DEV Community: iron_man

DEV-Part-2-Frontend-and-Sample-Files.md

iron_man — Mon, 21 Sep 2026 20:26:25 +0000

Oracle Schema Hardening — Part 2: Frontend and Sample Files

Each heading below is a file path relative to the project root. Create that file and copy only the code inside its code block. Both parts belong to the same Spring Boot and React project.

File list

fixtures/library/TR/db-links/definitions.json
fixtures/library/TR/grants/AUD_TXN.sql
fixtures/library/TR/manifest.json
fixtures/library/TR/synonyms/AUD_TXN.sql
fixtures/library/TR/tables/AUD_TXN.sql
fixtures/tnsnames.ora
frontend/package.json
frontend/src/App.tsx
frontend/src/api.ts
frontend/src/main.tsx
frontend/src/styles.css
frontend/src/types.ts
frontend/tsconfig.json
frontend/vite.config.ts

`fixtures/library/TR/db-links/definitions.json`

{
  "linkName": "CSS_LINK",
  "remoteSegment": "CSS",
  "tnsRule": "SELECTED",
  "remoteAlias": null,
  "verification": "DUAL",
  "dependentObjects": ["PKG_SETTLEMENT"]
}

`fixtures/library/TR/grants/AUD_TXN.sql`

GRANT SELECT ON ${TARGET_SCHEMA}.AUD_TXN TO ${BASE_SCHEMA}TRCUS;

`fixtures/library/TR/manifest.json`

[
  {"id":"css-link","objectName":"CSS_LINK","objectType":"DATABASE LINK","file":"db-links/definitions.json","rank":1,"dependencies":[],"executionSegment":"CURRENT","sourcePreference":"LIBRARY_FIRST","verification":"DB_LINK_HEALTHY"},
  {"id":"audit-table","objectName":"AUD_TXN","objectType":"TABLE","file":"tables/AUD_TXN.sql","rank":2,"dependencies":[],"executionSegment":"CURRENT","sourcePreference":"LIBRARY_FIRST","verification":"TABLE_EXISTS"},
  {"id":"audit-grant","objectName":"AUD_TXN","objectType":"GRANT","file":"grants/AUD_TXN.sql","rank":3,"dependencies":["audit-table"],"executionSegment":"TR","sourcePreference":"LIBRARY_FIRST","verification":"GRANT_EXISTS","relatedSegment":"TRCUS","privilege":"SELECT"},
  {"id":"audit-synonym","objectName":"AUD_TXN","objectType":"SYNONYM","file":"synonyms/AUD_TXN.sql","rank":3,"dependencies":["audit-grant"],"executionSegment":"TRCUS","sourcePreference":"LIBRARY_FIRST","verification":"SYNONYM_EXISTS","relatedSegment":"TR"}
]

`fixtures/library/TR/synonyms/AUD_TXN.sql`

CREATE SYNONYM ${TARGET_SCHEMA}.AUD_TXN FOR ${BASE_SCHEMA}TR.AUD_TXN;

`fixtures/library/TR/tables/AUD_TXN.sql`

-- Example fixture only. Replace with your reviewed audit-table definition.
CREATE TABLE ${TARGET_SCHEMA}.AUD_TXN (
  TXN_ID NUMBER NOT NULL,
  ACTION_NAME VARCHAR2(30),
  CHANGED_AT TIMESTAMP DEFAULT SYSTIMESTAMP
);

`fixtures/tnsnames.ora`

# Demonstration only. No corporate endpoints.
DEMO141 =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1521))
    (CONNECT_DATA = (SERVICE_NAME = DEMO)))
DEMO141_ALT =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = localhost)(PORT = 1522))
    (CONNECT_DATA = (SERVICE_NAME = DEMO_ALT)))

`frontend/package.json`

{
  "name": "oracle-hardening-dashboard",
  "private": true,
  "version": "0.1.0",
  "type": "module",
  "scripts": {
    "dev": "vite --host 127.0.0.1",
    "build": "tsc -b && vite build"
  },
  "dependencies": {
    "react": "19.1.1",
    "react-dom": "19.1.1",
    "lucide-react": "0.468.0"
  },
  "devDependencies": {
    "@types/react": "19.1.10",
    "@types/react-dom": "19.1.9",
    "@vitejs/plugin-react": "4.7.0",
    "typescript": "5.9.2",
    "vite": "6.4.1"
  },
  "engines": {
    "node": ">=22.12.0"
  }
}

