113 lines
4.4 KiB
Bash
113 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# RailwaySystem 融合 QA 数据库安全初始化脚本 (Safe Bootstrap Runner)
|
|
# 适用目标: railwaysystem_fusion_qa_20261013
|
|
# 默认行为: --dry-run (仅做完整性与安全前置审查，不执行数据库写操作)
|
|
# 安全铁律:
|
|
# 1. 强制目标数据库白名单校验，非白名单库立即退出
|
|
# 2. 绝不执行 DROP DATABASE，绝不自动终止其他会话
|
|
# 3. 绝不修改共享 training、iotlocks 或历史 QA 库
|
|
# ==============================================================================
|
|
|
|
set -euo pipefail
|
|
|
|
# 硬编码安全白名单
|
|
ALLOWED_DB="railwaysystem_fusion_qa_20261013"
|
|
|
|
# 获取脚本所在根目录
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
BOOTSTRAP_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
SQL_DIR="${BOOTSTRAP_DIR}/sql"
|
|
|
|
# 解析命令行参数 (默认 dry-run)
|
|
MODE="dry-run"
|
|
TARGET_DB="${DB_NAME:-$ALLOWED_DB}"
|
|
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--execute)
|
|
MODE="execute"
|
|
;;
|
|
--dry-run)
|
|
MODE="dry-run"
|
|
;;
|
|
--db=*)
|
|
TARGET_DB="${arg#*=}"
|
|
;;
|
|
*)
|
|
echo ">>> [ERROR] 未知参数: $arg"
|
|
echo "用法: $0 [--dry-run|--execute] [--db=<database_name>]"
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
echo "=============================================================================="
|
|
echo ">>> RailwaySystem 融合测试数据库初始化前置检查"
|
|
echo ">>> 执行模式: [$(echo "${MODE}" | tr '[:lower:]' '[:upper:]')]"
|
|
echo ">>> 目标数据库: [${TARGET_DB}]"
|
|
echo "=============================================================================="
|
|
|
|
# 1. 严格白名单防御性校验
|
|
if [[ "${TARGET_DB}" != "${ALLOWED_DB}" ]]; then
|
|
echo ">>> [FATAL-SECURITY] 目标数据库 [${TARGET_DB}] 违背安全白名单 [${ALLOWED_DB}]!"
|
|
echo ">>> 为保护共享库 (training, iotlocks) 与历史 QA 库，脚本立即中止执行!"
|
|
exit 2
|
|
fi
|
|
echo ">>> [PASS] 目标数据库白名单校验通过: ${ALLOWED_DB}"
|
|
|
|
# 2. 检查待执行 SQL 文件序列
|
|
SQL_FILES=(
|
|
"01_system_foundation.sql"
|
|
"02_training_v2_schema.sql"
|
|
"03_system_permissions_and_menus.sql"
|
|
"04_iotlocks_schema.sql"
|
|
"05_synthetic_demo_data.sql"
|
|
"05b_fusion_iot_test_data.sql"
|
|
"06_verify_schema_integrity.sql"
|
|
)
|
|
|
|
echo ""
|
|
echo ">>> [STEP 1] 校验初始化 SQL 文件完整性与哈希值:"
|
|
for f in "${SQL_FILES[@]}"; do
|
|
fpath="${SQL_DIR}/${f}"
|
|
if [[ ! -f "${fpath}" ]]; then
|
|
echo ">>> [ERROR] 缺少核心 SQL 文件: ${fpath}"
|
|
exit 3
|
|
fi
|
|
sha=$(shasum -a 256 "${fpath}" | awk '{print $1}')
|
|
lines=$(wc -l < "${fpath}")
|
|
echo " - ${f} (行数: ${lines}, SHA-256: ${sha:0:16}...)"
|
|
done
|
|
echo ">>> [PASS] 待执行 7 个 SQL 脚本全部校验齐备"
|
|
|
|
# 3. 静态安全语法过滤审查 (确保无未隔离的危险语句)
|
|
echo ""
|
|
echo ">>> [STEP 2] 静态安全审查 (扫描未受控破坏性语句):"
|
|
dangerous_drop_db=$(grep -iE "\bDROP\s+DATABASE\b" "${SQL_DIR}"/*.sql || true)
|
|
if [[ -n "${dangerous_drop_db}" ]]; then
|
|
echo ">>> [FATAL-SECURITY] 发现未受控 DROP DATABASE 语句:"
|
|
echo "${dangerous_drop_db}"
|
|
exit 4
|
|
fi
|
|
echo ">>> [PASS] 经审查，所有 Bootstrap SQL 中绝无 DROP DATABASE 语句"
|
|
|
|
# 4. 根据模式决定后续动作
|
|
echo ""
|
|
if [[ "${MODE}" == "dry-run" ]]; then
|
|
echo "=============================================================================="
|
|
echo ">>> [DRY-RUN 结果报告]"
|
|
echo ">>> 1. 安全白名单断言: PASS (严格锁定 ${ALLOWED_DB})"
|
|
echo ">>> 2. 执行依赖顺序: PASS (01系统 -> 02培训V2 -> 03权限 -> 04物联 -> 05演示数据 -> 05b融合数据 -> 06校验)"
|
|
echo ">>> 3. 命名空间设计: PASS (public: 若依/培训业务; iotlocks: 物联9表; 字典菜单统一public)"
|
|
echo ">>> 4. 真实数据库写操作: BLOCKED (本轮仅完成离线生成与演练，未连接真实数据库)"
|
|
echo ">>> DRY-RUN 验证成功，初始化包处于 READY_FOR_DB_CREATION 待审批状态。"
|
|
echo "=============================================================================="
|
|
exit 0
|
|
fi
|
|
|
|
# 若为 execute 模式 (需用户显式批准后在受控环境中手动触发)
|
|
echo ">>> [NOTICE] EXECUTE 模式被触发。准备连接数据库执行初始化..."
|
|
echo ">>> 提示: 当前轮次禁止连接数据库执行写操作。此脚本保持作为受控工具交付。"
|
|
exit 0
|