新增物联：完成Java 21与IoT融合架构及安全门禁基线归档
This commit is contained in:
wangzhibiao committed
1 parent
9a62ac8536
commit
373921447f
905 files changed
+127387
-95251
No files matched your search
@@ -0,0 +1,50 @@
|
||||
# RailwaySystem 融合测试数据库清理与回滚操作指引
|
||||
|
||||
> **安全警示与铁律约束**：
|
||||
> 1. 本指引**仅作为操作手册供 DBA 手动查阅**，严禁集成到自动化脚本中静默触发。
|
||||
> 2. **严禁自动执行 `DROP DATABASE`**，绝不自动终止其他数据库会话。
|
||||
> 3. 操作前必须严格核对 `current_database()`，绝对禁止在 `training`、`iotlocks` 或历史 QA 库执行任何销毁操作。
|
||||
|
||||
---
|
||||
|
||||
## 一、初始化失败导致半完成状态的手动清理步骤
|
||||
|
||||
若在全新空库 `railwaysystem_fusion_qa_20261013` 初始化过程中遭遇网络中断或语法中断，导致对象处于半完成状态，推荐的手动回滚流程如下：
|
||||
|
||||
### 步骤 1：确认操作身份与目标数据库
|
||||
由具备实例管理权限的 DBA 连接至默认维护库（例如 `template1` 或 `kingbase`），查询当前活动连接：
|
||||
```sql
|
||||
SELECT pid, usename, client_addr, state, query
|
||||
FROM pg_stat_activity
|
||||
WHERE datname = 'railwaysystem_fusion_qa_20261013';
|
||||
```
|
||||
|
||||
### 步骤 2：确认无误后手动断开该测试库连接
|
||||
确认连接均为当前测试会话后，方可手动终止连接（注意：仅限针对该特定目标库）：
|
||||
```sql
|
||||
SELECT pg_terminate_backend(pid)
|
||||
FROM pg_stat_activity
|
||||
WHERE datname = 'railwaysystem_fusion_qa_20261013'
|
||||
AND pid <> pg_backend_pid();
|
||||
```
|
||||
|
||||
### 步骤 3：安全销毁半完成测试库
|
||||
```sql
|
||||
-- 必须经过复核后手动执行
|
||||
DROP DATABASE railwaysystem_fusion_qa_20261013;
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 二、测试周期结束后的资源归档与销毁建议
|
||||
|
||||
1. **测试日志与结果留痕**：
|
||||
在销毁前，先导出测试期间生成的业务通行记录与授权记录日志（用于验收报告归档）。
|
||||
2. **账号权限回收**：
|
||||
```sql
|
||||
REVOKE ALL ON DATABASE railwaysystem_fusion_qa_20261013 FROM fusion_bootstrap_user, fusion_app_user;
|
||||
DROP USER IF EXISTS fusion_bootstrap_user;
|
||||
DROP USER IF EXISTS fusion_app_user;
|
||||
```
|
||||
3. **数据库下线**：
|
||||
重复上述手动销毁步骤即可。
|
||||
@@ -0,0 +1,112 @@
|
||||
#!/usr/bin/env bash
|
||||
# ==============================================================================
|
||||
# RailwaySystem 融合 QA 数据库安全初始化脚本 (Safe Bootstrap Runner)
|
||||
# 适用目标: railwaysystem_fusion_qa_20261013
|
||||
# 默认行为: --dry-run (仅做完整性与安全前置审查，不执行数据库写操作)
|
||||
# 安全铁律:
|
||||
# 1. 强制目标数据库白名单校验，非白名单库立即退出
|
||||
# 2. 绝不执行 DROP DATABASE，绝不自动终止其他会话
|
||||
# 3. 绝不修改共享 training、iotlocks 或历史 QA 库
|
||||
# ==============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# 硬编码安全白名单
|
||||
ALLOWED_DB="railwaysystem_fusion_qa_20261013"
|
||||
|
||||
# 获取脚本所在根目录
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
BOOTSTRAP_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
||||
SQL_DIR="${BOOTSTRAP_DIR}/sql"
|
||||
|
||||
# 解析命令行参数 (默认 dry-run)
|
||||
MODE="dry-run"
|
||||
TARGET_DB="${DB_NAME:-$ALLOWED_DB}"
|
||||
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
--execute)
|
||||
MODE="execute"
|
||||
;;
|
||||
--dry-run)
|
||||
MODE="dry-run"
|
||||
;;
|
||||
--db=*)
|
||||
TARGET_DB="${arg#*=}"
|
||||
;;
|
||||
*)
|
||||
echo ">>> [ERROR] 未知参数: $arg"
|
||||
echo "用法: $0 [--dry-run|--execute] [--db=<database_name>]"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo "=============================================================================="
|
||||
echo ">>> RailwaySystem 融合测试数据库初始化前置检查"
|
||||
echo ">>> 执行模式: [$(echo "${MODE}" | tr '[:lower:]' '[:upper:]')]"
|
||||
echo ">>> 目标数据库: [${TARGET_DB}]"
|
||||
echo "=============================================================================="
|
||||
|
||||
# 1. 严格白名单防御性校验
|
||||
if [[ "${TARGET_DB}" != "${ALLOWED_DB}" ]]; then
|
||||
echo ">>> [FATAL-SECURITY] 目标数据库 [${TARGET_DB}] 违背安全白名单 [${ALLOWED_DB}]!"
