vpd-permission-poc/database/adb/48_kb_permission_condition_codes.sql

-- ============================================================
-- 48_kb_permission_condition_codes.sql
--
-- Replaces the first KB example's stakeholder-specific predicate types with
-- policy condition codes. CB_AGENT_DOC_VPD_FILTER expands these codes into
-- the target object's WHERE predicate.
-- Execute as ADMIN after 25 and 46.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO OFF
SET FEEDBACK ON
SET DEFINE OFF

ALTER SESSION DISABLE PARALLEL DML;

PROMPT === 1. Replacing KB example rules with filter condition codes ===
UPDATE cb_permission_rule r
SET rule_type = CASE
      WHEN EXISTS (
        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_DESIGNER_ROLE'
          AND p.target_name = 'KB_CONTRACTS'
      ) THEN 'OWN_CONTRACT'
      WHEN EXISTS (
        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
          AND p.target_name = 'KB_CONTRACTS'
      ) THEN 'CHANNEL_CONTRACT'
      WHEN EXISTS (
        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_DESIGNER_ROLE'
          AND p.target_name IN ('KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
      ) THEN 'OWN_CUSTOMER'
      WHEN EXISTS (
        SELECT 1 FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
        WHERE p.perm_id = r.perm_id AND ar.role_name = 'KB_BRANCH_MANAGER_ROLE'
          AND p.target_name IN ('KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
      ) THEN 'CHANNEL_CUSTOMER'
      ELSE r.rule_type
    END,
    rule_value = NULL
WHERE r.rule_type IN ('STAKEHOLDER_SELF', 'STAKEHOLDER_CHANNEL')
  AND EXISTS (
    SELECT 1
    FROM cb_permission p
    JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE p.perm_id = r.perm_id
      AND ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
      AND p.target_name IN ('KB_CONTRACTS', 'KB_CUSTOMERS', 'KB_COVERAGES', 'KB_CLAIMS', 'KB_EXTERNAL_HOLDINGS')
  );

COMMIT;

PROMPT === 2. Keeping token subject access as an identity-only permission ===
DECLARE
  v_identity_role_id NUMBER;
  v_permission_id    NUMBER;
  v_count            NUMBER;
BEGIN
  BEGIN
    SELECT role_id INTO v_identity_role_id
    FROM cb_app_role
    WHERE role_name = 'KB_STAKEHOLDER_IDENTITY_ROLE';
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT NVL(MAX(role_id), 0) + 1 INTO v_identity_role_id FROM cb_app_role;
      INSERT INTO cb_app_role(role_id, role_name, max_sensitivity_level)
      VALUES (v_identity_role_id, 'KB_STAKEHOLDER_IDENTITY_ROLE', 'INTERNAL');
  END;

  FOR u IN (
    SELECT user_id FROM cb_app_user
    WHERE stakeholder_user_id IS NOT NULL AND active = 'Y'
  ) LOOP
    SELECT COUNT(*) INTO v_count
    FROM cb_user_role
    WHERE user_id = u.user_id AND role_id = v_identity_role_id;
    IF v_count = 0 THEN
      INSERT INTO cb_user_role(user_id, role_id) VALUES (u.user_id, v_identity_role_id);
    END IF;
  END LOOP;

  -- Business roles do not need to grant the stakeholder source row. The
  -- identity role alone lets a valid token resolve its own stakeholder row.
  DELETE FROM cb_permission_column
  WHERE permission_id IN (
    SELECT p.perm_id
    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
      AND p.target_name = 'KB_STAKEHOLDERS'
  );
  DELETE FROM cb_permission_rule
  WHERE perm_id IN (
    SELECT p.perm_id
    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
      AND p.target_name = 'KB_STAKEHOLDERS'
  );
  DELETE FROM cb_permission
  WHERE perm_id IN (
    SELECT p.perm_id
    FROM cb_permission p JOIN cb_app_role ar ON ar.role_id = p.role_id
    WHERE ar.role_name IN ('KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE')
      AND p.target_name = 'KB_STAKEHOLDERS'
  );

  BEGIN
    SELECT perm_id INTO v_permission_id
    FROM cb_permission
    WHERE role_id = v_identity_role_id
      AND target_name = 'KB_STAKEHOLDERS'
      AND action_name = 'SELECT';
  EXCEPTION
    WHEN NO_DATA_FOUND THEN
      SELECT cb_permission_seq.NEXTVAL INTO v_permission_id FROM dual;
      INSERT INTO cb_permission(perm_id, role_id, target_name, action_name, permission_effect)
      VALUES (v_permission_id, v_identity_role_id, 'KB_STAKEHOLDERS', 'SELECT', 'ALLOW');
  END;

  DELETE FROM cb_permission_rule WHERE perm_id = v_permission_id;
  INSERT INTO cb_permission_rule(rule_id, perm_id, rule_column, rule_type, rule_value)
  VALUES (cb_permission_rule_seq.NEXTVAL, v_permission_id, 'USER_ID', 'TOKEN_SUBJECT', NULL);
END;
/
COMMIT;

PROMPT === 3. Condition codes consumed by the VPD filter ===
SELECT ar.role_name, p.target_name, r.rule_column, r.rule_type
FROM cb_permission p
JOIN cb_app_role ar ON ar.role_id = p.role_id
JOIN cb_permission_rule r ON r.perm_id = p.perm_id
WHERE ar.role_name IN (
  'KB_DESIGNER_ROLE', 'KB_BRANCH_MANAGER_ROLE', 'KB_STAKEHOLDER_IDENTITY_ROLE'
)
ORDER BY ar.role_name, p.target_name, r.rule_id;

PROMPT === KB permission condition codes ready ===