权限门禁：补齐住宿与门禁最小权限迁移
This commit is contained in:
wangzhibiao committed
1 parent
f8ca87cfab
commit
84e1972947
2 files changed
+185
No files matched your search
+121
@@ -0,0 +1,121 @@
|
||||
-- =============================================================================
|
||||
-- Migration: 014 DMS Access Safety & Accommodation Permissions
|
||||
-- Target: KingbaseES, schema public
|
||||
-- Scope:
|
||||
-- 1. Register '门禁管理' menu (2060) under '教学设施' (2154)
|
||||
-- 2. Register '分配住宿' button permission (2264) under '住宿管理' (2261)
|
||||
-- 3. Ensure minimal operational access permissions (2191, 2192, 2193) exist
|
||||
-- 4. Grant minimal necessary permissions to train_admin role (role_id = 3):
|
||||
-- - 2060 (门禁管理页面)
|
||||
-- - 2191 (train:access:query)
|
||||
-- - 2192 (train:access:manage)
|
||||
-- - 2193 (train:access:reconcile)
|
||||
-- - 2264 (train:accommodation:add)
|
||||
-- 5. Safety Guard: Explicitly verify train_admin DOES NOT have accommodation:remove or remote unlock
|
||||
-- 6. Post-migration verification assertion block
|
||||
-- =============================================================================
|
||||
|
||||
BEGIN;
|
||||
|
||||
-- 1. Register '门禁管理' menu under '教学设施' (parent_id = 2154)
|
||||
INSERT INTO public.sys_menu
|
||||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||||
SELECT 2060, '门禁管理', 2154, 9, 'auth', 'train/auth/index', '', 1, 0,
|
||||
'C', '0', '0', 'train:access:query', 'lock', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁授权与设备状态管理'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2060);
|
||||
|
||||
-- Update menu 2060 in case it existed with different params
|
||||
UPDATE public.sys_menu
|
||||
SET parent_id = 2154, path = 'auth', component = 'train/auth/index', perms = 'train:access:query',
|
||||
status = '0', visible = '0', update_by = 'admin', update_time = CURRENT_TIMESTAMP
|
||||
WHERE menu_id = 2060;
|
||||
|
||||
-- 2. Ensure access permissions (2191, 2192, 2193) exist under parent 2060
|
||||
INSERT INTO public.sys_menu
|
||||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||||
SELECT 2191, '门禁与资源映射查看', 2060, 1, '#', '', '', 1, 0,
|
||||
'F', '0', '0', 'train:access:query', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁授权与外部资源映射查看权限'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2191);
|
||||
|
||||
INSERT INTO public.sys_menu
|
||||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||||
SELECT 2192, '门禁资源映射维护', 2060, 2, '#', '', '', 1, 0,
|
||||
'F', '0', '0', 'train:access:manage', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁凭据下发、注销与映射维护权限'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2192);
|
||||
|
||||
INSERT INTO public.sys_menu
|
||||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||||
SELECT 2193, '门禁手动对账触发', 2060, 3, '#', '', '', 1, 0,
|
||||
'F', '0', '0', 'train:access:reconcile', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁权限手动对账触发执行权限'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2193);
|
||||
|
||||
-- 3. Register '分配住宿' permission under '住宿管理' (parent_id = 2261)
|
||||
INSERT INTO public.sys_menu
|
||||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||||
SELECT 2264, '分配住宿', 2261, 3, '#', '', '', 1, 0,
|
||||
'F', '0', '0', 'train:accommodation:add', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '分配学员住宿安排权限'
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2264);
|
||||
|
||||
-- 4. Grant minimal operational permissions to train_admin role (role_id = 3)
|
||||
-- 门禁管理页面
|
||||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||||
SELECT 3, 2060
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2060);
|
||||
|
||||
-- 门禁与资源映射查看
|
||||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||||
SELECT 3, 2191
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2191);
|
||||
|
||||
-- 门禁资源维护与下发/注销
|
||||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||||
SELECT 3, 2192
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2192);
|
||||
|
||||
-- 门禁手动对账
|
||||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||||
SELECT 3, 2193
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2193);
|
||||
|
||||
-- 分配住宿
|
||||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||||
SELECT 3, 2264
|
||||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2264);
|
||||
|
||||
-- 5. Post-migration Verification Assertions
|
||||
DO $$
|
||||
BEGIN
|
||||
-- Verify 2060 exists and active
|
||||
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2060 AND perms = 'train:access:query' AND status = '0') <> 1 THEN
|
||||
RAISE EXCEPTION 'Menu 2060 verification failed';
|
||||
END IF;
|
||||
|
||||
-- Verify 2191, 2192, 2193 exist
|
||||
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id IN (2191, 2192, 2193)) <> 3 THEN
|
||||
RAISE EXCEPTION 'Access button permissions (2191, 2192, 2193) verification failed';
|
||||
END IF;
|
||||
|
||||
-- Verify 2264 exists and active
|
||||
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2264 AND perms = 'train:accommodation:add' AND status = '0') <> 1 THEN
|
||||
RAISE EXCEPTION 'Menu 2264 verification failed';
|
||||
END IF;
|
||||
|
||||
-- Verify role_id = 3 has 2060, 2191, 2192, 2193, 2264
|
||||
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id IN (2060, 2191, 2192, 2193, 2264)) <> 5 THEN
|
||||
RAISE EXCEPTION 'Role assignment for train_admin verification failed';
|
||||
END IF;
|
||||
|
||||
-- Security Guard: Verify train_admin (role_id=3) DOES NOT have any forbidden remove or mutation permissions
|
||||
IF (SELECT count(*) FROM public.sys_role_menu rm
|
||||
JOIN public.sys_menu m ON m.menu_id = rm.menu_id
|
||||
WHERE rm.role_id = 3 AND m.perms IN ('train:course:remove', 'train:teacher:remove', 'train:student:remove', 'train:accommodation:remove')) > 0 THEN
|
||||
RAISE EXCEPTION 'Security violation: train_admin role must not have remove permissions';
|
||||
END IF;
|
||||
END $$;
|
||||
|
||||
COMMIT;
|
||||
Reference in new issue
Block a user