`frontend/src/App.tsx`

import { useEffect, useState } from 'react';
import { Activity, ArrowDown, ArrowRight, Check, CheckCircle2, ChevronRight, Clock3, Code2, Database, Download, FileCode2, History, Layers3, LayoutDashboard, Link2, LoaderCircle, LockKeyhole, Play, RefreshCw, Search, Settings2, ShieldCheck, Terminal, Unplug, X } from 'lucide-react';
import { api, login, refreshCsrf } from './api';
import { nextBatch, type Action, type Config, type Run } from './types';
export default function App() {
    const [config, setConfig] = useState<Config | null>(null), [input, setInput] = useState('DEMO@141'), [alias, setAlias] = useState(''), [aliases, setAliases] = useState<string[]>([]), [segment, setSegment] = useState('TR');
    const [run, setRun] = useState<Run | null>(null), [busy, setBusy] = useState(''), [error, setError] = useState(''), [notice, setNotice] = useState(''), [selected, setSelected] = useState<Action | null>(null), [tab, setTab] = useState('workspace');
    const [history, setHistory] = useState<Run[]>([]), [approval, setApproval] = useState<Action[] | null>(null), [approved, setApproved] = useState(false), [adminOpen, setAdminOpen] = useState(false), [password, setPassword] = useState(''), [username, setUsername] = useState('admin');
    const [referenceInput, setReferenceInput] = useState('REFERENCE@141'), [referenceAlias, setReferenceAlias] = useState(''), [referenceAliases, setReferenceAliases] = useState<string[]>([]), [release, setRelease] = useState(''), [referencePreview, setReferencePreview] = useState<{
        sourceSchema: string;
        release: string;
        sql: string;
        checksum: string;
        message: string;
    } | null>(null), [filter, setFilter] = useState('');
    const [historical, setHistorical] = useState(false);
    const [compatible, setCompatible] = useState(false), [targetRelease, setTargetRelease] = useState('');
    const [candidates, setCandidates] = useState<{
        id: string;
        objectName: string;
        objectType: string;
        segment: string;
        sql: string;
        checksum: string;
    }[]>([]), [publishCandidate, setPublishCandidate] = useState<string | null>(null);
    async function task(name: string, fn: () => Promise<void>) { setBusy(name); setError(''); setNotice(''); try {
        await fn();
    }
    catch (e) {
        setError(e instanceof Error ? e.message : 'Operation failed');
    }
    finally {
        setBusy('');
    } }
    useEffect(() => { api<Config>('/config').then(c => { setConfig(c); setSegment(c.segments[0] || ''); }).catch(e => setError(e.message)); }, []);
    const batch = run ? nextBatch(run.actions) : [];
    const base = input.split('@')[0].trim().toUpperCase();
    const successes = run?.actions.filter(a => a.status === 'SUCCESS').length || 0;
    const prerequisites = run?.actions.filter(a => a.source === 'LIBRARY') || [];
    function clearRun() { setRun(null); setSelected(null); setApproval(null); setReferencePreview(null); setHistorical(false); }
    async function findTns() { await task('Finding TNS', async () => { const result = await api<{
        aliases: string[];
    }>('/tns?input=' + encodeURIComponent(input)); setAliases(result.aliases); setAlias(result.aliases.length === 1 ? result.aliases[0] : ''); if (!result.aliases.length)
        setNotice('No matching aliases. Ask your administrator to update the approved TNS file.'); }); }
    async function scan() { await task('Connecting and scanning', async () => { const target = { input, alias, segment }; await api('/connection/test', 'POST', target); const result = await api<Run>('/runs', 'POST', target); setRun(result); setSelected(result.actions[0] || null); setHistorical(false); setReferencePreview(null); }); }
    function review(actions: Action[]) { setApproval(actions); setApproved(false); }
    function exportRun() { if (!run)
        return; const link = document.createElement('a'); link.href = URL.createObjectURL(new Blob([JSON.stringify(run, null, 2)], { type: 'application/json' })); link.download = `hardening-${run.id}.json`; link.click(); URL.revokeObjectURL(link.href); }
    const visible = run?.actions.filter(a => (a.objectName + ' ' + a.objectType + ' ' + a.status).toLowerCase().includes(filter.toLowerCase())) || [];
    return <div className="app">
  <aside className="sidebar">
   <a className="brand" href="/" aria-label="SchemaWorks home"><span className="brand-mark"><Layers3 size={22}/></span><span>Schema<span className="brand-light">Works</span><small>ORACLE OPERATIONS</small></span></a>
   <div className="nav-label">WORKSPACE</div>
   <button className={'nav-item ' + (tab === 'workspace' ? 'active' : '')} onClick={() => setTab('workspace')}><LayoutDashboard size={18}/>Schema hardening<span className="nav-dot"/></button>
   <button className={'nav-item ' + (tab === 'history' ? 'active' : '')} onClick={() => task('Loading history', async () => { setHistory(await api<Run[]>('/history')); setTab('history'); })}><History size={18}/>Run history</button>
   <button className={'nav-item ' + (tab === 'library' ? 'active' : '')} onClick={() => task('Loading library', async () => { setTab('library'); if (config?.admin)
        setCandidates(await api('/admin/candidates')); })}><FileCode2 size={18}/>Fix library</button>
   <div className="nav-label tools-label">MANAGEMENT</div>
   <button className="nav-item" onClick={() => setAdminOpen(true)}><Settings2 size={18}/>Reference setup<LockKeyhole size={13}/></button>
   <div className="sidebar-bottom"><div className="connection-orbit"><Database size={21}/><span /></div><strong>Built for your environment</strong><p>One workspace. Every schema.<br />Changes stay in your control.</p><div className="sidebar-version"><span className="tiny-dot"/> LOCAL WORKSPACE <span>v0.1</span></div></div>
  </aside>
  <div className="main-shell">
   <header className="topbar"><div className="breadcrumbs">Operations <ChevronRight size={14}/><span>{tab === 'history' ? 'Run history' : tab === 'library' ? 'Fix library' : 'Schema hardening'}</span></div><div className="topbar-right"><button className="reference-status" onClick={() => setAdminOpen(true)}><span className={'tiny-dot ' + (config?.referenceReady ? 'green' : 'amber')}/>Reference: {config?.referenceReady ? 'Configured' : 'Not configured'}<ChevronRight size={13}/></button><span className="top-divider"/><button className="avatar" onClick={() => setAdminOpen(true)} aria-label="Account and reference settings">{config?.admin ? 'AD' : 'OP'}</button></div></header>
   <main>
    <div className="page-heading"><div><div className="eyebrow">DATABASE READINESS</div><h1>{tab === 'history' ? 'Run history' : tab === 'library' ? 'Reusable fix library' : 'Schema hardening'}</h1><p>{tab === 'history' ? 'A record of every reviewed change and verified result.' : tab === 'library' ? 'Reviewed fixes, organised by segment and dependency.' : 'From invalid objects to a ready schema. One reviewed step at a time.'}</p></div><div className="mode-badge"><span className="tiny-dot"/>{config?.mode === 'demo' ? 'DEMO ENVIRONMENT' : 'ORACLE ENVIRONMENT'}</div></div>
    {config?.mode === 'demo' && <div className="demo-banner"><ShieldCheck size={17}/><span><strong>Explore safely.</strong> This workspace uses simulated Oracle objects. No database is connected.</span><span className="banner-tag">SAMPLE DATA</span></div>}
    {error && <div className="message error" role="alert"><span>{error}</span><button onClick={() => setError('')} aria-label="Dismiss error"><X size={16}/></button></div>}
    {notice && <div className="message" role="status">{notice}</div>}
    {busy && <div className="busy-line" role="status"><LoaderCircle size={14} className="spin"/>{busy}…</div>}
    {tab === 'workspace' && <>
     <section className="connection-card card"><div className="section-title"><span className="section-icon"><Database size={19}/></span><div><h2>Target connection</h2><p>Choose the schema you want to prepare.</p></div><span className="step-tag">01 / CONNECT</span></div>
      <div className="connection-fields"><label>Schema & server hint<div className="input-with-button"><input value={input} onChange={e => { setInput(e.target.value); setAliases([]); setAlias(''); clearRun(); }} onKeyDown={e => e.key === 'Enter' && findTns()} placeholder="BASE_SCHEMA@SERVER_HINT"/><button disabled={!!busy || !input} onClick={findTns} aria-label="Find matching TNS aliases"><Search size={16}/></button></div></label>
       <label>TNS alias<select value={alias} onChange={e => { setAlias(e.target.value); clearRun(); }}><option value="">{aliases.length ? 'Select matching alias' : 'Find TNS to get aliases'}</option>{aliases.map(a => <option key={a}>{a}</option>)}</select></label>
       <div className="segment-field"><span className="field-label">Segment</span><div className="segment-buttons" role="group" aria-label="Segment">{config?.segments.map(s => <button key={s} aria-pressed={segment === s} aria-label={s + ' segment'} className={segment === s ? 'chosen' : ''} onClick={() => { setSegment(s); clearRun(); }}>{s}</button>)}</div></div>
       <button className="primary connect-button" disabled={!!busy || !alias || !segment} onClick={scan}>{busy === 'Connecting and scanning' ? <LoaderCircle size={16} className="spin"/> : <Unplug size={16}/>}Connect & scan<ArrowRight size={16}/></button>
      </div><div className="connection-footer"><span>Target preview <code>{base && segment ? base + segment : '—'}</code></span><span><LockKeyhole size={12}/>Connection and scanning are read-only</span></div>
     </section>
     <div className="metrics"><Metric label="Invalid objects" value={run ? String(run.remainingInvalid) : '—'} icon={<Layers3 size={18}/>} note={run ? `${run.initialInvalid} at initial scan` : 'Waiting for first scan'} tone="orange"/><Metric label="Library prerequisites" value={run ? String(prerequisites.length) : '—'} icon={<FileCode2 size={18}/>} note={run ? `${prerequisites.filter(a => a.status === 'SUCCESS').length} verified · repair before compilation` : 'Tables, grants & synonyms'}/><Metric label="Verified actions" value={run ? `${successes} / ${run.actions.length}` : '—'} icon={<CheckCircle2 size={18}/>} note={run ? 'Results checked after execution' : 'Every change gets a verification'} tone="green"/><Metric label="Reference environment" value={config?.referenceReady ? 'Configured' : 'Not set'} icon={<Link2 size={18}/>} note="Same-segment fallback" small/></div>
     <div className="workspace-grid"><section className="plan-card card"><div className="plan-header"><div><h2>Repair plan <span className="count-pill">{run?.actions.length || 0}</span></h2><p>Prerequisites first. Dependencies always respected.</p></div><span className="step-tag">02 / REVIEW</span></div>
      <div className="plan-toolbar"><div className="search-field"><Search size={15}/><input aria-label="Search repair objects" placeholder="Search objects…" value={filter} onChange={e => setFilter(e.target.value)}/></div><span className="quiet-text">{historical ? 'Historical · read-only' : run ? 'Dependency order' : 'Awaiting connection'}</span></div>
      <div className="table-scroll"><table><thead><tr><th>ORDER</th><th>OBJECT / ACTION</th><th>SOURCE</th><th>STATUS</th><th /></tr></thead><tbody>{visible.map(a => <tr key={a.id} className={selected?.id === a.id ? 'selected' : ''} onClick={() => { setSelected(a); setReferencePreview(null); }} tabIndex={0} onKeyDown={e => { if (e.key === 'Enter') {
            setSelected(a);
            setReferencePreview(null);
        } }}><td><span className={'rank ' + (a.status === 'SUCCESS' ? 'rank-done' : '')}>{a.status === 'SUCCESS' ? <Check size={13}/> : String(a.rank).padStart(2, '0')}</span></td><td><strong>{a.objectName}</strong><small>{a.objectType.replaceAll('_', ' ')} <span>·</span> {a.executionSchema}</small></td><td><span className="source-tag">{a.source === 'LIBRARY' ? <FileCode2 size={12}/> : <Code2 size={12}/>} {a.source === 'LIBRARY' ? 'Library' : a.source === 'REFERENCE' ? 'Reference' : 'Compile'}</span></td><td><Status status={a.status}/></td><td><ChevronRight size={14}/></td></tr>)}</tbody></table></div>
      {!run && <div className="empty-plan"><div className="empty-icon"><Layers3 size={27}/></div><h3>Your repair plan starts here</h3><p>Connect a target schema to discover invalid objects<br />and build a plan from the shared library.</p><div className="empty-flow"><span>Connect</span><ChevronRight size={12}/><span>Scan</span><ChevronRight size={12}/><span>Review</span><ChevronRight size={12}/><span>Repair</span></div></div>}
      {run && !visible.length && <div className="empty-plan"><CheckCircle2 size={26}/><h3>{run.actions.length ? 'No matching objects' : 'No repairs required'}</h3></div>}
      <div className="plan-bottom"><div><ShieldCheck size={16}/><span>{run?.status === 'COMPLETED' ? 'All planned actions verified' : batch.length ? `${batch.length} action${batch.length > 1 ? 's' : ''} ready in rank ${batch[0].rank}` : 'Changes require your explicit approval'}</span></div><button className="primary" disabled={!!busy || !batch.length || historical || !config?.writesEnabled} onClick={() => review(batch)}><Play size={14}/>Repair all · review batch</button></div>
     </section>
     <aside className="detail-card card"><div className="detail-heading"><h2>Object details</h2><Code2 size={17}/></div>{selected ? <><div className="object-title"><span className="object-type">{selected.objectType}</span><h3>{selected.objectName}</h3><Status status={selected.status}/></div><dl><div><dt>Execution schema</dt><dd>{selected.executionSchema}</dd></div><div><dt>Repair source</dt><dd>{selected.source}</dd></div><div><dt>Verification</dt><dd>{selected.verification.replaceAll('_', ' ').toLowerCase()}</dd></div></dl><h4>WHY THIS ACTION</h4><p className="reason">{selected.reason}</p><h4>SCRIPT PREVIEW <span>READ-ONLY</span></h4><pre>{selected.sql || 'Manual review required.'}</pre><div className="dependency-note"><Link2 size={14}/>{selected.dependencies.length ? `${selected.dependencies.length} prerequisite${selected.dependencies.length > 1 ? 's' : ''} must complete first` : 'No prerequisite actions'}</div><div className="detail-actions"><button className="secondary" disabled={!!busy || historical || !batch.some(a => a.id === selected.id) || !config?.writesEnabled} onClick={() => review([selected])}>{selected.source === 'COMPILE' ? 'Compile selected' : 'Review library fix'}<ArrowRight size={14}/></button><button className="text-button" disabled={!!busy || historical || !config?.referenceReady} onClick={() => task('Reading reference', async () => setReferencePreview(await api(`/runs/${run!.id}/reference/${selected.id}`)))}>Compare reference</button><button className="text-button muted" disabled={!!busy || historical || !['PENDING', 'MANUAL'].includes(selected.status)} onClick={() => task('Skipping action', async () => { const next = await api<Run>(`/runs/${run!.id}/skip/${selected.id}`, 'POST'); setRun(next); setSelected(next.actions.find(a => a.id === selected.id) || null); })}>Skip action</button></div></> : <div className="empty-detail"><Search size={24}/><p>Select an object to inspect its errors, script, and dependencies.</p></div>}</aside></div>
     <section className="activity-card card"><div className="activity-heading"><div><Terminal size={18}/><h2>Run activity</h2><span className="quiet-text">{run ? run.id.slice(0, 8) : 'No active run'}</span></div><button className="text-button" disabled={!run} onClick={exportRun}><Download size={14}/>Export report</button></div>{!run ? <div className="activity-empty"><span className="tiny-dot"/>Ready when you are. Connect a schema to begin.</div> : <div className="events">{run.events.slice().reverse().map((e, i) => <div className="event" key={i}><time>{new Date(e.time).toLocaleTimeString([], { hour: '2-digit', minute: '2-digit', second: '2-digit' })}</time><span className={'event-dot ' + (e.status === 'FAILED' ? 'failed' : '')}/><strong>{e.action}</strong><span>{e.message}</span>{e.durationMs > 0 && <small>{e.durationMs} ms</small>}</div>)}</div>}</section>
     <footer><span><ShieldCheck size={13}/>Preview. Approve. Execute. Verify.</span><span>Oracle Schema Hardening · {config?.mode === 'demo' ? 'Demonstration workspace' : 'Configured Oracle environment'}</span></footer>
    </>}
    {tab === 'history' && <section className="card history-card"><div className="section-title"><History size={20}/><h2>Previous runs</h2><span className="quiet-text">Visible to your current account or demo session</span></div>{!history.length ? <div className="empty-plan"><Clock3 size={28}/><h3>No runs yet</h3><p>Completed scans and repair actions will appear here.</p></div> : <table><thead><tr><th>TARGET</th><th>STARTED</th><th>INVALID OBJECTS</th><th>STATUS</th><th /></tr></thead><tbody>{history.map(h => <tr key={h.id}><td><strong>{h.targetSchema}</strong><small>{h.alias} · {h.mode}</small></td><td>{new Date(h.createdAt).toLocaleString()}</td><td>{h.initialInvalid} → {h.remainingInvalid}</td><td><Status status={h.status}/></td><td><button className="text-button" onClick={() => { setRun(h); setSelected(h.actions[0] || null); setHistorical(true); setTab('workspace'); }}>Open report<ArrowRight size={14}/></button></td></tr>)}</tbody></table>}</section>}
    {tab === 'library' && <section className="card library-info"><FileCode2 size={32}/><h2>A shared library, built on verified fixes</h2><p>Library manifests define each script’s execution segment, dependencies, and verification strategy. The backend reads the externally configured folder when you scan.</p><div className="library-steps"><div><span>01</span><h3>Individual scripts</h3><p>One logical object per SQL file. Tables, grants, and synonyms stay separate.</p></div><div><span>02</span><h3>Dependency order</h3><p>Only missing prerequisites from the selected segment policy become repair actions.</p></div><div><span>03</span><h3>Reviewed publication</h3><p>Reference fixes require compatibility review before they become reusable library entries.</p></div></div><div className="message">The included TR library contains example DB-link definitions, audit-table, grant, and synonym scripts. Replace these fixtures with your reviewed corporate scripts before Oracle use.</div>{config?.admin && <div className="candidate-list"><h3>Verified reference candidates</h3>{!candidates.length ? <p>No verified reference repairs are awaiting publication.</p> : candidates.map(c => <div className="approval-script" key={c.id}><div><strong>{c.segment} / {c.objectName}</strong><span>{c.objectType}</span></div><pre>{c.sql}</pre><label className="approval-check"><input type="checkbox" checked={publishCandidate === c.id} onChange={e => setPublishCandidate(e.target.checked ? c.id : null)}/>I reviewed this script for reuse in this segment.</label><button className="secondary" disabled={!!busy || publishCandidate !== c.id} onClick={() => task('Publishing versioned fix', async () => { await api(`/admin/candidates/${c.id}/publish`, 'POST', { checksum: c.checksum }); setCandidates(await api('/admin/candidates')); setPublishCandidate(null); setNotice('Versioned fix published to the segment manifest.'); })}>Publish to library</button></div>)}</div>}<button className="secondary" onClick={() => setTab('workspace')}>Back to workspace<ArrowRight size={15}/></button></section>}
   </main>
  </div>
  {approval && <div className="modal-overlay"><section className="modal approval-modal" role="dialog" aria-modal="true" aria-labelledby="approval-title"><button className="modal-close" onClick={() => setApproval(null)} disabled={!!busy} aria-label="Close approval"><X /></button><span className="modal-icon"><ShieldCheck size={26}/></span><div className="eyebrow">EXPLICIT APPROVAL</div><h2 id="approval-title">Review rank {approval[0].rank}</h2><p>{config?.mode === 'demo' ? 'These actions will update the simulated schema.' : 'These actions change the selected Oracle schemas. Oracle DDL may commit immediately.'}</p>{approval.map(a => <div className="approval-script" key={a.id}><div><strong>{a.objectName}</strong><code>{a.executionSchema}</code></div><pre>{a.sql}</pre><small>Verify: {a.verification.replaceAll('_', ' ')}</small></div>)}<label className="approval-check"><input type="checkbox" checked={approved} onChange={e => setApproved(e.target.checked)}/>I approve these exact scripts and their displayed target schemas.</label>{error && <div className="message error" role="alert">{error}</div>}<div className="modal-footer"><button className="secondary" onClick={() => setApproval(null)} disabled={!!busy}>Cancel</button><button className="primary" disabled={!approved || !!busy} onClick={() => task('Executing approved batch', async () => { const result = await api<Run>(`/runs/${run!.id}/execute`, 'POST', { digest: run!.digest, actionIds: approval.map(a => a.id), approved: true }); setRun(result); setSelected(result.actions.find(a => a.id === selected?.id) || null); setApproval(null); })}>{busy ? <LoaderCircle size={15} className="spin"/> : <Play size={15}/>}Approve & execute</button></div></section></div>}
  {adminOpen && <div className="modal-overlay"><section className="modal" role="dialog" aria-modal="true" aria-labelledby="admin-title"><button className="modal-close" onClick={() => { setAdminOpen(false); setPassword(''); }} aria-label="Close settings"><X /></button><span className="modal-icon"><LockKeyhole size={26}/></span>{config?.authenticated && <button className="text-button" disabled={!!busy} onClick={() => task('Signing out', async () => { await api('/logout', 'POST'); await refreshCsrf(); setConfig(await api<Config>('/config')); clearRun(); setHistory([]); setCandidates([]); setAdminOpen(false); })}>Sign out</button>}<h2 id="admin-title">{config?.admin ? 'Reference environment' : 'Administrator access'}</h2><p>{config?.admin ? 'Configure one reference base. The target segment selects its matching reference schema.' : 'Application accounts are configured on the server. Reference settings are restricted to administrators.'}</p>{!config?.admin ? <form onSubmit={e => { e.preventDefault(); task('Signing in', async () => { try {
        await login(username, password);
        const signedIn = await api<Config>('/config');
        setConfig(signedIn);
        clearRun();
        if (!signedIn.admin)
            setAdminOpen(false);
    }
    finally {
        setPassword('');
    } }); }}><label>Account<select value={username} onChange={e => setUsername(e.target.value)}><option value="admin">Administrator</option><option value="operator">Operator</option></select></label><label>Password<input type="password" autoComplete="current-password" value={password} onChange={e => setPassword(e.target.value)}/></label><button className="primary" disabled={!!busy || !password}>Sign in<ArrowRight size={15}/></button></form> : <><label>Reference base & server hint<div className="input-with-button"><input value={referenceInput} onChange={e => { setReferenceInput(e.target.value); setReferenceAlias(''); setReferenceAliases([]); }}/><button aria-label="Find reference TNS" disabled={!!busy} onClick={() => task('Finding reference TNS', async () => { const r = await api<{
        aliases: string[];
    }>('/tns?input=' + encodeURIComponent(referenceInput)); setReferenceAliases(r.aliases); })}><Search size={15}/></button></div></label><label>Reference TNS<select value={referenceAlias} onChange={e => setReferenceAlias(e.target.value)}><option value="">Select alias</option>{referenceAliases.map(a => <option key={a}>{a}</option>)}</select></label><label>Application release<input placeholder="e.g. release-2026.09" value={release} onChange={e => setRelease(e.target.value)}/></label><div className="modal-footer"><button className="secondary" disabled={!!busy || !config.referenceReady} onClick={() => task('Clearing reference', async () => { await api('/admin/reference', 'DELETE'); setConfig(await api<Config>('/config')); setAdminOpen(false); })}>Deactivate</button><button className="primary" disabled={!!busy || !referenceAlias || !release} onClick={() => task('Configuring reference', async () => { await api('/admin/reference', 'POST', { input: referenceInput, alias: referenceAlias, release }); setConfig(await api<Config>('/config')); setAdminOpen(false); setNotice('Reference configuration saved. Availability is checked during each lookup.'); })}>Save reference<Check size={15}/></button></div></>}{error && <div className="message error">{error}</div>}</section></div>}
  {referencePreview && <div className="modal-overlay"><section className="modal approval-modal" role="dialog" aria-modal="true" aria-label="Reference comparison"><button className="modal-close" onClick={() => setReferencePreview(null)} aria-label="Close comparison"><X /></button><h2>Reference comparison</h2><p>{referencePreview.sourceSchema} · {referencePreview.release}</p><pre>{referencePreview.sql}</pre><div className="message">{referencePreview.message}</div><label>Target application release<input value={targetRelease} onChange={e => setTargetRelease(e.target.value)} placeholder="Must match the configured reference release"/></label><label className="approval-check"><input type="checkbox" checked={compatible} onChange={e => setCompatible(e.target.checked)}/>I reviewed source compatibility and environment-specific references.</label><div className="modal-footer"><button className="secondary" onClick={() => { setReferencePreview(null); setCompatible(false); }}>Close preview</button><button className="primary" disabled={!!busy || historical || !compatible || targetRelease !== referencePreview.release || !selected || !['FAILED', 'MANUAL'].includes(selected.status)} onClick={() => task('Preparing reference repair', async () => { const result = await api<Run>(`/runs/${run!.id}/reference-plan`, 'POST', { actionId: selected!.id, release: targetRelease, checksum: referencePreview.checksum, compatibilityReviewed: compatible }); setRun(result); setSelected(result.actions.find(a => a.id === selected!.id) || null); setReferencePreview(null); setCompatible(false); setNotice('Reference repair added. Review and approve its exact script before execution.'); })}>Add to repair plan</button></div></section></div>}
 </div>;
}
function Status({ status }: {
    status: string;
}) { const labels: Record<string, string> = { PENDING: 'Pending', SUCCESS: 'Verified', FAILED: 'Failed', BLOCKED: 'Blocked', MANUAL: 'Review needed', SKIPPED: 'Skipped', RUNNING: 'Running', REVIEW: 'In review', COMPLETED: 'Completed', NEEDS_RESCAN: 'Needs re-scan' }; return <span className={'status status-' + status.toLowerCase()}><span />{labels[status] || status}</span>; }
function Metric({ label, value, icon, note, tone = '', small = false }: {
    label: string;
    value: string;
    icon: React.ReactNode;
    note: string;
    tone?: string;
    small?: boolean;
}) { return <div className={'metric card ' + tone}><div className="metric-label">{label}{icon}</div><strong className={small ? 'metric-small' : ''}>{value}</strong><span className="metric-note">{note}</span></div>; }

`frontend/src/api.ts`

let csrf: {
    token: string;
    header: string;
} | null = null;
export async function refreshCsrf() { const res = await fetch('/api/csrf'); if (!res.ok)
    throw new Error('Unable to establish a secure session'); csrf = await res.json(); }
export async function api<T>(path: string, method = 'GET', body?: unknown): Promise<T> {
    if (method !== 'GET' && !csrf)
        await refreshCsrf();
    const headers: Record<string, string> = { 'Content-Type': 'application/json' };
    if (method !== 'GET' && csrf)
        headers[csrf.header] = csrf.token;
    const res = await fetch('/api' + path, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
    if (!res.ok) {
        const data = await res.json().catch(() => ({}));
        throw new Error(data.message || (res.status === 401 ? 'Please sign in to continue.' : res.status === 403 ? 'This action requires permission or a refreshed session.' : 'The operation could not complete.'));
    }
    return res.status === 204 ? undefined as T : res.json();
}
export async function login(username: string, password: string) {
    await refreshCsrf();
    const headers: Record<string, string> = { 'Content-Type': 'application/x-www-form-urlencoded' };
    headers[csrf!.header] = csrf!.token;
    const res = await fetch('/api/login', { method: 'POST', headers, body: new URLSearchParams({ username, password }) });
    if (!res.ok)
        throw new Error('Sign-in failed. Check the externally configured application account.');
    await refreshCsrf();
}

`frontend/src/main.tsx`

import React from 'react';
import { createRoot } from 'react-dom/client';
import App from './App';
import './styles.css';
createRoot(document.getElementById('root')!).render(<React.StrictMode><App /></React.StrictMode>);

`frontend/src/styles.css`

:root {
  font-family: Inter,"Segoe UI",Arial,sans-serif;
  color: #25352f;
  background: #f5f7f5;
  font-synthesis: none;
  font-weight: 400;
  font-size: 13px;
  --green: #245f48;
  --dark: #142c23;
  --border: #e3e9e4;
  --muted: #7b8981;
}

