105 lines
3.4 KiB
MySQL
105 lines
3.4 KiB
MySQL
-- ============================================================
|
|
-- 47_kb_stakeholder_permission_or_branches.sql
|
|
--
|
|
-- Refines the KB example so the permission table carries the expected
|
|
-- stakeholder role and each role branch becomes an OR candidate in the
|
|
-- dynamic VPD filter. Execute after 26 and 46 as ADMIN.
|
|
-- ============================================================
|
|
WHENEVER SQLERROR EXIT SQL.SQLCODE
|
|
SET ECHO OFF
|
|
SET FEEDBACK ON
|
|
SET DEFINE OFF
|
|
|
|
PROMPT === 1. Storing expected stakeholder role in example rules ===
|
|
UPDATE cb_permission_rule r
|
|
SET rule_value = CASE
|
|
WHEN EXISTS (
|
|
SELECT 1
|
|
FROM cb_permission p
|
|
JOIN cb_app_role ar ON ar.role_id = p.role_id
|
|
WHERE p.perm_id = r.perm_id
|
|
AND ar.role_name = 'KB_DESIGNER_ROLE'
|
|
) THEN '설계사'
|
|
WHEN EXISTS (
|
|
SELECT 1
|
|
FROM cb_permission p
|
|
JOIN cb_app_role ar ON ar.role_id = p.role_id
|
|
WHERE p.perm_id = r.perm_id
|
|
AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
|
|
) THEN '지점장'
|
|
END
|
|
WHERE r.rule_type IN ('STAKEHOLDER_SELF', 'STAKEHOLDER_CHANNEL')
|
|
AND EXISTS (
|
|
SELECT 1
|
|
FROM cb_permission p
|
|
JOIN cb_app_role ar ON ar.role_id = p.role_id
|
|
WHERE p.perm_id = r.perm_id
|
|
AND ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
|
|
);
|
|
|
|
PROMPT === 2. Adding an identity role so every stakeholder token can resolve itself ===
|
|
DECLARE
|
|
v_role_id NUMBER;
|
|
v_permission_id NUMBER;
|
|
v_count NUMBER;
|
|
BEGIN
|
|
BEGIN
|
|
SELECT role_id INTO v_role_id
|
|
FROM cb_app_role
|
|
WHERE role_name = 'KB_STAKEHOLDER_IDENTITY_ROLE';
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT NVL(MAX(role_id), 0) + 1 INTO v_role_id FROM cb_app_role;
|
|
INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
|
|
VALUES (v_role_id, 'KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL');
|
|
END;
|
|
|
|
FOR u IN (
|
|
SELECT user_id
|
|
FROM cb_app_user
|
|
WHERE stakeholder_user_id IS NOT NULL
|
|
AND active = 'Y'
|
|
) LOOP
|
|
SELECT COUNT(*) INTO v_count
|
|
FROM cb_user_role
|
|
WHERE user_id = u.user_id
|
|
AND role_id = v_role_id;
|
|
IF v_count = 0 THEN
|
|
INSERT INTO cb_user_role(user_id, role_id) VALUES (u.user_id, v_role_id);
|
|
END IF;
|
|
END LOOP;
|
|
|
|
BEGIN
|
|
SELECT perm_id INTO v_permission_id
|
|
FROM cb_permission
|
|
WHERE role_id = v_role_id
|
|
AND target_name = 'KB_STAKEHOLDERS'
|
|
AND action_name = 'SELECT';
|
|
EXCEPTION
|
|
WHEN NO_DATA_FOUND THEN
|
|
SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
|
|
INSERT INTO cb_permission(perm_id, role_id, target_name, action_name, permission_effect)
|
|
VALUES (v_permission_id, v_role_id, 'KB_STAKEHOLDERS', 'SELECT', 'ALLOW');
|
|
INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
|
|
VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, 'USER_ID', 'TOKEN_SUBJECT', NULL);
|
|
END;
|
|
END;
|
|
/
|
|
COMMIT;
|
|
|
|
PROMPT === 3. Result: role-specific permission branches ===
|
|
SELECT ar.role_name,
|
|
p.target_name,
|
|
r.rule_column,
|
|
r.rule_type,
|
|
NVL(r.rule_value, '(token role)') AS expected_stakeholder_role
|
|
FROM cb_permission p
|
|
JOIN cb_app_role ar ON ar.role_id = p.role_id
|
|
JOIN cb_permission_rule r ON r.perm_id = p.perm_id
|
|
WHERE ar.role_name IN (
|
|
'KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE', 'KB_STAKEHOLDER_IDENTITY_ROLE'
|
|
)
|
|
ORDER BY ar.role_name, p.target_name, r.rule_id;
|
|
|
|
PROMPT === KB role branches are combined as OR by CB_AGENT_DOC_VPD_FILTER ===
|