Improve shared app account scenario

scenarios/02-shared-app-account/sql/00_schema.sql

@@ -1,11 +1,20 @@
 WHENEVER SQLERROR EXIT SQL.SQLCODE
 
-CREATE TABLE dds_orders (
-  order_id      NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
-  customer_name VARCHAR2(100) NOT NULL,
-  region        VARCHAR2(30) NOT NULL,
-  seller        VARCHAR2(60) NOT NULL,
-  amount        NUMBER(12,2) NOT NULL,
-  margin        NUMBER(12,2) NOT NULL
-);
-
+BEGIN
+  EXECUTE IMMEDIATE q'[
+    CREATE TABLE dds_orders (
+      order_id      NUMBER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+      customer_name VARCHAR2(100) NOT NULL,
+      region        VARCHAR2(30) NOT NULL,
+      seller        VARCHAR2(60) NOT NULL,
+      amount        NUMBER(12,2) NOT NULL,
+      margin        NUMBER(12,2) NOT NULL
+    )
+  ]';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -955 THEN
+      RAISE;
+    END IF;
+END;
+/

scenarios/02-shared-app-account/sql/02_identities.sql

@@ -14,5 +14,11 @@ GRANT shared_app_session_role TO latam_manager_role;
 GRANT DATA ROLE seller_role TO alice;
 GRANT DATA ROLE latam_manager_role TO bruno;
 
-CREATE USER dds_app IDENTIFIED BY "Welcome1_DDS_App!" ACCOUNT UNLOCK;
+CREATE USER dds_app IDENTIFIED BY "AppPool#2026Lab!" ACCOUNT UNLOCK;
 GRANT CREATE SESSION TO dds_app;
+
+-- Vulnerable baseline: this broad legacy role simulates a shared application
+-- account or connection pool that can query the full table before DDS is enforced.
+CREATE ROLE shared_app_legacy_access_role;
+GRANT SELECT ON dds_orders TO shared_app_legacy_access_role;
+GRANT shared_app_legacy_access_role TO dds_app;

scenarios/02-shared-app-account/sql/03_data_grants.sql

@@ -3,7 +3,7 @@ WHENEVER SQLERROR EXIT SQL.SQLCODE
 CREATE OR REPLACE DATA GRANT seller_own_orders
   AS SELECT (order_id, customer_name, region, seller, amount)
   ON dds_orders
-  WHERE seller = ORA_END_USER_CONTEXT.username
+  WHERE UPPER(seller) = ORA_END_USER_CONTEXT.username
   TO seller_role;
 
 CREATE OR REPLACE DATA GRANT latam_manager_orders

scenarios/02-shared-app-account/sql/99_reset.sql

@@ -14,6 +14,8 @@ BEGIN EXECUTE IMMEDIATE 'DROP DATA ROLE latam_manager_role'; EXCEPTION WHEN OTHE
 /
 BEGIN EXECUTE IMMEDIATE 'DROP ROLE shared_app_session_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
+BEGIN EXECUTE IMMEDIATE 'DROP ROLE shared_app_legacy_access_role'; EXCEPTION WHEN OTHERS THEN NULL; END;
+/
 BEGIN EXECUTE IMMEDIATE 'DROP END USER alice'; EXCEPTION WHEN OTHERS THEN NULL; END;
 /
 BEGIN EXECUTE IMMEDIATE 'DROP END USER bruno'; EXCEPTION WHEN OTHERS THEN NULL; END;