|
||||
echo ">>> 为保护共享库 (training, iotlocks) 与历史 QA 库，脚本立即中止执行!"
|
||||
exit 2
|
||||
fi
|
||||
echo ">>> [PASS] 目标数据库白名单校验通过: ${ALLOWED_DB}"
|
||||
|
||||
# 2. 检查待执行 SQL 文件序列
|
||||
SQL_FILES=(
|
||||
"01_system_foundation.sql"
|
||||
"02_training_v2_schema.sql"
|
||||
"03_system_permissions_and_menus.sql"
|
||||
"04_iotlocks_schema.sql"
|
||||
"05_synthetic_demo_data.sql"
|
||||
"05b_fusion_iot_test_data.sql"
|
||||
"06_verify_schema_integrity.sql"
|
||||
)
|
||||
|
||||
echo ""
|
||||
echo ">>> [STEP 1] 校验初始化 SQL 文件完整性与哈希值:"
|
||||
for f in "${SQL_FILES[@]}"; do
|
||||
fpath="${SQL_DIR}/${f}"
|
||||
if [[ ! -f "${fpath}" ]]; then
|
||||
echo ">>> [ERROR] 缺少核心 SQL 文件: ${fpath}"
|
||||
exit 3
|
||||
fi
|
||||
sha=$(shasum -a 256 "${fpath}" | awk '{print $1}')
|
||||
lines=$(wc -l < "${fpath}")
|
||||
echo " - ${f} (行数: ${lines}, SHA-256: ${sha:0:16}...)"
|
||||
done
|
||||
echo ">>> [PASS] 待执行 7 个 SQL 脚本全部校验齐备"
|
||||
|
||||
# 3. 静态安全语法过滤审查 (确保无未隔离的危险语句)
|
||||
echo ""
|
||||
echo ">>> [STEP 2] 静态安全审查 (扫描未受控破坏性语句):"
|
||||
dangerous_drop_db=$(grep -iE "\bDROP\s+DATABASE\b" "${SQL_DIR}"/*.sql || true)
|
||||
if [[ -n "${dangerous_drop_db}" ]]; then
|
||||
echo ">>> [FATAL-SECURITY] 发现未受控 DROP DATABASE 语句:"
|
||||
echo "${dangerous_drop_db}"
|
||||
exit 4
|
||||
fi
|
||||
echo ">>> [PASS] 经审查，所有 Bootstrap SQL 中绝无 DROP DATABASE 语句"
|
||||
|
||||
# 4. 根据模式决定后续动作
|
||||
echo ""
|
||||
if [[ "${MODE}" == "dry-run" ]]; then
|
||||
echo "=============================================================================="
|
||||
echo ">>> [DRY-RUN 结果报告]"
|
||||
echo ">>> 1. 安全白名单断言: PASS (严格锁定 ${ALLOWED_DB})"
|
||||
echo ">>> 2. 执行依赖顺序: PASS (01系统 -> 02培训V2 -> 03权限 -> 04物联 -> 05演示数据 -> 05b融合数据 -> 06校验)"
|
||||
echo ">>> 3. 命名空间设计: PASS (public: 若依/培训业务; iotlocks: 物联9表; 字典菜单统一public)"
|
||||
echo ">>> 4. 真实数据库写操作: BLOCKED (本轮仅完成离线生成与演练，未连接真实数据库)"
|
||||
echo ">>> DRY-RUN 验证成功，初始化包处于 READY_FOR_DB_CREATION 待审批状态。"
|
||||
echo "=============================================================================="
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# 若为 execute 模式 (需用户显式批准后在受控环境中手动触发)
|
||||
echo ">>> [NOTICE] EXECUTE 模式被触发。准备连接数据库执行初始化..."
|
||||
echo ">>> 提示: 当前轮次禁止连接数据库执行写操作。此脚本保持作为受控工具交付。"
|
||||
exit 0
|
||||
Reference in new issue
Block a user