* {
  box-sizing: border-box;
}

body {
  margin: 0;
}

button,input,select {
  font: inherit;
}

button {
  cursor: pointer;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  gap: 8px;
  transition: background .15s,border-color .15s;
}

button:disabled {
  opacity: .4;
  cursor: not-allowed;
}

button:focus-visible,a:focus-visible,input:focus-visible,select:focus-visible,tr:focus-visible {
  outline: 2px solid #65a782;
  outline-offset: 3px;
}

button {
  border: 0;
}

input,select {
  min-width: 0;
  border: 1px solid #dce3dd;
  border-radius: 6px;
  background: #fff;
  color: #2f4037;
  height: 40px;
  padding: 0 11px;
  width: 100%;
  outline: none;
}

input:focus,select:focus {
  border-color: #599c76;
}

a {
  color: inherit;
  text-decoration: none;
}

h1,h2,h3,p {
  margin: 0;
}

h2 {
  font-size: 15px;
  font-weight: 650;
  letter-spacing: -.25px;
}

h3 {
  font-size: 14px;
}

code,pre {
  font-family: "Cascadia Code",Consolas,monospace;
}

.app {
  display: flex;
  min-height: 100vh;
}

.sidebar {
  background: #142b23;
  width: 228px;
  position: fixed;
  inset: 0 auto 0 0;
  color: #c2cfc6;
  display: flex;
  flex-direction: column;
  padding: 30px 16px 20px;
}

.brand {
  display: flex;
  gap: 10px;
  align-items: center;
  font-size: 21px;
  font-weight: 650;
  letter-spacing: -.8px;
  color: #f3f7f2;
  padding: 0 9px;
}

.brand-light {
  font-weight: 350;
  color: #c9dacb;
}

.brand small {
  display: block;
  font-size: 8px;
  letter-spacing: 2.5px;
  color: #91a496;
  margin-top: 5px;
}

.brand-mark {
  background: #2b4b3a;
  border: 1px solid #405e46;
  color: #c3e8b3;
  width: 37px;
  height: 39px;
  border-radius: 10px;
  display: grid;
  place-items: center;
}

.nav-label {
  font-size: 9px;
  font-weight: 650;
  letter-spacing: 1.7px;
  color: #799184;
  margin: 49px 14px 15px;
}

.nav-item {
  background: transparent;
  color: #acbdb1;
  justify-content: flex-start;
  width: 100%;
  padding: 13px 13px;
  border-radius: 6px;
  margin-bottom: 5px;
  font-size: 12px;
  gap: 12px;
  white-space: nowrap;
}

.nav-item.active {
  background: #2b4937;
  color: #e1f2da;
}

.nav-item:hover {
  background: #243f31;
}

.nav-dot {
  width: 5px;
  height: 5px;
  border-radius: 50%;
  background: #abd598;
  margin-left: auto;
}

.tools-label {
  margin-top: 31px;
}

.sidebar-bottom {
  margin-top: auto;
  padding: 30px 12px 0;
}

.connection-orbit {
  width: 47px;
  height: 47px;
  background: #203d2e;
  border: 1px solid #395443;
  border-radius: 13px;
  display: grid;
  place-items: center;
  color: #a2c491;
  position: relative;
  margin-bottom: 15px;
}

.connection-orbit span {
  position: absolute;
  right: -3px;
  bottom: 4px;
  width: 11px;
  height: 11px;
  background: #90c078;
  border: 3px solid #142b23;
  border-radius: 50%;
}

.sidebar-bottom strong {
  font-size: 11px;
  font-weight: 500;
  color: #c1d1c4;
}

.sidebar-bottom p {
  font-size: 10px;
  color: #839b8b;
  line-height: 1.9;
  margin-top: 8px;
}

.sidebar-version {
  border-top: 1px solid #30483a;
  margin-top: 26px;
  padding-top: 19px;
  font-size: 8px;
  letter-spacing: 1px;
  display: flex;
  align-items: center;
  gap: 7px;
  color: #7c9686;
}

.sidebar-version>span:last-child {
  margin-left: auto;
}

.tiny-dot {
  width: 6px;
  height: 6px;
  display: inline-block;
  border-radius: 50%;
  background: #8bac7d;
  flex-shrink: 0;
}

.tiny-dot.amber {
  background: #c7a268;
}

.tiny-dot.green {
  background: #488863;
}

.main-shell {
  margin-left: 228px;
  flex: 1;
  min-width: 0;
}

.topbar {
  height: 70px;
  border-bottom: 1px solid var(--border);
  background: #fff;
  display: flex;
  align-items: center;
  justify-content: space-between;
  padding: 0 35px;
}

.breadcrumbs {
  display: flex;
  align-items: center;
  gap: 13px;
  font-size: 11px;
  color: #8b958f;
}

.breadcrumbs span {
  color: #394c41;
}

.topbar-right {
  display: flex;
  align-items: center;
  gap: 21px;
}

.reference-status {
  background: transparent;
  color: #748174;
  font-size: 10px;
  gap: 8px;
}

.top-divider {
  height: 22px;
  border-right: 1px solid var(--border);
}

.avatar {
  border: 1px solid #dfe5df;
  color: #5d725f;
  background: #f0f3ed;
  border-radius: 50%;
  width: 30px;
  height: 30px;
  font-size: 10px;
  font-weight: 600;
}

main {
  padding: 32px 35px 18px;
  max-width: 1650px;
  margin: auto;
}

.page-heading {
  display: flex;
  justify-content: space-between;
  align-items: center;
  margin-bottom: 25px;
}

.eyebrow {
  font-size: 8px;
  font-weight: 650;
  letter-spacing: 1.8px;
  color: #7b8e7d;
  margin-bottom: 9px;
}

h1 {
  font-weight: 550;
  font-size: 29px;
  letter-spacing: -1px;
  line-height: 1.2;
}

.page-heading p {
  font-size: 11px;
  color: #839086;
  margin-top: 9px;
}

.mode-badge {
  font-size: 8px;
  letter-spacing: 1.2px;
  border: 1px solid #d8e2d6;
  border-radius: 5px;
  padding: 8px 10px;
  color: #63805e;
  display: flex;
  align-items: center;
  gap: 7px;
  background: #f0f5ed;
}

.demo-banner {
  padding: 12px 15px;
  background: #edf3e9;
  border: 1px solid #dce7d7;
  border-radius: 6px;
  display: flex;
  align-items: center;
  gap: 10px;
  color: #6c8065;
  font-size: 10px;
  margin-bottom: 23px;
}

.demo-banner strong {
  color: #4f684a;
  font-weight: 600;
}

.banner-tag {
  margin-left: auto;
  font-size: 7px;
  letter-spacing: 1.4px;
  color: #809679;
  white-space: nowrap;
}

.card {
  border: 1px solid var(--border);
  border-radius: 9px;
  background: white;
  box-shadow: 0 2px 3px #142b2302;
}

.connection-card {
  padding: 20px 22px 0;
}

.section-title {
  display: flex;
  align-items: center;
  gap: 11px;
}

.section-title p,.plan-header p {
  font-size: 10px;
  color: #8c978f;
  margin-top: 5px;
}

.section-icon {
  width: 34px;
  height: 34px;
  border: 1px solid #e3e9df;
  background: #f5f8f2;
  border-radius: 7px;
  display: grid;
  place-items: center;
  color: #617e57;
}

.step-tag {
  margin-left: auto;
  font-size: 8px;
  letter-spacing: 1.4px;
  color: #9aa69b;
  font-weight: 600;
}

.connection-fields {
  display: grid;
  grid-template-columns: 1.1fr 1fr 1.25fr auto;
  gap: 17px;
  align-items: end;
  margin: 23px 0 20px;
}

label {
  font-size: 10px;
  font-weight: 550;
  color: #6c7d70;
  display: flex;
  flex-direction: column;
  gap: 8px;
}

.input-with-button {
  display: flex;
  border: 1px solid #dce3dd;
  border-radius: 6px;
  overflow: hidden;
  background: white;
}

.input-with-button input {
  border: none;
  min-width: 0;
}

.input-with-button button {
  width: 36px;
  flex-shrink: 0;
  background: #fff;
  color: #8ca18f;
}

.segment-buttons {
  display: flex;
  height: 40px;
  gap: 3px;
  border: 1px solid #e1e6df;
  border-radius: 6px;
  padding: 4px;
  background: #f9faf8;
}

.segment-buttons button {
  background: transparent;
  color: #7e8b7c;
  font-size: 10px;
  padding: 0 9px;
  border-radius: 3px;
  flex: 1;
}

.segment-buttons button.chosen {
  background: #e4eddf;
  color: #467242;
  box-shadow: 0 1px 2px #20302415;
  font-weight: 650;
}

.primary {
  background: #286044;
  color: #fff;
  font-size: 10px;
  font-weight: 550;
  padding: 11px 14px;
  border-radius: 5px;
  white-space: nowrap;
  min-height: 36px;
}

.primary:hover:not(:disabled) {
  background: #1b4931;
}

.connect-button {
  height: 40px;
}

.connection-footer {
  border-top: 1px solid #edf0eb;
  padding: 12px 0;
  display: flex;
  align-items: center;
  justify-content: space-between;
  color: #8c988e;
  font-size: 9px;
}

.connection-footer span {
  display: flex;
  gap: 8px;
  align-items: center;
}

.connection-footer code {
  font-size: 9px;
  color: #5d775b;
  background: #f3f6ef;
  padding: 3px 7px;
  border-radius: 3px;
}

.metrics {
  display: grid;
  grid-template-columns: repeat(4,1fr);
  gap: 15px;
  margin: 20px 0;
}

.metric {
  padding: 17px 18px 16px;
}

.metric-label {
  font-size: 10px;
  font-weight: 500;
  color: #768577;
  display: flex;
  align-items: center;
  justify-content: space-between;
}

.metric-label svg {
  color: #94a58e;
}

.metric strong {
  display: block;
  font-size: 29px;
  font-weight: 550;
  letter-spacing: -1px;
  margin: 12px 0 7px;
}

.metric.orange strong {
  color: #ad7944;
}

.metric.green strong {
  color: #4b7654;
}

.metric strong.metric-small {
  font-size: 22px;
  margin-top: 17px;
  margin-bottom: 10px;
  color: #647261;
  letter-spacing: -.6px;
}

.metric-note {
  font-size: 9px;
  color: #93a08f;
}

.workspace-grid {
  display: grid;
  grid-template-columns: minmax(0,1fr) 292px;
  gap: 19px;
  align-items: start;
}

.plan-card {
  overflow: hidden;
}

.plan-header {
  padding: 21px 21px 18px;
  display: flex;
  align-items: center;
  justify-content: space-between;
}

.plan-header h2 {
  display: flex;
  gap: 8px;
  align-items: center;
}

.count-pill {
  font-size: 9px;
  border: 1px solid #e1e7df;
  background: #f5f7f2;
  padding: 2px 6px;
  border-radius: 4px;
  color: #72856c;
}

.plan-toolbar {
  display: flex;
  align-items: center;
  justify-content: space-between;
  border-top: 1px solid #f0f2ed;
  border-bottom: 1px solid #e8ece5;
  padding: 11px 18px;
  gap: 10px;
}

.search-field {
  display: flex;
  align-items: center;
  gap: 7px;
  color: #9aa697;
}

.search-field input {
  height: 25px;
  border: 0;
  width: 160px;
  padding: 0;
  font-size: 10px;
}

.quiet-text {
  font-size: 9px;
  color: #929e91;
}

.table-scroll {
  overflow: auto;
}

table {
  width: 100%;
  border-collapse: collapse;
  text-align: left;
}

th {
  font-size: 7px;
  font-weight: 650;
  letter-spacing: 1px;
  color: #929e8e;
  background: #fafbf8;
  padding: 12px 12px;
  border-bottom: 1px solid #e8ede4;
  white-space: nowrap;
}

th:first-child,td:first-child {
  padding-left: 21px;
}

td {
  padding: 15px 12px;
  border-bottom: 1px solid #edf0e9;
  font-size: 11px;
  color: #52664d;
}

tbody tr {
  cursor: pointer;
}

tbody tr:hover {
  background: #f8faf5;
}

tbody tr.selected {
  background: #f1f6ec;
  box-shadow: inset 3px 0 #83a671;
}

td strong {
  display: block;
  font-family: "Cascadia Code",Consolas,monospace;
  font-size: 10px;
  font-weight: 550;
  color: #42523d;
}

td small {
  display: block;
  font-size: 8px;
  color: #93a18d;
  margin-top: 5px;
  white-space: nowrap;
}

td small span {
  padding: 0 3px;
}

.rank {
  display: grid;
  place-items: center;
  border: 1px solid #e2e8da;
  background: #fafbf7;
  width: 25px;
  height: 25px;
  border-radius: 6px;
  font-size: 10px;
  color: #7b8b6e;
  font-family: Consolas,monospace;
}

.rank-done {
  background: #e1eed9;
  color: #57864b;
  border-color: #d8e7ce;
}

.source-tag {
  font-size: 8px;
  display: flex;
  align-items: center;
  gap: 5px;
  color: #85977c;
  white-space: nowrap;
}

.status {
  font-size: 8px;
  display: inline-flex;
  align-items: center;
  gap: 5px;
  padding: 4px 6px;
  background: #f3f3ed;
  border: 1px solid #e8e9e0;
  color: #8f947d;
  border-radius: 4px;
  white-space: nowrap;
}

.status>span {
  width: 4px;
  height: 4px;
  border-radius: 50%;
  background: currentColor;
}

.status-success,.status-completed {
  background: #eef5e8;
  color: #60894e;
  border-color: #dbe8d1;
}

.status-failed,.status-blocked,.status-needs_rescan {
  background: #fbf0e9;
  border-color: #efdccc;
  color: #aa7556;
}

.status-manual {
  background: #fbf5e9;
  border-color: #efe3c9;
  color: #a78b50;
}

.status-running {
  color: #567f99;
  background: #eff5fa;
}

.plan-bottom {
  padding: 15px 18px;
  display: flex;
  justify-content: space-between;
  align-items: center;
  background: #fcfdf9;
  gap: 10px;
}

.plan-bottom>div {
  display: flex;
  gap: 7px;
  align-items: center;
  color: #899780;
  font-size: 9px;
}

.detail-card {
  padding: 20px 19px;
}

.detail-heading {
  display: flex;
  justify-content: space-between;
  align-items: center;
  color: #859779;
}

.detail-heading h2 {
  font-size: 13px;
  color: #4a5e43;
}

.object-title {
  padding-top: 23px;
}

.object-type {
  font-size: 8px;
  letter-spacing: 1.2px;
  color: #97a28d;
}

.object-title h3 {
  font-size: 14px;
  font-family: Consolas,monospace;
  margin: 8px 0 11px;
  color: #41543b;
  overflow-wrap: anywhere;
}

.detail-card dl {
  border-top: 1px solid #ebeee6;
  border-bottom: 1px solid #ebeee6;
  padding: 14px 0;
  margin: 17px 0 19px;
  display: grid;
  gap: 11px;
}

.detail-card dl div {
  display: flex;
  justify-content: space-between;
  gap: 10px;
  font-size: 9px;
}

.detail-card dt {
  color: #98a28f;
}

.detail-card dd {
  margin: 0;
  color: #5d7152;
  text-align: right;
  word-break: break-word;
}

.detail-card h4 {
  font-size: 7px;
  letter-spacing: 1px;
  color: #8f9e83;
  margin: 17px 0 10px;
}

.detail-card h4 span {
  float: right;
  font-size: 6px;
  color: #b0b9a9;
}

.reason {
  font-size: 10px;
  line-height: 1.7;
  color: #7b8b71;
}

pre {
  font-size: 9px;
  line-height: 1.8;
  padding: 14px;
  background: #f6f8f2;
  border: 1px solid #e8ede0;
  border-radius: 5px;
  overflow: auto;
  color: #63794f;
  white-space: pre-wrap;
  overflow-wrap: anywhere;
  margin: 0;
  max-height: 260px;
}

.dependency-note {
  display: flex;
  gap: 6px;
  font-size: 8px;
  line-height: 1.5;
  color: #97a388;
  margin-top: 12px;
}

.detail-actions {
  display: flex;
  flex-direction: column;
  gap: 9px;
  margin-top: 18px;
}

