71 lines
3.2 KiB
PL/PgSQL
71 lines
3.2 KiB
PL/PgSQL
|
-- =============================================================================
|
||
|
|
-- 脚本名称: 011_teacher_student_remove_permissions.sql
|
||
|
|
-- 业务模块: 教师与学员零引用安全删除权限节点注册 (ZERO-REFERENCE SAFE DELETE RBAC)
|
||
|
|
-- 适用数据库: KingbaseES, schema public
|
||
|
|
-- 范围: 仅限 sys_menu 按钮级权限增量注册，不改动已有角色分配 (sys_role_menu Δ = 0)
|
||
|
|
-- 幂等性设计: 支持重复执行，WHERE NOT EXISTS 防重，无破坏性语句
|
||
|
|
-- 安全红线:
|
||
|
|
-- 1. 严禁执行 007_dicts.sql
|
||
|
|
-- 2. 严禁清空/重建 sys_menu
|
||
|
|
-- 3. 严禁重置角色权限
|
||
|
|
-- 4. 严禁给 train_admin (role_id = 3) 自动赋权，保持 TRAIN_ADMIN_*_REMOVE = NO
|
||
|
|
-- =============================================================================
|
||
|
|
|
||
|
|
BEGIN;
|
||
|
|
|
||
|
|
-- 前置碰撞检查
|
||
|
|
DO $$
|
||
|
|
BEGIN
|
||
|
|
IF EXISTS (
|
||
|
|
SELECT 1 FROM public.sys_menu
|
||
|
|
WHERE menu_id = 2245 AND perms <> 'train:teacher:remove'
|
||
|
|
) THEN
|
||
|
|
RAISE EXCEPTION 'Menu ID 2245 collides with an existing menu item';
|
||
|
|
END IF;
|
||
|
|
|
||
|
|
IF EXISTS (
|
||
|
|
SELECT 1 FROM public.sys_menu
|
||
|
|
WHERE menu_id = 2246 AND perms <> 'train:student:remove'
|
||
|
|
) THEN
|
||
|
|
RAISE EXCEPTION 'Menu ID 2246 collides with an existing menu item';
|
||
|
|
END IF;
|
||
|
|
END $$;
|
||
|
|
|
||
|
|
-- 1. 教师删除按钮权限 (train:teacher:remove, parent: 2155 教师管理)
|
||
|
|
INSERT INTO public.sys_menu
|
||
|
|
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||
|
|
menu_type, visible, status, perms, icon, create_by, create_time, remark)
|
||
|
|
SELECT 2245, '教师删除', 2155, 7, '#', '', '', 1, 0,
|
||
|
|
'F', '0', '0', 'train:teacher:remove', '#', 'admin', CURRENT_TIMESTAMP, '教师档案安全删除'
|
||
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:teacher:remove');
|
||
|
|
|
||
|
|
-- 2. 学员删除按钮权限 (train:student:remove, parent: 2156 学员管理)
|
||
|
|
INSERT INTO public.sys_menu
|
||
|
|
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||
|
|
menu_type, visible, status, perms, icon, create_by, create_time, remark)
|
||
|
|
SELECT 2246, '学员删除', 2156, 6, '#', '', '', 1, 0,
|
||
|
|
'F', '0', '0', 'train:student:remove', '#', 'admin', CURRENT_TIMESTAMP, '学员档案安全删除'
|
||
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:student:remove');
|
||
|
|
|
||
|
|
-- 3. 后置自检验收 (断言权限存在且唯一，且未向 train_admin 越权授权)
|
||
|
|
DO $$
|
||
|
|
BEGIN
|
||
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE perms = 'train:teacher:remove' AND parent_id = 2155 AND menu_type = 'F') <> 1 THEN
|
||
|
|
RAISE EXCEPTION 'Teacher remove permission registration verification failed';
|
||
|
|
END IF;
|
||
|
|
|
||
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE perms = 'train:student:remove' AND parent_id = 2156 AND menu_type = 'F') <> 1 THEN
|
||
|
|
RAISE EXCEPTION 'Student remove permission registration verification failed';
|
||
|
|
END IF;
|
||
|
|
|
||
|
|
-- 严格断言 train_admin (role_id = 3) 未被分配这两个权限
|
||
|
|
IF EXISTS (
|
||
|
|
SELECT 1 FROM public.sys_role_menu rm
|
||
|
|
JOIN public.sys_menu m ON rm.menu_id = m.menu_id
|
||
|
|
WHERE rm.role_id = 3 AND m.perms IN ('train:teacher:remove', 'train:student:remove')
|
||
|
|
) THEN
|
||
|
|
RAISE EXCEPTION 'FATAL: train_admin must not be granted teacher/student remove permissions';
|
||
|
|
END IF;
|
||
|
|
END $$;
|
||
|
|
|
||
|
|
COMMIT;
|