Grant select on all but security tables to cwms_user for codegen.

schema/src/buildCWMS_DB.sql

@@ -199,7 +199,27 @@ begin
 end;
 /
 @@cwms/User-Roles/web_user_role_grants.sql
-alter session set current_schema = &builduser
+
+-- Grant select on tables to normal users.
+
+begin
+   for rec in (select object_name
+                 from dba_objects
+                where owner = '&cwms_schema'
+                  and object_type = 'TABLE'
+                  and (instr(object_name, 'AT_') = 1 or instr(object_name, 'CWMS_') = 1)
+                  and instr(object_name, 'AT_SEC_') = 0
+		            and object_name != 'AT_API_KEYS'
+                order by 1
+              )
+   loop
+      execute immediate 'grant select on '||rec.object_name||' to cwms_user';
+   end loop;
+end;
+/
+
+
+alter session set current_schema = &builduser;
 
 -- create CWMS service user
 begin execute immediate 'create user ' || cwms_sec.cac_service_user || ' PROFILE CWMS_PROF IDENTIFIED BY "FEDCBA9876543210" '; end; 

schema/src/test/test_aaa_normaluserfails.sql

@@ -8,6 +8,9 @@ AS
     -- %test(Normal user cannot arbitrarily set user context)
     -- %throws(-20998)
     procedure cannot_set_context_users;
+
+    --%test(Normal user has no READ access to sensitive tables)
+    procedure no_read_access;
 END;
 /
 
@@ -32,5 +35,46 @@ AS
         ut.expect(cwms_util.get_user_id()).not_to_equal(upper(l_other_user));
         ut.fail('This should not have worked');
     end;
+
+    procedure no_read_access is
+        c_owner constant varchar2(128) := '&&cwms_schema';
+        type t_table_list is table of varchar2(128);
+        c_tables constant t_table_list := t_table_list(
+              'AT_API_KEYS',
+              'AT_SEC_ALLOW',
+              'AT_SEC_CWMS_USERS',
+              'AT_SEC_LOCKED_USERS',
+              'AT_SEC_SERVICE_USER',
+              'AT_SEC_SESSION',
+              'AT_SEC_TS_GROUPS',
+              'AT_SEC_TS_GROUP_MASKS',
+              'AT_SEC_USERS',
+              'AT_SEC_USER_GROUPS',
+              'AT_SEC_USER_OFFICE'
+            );
+
+        l_cnt number;
+    begin
+        for i in 1 .. c_tables.count loop
+            select count(*)
+            into l_cnt
+            from all_tab_privs p
+            where p.table_schema = c_owner
+              and p.table_name   = c_tables(i)
+              and p.privilege    = 'SELECT'
+              and (
+                p.grantee = user
+                    or p.grantee = 'PUBLIC'
+                    or p.grantee in (select granted_role from user_role_privs)
+                );
+
+            if l_cnt <> 0 then
+                ut.fail(
+                        'Expected no SELECT on ' || c_owner || '.' || c_tables(i) ||
+                        ' for user=' || user || '. Found count=' || l_cnt
+                );
+            end if;
+        end loop;
+    end;
 END;
 /