.secondary {
  border: 1px solid #dce5d3;
  border-radius: 5px;
  color: #647d50;
  background: #fafcf7;
  font-size: 10px;
  padding: 10px 12px;
  min-height: 35px;
}

.secondary:hover:not(:disabled) {
  background: #eef4e7;
}

.text-button {
  background: transparent;
  color: #758f60;
  font-size: 9px;
  padding: 5px;
  gap: 7px;
}

.text-button.muted {
  color: #a0ab94;
}

.activity-card {
  margin-top: 20px;
  overflow: hidden;
}

.activity-heading {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 17px 20px;
  border-bottom: 1px solid #e9ede3;
}

.activity-heading>div {
  display: flex;
  align-items: center;
  gap: 10px;
  color: #889c78;
}

.activity-heading h2 {
  font-size: 12px;
  color: #506344;
}

.activity-heading .quiet-text {
  margin-left: 7px;
  font-family: Consolas,monospace;
  font-size: 8px;
}

.activity-empty {
  padding: 22px;
  color: #9aa88d;
  font-family: Consolas,monospace;
  font-size: 10px;
  display: flex;
  align-items: center;
  gap: 11px;
}

.events {
  max-height: 215px;
  overflow: auto;
  padding: 13px 20px;
}

.event {
  display: flex;
  align-items: baseline;
  gap: 11px;
  padding: 7px 0;
  font-size: 9px;
  line-height: 1.4;
}

.event time {
  font-family: Consolas,monospace;
  color: #a1ad94;
  white-space: nowrap;
}

.event strong {
  color: #6d8558;
  font-weight: 500;
  white-space: nowrap;
}

.event>span:last-of-type {
  color: #8e9e7c;
}

.event small {
  margin-left: auto;
  color: #a4b494;
}

.event-dot {
  width: 5px;
  height: 5px;
  border-radius: 50%;
  background: #8aa56e;
  flex-shrink: 0;
}

.event-dot.failed {
  background: #b68562;
}

footer {
  display: flex;
  justify-content: space-between;
  font-size: 8px;
  color: #a1ad98;
  margin-top: 23px;
}

footer span {
  display: flex;
  align-items: center;
  gap: 6px;
}

.empty-plan {
  text-align: center;
  padding: 46px 15px;
  color: #92a286;
}

.empty-icon {
  width: 58px;
  height: 58px;
  margin: 0 auto 18px;
  background: #f0f5e9;
  border: 1px solid #e3ebdb;
  border-radius: 16px;
  display: grid;
  place-items: center;
  color: #91aa7d;
}

.empty-plan h3 {
  font-weight: 500;
  color: #627951;
  font-size: 13px;
  margin: 10px 0;
}

.empty-plan p {
  font-size: 10px;
  line-height: 1.9;
  color: #98a68e;
}

.empty-flow {
  display: flex;
  justify-content: center;
  align-items: center;
  gap: 12px;
  margin-top: 25px;
  font-size: 8px;
  color: #a0ae95;
}

.empty-detail {
  padding: 60px 8px;
  text-align: center;
  font-size: 11px;
  line-height: 1.8;
  color: #9fab92;
}

.empty-detail p {
  margin-top: 12px;
}

.message {
  padding: 12px 15px;
  background: #edf3e7;
  border: 1px solid #dbe5d1;
  border-radius: 6px;
  color: #70825f;
  margin-bottom: 16px;
  line-height: 1.6;
  font-size: 11px;
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 12px;
}

.message.error {
  background: #fcf0e9;
  color: #9e644b;
  border-color: #f0d9ca;
}

.message button {
  background: transparent;
  color: inherit;
}

.busy-line {
  font-size: 10px;
  color: #72905c;
  margin-bottom: 12px;
  display: flex;
  gap: 7px;
  align-items: center;
}

.spin {
  animation: spin 1s linear infinite;
}

@keyframes spin {
  to {
    transform: rotate(360deg);
  }
}

.modal-overlay {
  position: fixed;
  inset: 0;
  background: #142b2370;
  backdrop-filter: blur(3px);
  z-index: 20;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 24px;
}

.modal {
  width: 440px;
  background: #fff;
  border: 1px solid #e6eddf;
  border-radius: 12px;
  padding: 30px;
  box-shadow: 0 25px 100px #142b2330;
  position: relative;
  max-height: 90vh;
  overflow: auto;
}

.modal h2 {
  font-size: 22px;
  font-weight: 550;
  margin: 10px 0;
}

.modal>p {
  color: #859777;
  font-size: 11px;
  line-height: 1.8;
  margin-bottom: 23px;
}

.modal-close {
  position: absolute;
  top: 14px;
  right: 14px;
  background: transparent;
  color: #95a788;
  padding: 5px;
}

.modal-close svg {
  width: 18px;
}

.modal-icon {
  display: grid;
  place-items: center;
  color: #73925b;
  background: #eef5e7;
  border: 1px solid #e0ebd6;
  border-radius: 11px;
  width: 49px;
  height: 49px;
  margin-bottom: 20px;
}

.modal label {
  margin: 15px 0;
}

.modal .primary {
  margin-top: 5px;
}

.modal-footer {
  display: flex;
  justify-content: flex-end;
  gap: 10px;
  margin-top: 20px;
  align-items: center;
}

.approval-modal {
  width: 620px;
}

.approval-script {
  margin: 15px 0;
  border: 1px solid #e3eadb;
  border-radius: 7px;
  padding: 13px;
}

.approval-script>div {
  display: flex;
  justify-content: space-between;
  margin-bottom: 10px;
  font-size: 10px;
  color: #71875e;
}

.approval-script>div code {
  font-size: 9px;
}

.approval-script small {
  display: block;
  margin-top: 8px;
  font-size: 8px;
  color: #8d9f7b;
}

.approval-check {
  flex-direction: row;
  align-items: center;
  line-height: 1.5;
}

.approval-check input {
  height: 16px;
  width: 16px;
  accent-color: #47753b;
}

.history-card .section-title {
  padding: 23px;
}

.history-card .section-title .quiet-text {
  margin-left: auto;
}

.history-card {
  overflow: auto;
}

.library-info {
  padding: 35px;
  color: #708961;
}

.library-info h2 {
  margin-top: 18px;
  font-size: 22px;
}

.library-info>p {
  margin-top: 13px;
  max-width: 660px;
  font-size: 12px;
  line-height: 1.9;
}

.library-steps {
  display: grid;
  grid-template-columns: repeat(3,1fr);
  gap: 25px;
  margin: 35px 0;
}

.library-steps>div {
  border: 1px solid #e4eadc;
  border-radius: 8px;
  padding: 22px;
}

.library-steps span {
  font: 22px Consolas,monospace;
  color: #a6b695;
}

.library-steps h3 {
  margin: 18px 0 10px;
}

.library-steps p {
  font-size: 11px;
  line-height: 1.8;
  color: #91a181;
}

@media (min-width:1500px) {
  .workspace-grid {
    grid-template-columns: minmax(0,1fr) 330px;
  }
  td {
    padding-top: 18px;
    padding-bottom: 18px;
  }
}

@media (max-width:1200px) {
  .sidebar {
    width: 194px;
    padding-left: 10px;
    padding-right: 10px;
  }
  .brand {
    font-size: 18px;
  }
  .main-shell {
    margin-left: 194px;
  }
  main {
    padding: 27px 23px;
  }
  .topbar {
    padding: 0 23px;
  }
  .connection-fields {
    grid-template-columns: 1fr 1fr;
    gap: 14px;
  }
  .workspace-grid {
    grid-template-columns: minmax(0,1fr) 258px;
  }
  .metric {
    padding: 15px 13px;
  }
  .metrics {
    gap: 10px;
  }
  .metric-note {
    font-size: 8px;
  }
  .plan-bottom {
    flex-wrap: wrap;
  }
  .source-tag {
    font-size: 7px;
  }
  td,th {
    padding-left: 9px;
    padding-right: 9px;
  }
}

@media (max-width:950px) {
  .sidebar {
    width: 66px;
    padding: 25px 8px;
  }
  .brand {
    padding: 0;
    justify-content: center;
  }
  .brand>span:last-child,.nav-label,.sidebar-bottom,.nav-item .nav-dot {
    display: none;
  }
  .nav-item {
    font-size: 0;
    gap: 0;
    justify-content: center;
    padding: 13px 0;
  }
  .nav-item:first-of-type {
    margin-top: 42px;
  }
  .nav-item>svg:last-child:not(:first-child) {
    display: none;
  }
  .main-shell {
    margin-left: 66px;
  }
  .workspace-grid {
    grid-template-columns: 1fr;
  }
  .detail-card {
    display: block;
  }
  .metrics {
    grid-template-columns: repeat(2,1fr);
  }
  .plan-bottom {
    flex-wrap: nowrap;
  }
  .banner-tag {
    display: none;
  }
}

@media (max-width:600px) {
  .sidebar {
    display: none;
  }
  .main-shell {
    margin-left: 0;
  }
  main {
    padding: 22px 14px;
  }
  .topbar {
    height: 58px;
    padding: 0 14px;
  }
  .breadcrumbs {
    font-size: 9px;
  }
  .reference-status {
    font-size: 8px;
  }
  .topbar-right {
    gap: 9px;
  }
  .top-divider {
    display: none;
  }
  .page-heading {
    align-items: flex-start;
    gap: 10px;
  }
  h1 {
    font-size: 24px;
  }
  .page-heading p {
    font-size: 10px;
    line-height: 1.7;
  }
  .mode-badge {
    font-size: 6px;
    white-space: nowrap;
    padding: 7px;
    margin-top: 8px;
  }
  .connection-card {
    padding-left: 15px;
    padding-right: 15px;
  }
  .connection-fields {
    grid-template-columns: 1fr;
  }
  .connection-footer>span:last-child {
    display: none;
  }
  .step-tag {
    font-size: 6px;
  }
  .plan-bottom {
    flex-direction: column;
    align-items: stretch;
  }
  .plan-bottom>div {
    font-size: 8px;
  }
  .event {
    flex-wrap: wrap;
    gap: 7px;
  }
  .event>span:last-of-type {
    flex-basis: 100%;
    padding-left: 10px;
  }
  footer>span:last-child {
    display: none;
  }
  .library-steps {
    grid-template-columns: 1fr;
  }
  .modal {
    padding: 23px;
  }
  .demo-banner {
    font-size: 9px;
    line-height: 1.6;
  }
  .approval-script>div {
    flex-wrap: wrap;
    gap: 7px;
  }
  .metrics {
    gap: 9px;
  }
}

.field-label {
  display: block;
  font-size: 10px;
  font-weight: 550;
  color: #6c7d70;
  margin-bottom: 8px;
}

.candidate-list {
  margin: 24px 0;
}

.candidate-list>p {
  margin: 12px 0;
  color: #829373;
  font-size: 11px;
}

`frontend/src/types.ts`

export type Config = {
    mode: string;
    segments: string[];
    referenceReady: boolean;
    writesEnabled: boolean;
    admin: boolean;
    authenticated: boolean;
};
export type Action = {
    id: string;
    objectName: string;
    objectType: string;
    rank: number;
    dependencies: string[];
    executionSchema: string;
    executionSegment: string;
    source: string;
    reason: string;
    sql: string;
    verification: string;
    status: string;
    message: string;
};
export type ObjectInfo = {
    name: string;
    type: string;
    status: string;
    errors: string[];
    dependencies: string[];
};
export type Run = {
    id: string;
    targetSchema: string;
    segment: string;
    alias: string;
    mode: string;
    status: string;
    createdAt: string;
    initialInvalid: number;
    remainingInvalid: number;
    digest: string;
    objects: ObjectInfo[];
    actions: Action[];
    events: {
        time: string;
        action: string;
        status: string;
        message: string;
        durationMs: number;
    }[];
};
export function nextBatch(actions: Action[]): Action[] {
    const done = new Set(actions.filter(a => a.status === 'SUCCESS').map(a => a.id));
    const ready = actions.filter(a => a.status === 'PENDING' && a.dependencies.every(d => done.has(d)));
    if (!ready.length)
        return [];
    const rank = Math.min(...ready.map(a => a.rank));
    // Each dependency is independently reviewed after it verifies, even within the same rank.
    return ready.filter(a => a.rank === rank);
}

`frontend/tsconfig.json`

{
  "compilerOptions": {
    "target": "ES2022",
    "lib": [
      "ES2022",
      "DOM",
      "DOM.Iterable"
    ],
    "module": "ESNext",
    "moduleResolution": "Bundler",
    "jsx": "react-jsx",
    "strict": true,
    "skipLibCheck": true,
    "noEmit": true,
    "allowImportingTsExtensions": true
  },
  "include": [
    "src",
    "vite.config.ts"
  ]
}

`frontend/vite.config.ts`

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';

export default defineConfig({
  plugins: [react()],
  server: {
    host: '127.0.0.1',
    proxy: { '/api': 'http://127.0.0.1:8080' },
  },
});

DEV-Part-1-Backend.md

iron_man — Mon, 21 Sep 2026 20:24:47 +0000

Oracle Schema Hardening — Part 1: Backend

Each heading below is a file path relative to the project root. Create that file and copy only the code inside its code block. Both parts belong to the same Spring Boot and React project.

File list

src/main/java/com/hardening/Application.java
pom.xml
src/main/java/com/hardening/ApiController.java
src/main/java/com/hardening/ApiErrors.java
src/main/java/com/hardening/DatabaseGateway.java
src/main/java/com/hardening/DbLinkDefinition.java
src/main/java/com/hardening/DemoDatabaseGateway.java
src/main/java/com/hardening/FileRunHistoryRepository.java
src/main/java/com/hardening/Identifiers.java
src/main/java/com/hardening/LibraryRepository.java
src/main/java/com/hardening/Models.java
src/main/java/com/hardening/OracleConnectionFactory.java
src/main/java/com/hardening/OracleDatabaseGateway.java
src/main/java/com/hardening/OracleScriptExecutor.java
src/main/java/com/hardening/PathConfiguration.java
src/main/java/com/hardening/ReferenceConfigurationService.java
src/main/java/com/hardening/ReferenceRepairService.java
src/main/java/com/hardening/RepairExecutionService.java
src/main/java/com/hardening/RepairPlanner.java
src/main/java/com/hardening/RunHistoryRepository.java
src/main/java/com/hardening/SchemaInputParser.java
src/main/java/com/hardening/SchemaNameBuilder.java
src/main/java/com/hardening/ScriptTemplateRenderer.java
src/main/java/com/hardening/SecurityConfiguration.java
src/main/java/com/hardening/Settings.java
src/main/java/com/hardening/TnsResolver.java
src/main/resources/application.properties

`src/main/java/com/hardening/Application.java`

package com.hardening;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.context.properties.EnableConfigurationProperties;

@SpringBootApplication
@EnableConfigurationProperties(Settings.class)
public class Application {
    public static void main(String[] args) { SpringApplication.run(Application.class, args); }
}

`pom.xml`

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>3.5.16</version><relativePath/></parent>
  <groupId>com.hardening</groupId><artifactId>oracle-hardening</artifactId><version>0.1.0</version>
  <properties><java.version>21</java.version></properties>
  <dependencies>
    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId></dependency>
    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency>
    <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-validation</artifactId></dependency>
    <dependency><groupId>com.oracle.database.jdbc</groupId><artifactId>ojdbc11</artifactId><version>23.9.0.25.07</version></dependency>
  </dependencies>
  <build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins>
    <resources><resource><directory>src/main/resources</directory></resource><resource><directory>frontend/dist</directory><targetPath>static</targetPath></resource></resources>
  </build>
</project>

`src/main/java/com/hardening/ApiController.java`

package com.hardening;

import jakarta.servlet.http.HttpServletRequest;
import java.util.*;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.bind.annotation.*;
import static com.hardening.Models.*;

