source.rule_column, source.rule_type, source.rule_value);
|
|
|
|
MERGE INTO cb_vector_document_chunk target
|
|
USING (SELECT 29040 chunk_id, 'dds-fixture-service-allow' document_id, 1 chunk_no,
|
|
'DDS verification allow fixture' title, TO_CLOB('Deterministic allow fixture.') chunk_text,
|
|
'fixture://dds/service/allow' source_uri, TO_VECTOR('[0.11,0.22,0.33,0.44]') embedding FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id)
|
|
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
|
|
target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
|
|
VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);
|
|
|
|
MERGE INTO cb_vector_document_chunk target
|
|
USING (SELECT 29041 chunk_id, 'dds-fixture-service-deny' document_id, 1 chunk_no,
|
|
'DDS verification deny fixture' title, TO_CLOB('Deterministic deny fixture.') chunk_text,
|
|
'fixture://dds/service/deny' source_uri, TO_VECTOR('[0.12,0.23,0.34,0.45]') embedding FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id)
|
|
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
|
|
target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
|
|
VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);
|
|
|
|
MERGE INTO cb_vector_document_chunk target
|
|
USING (SELECT 29042 chunk_id, 'dds-fixture-direct' document_id, 1 chunk_no,
|
|
'DDS direct comparison fixture' title, TO_CLOB('Deterministic direct fixture.') chunk_text,
|
|
'fixture://dds/direct' source_uri, TO_VECTOR('[0.13,0.24,0.35,0.46]') embedding FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id)
|
|
WHEN MATCHED THEN UPDATE SET target.document_id = source.document_id, target.chunk_no = source.chunk_no,
|
|
target.title = source.title, target.chunk_text = source.chunk_text, target.source_uri = source.source_uri, target.embedding = source.embedding
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, document_id, chunk_no, title, chunk_text, source_uri, embedding)
|
|
VALUES (source.chunk_id, source.document_id, source.chunk_no, source.title, source.chunk_text, source.source_uri, source.embedding);
|
|
|
|
MERGE INTO cb_vector_document_tag target USING (SELECT 29040 chunk_id, 'DDS_VERIFY_ALLOW' tech_tag FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);
|
|
MERGE INTO cb_vector_document_tag target USING (SELECT 29041 chunk_id, 'DDS_VERIFY_DENY' tech_tag FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);
|
|
MERGE INTO cb_vector_document_tag target USING (SELECT 29042 chunk_id, 'ORACLE_DDS' tech_tag FROM dual) source
|
|
ON (target.chunk_id = source.chunk_id AND target.tech_tag = source.tech_tag)
|
|
WHEN NOT MATCHED THEN INSERT (chunk_id, tech_tag) VALUES (source.chunk_id, source.tech_tag);
|
|
|
|
PROMPT === 3. Registering fixture manifest ===
|
|
MERGE INTO cb_dds_validation_fixture target
|
|
USING (SELECT 'SERVICE_ALLOW' fixture_id, 'SERVICE' enforcement_path, 'service' subject_key, 9904 application_user_id,
|
|
'dds-fixture-service-allow' document_id, 'Y' expected_visible, 'Temporary token sees allowed tag' description FROM dual) source
|
|
ON (target.fixture_id = source.fixture_id)
|
|
WHEN MATCHED THEN UPDATE SET target.enforcement_path = source.enforcement_path, target.subject_key = source.subject_key,
|
|
target.application_user_id = source.application_user_id, target.document_id = source.document_id,
|
|
target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
|
|
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
|
|
VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
|
|
MERGE INTO cb_dds_validation_fixture target
|
|
USING (SELECT 'SERVICE_DENY' fixture_id, 'SERVICE' enforcement_path, 'service' subject_key, 9904 application_user_id,
|
|
'dds-fixture-service-deny' document_id, 'N' expected_visible, 'Temporary token cannot see denied tag' description FROM dual) source
|
|
ON (target.fixture_id = source.fixture_id)
|
|
WHEN MATCHED THEN UPDATE SET target.enforcement_path = source.enforcement_path, target.subject_key = source.subject_key,
|
|
target.application_user_id = source.application_user_id, target.document_id = source.document_id,
|
|
target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
|
|
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
|
|
VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
|
|
MERGE INTO cb_dds_validation_fixture target
|
|
USING (SELECT 'DIRECT_ALLOW' fixture_id, 'DIRECT' enforcement_path, 'both' subject_key, 0 application_user_id,
|
|
'dds-fixture-direct' document_id, 'Y' expected_visible, 'Combined DDS profile sees direct fixture' description FROM dual) source
|
|
ON (target.fixture_id = source.fixture_id)
|
|
WHEN MATCHED THEN UPDATE SET target.subject_key = source.subject_key, target.document_id = source.document_id,
|
|
target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
|
|
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
|
|
VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
|
|
MERGE INTO cb_dds_validation_fixture target
|
|
USING (SELECT 'DIRECT_DENY' fixture_id, 'DIRECT' enforcement_path, 'none' subject_key, 0 application_user_id,
|
|
'dds-fixture-direct' document_id, 'N' expected_visible, 'Default deny DDS profile cannot see fixture' description FROM dual) source
|
|
ON (target.fixture_id = source.fixture_id)
|
|
WHEN MATCHED THEN UPDATE SET target.subject_key = source.subject_key, target.document_id = source.document_id,
|
|
target.expected_visible = source.expected_visible, target.description = source.description, target.active_yn = 'Y'
|
|
WHEN NOT MATCHED THEN INSERT (fixture_id, enforcement_path, subject_key, application_user_id, document_id, expected_visible, description)
|
|
VALUES (source.fixture_id, source.enforcement_path, source.subject_key, source.application_user_id, source.document_id, source.expected_visible, source.description);
|
|
|
|
PROMPT === 4. Recording the service baseline ===
|
|
MERGE INTO cb_dds_protection_snapshot target
|
|
USING (
|
|
SELECT 'SERVICE' enforcement_path, 'service' subject_key,
|
|
STANDARD_HASH('SERVICE|ADMIN.CB_DDS_VECTOR_SEARCH_DOCUMENTS|CB_DDS_TOKEN_ROLE|DDS_DEMO_TOKEN_VECTOR_GRANT|ADMIN.CB_DDS_VECTOR_TAG_ALLOWED', 'SHA256') fingerprint
|
|
FROM dual
|
|
) source
|
|
ON (target.enforcement_path = source.enforcement_path AND target.subject_key = source.subject_key)
|
|
WHEN NOT MATCHED THEN INSERT (snapshot_id, object_name, enforcement_path, subject_key, fingerprint, actor, note, published_at)
|
|
VALUES (cb_dds_protection_snapshot_seq.NEXTVAL, 'ADMIN.CB_DDS_VECTOR_SEARCH_DOCUMENTS', source.enforcement_path,
|
|
source.subject_key, source.fingerprint, 'DDS migration', 'Initial token-service baseline', SYSTIMESTAMP);
|
|
|
|
COMMIT;
|
|
|
|
SELECT fixture_id, enforcement_path, subject_key, expected_visible
|
|
FROM cb_dds_validation_fixture
|
|
ORDER BY fixture_id;
|
|
|
|
PROMPT === DDS protection evidence setup complete ===
|
|
EXIT;
|