104 lines
5.3 KiB
PL/PgSQL
104 lines
5.3 KiB
PL/PgSQL
-- =============================================================================
|
|
-- Migration: 013 Interaction Route Cleanup & Accommodation Management Registration
|
|
-- Target: KingbaseES, schema public
|
|
-- Scope:
|
|
-- 1. Deactivate empty parent menu '教学成果' (2165)
|
|
-- 2. Deactivate missing component historical menu '手动任务' (2059)
|
|
-- 3. Register '住宿管理' menu (2261) and operation permissions (2262, 2263) under '教学设施' (2154)
|
|
-- 4. Grant minimal necessary operational permissions to train_admin role (role_id = 3)
|
|
-- 5. Post-migration verification assertion block
|
|
-- =============================================================================
|
|
|
|
BEGIN;
|
|
|
|
-- 1. Deactivate empty parent menu '教学成果' (2165) since all child menus are dropped/deactivated
|
|
UPDATE public.sys_menu
|
|
SET status = '1', visible = '1', update_by = 'admin', update_time = CURRENT_TIMESTAMP, remark = '子菜单全部停用暂时隐藏(V2架构)'
|
|
WHERE menu_id = 2165;
|
|
|
|
-- 2. Deactivate missing component historical menu '手动任务' (2059)
|
|
UPDATE public.sys_menu
|
|
SET status = '1', visible = '1', update_by = 'admin', update_time = CURRENT_TIMESTAMP, remark = '缺失组件历史配置停用'
|
|
WHERE menu_id = 2059;
|
|
|
|
-- 3. Insert '住宿管理' menu under '教学设施' (parent_id = 2154)
|
|
INSERT INTO public.sys_menu
|
|
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
|
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
|
SELECT 2261, '住宿管理', 2154, 8, 'accommodation', 'train/accommodation/index', '', 1, 0,
|
|
'C', '0', '0', 'train:accommodation:list', 'home', 'admin', CURRENT_TIMESTAMP, '', NULL, '学员住宿安排与办理'
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2261);
|
|
|
|
-- 4. Insert accommodation query button permission
|
|
INSERT INTO public.sys_menu
|
|
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
|
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
|
SELECT 2262, '住宿查询', 2261, 1, '#', '', '', 1, 0,
|
|
'F', '0', '0', 'train:accommodation:query', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '住宿详情与历史查询'
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2262);
|
|
|
|
-- 5. Insert accommodation checkin/checkout/transfer button permission (edit)
|
|
INSERT INTO public.sys_menu
|
|
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
|
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
|
SELECT 2263, '住宿办理', 2261, 2, '#', '', '', 1, 0,
|
|
'F', '0', '0', 'train:accommodation:edit', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '办理入住/退宿/调房业务'
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2263);
|
|
|
|
-- 6. Grant minimal operational permissions to train_admin role (role_id = 3)
|
|
-- STRICT RULE: Only grant list, query, edit. DO NOT grant remove or door hardware mutation!
|
|
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
|
SELECT 3, 2261
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2261);
|
|
|
|
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
|
SELECT 3, 2262
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2262);
|
|
|
|
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
|
SELECT 3, 2263
|
|
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2263);
|
|
|
|
-- 7. Verification Assertions
|
|
DO $$
|
|
BEGIN
|
|
-- Verify 2165 deactivated
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2165 AND status = '1' AND visible = '1') <> 1 THEN
|
|
RAISE EXCEPTION 'Menu 2165 deactivation verification failed';
|
|
END IF;
|
|
|
|
-- Verify 2059 deactivated
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2059 AND status = '1' AND visible = '1') <> 1 THEN
|
|
RAISE EXCEPTION 'Menu 2059 deactivation verification failed';
|
|
END IF;
|
|
|
|
-- Verify 2261 exists
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2261 AND perms = 'train:accommodation:list' AND status = '0') <> 1 THEN
|
|
RAISE EXCEPTION 'Menu 2261 verification failed';
|
|
END IF;
|
|
|
|
-- Verify 2262 exists
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2262 AND perms = 'train:accommodation:query' AND status = '0') <> 1 THEN
|
|
RAISE EXCEPTION 'Menu 2262 verification failed';
|
|
END IF;
|
|
|
|
-- Verify 2263 exists
|
|
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2263 AND perms = 'train:accommodation:edit' AND status = '0') <> 1 THEN
|
|
RAISE EXCEPTION 'Menu 2263 verification failed';
|
|
END IF;
|
|
|
|
-- Verify role_id = 3 has 2261, 2262, 2263
|
|
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id IN (2261, 2262, 2263)) <> 3 THEN
|
|
RAISE EXCEPTION 'Role assignment for accommodation verification failed';
|
|
END IF;
|
|
|
|
-- Security Guard: Verify train_admin (role_id=3) DOES NOT have any remove permission
|
|
IF (SELECT count(*) FROM public.sys_role_menu rm
|
|
JOIN public.sys_menu m ON m.menu_id = rm.menu_id
|
|
WHERE rm.role_id = 3 AND m.perms IN ('train:course:remove', 'train:teacher:remove', 'train:student:remove', 'train:accommodation:remove')) > 0 THEN
|
|
RAISE EXCEPTION 'Security violation: train_admin role must not have remove permissions';
|
|
END IF;
|
|
END $$;
|
|
|
|
COMMIT;
|