@RestController
@RequestMapping("/api")
public class ApiController {
    private final Settings settings; private final TnsResolver tns; private final SchemaNameBuilder names;
    private final DatabaseGateway db; private final RepairExecutionService repairs; private final ReferenceConfigurationService reference;
    private final RunHistoryRepository history;private final ReferenceRepairService referenceRepairs;
    public ApiController(Settings settings,TnsResolver tns,SchemaNameBuilder names,DatabaseGateway db,RepairExecutionService repairs,ReferenceConfigurationService reference,RunHistoryRepository history,ReferenceRepairService referenceRepairs) {
        this.settings=settings;this.tns=tns;this.names=names;this.db=db;this.repairs=repairs;this.reference=reference;this.history=history;this.referenceRepairs=referenceRepairs;
    }
    private String owner(HttpServletRequest r,Authentication a) { return a!=null && a.isAuthenticated()?"user:"+a.getName():"session:"+r.getSession().getId(); }
    @GetMapping("/csrf") public Map<String,String> csrf(CsrfToken token) { return Map.of("token",token.getToken(),"header",token.getHeaderName()); }
    @GetMapping("/config") public Map<String,Object> config(Authentication auth) {
        return Map.of("mode",settings.mode(),"segments",settings.segments(),"referenceReady",reference.ready(),"writesEnabled",settings.demo()||settings.allowWrites(),
            "admin",auth!=null && auth.getAuthorities().stream().anyMatch(a->a.getAuthority().equals("ROLE_ADMIN")),"authenticated",auth!=null);
    }
    @GetMapping("/tns") public Map<String,Object> tns(@RequestParam String input) { var parsed=SchemaInputParser.parse(input); return Map.of("base",parsed.base(),"aliases",tns.search(parsed.hint())); }
    @PostMapping("/connection/test") public Map<String,String> test(@RequestBody Target target) {
        String schema=names.build(SchemaInputParser.parse(target.input()).base(),target.segment()); db.test(target); return Map.of("schema",schema,"status","SUCCESS");
    }
    @PostMapping("/runs") public RunView scan(@RequestBody Target target,HttpServletRequest req,Authentication a) { return repairs.scan(owner(req,a),target); }
    @GetMapping("/runs/{id}") public RunView run(@PathVariable String id,HttpServletRequest req,Authentication a) { return repairs.get(owner(req,a),id); }
    @GetMapping("/history") public List<RunView> history(HttpServletRequest req,Authentication a) { return history.list(owner(req,a)); }
    @PostMapping("/runs/{id}/execute") public RunView execute(@PathVariable String id,@RequestBody Approval approval,HttpServletRequest req,Authentication a) { return repairs.execute(owner(req,a),id,approval); }
    @PostMapping("/runs/{id}/skip/{actionId}") public RunView skip(@PathVariable String id,@PathVariable String actionId,HttpServletRequest req,Authentication a) { return repairs.skip(owner(req,a),id,actionId); }
    @PostMapping("/admin/reference") public Map<String,String> configure(@RequestBody ReferenceConfig config) { reference.configure(config); return Map.of("status","CONFIGURED"); }
    @DeleteMapping("/admin/reference") public void clear() { reference.clear(); }
    @GetMapping("/runs/{id}/reference/{actionId}") public ReferenceRepairService.Preview preview(@PathVariable String id,@PathVariable String actionId,HttpServletRequest req,Authentication a) { return referenceRepairs.preview(owner(req,a),id,actionId); }
    @PostMapping("/runs/{id}/reference-plan") public RunView referencePlan(@PathVariable String id,@RequestBody ReferenceRepairService.Review review,HttpServletRequest req,Authentication a) { return referenceRepairs.propose(owner(req,a),id,review); }
    @GetMapping("/admin/candidates") public List<Candidate> candidates() { return referenceRepairs.verifiedCandidates(); }
    @PostMapping("/admin/candidates/{id}/publish") public Map<String,String> publish(@PathVariable String id,@RequestBody Map<String,String> body) { return Map.of("file",referenceRepairs.publish(id,body.get("checksum"))); }
}

`src/main/java/com/hardening/ApiErrors.java`

package com.hardening;

import java.util.Map;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestControllerAdvice
public class ApiErrors {
    @ExceptionHandler(IllegalArgumentException.class)
    public ResponseEntity<?> invalid(IllegalArgumentException e) { return ResponseEntity.badRequest().body(Map.of("code","VALIDATION","message",e.getMessage())); }
    @ExceptionHandler(Exception.class)
    public ResponseEntity<?> failure(Exception e) { return ResponseEntity.internalServerError().body(Map.of("code","OPERATION_FAILED","message","Operation could not complete. Check server configuration and run history.")); }
}

`src/main/java/com/hardening/DatabaseGateway.java`

package com.hardening;

import java.util.List;
import static com.hardening.Models.*;

public interface DatabaseGateway {
    void test(Target target);
    Snapshot scan(String runId, Target target, List<LibraryEntry> entries);
    void execute(String runId, Target target, Action action);
    boolean verify(String runId, Target target, Action action, List<LibraryEntry> entries);
    String referenceSource(String schema, String alias, String type, String name);
}

`src/main/java/com/hardening/DbLinkDefinition.java`

package com.hardening;

import java.util.List;

public record DbLinkDefinition(String linkName,String remoteSegment,String tnsRule,String remoteAlias,String verification,List<String> dependentObjects) {
    public DbLinkDefinition {
        linkName=Identifiers.name(linkName); remoteSegment=Identifiers.name(remoteSegment);
        if(!List.of("SELECTED","CONFIGURED").contains(tnsRule)) throw new IllegalArgumentException("Unknown remote TNS rule");
        if(tnsRule.equals("CONFIGURED")) remoteAlias=Identifiers.alias(remoteAlias);
        if(!"DUAL".equals(verification)) throw new IllegalArgumentException("Only DUAL verification is supported for DB links");
    }
    public String alias(String selected) { return tnsRule.equals("SELECTED")?selected:remoteAlias; }
}

`src/main/java/com/hardening/DemoDatabaseGateway.java`

package com.hardening;

import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.stereotype.Component;
import static com.hardening.Models.*;

@Component
@ConditionalOnProperty(name="hardening.mode", havingValue="demo")
public class DemoDatabaseGateway implements DatabaseGateway {
    private final Map<String,Set<String>> completed = new ConcurrentHashMap<>();
    private final TnsResolver tns;
    public DemoDatabaseGateway(TnsResolver tns) { this.tns=tns; }
    public void test(Target target) { tns.resolve(target.alias()); }
    public Snapshot scan(String run, Target target, List<LibraryEntry> entries) {
        Set<String> done = completed.computeIfAbsent(run, k -> ConcurrentHashMap.newKeySet());
        List<ObjectInfo> objects = new ArrayList<>();
        if (!done.contains("compile-PROCEDURE-PRC_RECONCILE")) objects.add(new ObjectInfo("PRC_RECONCILE","PROCEDURE","INVALID",List.of("PLS-00905: dependent audit object is invalid"),List.of("AUD_TXN")));
        if (!done.contains("compile-PACKAGE-BODY-PKG_SETTLEMENT")) objects.add(new ObjectInfo("PKG_SETTLEMENT","PACKAGE BODY","INVALID",List.of("PL/SQL: SQL statement ignored"),List.of("AUD_TXN")));
        if (!done.contains("compile-TRIGGER-TRG_TXN_AUD")) objects.add(new ObjectInfo("TRG_TXN_AUD","TRIGGER","INVALID",List.of("ORA-00942: audit table does not exist"),List.of("AUD_TXN")));
        return new Snapshot(objects, Set.copyOf(done));
    }
    public void execute(String run, Target target, Action action) {
        OracleScriptExecutor.split(action.sql());
        completed.computeIfAbsent(run,k -> ConcurrentHashMap.newKeySet()).add(action.id());
    }
    public boolean verify(String run, Target target, Action action, List<LibraryEntry> entries) { return completed.getOrDefault(run,Set.of()).contains(action.id()); }
    public String referenceSource(String schema,String alias,String type,String name) {
        return "-- Demonstration source only; compatibility must be reviewed\nCREATE OR REPLACE PROCEDURE " + Identifiers.quote(name) + " AS\nBEGIN\n  NULL;\nEND;\n/";
    }
}

`src/main/java/com/hardening/FileRunHistoryRepository.java`

package com.hardening;

import com.fasterxml.jackson.databind.ObjectMapper;
import java.nio.file.*;
import java.util.*;
import org.springframework.stereotype.Repository;
import static com.hardening.Models.*;

@Repository
public class FileRunHistoryRepository implements RunHistoryRepository {
    public record Stored(String owner,RunView run) {}
    private final Settings settings; private final ObjectMapper mapper;
    public FileRunHistoryRepository(Settings settings,ObjectMapper mapper) { this.settings=settings;this.mapper=mapper; }
    public synchronized void save(String owner,RunView view) {
        try {
            Files.createDirectories(settings.historyPath());
            Path target=settings.historyPath().resolve(UUID.fromString(view.id())+".json");
            Path temp=Files.createTempFile(settings.historyPath(),"run-",".tmp");
            mapper.writeValue(temp.toFile(),new Stored(owner,view));
            try { Files.move(temp,target,StandardCopyOption.REPLACE_EXISTING,StandardCopyOption.ATOMIC_MOVE); }
            catch(AtomicMoveNotSupportedException e) { Files.move(temp,target,StandardCopyOption.REPLACE_EXISTING); }
        } catch(java.io.IOException e) { throw new IllegalStateException("History cannot be saved; execution is stopped"); }
    }
    public List<RunView> list(String owner) {
        if(!Files.isDirectory(settings.historyPath())) return List.of();
        try(var files=Files.list(settings.historyPath())) {
            List<RunView> result=new ArrayList<>();
            for(Path path:files.filter(p->p.toString().endsWith(".json")).toList()) {
                Stored stored=mapper.readValue(path.toFile(),Stored.class);
                if(stored.owner().equals(owner)) result.add(stored.run());
            }
            result.sort(Comparator.comparing(RunView::createdAt).reversed()); return result;
        } catch(java.io.IOException e) { throw new IllegalStateException("History could not be read"); }
    }
}

`src/main/java/com/hardening/Identifiers.java`

package com.hardening;

import java.util.Locale;

public final class Identifiers {
    private Identifiers() {}
    public static String name(String input) {
        if (input == null || !input.matches("[A-Za-z][A-Za-z0-9_$#]{0,127}"))
            throw new IllegalArgumentException("Use an unquoted Oracle identifier (letters, digits, _, $, #; maximum 128 characters)");
        return input.toUpperCase(Locale.ROOT);
    }
    public static String alias(String input) {
        if (input == null || !input.matches("[A-Za-z0-9][A-Za-z0-9_.-]{0,127}"))
            throw new IllegalArgumentException("Invalid TNS alias or search hint");
        return input.toUpperCase(Locale.ROOT);
    }
    public static String quote(String input) { return "\"" + name(input) + "\""; }
}

`src/main/java/com/hardening/LibraryRepository.java`

package com.hardening;

import com.fasterxml.jackson.core.type.TypeReference;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.nio.file.*;
import java.util.*;
import org.springframework.stereotype.Repository;
import static com.hardening.Models.*;

@Repository
public class LibraryRepository {
    private final Settings settings; private final ObjectMapper mapper;
    public LibraryRepository(Settings settings, ObjectMapper mapper) { this.settings = settings; this.mapper = mapper; }
    public List<LibraryEntry> entries(String segment) {
        try {
            Path manifest = safe(segment, "manifest.json");
            if (!Files.exists(manifest)) return List.of();
            List<LibraryEntry> entries = mapper.readValue(manifest.toFile(), new TypeReference<>() {});
            Set<String> ids = new HashSet<>();
            for (var e : entries) {
                if (e.id() == null || !e.id().matches("[a-zA-Z0-9_-]+") || !ids.add(e.id())) throw new IllegalArgumentException("Duplicate/invalid library id");
                Identifiers.name(e.objectName());
                if (e.dependencies() == null || e.rank() < 1 || e.rank() > 99) throw new IllegalArgumentException("Invalid library dependencies/rank");
                if (!e.executionSegment().equals("CURRENT") && !settings.segments().contains(e.executionSegment())) throw new IllegalArgumentException("Unconfigured library execution segment");
                if (!Set.of("TABLE_EXISTS","COLUMN_EXISTS","OBJECT_VALID","GRANT_EXISTS","SYNONYM_EXISTS","DB_LINK_HEALTHY").contains(e.verification())) throw new IllegalArgumentException("Unsupported verification strategy");
                safe(segment, e.file());
            }
            return List.copyOf(entries);
        } catch (java.io.IOException e) { throw new IllegalArgumentException("Cannot read the configured library"); }
    }
    public String script(String segment, LibraryEntry entry, String base, String executionSchema) {
        try {
            if(entry.verification().equals("DB_LINK_HEALTHY")) {
                DbLinkDefinition d=link(segment,entry);
                return "-- Create missing DB link only; an existing failed link requires manual review.\n-- Definition: " + mapper.writeValueAsString(d) + "\n-- Remote schema: " + Identifiers.name(base+d.remoteSegment()) + "\n-- Credentials and resolved TNS are supplied only at execution.\n-- Verify using SELECT 1 FROM DUAL@" + d.linkName();
            }
            return ScriptTemplateRenderer.render(Files.readString(safe(segment, entry.file())),
                Map.of("TARGET_SCHEMA", executionSchema, "BASE_SCHEMA", base, "SEGMENT", segment));
        } catch (java.io.IOException e) { throw new IllegalArgumentException("Library script is unavailable"); }
    }
    public DbLinkDefinition link(String segment,LibraryEntry entry) {
        try {
            DbLinkDefinition d=mapper.readValue(safe(segment,entry.file()).toFile(),DbLinkDefinition.class);
            if(!d.linkName().equals(entry.objectName()) || !settings.segments().contains(d.remoteSegment())) throw new IllegalArgumentException("Invalid DB-link definition mapping");
            return d;
        } catch(java.io.IOException e) { throw new IllegalArgumentException("Cannot read DB-link definition"); }
    }
    private Path safe(String segment, String file) throws java.io.IOException {
        if (file == null || Path.of(file).isAbsolute()) throw new IllegalArgumentException("Invalid library path");
        Path root = settings.libraryPath().toAbsolutePath().normalize();
        Path folder = root.resolve(Identifiers.name(segment));
        Path path = folder.resolve(file).normalize();
        if (!path.startsWith(folder)) throw new IllegalArgumentException("Library path escapes segment folder");
        if (Files.exists(path) && !path.toRealPath().startsWith(root.toRealPath().resolve(segment)))
            throw new IllegalArgumentException("Library symlinks may not escape segment folder");
        return path;
    }
    public synchronized String publish(Candidate candidate) {
        if (!candidate.verified()) throw new IllegalArgumentException("Only verified fixes can be published");
        try {
            Path folder = settings.libraryPath().resolve(Identifiers.name(candidate.segment())).resolve("candidates");
            Files.createDirectories(folder);
            String file = candidate.objectName() + "-" + candidate.id();
            Files.writeString(folder.resolve(file + ".sql"), candidate.sql(), StandardOpenOption.CREATE_NEW);
            mapper.writeValue(folder.resolve(file + ".json").toFile(), candidate);
            List<LibraryEntry> manifest=new ArrayList<>(entries(candidate.segment()));
            manifest.removeIf(e->e.objectName().equals(candidate.objectName()) && e.objectType().equals(candidate.objectType()) && e.verification().equals("OBJECT_VALID"));
            manifest.add(new LibraryEntry("published-"+candidate.id(),candidate.objectName(),candidate.objectType(),"candidates/"+file+".sql",
                candidate.objectType().equals("TRIGGER")?6:4,List.of(),"CURRENT","LIBRARY_FIRST","OBJECT_VALID",null,null,null));
            Path manifestPath=safe(candidate.segment(),"manifest.json");
            Path temp=Files.createTempFile(manifestPath.getParent(),"manifest-",".tmp");
            mapper.writeValue(temp.toFile(),manifest);
            try { Files.move(temp,manifestPath,StandardCopyOption.REPLACE_EXISTING,StandardCopyOption.ATOMIC_MOVE); }
            catch(AtomicMoveNotSupportedException e) { Files.move(temp,manifestPath,StandardCopyOption.REPLACE_EXISTING); }
            return file;
        } catch (java.io.IOException e) { throw new IllegalArgumentException("Unable to publish versioned library candidate"); }
    }
}

`src/main/java/com/hardening/Models.java`

package com.hardening;

import java.util.*;

public final class Models {
    public record Target(String input, String alias, String segment) {}
    public record ObjectInfo(String name, String type, String status, List<String> errors, List<String> dependencies) {}
    public record Snapshot(List<ObjectInfo> invalidObjects, Set<String> satisfied) {}
    public record LibraryEntry(String id, String objectName, String objectType, String file, int rank,
            List<String> dependencies, String executionSegment, String sourcePreference,
            String verification, String checkColumn, String relatedSegment, String privilege) {}
    public record Action(String id, String objectName, String objectType, int rank, List<String> dependencies,
            String executionSchema, String executionSegment, String source, String reason, String sql,
            String verification, String status, String message) {
        public Action state(String state, String detail) {
            return new Action(id, objectName, objectType, rank, dependencies, executionSchema, executionSegment,
                    source, reason, sql, verification, state, detail);
        }
    }
    public record Event(String time, String action, String status, String message, long durationMs) {}
    public record RunView(String id, String targetSchema, String segment, String alias, String mode,
            String status, String createdAt, int initialInvalid, int remainingInvalid, String digest,
            List<ObjectInfo> objects, List<Action> actions, List<Event> events) {}
    public record Approval(String digest, List<String> actionIds, boolean approved) {}
    public record ReferenceConfig(String input, String alias, String release) {}
    public record Candidate(String id, String runId, String segment, String objectName, String objectType,
            String sourceSchema, String sql, String checksum, String createdAt, boolean verified) {}
}

`src/main/java/com/hardening/OracleConnectionFactory.java`

package com.hardening;

import java.sql.*;
import java.util.Properties;
import org.springframework.stereotype.Service;

@Service
public class OracleConnectionFactory {
    private final Settings settings; private final TnsResolver tns;
    public OracleConnectionFactory(Settings settings, TnsResolver tns) { this.settings = settings; this.tns = tns; }
    public Connection open(String schema, String alias) throws SQLException {
        if (!settings.credentialStrategy().equals("schema-name"))
            throw new IllegalArgumentException("Configure an approved credential strategy before using Oracle");
        String user = Identifiers.name(schema);
        Properties props = new Properties();
        props.setProperty("user",user); props.setProperty("password",user);
        props.setProperty("oracle.net.CONNECT_TIMEOUT","5000");
        props.setProperty("oracle.jdbc.ReadTimeout","30000");
        return DriverManager.getConnection("jdbc:oracle:thin:@" + tns.resolve(alias),props);
    }
}

`src/main/java/com/hardening/OracleDatabaseGateway.java`

package com.hardening;

import java.sql.*;
import java.util.*;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.stereotype.Component;
import static com.hardening.Models.*;

@Component
@ConditionalOnProperty(name="hardening.mode", havingValue="oracle")
public class OracleDatabaseGateway implements DatabaseGateway {
    private final OracleConnectionFactory factory; private final SchemaNameBuilder names; private final Settings settings;
    private final LibraryRepository library; private final TnsResolver tns;
    public OracleDatabaseGateway(OracleConnectionFactory factory, SchemaNameBuilder names, Settings settings,LibraryRepository library,TnsResolver tns) { this.factory=factory; this.names=names; this.settings=settings;this.library=library;this.tns=tns; }
    private String schema(Target target) { return names.build(SchemaInputParser.parse(target.input()).base(),target.segment()); }
    public void test(Target target) {
        try (Connection c=factory.open(schema(target),target.alias()); Statement s=c.createStatement(); ResultSet r=s.executeQuery("SELECT USER FROM DUAL")) {
            if (!r.next() || !r.getString(1).equals(schema(target))) throw new IllegalArgumentException("Connected schema does not match the selected target");
        } catch (SQLException e) { throw databaseError(e); }
    }
    public Snapshot scan(String run, Target target, List<LibraryEntry> entries) {
        try (Connection c=factory.open(schema(target),target.alias())) {
            List<ObjectInfo> objects=new ArrayList<>();
            try (PreparedStatement s=c.prepareStatement("SELECT OBJECT_NAME, OBJECT_TYPE FROM USER_OBJECTS WHERE STATUS='INVALID' ORDER BY OBJECT_TYPE,OBJECT_NAME"); ResultSet r=s.executeQuery()) {
                while (r.next()) {
                    String name=r.getString(1), type=r.getString(2);
                    List<String> errors=new ArrayList<>(),deps=new ArrayList<>();
                    try (PreparedStatement q=c.prepareStatement("SELECT LINE, POSITION, TEXT FROM USER_ERRORS WHERE NAME=? AND TYPE=? ORDER BY SEQUENCE")) {
                        q.setString(1,name); q.setString(2,type); try(ResultSet er=q.executeQuery()) { while(er.next()) errors.add("Line " + er.getInt(1) + ":" + er.getInt(2) + " " + er.getString(3)); }
                    }
                    try (PreparedStatement q=c.prepareStatement("SELECT REFERENCED_NAME FROM USER_DEPENDENCIES WHERE NAME=? AND TYPE=? AND REFERENCED_OWNER=USER")) {
                        q.setString(1,name); q.setString(2,type); try(ResultSet dr=q.executeQuery()) { while(dr.next()) deps.add(dr.getString(1)); }
                    }
                    objects.add(new ObjectInfo(name,type,"INVALID",errors,deps));
                }
            }
            Set<String> satisfied=new HashSet<>();
            for (LibraryEntry entry:entries) {
                String segment=entry.executionSegment().equals("CURRENT")?target.segment():entry.executionSegment();
                String execSchema=names.build(SchemaInputParser.parse(target.input()).base(),segment);
                if (execSchema.equals(schema(target))) { if(check(c,entry,target)) satisfied.add(entry.id()); }
                else try (Connection sibling=factory.open(execSchema,target.alias())) { if(check(sibling,entry,target)) satisfied.add(entry.id()); }
            }
            return new Snapshot(objects,satisfied);
        } catch(SQLException e) { throw databaseError(e); }
    }
    private boolean exists(Connection c,String sql,String...values) throws SQLException {
        try(PreparedStatement s=c.prepareStatement(sql)) {
            for(int i=0;i<values.length;i++) s.setString(i+1,values[i]);
            try(ResultSet r=s.executeQuery()) { return r.next(); }
        }
    }
    private boolean check(Connection c,LibraryEntry e,Target target) throws SQLException {
        String object=Identifiers.name(e.objectName());
        return switch(e.verification()) {
            case "DB_LINK_HEALTHY" -> {
                if(!exists(c,"SELECT 1 FROM USER_DB_LINKS WHERE DB_LINK=? OR DB_LINK LIKE ?",object,object+".%")) yield false;
                try(Statement s=c.createStatement()) { s.setQueryTimeout(10); try(ResultSet r=s.executeQuery("SELECT 1 FROM DUAL@"+Identifiers.quote(object))) { yield r.next(); } }
                catch(SQLException ex) { yield false; }
            }
            case "TABLE_EXISTS" -> exists(c,"SELECT 1 FROM USER_TABLES WHERE TABLE_NAME=?",object);
            case "COLUMN_EXISTS" -> exists(c,"SELECT 1 FROM USER_TAB_COLUMNS WHERE TABLE_NAME=? AND COLUMN_NAME=?",object,Identifiers.name(e.checkColumn()));
            case "OBJECT_VALID" -> exists(c,"SELECT 1 FROM USER_OBJECTS WHERE OBJECT_NAME=? AND OBJECT_TYPE=? AND STATUS='VALID'",object,e.objectType());
            case "GRANT_EXISTS" -> exists(c,"SELECT 1 FROM USER_TAB_PRIVS_MADE WHERE TABLE_NAME=? AND GRANTEE=? AND PRIVILEGE=?",object,names.build(SchemaInputParser.parse(target.input()).base(),e.relatedSegment()),e.privilege());
            case "SYNONYM_EXISTS" -> exists(c,"SELECT 1 FROM USER_SYNONYMS WHERE SYNONYM_NAME=? AND TABLE_OWNER=? AND TABLE_NAME=? AND DB_LINK IS NULL",object,names.build(SchemaInputParser.parse(target.input()).base(),e.relatedSegment()),object);
            default -> false;
        };
    }
    public void execute(String run,Target target,Action action) {
        if(!settings.allowWrites()) throw new IllegalArgumentException("Oracle writes are disabled by external configuration");
        String expected=names.build(SchemaInputParser.parse(target.input()).base(),action.executionSegment());
        if(!expected.equals(action.executionSchema())) throw new IllegalArgumentException("Execution target mismatch");
        try(Connection c=factory.open(expected,target.alias())) {
            if(action.verification().equals("DB_LINK_HEALTHY")) {
                if(exists(c,"SELECT 1 FROM USER_DB_LINKS WHERE DB_LINK=? OR DB_LINK LIKE ?",action.objectName(),action.objectName()+".%"))
                    throw new IllegalArgumentException("Existing DB link requires manual review; it will not be dropped or replaced");
                LibraryEntry e=library.entries(target.segment()).stream().filter(x->x.id().equals(action.id())).findFirst().orElseThrow();
                DbLinkDefinition d=library.link(target.segment(),e);
                String remote=names.build(SchemaInputParser.parse(target.input()).base(),d.remoteSegment());
                String description=tns.resolve(d.alias(target.alias()));
                String sql="CREATE DATABASE LINK "+Identifiers.quote(d.linkName())+" CONNECT TO "+Identifiers.quote(remote)+" IDENTIFIED BY "+Identifiers.quote(remote)+" USING '"+description.replace("'","''")+"'";
                try(Statement s=c.createStatement()) { s.setQueryTimeout(30);s.execute(sql); }
            } else OracleScriptExecutor.execute(c,action.sql());
        }
        catch(SQLException e) { throw databaseError(e); }
    }
    public boolean verify(String run,Target target,Action action,List<LibraryEntry> entries) {
        try(Connection c=factory.open(action.executionSchema(),target.alias())) {
            if(!action.source().equals("LIBRARY")) return exists(c,"SELECT 1 FROM USER_OBJECTS WHERE OBJECT_NAME=? AND OBJECT_TYPE=? AND STATUS='VALID'",action.objectName(),action.objectType());
            LibraryEntry e=entries.stream().filter(x->x.id().equals(action.id())).findFirst().orElseThrow();
            return check(c,e,target);
        } catch(SQLException e) { throw databaseError(e); }
    }
    public String referenceSource(String schema,String alias,String type,String name) {
        if(!Set.of("PROCEDURE","FUNCTION","PACKAGE","PACKAGE BODY","TRIGGER","VIEW","TABLE").contains(type)) throw new IllegalArgumentException("Reference type is not supported");
        try(Connection c=factory.open(Identifiers.name(schema),alias)) {
            // DBMS_METADATA settings affect only this short-lived reference session.
            try(CallableStatement s=c.prepareCall("BEGIN DBMS_METADATA.SET_TRANSFORM_PARAM(DBMS_METADATA.SESSION_TRANSFORM,'EMIT_SCHEMA',FALSE); DBMS_METADATA.SET_TRANSFORM_PARAM(DBMS_METADATA.SESSION_TRANSFORM,'SEGMENT_ATTRIBUTES',FALSE); END;")) { s.execute(); }
            try(PreparedStatement s=c.prepareStatement("SELECT DBMS_METADATA.GET_DDL(?, ?, USER) FROM DUAL")) {
                s.setString(1,type.equals("PACKAGE BODY")?"PACKAGE_BODY":type); s.setString(2,Identifiers.name(name));
                try(ResultSet r=s.executeQuery()) {
                    if(!r.next()) throw new IllegalArgumentException("Reference object is unavailable");
                    String ddl=r.getString(1);
                    if(ddl.toUpperCase(Locale.ROOT).contains(Identifiers.name(schema))) throw new IllegalArgumentException("Reference source contains owner-specific references; manual normalization required");
                    return ddl;
                }
            }
        } catch(SQLException e) { throw databaseError(e); }
    }
    private IllegalArgumentException databaseError(SQLException e) {
        return new IllegalArgumentException("Oracle operation failed (error code " + e.getErrorCode() + "). Review privileges, connectivity, or object errors.");
    }
}

`src/main/java/com/hardening/OracleScriptExecutor.java`

package com.hardening;

import java.sql.*;
import java.util.*;

public final class OracleScriptExecutor {
    private OracleScriptExecutor() {}
    // Split SQL outside comments/quoted strings. PL/SQL units end at a slash on its own line.
    // SQL*Plus commands and alternate quote syntax are explicitly rejected in this first version.
    public static List<String> split(String script) {
        List<String> out = new ArrayList<>(); StringBuilder current = new StringBuilder();
        boolean single = false, quoted = false, block = false;
        for (String line : script.replace("\r", "").split("\n", -1)) {
            if (!single && !quoted && !block && line.trim().equals("/")) {
                if (!current.toString().isBlank()) { out.add(current.toString().trim()); current.setLength(0); }
                continue;
            }
            if (!single && !quoted && !block && line.stripLeading().matches("(?i)^(SET|SPOOL|PROMPT|CONNECT|HOST|WHENEVER|EXIT|@|START)\\b.*"))
                throw new IllegalArgumentException("SQL*Plus commands are not supported");
            for (int i = 0; i < line.length(); i++) {
                char c = line.charAt(i), n = i+1 < line.length() ? line.charAt(i+1) : '\0';
                if (block) { if (c == '*' && n == '/') { block=false; i++; current.append(' '); } continue; }
                if (!single && !quoted && c=='-' && n=='-') break;
                if (!single && !quoted && c=='/' && n=='*') { block=true; i++; continue; }
                if (!single && !quoted && (c=='q' || c=='Q') && n=='\'') throw new IllegalArgumentException("Oracle q-quoted literals require manual review in this version");
                if (c=='\'' && !quoted) {
                    current.append(c);
                    if (single && n=='\'') { current.append(n); i++; } else single=!single;
                    continue;
                }
                if (c=='"' && !single) quoted=!quoted;
                if (c==';' && !single && !quoted && !isPlsql(current.toString())) {
                    if (!current.toString().isBlank()) out.add(current.toString().trim()); current.setLength(0);
                } else current.append(c);
            }
            current.append('\n');
        }
        if (single || quoted || block) throw new IllegalArgumentException("Unterminated SQL string or comment");
        if (!current.toString().isBlank()) {
            if (isPlsql(current.toString())) throw new IllegalArgumentException("PL/SQL requires a slash on its own line");
            out.add(current.toString().trim());
        }
        return out;
    }
    private static boolean isPlsql(String sql) {
        return sql.stripLeading().matches("(?is)^(DECLARE|BEGIN)\\b.*") ||
            sql.stripLeading().matches("(?is)^CREATE\\s+(OR\\s+REPLACE\\s+)?(EDITIONABLE\\s+|NONEDITIONABLE\\s+)?(PROCEDURE|FUNCTION|PACKAGE|TRIGGER|TYPE)\\b.*");
    }
    public static void execute(Connection connection, String sql) throws SQLException {
        for (String statement : split(sql)) try (Statement st = connection.createStatement()) {
            st.setQueryTimeout(30); st.execute(statement);
        }
    }
}

`src/main/java/com/hardening/PathConfiguration.java`

package com.hardening;

import java.nio.file.Path;
import org.springframework.boot.context.properties.ConfigurationPropertiesBinding;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.converter.Converter;

@Configuration(proxyBeanMethods=false)
public class PathConfiguration {
    @Bean @ConfigurationPropertiesBinding
    static Converter<String,Path> filesystemPathConverter() {
        // Treat external paths as filesystem paths, not servlet resource URLs.
        return new Converter<>() { public Path convert(String source) { return Path.of(source).toAbsolutePath().normalize(); } };
    }
}

`src/main/java/com/hardening/ReferenceConfigurationService.java`

package com.hardening;

import org.springframework.stereotype.Service;
import static com.hardening.Models.*;

@Service
public class ReferenceConfigurationService {
    private volatile ReferenceConfig active;
    private final TnsResolver tns; private final SchemaNameBuilder names;
    public ReferenceConfigurationService(TnsResolver tns,SchemaNameBuilder names) { this.tns=tns;this.names=names; }
    public void configure(ReferenceConfig config) {
        SchemaInputParser.parse(config.input()); tns.resolve(config.alias());
        if(config.release()==null || config.release().isBlank() || config.release().length()>80) throw new IllegalArgumentException("Enter the application release for this reference");
        active=config;
    }
    public void clear() { active=null; }
    public boolean ready() { return active!=null; }
    public ReferenceConfig get() { if(active==null) throw new IllegalArgumentException("An admin must configure the reference environment"); return active; }
    public String schema(String targetSegment) { return names.reference(SchemaInputParser.parse(get().input()).base(),targetSegment); }
}

`src/main/java/com/hardening/ReferenceRepairService.java`

package com.hardening;

import java.time.Instant;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import org.springframework.stereotype.Service;
import static com.hardening.Models.*;

@Service
public class ReferenceRepairService {
    public record Preview(String sourceSchema,String release,String sql,String checksum,String message) {}
    public record Review(String actionId,String release,String checksum,boolean compatibilityReviewed) {}
    private record Pending(String owner,String runId,String actionId,Candidate candidate) {}
    private final RepairExecutionService repairs;private final ReferenceConfigurationService reference;
    private final DatabaseGateway db;private final LibraryRepository library;
    private final Map<String,Pending> candidates=new ConcurrentHashMap<>();
    public ReferenceRepairService(RepairExecutionService repairs,ReferenceConfigurationService reference,DatabaseGateway db,LibraryRepository library) {
        this.repairs=repairs;this.reference=reference;this.db=db;this.library=library;
    }
    public Preview preview(String owner,String runId,String actionId) {
        RunView run=repairs.get(owner,runId);
        Action action=run.actions().stream().filter(a->a.id().equals(actionId)).findFirst().orElseThrow(()->new IllegalArgumentException("Action not found"));
        if(!Set.of("PROCEDURE","FUNCTION","PACKAGE","PACKAGE BODY","TRIGGER","VIEW").contains(action.objectType())) throw new IllegalArgumentException("This reference type requires manual review outside the application");
        ReferenceConfig ref=reference.get();
        String schema=Identifiers.name(SchemaInputParser.parse(ref.input()).base()+run.segment());
        String sql=db.referenceSource(schema,ref.alias(),action.objectType(),action.objectName()).strip();
        if(!action.objectType().equals("VIEW") && !sql.endsWith("/")) sql+="\n/";
        return new Preview(schema,ref.release(),sql,RepairExecutionService.hash(sql),"Read-only source. Confirm release compatibility before adding it to the repair plan.");
    }
    public RunView propose(String owner,String runId,Review review) {
        Preview p=preview(owner,runId,review.actionId());
        if(!review.compatibilityReviewed() || !p.release().equals(review.release()) || !p.checksum().equals(review.checksum()))
            throw new IllegalArgumentException("Reference source or release changed, or compatibility was not reviewed");
        RunView run=repairs.addReference(owner,runId,review.actionId(),p.sql(),p.sourceSchema());
        Action a=run.actions().stream().filter(x->x.id().equals(review.actionId())).findFirst().orElseThrow();
        String id=UUID.randomUUID().toString();
        candidates.put(id,new Pending(owner,runId,a.id(),new Candidate(id,runId,run.segment(),a.objectName(),a.objectType(),p.sourceSchema(),p.sql(),p.checksum(),Instant.now().toString(),false)));
        return run;
    }
    public List<Candidate> verifiedCandidates() {
        List<Candidate> out=new ArrayList<>();
        for(Pending p:candidates.values()) {
            RunView run=repairs.get(p.owner(),p.runId());
            if(run.actions().stream().anyMatch(a->a.id().equals(p.actionId()) && a.status().equals("SUCCESS") && RepairExecutionService.hash(a.sql()).equals(p.candidate().checksum()))) {
                Candidate c=p.candidate();out.add(new Candidate(c.id(),c.runId(),c.segment(),c.objectName(),c.objectType(),c.sourceSchema(),c.sql(),c.checksum(),c.createdAt(),true));
            }
        }
        return out;
    }
    public String publish(String id,String checksum) {
        Candidate c=verifiedCandidates().stream().filter(x->x.id().equals(id)).findFirst().orElseThrow(()->new IllegalArgumentException("Verified candidate not found"));
        if(!c.checksum().equals(checksum)) throw new IllegalArgumentException("Approve the exact candidate checksum");
        String file=library.publish(c);candidates.remove(id);return file;
    }
}

`src/main/java/com/hardening/RepairExecutionService.java`

package com.hardening;

import java.nio.charset.StandardCharsets;
import java.security.*;
import java.time.Instant;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import org.springframework.stereotype.Service;
import static com.hardening.Models.*;

@Service
public class RepairExecutionService {
    private final Map<String,Run> runs=new ConcurrentHashMap<>();
    private final DatabaseGateway db; private final RepairPlanner planner; private final LibraryRepository library;
    private final SchemaNameBuilder names; private final RunHistoryRepository history; private final Settings settings;
    static final class Run {
        String id=UUID.randomUUID().toString(), created=Instant.now().toString(), owner, schema, status="REVIEW";
        Target target; int initial; Snapshot snapshot; List<Action> actions; List<LibraryEntry> entries;
        List<Event> events=new ArrayList<>(); String fingerprint;
    }
    public RepairExecutionService(DatabaseGateway db,RepairPlanner planner,LibraryRepository library,SchemaNameBuilder names,RunHistoryRepository history,Settings settings) {
        this.db=db;this.planner=planner;this.library=library;this.names=names;this.history=history;this.settings=settings;
    }
    public RunView scan(String owner,Target target) {
        if(runs.size()>1000) throw new IllegalArgumentException("Active run capacity reached; archive history and restart the service");
        Run run=new Run(); run.owner=owner; run.target=normalize(target);
        run.schema=names.build(SchemaInputParser.parse(target.input()).base(),run.target.segment());
        db.test(run.target); run.entries=library.entries(run.target.segment());
        run.snapshot=db.scan(run.id,run.target,run.entries); run.initial=run.snapshot.invalidObjects().size();
        run.actions=new ArrayList<>(planner.plan(run.target,run.snapshot,run.entries));
        run.fingerprint=fingerprint(run.snapshot);
        event(run,"Scan","SUCCESS","Read-only scan completed; no database changes",0);
        save(run); runs.put(run.id,run); return view(run);
    }
    private Target normalize(Target target) {
        var input=SchemaInputParser.parse(target.input());
        String segment=Identifiers.name(target.segment()); names.build(input.base(),segment);
        return new Target(input.base()+"@"+input.hint(),Identifiers.alias(target.alias()),segment);
    }
    public RunView get(String owner,String id) { Run run=owned(owner,id); synchronized(run) { return view(run); } }
    public RunView execute(String owner,String id,Approval approval) {
        Run run=owned(owner,id);
        synchronized(run) {
            if(run.status.equals("NEEDS_RESCAN")) throw new IllegalArgumentException("A fresh scan is required before further execution");
            if(!approval.approved() || approval.digest()==null || !MessageDigest.isEqual(approval.digest().getBytes(StandardCharsets.UTF_8),digest(run).getBytes(StandardCharsets.UTF_8)))
                throw new IllegalArgumentException("Approve the exact current plan before execution");
            if(approval.actionIds()==null || approval.actionIds().isEmpty() || new HashSet<>(approval.actionIds()).size()!=approval.actionIds().size()) throw new IllegalArgumentException("Select at least one unique action");
            Set<String> requested=new HashSet<>(approval.actionIds());
            List<Action> batch=run.actions.stream().filter(a->requested.contains(a.id())).toList();
            if(batch.size()!=requested.size() || batch.stream().anyMatch(a->!a.status().equals("PENDING"))) throw new IllegalArgumentException("Only pending actions can be approved");
            if(batch.stream().map(Action::rank).distinct().count()!=1) throw new IllegalArgumentException("Approve one rank at a time");
            Set<String> done=new HashSet<>(); run.actions.stream().filter(a->a.status().equals("SUCCESS")).forEach(a->done.add(a.id()));
            for(Action action:batch) {
                if(!done.containsAll(action.dependencies())) throw new IllegalArgumentException("Dependencies must succeed before this batch");
                done.add(action.id());
            }
            Snapshot fresh=db.scan(run.id,run.target,run.entries);
            if(!fingerprint(fresh).equals(run.fingerprint)) throw new IllegalArgumentException("Database state changed; start a new scan and review the updated plan");
            // Re-read library scripts: edits on the share invalidate prior approval.
            List<LibraryEntry> current=library.entries(run.target.segment());
            if(!current.equals(run.entries)) throw new IllegalArgumentException("Library manifest changed; scan again");
            for(Action a:batch) if(a.source().equals("LIBRARY")) {
                LibraryEntry e=current.stream().filter(x->x.id().equals(a.id())).findFirst().orElseThrow();
                String sql=library.script(run.target.segment(),e,SchemaInputParser.parse(run.target.input()).base(),a.executionSchema());
                if(!sql.equals(a.sql())) throw new IllegalArgumentException("Library script changed; scan again");
            }
            run.status="RUNNING"; event(run,"Approval","APPROVED","Approved rank "+batch.getFirst().rank()+" ("+batch.size()+" actions)",0); save(run);
            for(Action a:batch) {
                if(run.actions.stream().anyMatch(d->a.dependencies().contains(d.id()) && !d.status().equals("SUCCESS"))) { replace(run,a.state("BLOCKED","A prerequisite failed")); continue; }
                long start=System.nanoTime(); replace(run,a.state("RUNNING","Execution started")); save(run);
                try {
                    db.execute(run.id,run.target,a);
                    boolean verified=db.verify(run.id,run.target,a,run.entries);
                    String state=verified?"SUCCESS":"FAILED", message=verified?"Verification passed":"Execution finished but verification failed; inspect Oracle errors";
                    replace(run,a.state(state,message)); event(run,a.objectName(),state,message,(System.nanoTime()-start)/1_000_000);
                } catch(RuntimeException e) {
                    replace(run,a.state("FAILED","Action failed; inspect configuration and Oracle object errors"));
                    event(run,a.objectName(),"FAILED","Execution failed; successful DDL may already be committed",(System.nanoTime()-start)/1_000_000);
                }
                save(run);
            }
            for(int i=0;i<run.actions.size();i++) {
                Action a=run.actions.get(i);
                if(a.status().equals("PENDING") && run.actions.stream().anyMatch(d->a.dependencies().contains(d.id()) && Set.of("FAILED","BLOCKED","SKIPPED","MANUAL").contains(d.status())))
                    run.actions.set(i,a.state("BLOCKED","A dependency requires attention"));
            }
            try {
                run.snapshot=db.scan(run.id,run.target,run.entries); run.fingerprint=fingerprint(run.snapshot);
                run.status=run.snapshot.invalidObjects().isEmpty() && run.actions.stream().allMatch(a->a.status().equals("SUCCESS"))?"COMPLETED":"REVIEW";
                event(run,"Re-scan","SUCCESS",run.snapshot.invalidObjects().size()+" invalid objects remain",0);
            } catch(RuntimeException e) { run.status="NEEDS_RESCAN"; event(run,"Re-scan","FAILED","Unable to verify final database state; start a fresh scan",0); }
            save(run); return view(run);
        }
    }
    public RunView skip(String owner,String id,String actionId) {
        Run run=owned(owner,id); synchronized(run) {
            Action action=run.actions.stream().filter(a->a.id().equals(actionId)).findFirst().orElseThrow(()->new IllegalArgumentException("Action not found"));
            if(!Set.of("PENDING","MANUAL").contains(action.status())) throw new IllegalArgumentException("Action cannot be skipped");
            replace(run,action.state("SKIPPED","Skipped by user")); event(run,action.objectName(),"SKIPPED","User skipped this action",0); save(run); return view(run);
        }
    }
    public Target target(String owner,String id) { return owned(owner,id).target; }
    public RunView addReference(String owner,String id,String actionId,String sql,String sourceSchema) {
        Run run=owned(owner,id); synchronized(run) {
            Action previous=run.actions.stream().filter(a->a.id().equals(actionId)).findFirst().orElseThrow(()->new IllegalArgumentException("Object action not found"));
            if(!Set.of("FAILED","MANUAL").contains(previous.status())) throw new IllegalArgumentException("Try the planned compile/library repair before reference fallback");
            if(run.entries.stream().anyMatch(e->e.objectName().equals(previous.objectName()) && e.verification().equals("OBJECT_VALID"))) throw new IllegalArgumentException("A library fix exists; review it before reference fallback");
            OracleScriptExecutor.split(sql);
            Action replacement=new Action(previous.id(),previous.objectName(),previous.objectType(),previous.rank(),List.of(),previous.executionSchema(),previous.executionSegment(),"REFERENCE","Reviewed source from "+sourceSchema,sql,"OBJECT_VALID","PENDING","Reference change awaiting exact-script approval");
            replace(run,replacement);run.status="REVIEW";event(run,previous.objectName(),"REVIEW","Reference change added to plan; execution still requires approval",0);save(run);return view(run);
        }
    }
    private Run owned(String owner,String id) {
        Run run=runs.get(id); if(run==null || !run.owner.equals(owner)) throw new IllegalArgumentException("Run not found for this session; historical runs are read-only"); return run;
    }
    private void replace(Run run,Action action) { for(int i=0;i<run.actions.size();i++) if(run.actions.get(i).id().equals(action.id())) { run.actions.set(i,action); return; } }
    private void event(Run run,String action,String state,String message,long ms) { run.events.add(new Event(Instant.now().toString(),action,state,message,ms)); }
    private void save(Run run) { history.save(run.owner,view(run)); }
    public static String hash(String value) { try { return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8))); } catch(NoSuchAlgorithmException e) { throw new IllegalStateException(e); } }
    private String fingerprint(Snapshot s) { return hash(s.invalidObjects().toString()+new TreeSet<>(s.satisfied())); }
    private String digest(Run run) { return hash(run.id+run.target+run.actions.toString()+run.fingerprint); }
    private RunView view(Run r) { return new RunView(r.id,r.schema,r.target.segment(),r.target.alias(),settings.mode(),r.status,r.created,r.initial,r.snapshot.invalidObjects().size(),digest(r),r.snapshot.invalidObjects(),List.copyOf(r.actions),List.copyOf(r.events)); }
}

`src/main/java/com/hardening/RepairPlanner.java`

package com.hardening;

import java.util.*;
import org.springframework.stereotype.Service;
import static com.hardening.Models.*;

@Service
public class RepairPlanner {
    private final SchemaNameBuilder names; private final LibraryRepository library;
    public RepairPlanner(SchemaNameBuilder names, LibraryRepository library) { this.names = names; this.library = library; }
    public List<Action> plan(Target target, Snapshot snapshot, List<LibraryEntry> entries) {
        String base = SchemaInputParser.parse(target.input()).base();
        List<Action> actions = new ArrayList<>();
        Map<String,String> objectActions = new HashMap<>();
        for (var entry : entries) {
            if (snapshot.satisfied().contains(entry.id())) continue;
            String segment = entry.executionSegment().equals("CURRENT") ? target.segment() : entry.executionSegment();
            String schema = names.build(base, segment);
            var deps = entry.dependencies().stream().filter(d -> !snapshot.satisfied().contains(d)).toList();
            String state = "PENDING";
            actions.add(new Action(entry.id(), entry.objectName(), entry.objectType(), entry.rank(), deps, schema, segment,
                    "LIBRARY", "Required by the approved segment library policy", library.script(target.segment(), entry, base, schema),
                    entry.verification(), state, state.equals("MANUAL") ? "Existing code replacement requires compatibility review" : "Awaiting approval"));
            if(segment.equals(target.segment())) objectActions.putIfAbsent(entry.objectName(), entry.id());
        }
        for (var obj : snapshot.invalidObjects()) objectActions.putIfAbsent(obj.name(), "compile-" + obj.type().replace(' ','-') + "-" + obj.name());
        for (var obj : snapshot.invalidObjects()) {
            String sql;
            try { sql = compileSql(obj.type(), obj.name()); }
            catch(IllegalArgumentException unsupportedIdentifier) { sql = ""; }
            List<String> deps = new ArrayList<>();
            for (String dep : obj.dependencies()) if (objectActions.containsKey(dep) && !dep.equals(obj.name())) deps.add(objectActions.get(dep));
            for (var entry : entries) if (!snapshot.satisfied().contains(entry.id()) && entry.verification().equals("OBJECT_VALID") && entry.objectName().equals(obj.name())) deps.add(entry.id());
            // Missing DB-link dependencies are not always present in USER_DEPENDENCIES.
            for (var entry : entries) if (!snapshot.satisfied().contains(entry.id()) && entry.verification().equals("DB_LINK_HEALTHY") && library.link(target.segment(),entry).dependentObjects().contains(obj.name())) deps.add(entry.id());
            String id = "compile-" + obj.type().replace(' ','-') + "-" + obj.name();
            actions.add(new Action(id, obj.name(), obj.type(), obj.type().equals("TRIGGER") ? 6 : obj.type().equals("PACKAGE") ? 4 : 5,
                deps.stream().distinct().filter(d -> !d.equals(id)).toList(), names.build(base,target.segment()), target.segment(), "COMPILE",
                obj.errors().isEmpty() ? "Object is invalid" : String.join("; ",obj.errors()), sql, "OBJECT_VALID",
                sql.isBlank() ? "MANUAL" : "PENDING", sql.isBlank() ? "Unsupported object type; manual review required" : "Awaiting prerequisites and approval"));
        }
        return order(actions);
    }
    public static String compileSql(String type, String name) {
        String q = Identifiers.quote(name);
        return switch (type) {
            case "PROCEDURE","FUNCTION","TRIGGER","VIEW","SYNONYM" -> "ALTER " + type + " " + q + " COMPILE";
            case "PACKAGE" -> "ALTER PACKAGE " + q + " COMPILE SPECIFICATION";
            case "PACKAGE BODY" -> "ALTER PACKAGE " + q + " COMPILE BODY";
            case "TYPE" -> "ALTER TYPE " + q + " COMPILE SPECIFICATION";
            case "TYPE BODY" -> "ALTER TYPE " + q + " COMPILE BODY";
            default -> "";
        };
    }
    public static List<Action> order(List<Action> actions) {
        Map<String,Action> pending = new LinkedHashMap<>();
        for (Action a : actions) if (pending.put(a.id(), a) != null) throw new IllegalArgumentException("Duplicate repair action id");
        List<Action> result = new ArrayList<>(); Set<String> done = new HashSet<>();
        while (!pending.isEmpty()) {
            var next = pending.values().stream().filter(a -> done.containsAll(a.dependencies()))
                .min(Comparator.comparingInt(Action::rank).thenComparing(Action::id));
            if (next.isEmpty()) {
                pending.values().forEach(a -> result.add(a.state("MANUAL", "Unresolved or cyclic dependency; manual review required")));
                break;
            }
            Action a = next.get(); result.add(a); done.add(a.id()); pending.remove(a.id());
        }
        return result;
    }
}

`src/main/java/com/hardening/RunHistoryRepository.java`

package com.hardening;

import java.util.List;
import static com.hardening.Models.*;

public interface RunHistoryRepository {
    void save(String owner,RunView view);
    List<RunView> list(String owner);
}

`src/main/java/com/hardening/SchemaInputParser.java`

package com.hardening;

public final class SchemaInputParser {
    public record Input(String base, String hint) {}
    public static Input parse(String input) {
        if (input == null) throw new IllegalArgumentException("Enter BASE_SCHEMA@SERVER_HINT");
        String[] parts = input.trim().split("@", -1);
        if (parts.length != 2) throw new IllegalArgumentException("Enter BASE_SCHEMA@SERVER_HINT");
        return new Input(Identifiers.name(parts[0]), Identifiers.alias(parts[1]));
    }
}

`src/main/java/com/hardening/SchemaNameBuilder.java`

package com.hardening;

import org.springframework.stereotype.Component;

@Component
public class SchemaNameBuilder {
    private final Settings settings;
    public SchemaNameBuilder(Settings settings) { this.settings = settings; }
    public String build(String base, String segment) {
        String s = Identifiers.name(segment);
        if (!settings.segments().contains(s)) throw new IllegalArgumentException("Segment is not configured");
        return Identifiers.name(Identifiers.name(base) + s);
    }
    public String reference(String referenceBase, String targetSegment) { return build(referenceBase, targetSegment); }
}

`src/main/java/com/hardening/ScriptTemplateRenderer.java`

package com.hardening;

import java.util.Map;
import java.util.regex.Pattern;

public final class ScriptTemplateRenderer {
    public static String render(String sql, Map<String,String> variables) {
        var matcher = Pattern.compile("\\$\\{([A-Z_]+)}").matcher(sql);
        var out = new StringBuilder();
        while (matcher.find()) {
            String value = variables.get(matcher.group(1));
            if (value == null) throw new IllegalArgumentException("Unknown script placeholder: " + matcher.group(1));
            matcher.appendReplacement(out, java.util.regex.Matcher.quoteReplacement(Identifiers.name(value)));
        }
        matcher.appendTail(out);
        if (out.indexOf("${") >= 0) throw new IllegalArgumentException("Unresolved script placeholder");
        return out.toString();
    }
}

`src/main/java/com/hardening/SecurityConfiguration.java`

package com.hardening;

import java.util.*;
import org.springframework.context.annotation.*;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.*;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfiguration {
    @Bean UserDetailsService users(Settings settings) {
        var encoder=new BCryptPasswordEncoder(); List<UserDetails> users=new ArrayList<>();
        if(settings.adminPassword()!=null && !settings.adminPassword().isBlank()) {
            if(settings.adminPassword().length()<12) throw new IllegalArgumentException("Admin password must contain at least 12 characters");
            users.add(User.withUsername("admin").password(encoder.encode(settings.adminPassword())).roles("ADMIN","USER").build());
        }
        if(settings.userPassword()!=null && !settings.userPassword().isBlank()) users.add(User.withUsername("operator").password(encoder.encode(settings.userPassword())).roles("USER").build());
        return new InMemoryUserDetailsManager(users);
    }
    @Bean SecurityFilterChain chain(HttpSecurity http,Settings settings) throws Exception {
        http.authorizeHttpRequests(auth-> {
            auth.requestMatchers("/api/admin/**").hasRole("ADMIN");
            auth.requestMatchers("/api/config","/api/csrf","/api/login","/","/index.html","/assets/**","/favicon.svg","/error").permitAll();
            if(settings.demo()) auth.anyRequest().permitAll(); else auth.anyRequest().authenticated();
        });
        http.formLogin(login->login.loginProcessingUrl("/api/login")
            .successHandler((req,res,auth)->{res.setStatus(200);res.setContentType("application/json");res.getWriter().write("{\"success\":true}");})
            .failureHandler((req,res,e)->res.setStatus(401)));
        http.logout(logout->logout.logoutUrl("/api/logout").logoutSuccessHandler((req,res,auth)->res.setStatus(204)));
        http.exceptionHandling(e->e.authenticationEntryPoint((req,res,ex)->res.sendError(401)));
        http.headers(h->h.contentSecurityPolicy(c->c.policyDirectives("default-src 'self'; style-src 'self'; script-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'")));
        return http.build();
    }
}

`src/main/java/com/hardening/Settings.java`

package com.hardening;

import java.nio.file.Path;
import java.util.List;
import org.springframework.boot.context.properties.ConfigurationProperties;

@ConfigurationProperties("hardening")
public record Settings(String mode, List<String> segments, Path tnsPath, Path libraryPath,
        Path historyPath, boolean allowWrites, String credentialStrategy, String adminPassword, String userPassword) {
    public Settings {
        if (!List.of("demo", "oracle").contains(mode)) throw new IllegalArgumentException("Unknown mode");
        segments = segments.stream().map(Identifiers::name).toList();
        if (mode.equals("oracle") && (userPassword == null || userPassword.length() < 12))
            throw new IllegalArgumentException("Oracle mode requires an externally configured application user password of at least 12 characters");
    }
    public boolean demo() { return mode.equals("demo"); }
    @Override public String toString() { return "Settings[mode=" + mode + "]"; }
}

`src/main/java/com/hardening/TnsResolver.java`

package com.hardening;

import java.io.IOException;
import java.nio.file.Files;
import java.util.*;
import java.util.regex.*;
import org.springframework.stereotype.Service;

@Service
public class TnsResolver {
    private final Settings settings;
    public TnsResolver(Settings settings) { this.settings = settings; }
    public Map<String,String> entries() {
        try { return parse(Files.readString(settings.tnsPath())); }
        catch (IOException e) { throw new IllegalArgumentException("TNS file is unavailable; check the external TNS path"); }
    }
    public List<String> search(String hint) {
        String h = Identifiers.alias(hint);
        return entries().keySet().stream().filter(a -> a.contains(h)).sorted().toList();
    }
    public String resolve(String alias) {
        String value = entries().get(Identifiers.alias(alias));
        if (value == null) throw new IllegalArgumentException("Select an alias from the configured TNS file");
        return value;
    }
    // Balanced parentheses preserve complete ADDRESS_LIST / DESCRIPTION_LIST entries.
    // IFILE is rejected rather than silently following an unreviewed filesystem path.
    public static Map<String,String> parse(String text) {
        String clean = text.replaceAll("(?m)#.*$", "");
        if (Pattern.compile("(?im)^\\s*IFILE\\s*=").matcher(clean).find())
            throw new IllegalArgumentException("TNS IFILE includes must be flattened into the approved configuration");
        Pattern header = Pattern.compile("\\G\\s*([A-Za-z0-9_.-]+(?:\\s*,\\s*[A-Za-z0-9_.-]+)*)\\s*=\\s*");
        Map<String,String> result = new LinkedHashMap<>();
        int cursor = 0;
        while (cursor < clean.length() && !clean.substring(cursor).isBlank()) {
            Matcher m = header.matcher(clean); m.region(cursor, clean.length());
            if (!m.find()) throw new IllegalArgumentException("Malformed TNS alias entry");
            int start = m.end(), depth = 0, end = start; boolean quoted = false;
            if (start >= clean.length() || clean.charAt(start) != '(') throw new IllegalArgumentException("Missing TNS description");
            for (; end < clean.length(); end++) {
                char c = clean.charAt(end);
                if (c == '"') quoted = !quoted;
                if (!quoted) {
                    if (c == '(') depth++;
                    if (c == ')' && --depth == 0) { end++; break; }
                }
            }
            if (depth != 0 || quoted) throw new IllegalArgumentException("Unbalanced TNS description");
            for (String alias : m.group(1).split(",")) {
                if (result.putIfAbsent(Identifiers.alias(alias.trim()), clean.substring(start, end)) != null)
                    throw new IllegalArgumentException("Duplicate TNS alias");
            }
            cursor = end;
        }
        return result;
    }
}

`src/main/resources/application.properties`

spring.application.name=oracle-hardening
server.address=${HARDENING_BIND:127.0.0.1}
server.port=${PORT:8080}
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.same-site=strict
server.servlet.session.timeout=30m
server.error.include-message=never
server.error.include-stacktrace=never
spring.jackson.serialization.indent-output=true
hardening.mode=${HARDENING_MODE:demo}
hardening.segments=${HARDENING_SEGMENTS:TR,CSS,RMS,TRCUS,CCS}
hardening.tns-path=${HARDENING_TNS_PATH:fixtures/tnsnames.ora}
hardening.library-path=${HARDENING_LIBRARY_PATH:fixtures/library}
hardening.history-path=${HARDENING_HISTORY_PATH:.data/history}
hardening.allow-writes=${HARDENING_ALLOW_WRITES:false}
hardening.credential-strategy=${HARDENING_CREDENTIAL_STRATEGY:disabled}
hardening.admin-password=${HARDENING_ADMIN_PASSWORD:}
hardening.user-password=${HARDENING_USER_PASSWORD:}

ApiErrors.java

iron_man — Mon, 21 Sep 2026 20:16:54 +0000

package com.hardening;

import java.util.Map;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestControllerAdvice
public class ApiErrors {
@ExceptionHandler(IllegalArgumentException.class)
public ResponseEntity<?> invalid(IllegalArgumentException e) { return ResponseEntity.badRequest().body(Map.of("code","VALIDATION","message",e.getMessage())); }
@ExceptionHandler(Exception.class)
public ResponseEntity<?> failure(Exception e) { return ResponseEntity.internalServerError().body(Map.of("code","OPERATION_FAILED","message","Operation could not complete. Check server configuration and run history.")); }
}

ApiController.java

iron_man — Mon, 21 Sep 2026 20:16:11 +0000

package com.hardening;

import jakarta.servlet.http.HttpServletRequest;
import java.util.;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.web.bind.annotation.;
import static com.hardening.Models.*;

@RestController
@RequestMapping("/api")
public class ApiController {
private final Settings settings; private final TnsResolver tns; private final SchemaNameBuilder names;
private final DatabaseGateway db; private final RepairExecutionService repairs; private final ReferenceConfigurationService reference;
private final RunHistoryRepository history;private final ReferenceRepairService referenceRepairs;
public ApiController(Settings settings,TnsResolver tns,SchemaNameBuilder names,DatabaseGateway db,RepairExecutionService repairs,ReferenceConfigurationService reference,RunHistoryRepository history,ReferenceRepairService referenceRepairs) {
this.settings=settings;this.tns=tns;this.names=names;this.db=db;this.repairs=repairs;this.reference=reference;this.history=history;this.referenceRepairs=referenceRepairs;
}
private String owner(HttpServletRequest r,Authentication a) { return a!=null && a.isAuthenticated()?"user:"+a.getName():"session:"+r.getSession().getId(); }
@GetMapping("/csrf") public Map csrf(CsrfToken token) { return Map.of("token",token.getToken(),"header",token.getHeaderName()); }
@GetMapping("/config") public Map config(Authentication auth) {
return Map.of("mode",settings.mode(),"segments",settings.segments(),"referenceReady",reference.ready(),"writesEnabled",settings.demo()||settings.allowWrites(),
"admin",auth!=null && auth.getAuthorities().stream().anyMatch(a->a.getAuthority().equals("ROLE_ADMIN")),"authenticated",auth!=null);
}
@GetMapping("/tns") public Map tns(@RequestParam String input) { var parsed=SchemaInputParser.parse(input); return Map.of("base",parsed.base(),"aliases",tns.search(parsed.hint())); }
@PostMapping("/connection/test") public Map test(@RequestBody Target target) {
String schema=names.build(SchemaInputParser.parse(target.input()).base(),target.segment()); db.test(target); return Map.of("schema",schema,"status","SUCCESS");
}
@PostMapping("/runs") public RunView scan(@RequestBody Target target,HttpServletRequest req,Authentication a) { return repairs.scan(owner(req,a),target); }
@GetMapping("/runs/{id}") public RunView run(@PathVariable String id,HttpServletRequest req,Authentication a) { return repairs.get(owner(req,a),id); }
@GetMapping("/history") public List history(HttpServletRequest req,Authentication a) { return history.list(owner(req,a)); }
@PostMapping("/runs/{id}/execute") public RunView execute(@PathVariable String id,@RequestBody Approval approval,HttpServletRequest req,Authentication a) { return repairs.execute(owner(req,a),id,approval); }
@PostMapping("/runs/{id}/skip/{actionId}") public RunView skip(@PathVariable String id,@PathVariable String actionId,HttpServletRequest req,Authentication a) { return repairs.skip(owner(req,a),id,actionId); }
@PostMapping("/admin/reference") public Map configure(@RequestBody ReferenceConfig config) { reference.configure(config); return Map.of("status","CONFIGURED"); }
@DeleteMapping("/admin/reference") public void clear() { reference.clear(); }
@GetMapping("/runs/{id}/reference/{actionId}") public ReferenceRepairService.Preview preview(@PathVariable String id,@PathVariable String actionId,HttpServletRequest req,Authentication a) { return referenceRepairs.preview(owner(req,a),id,actionId); }
@PostMapping("/runs/{id}/reference-plan") public RunView referencePlan(@PathVariable String id,@RequestBody ReferenceRepairService.Review review,HttpServletRequest req,Authentication a) { return referenceRepairs.propose(owner(req,a),id,review); }
@GetMapping("/admin/candidates") public List candidates() { return referenceRepairs.verifiedCandidates(); }
@PostMapping("/admin/candidates/{id}/publish") public Map publish(@PathVariable String id,@RequestBody Map body) { return Map.of("file",referenceRepairs.publish(id,body.get("checksum"))); }
}

definitions.json

iron_man — Mon, 21 Sep 2026 20:08:34 +0000

{
  "linkName": "CSS_LINK",
  "remoteSegment": "CSS",
  "tnsRule": "SELECTED",
  "remoteAlias": null,
  "verification": "DUAL",
  "dependentObjects": ["PKG_SETTLEMENT"]
}

Application.java

iron_man — Mon, 21 Sep 2026 20:08:01 +0000

package com.hardening;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.context.properties.EnableConfigurationProperties;

@SpringBootApplication
@EnableConfigurationProperties(Settings.class)
public class Application {
    public static void main(String[] args) { SpringApplication.run(Application.class, args); }
}

hii ironman

iron_man — Mon, 21 Sep 2026 19:54:01 +0000

i am ironman

hii

iron_man — Mon, 21 Sep 2026 19:52:49 +0000

can i post this