98 lines
4.8 KiB
PL/PgSQL
98 lines
4.8 KiB
PL/PgSQL
-- ============================================================================
|
||
-- Migration: 015_dms_package_a_hardening.sql
|
||
-- Description: Package A.1 DMS 一致性加固与最小权限拆分
|
||
-- 1. 权限最小化拆分：新增 2194 (train:access:credential)，从 train_admin 移除 2192 (train:access:manage) 并保证保留 2263 (train:accommodation:edit)
|
||
-- 2. 外部操作状态加固：确保 train_external_operation 支持 DISPATCHING 与 AMBIGUOUS
|
||
-- 3. 幂等与断言校验
|
||
-- ============================================================================
|
||
|
||
\set ON_ERROR_STOP on
|
||
|
||
BEGIN;
|
||
|
||
-- 1. 注册 2194 (train:access:credential) 门禁凭据下发与注销专用权限
|
||
INSERT INTO public.sys_menu
|
||
(menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
|
||
menu_type, visible, status, perms, icon, create_by, create_time, update_by, update_time, remark)
|
||
SELECT 2194, '门禁凭据操作', 2060, 4, '#', '', '', 1, 0,
|
||
'F', '0', '0', 'train:access:credential', '#', 'admin', CURRENT_TIMESTAMP, '', NULL, '门禁凭据下发与注销权限'
|
||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE menu_id = 2194);
|
||
|
||
-- 2. 超级管理员角色 (role_id = 1) 授予 2194
|
||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||
SELECT 1, 2194
|
||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 1 AND menu_id = 2194);
|
||
|
||
-- 3. 培训管理员角色 (role_id = 3) 调整权限 (MIN-09)：
|
||
-- 授予 2194 (train:access:credential)
|
||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||
SELECT 3, 2194
|
||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2194);
|
||
|
||
-- 从 train_admin (role_id = 3) 回收 2192 (train:access:manage，硬件映射与维护权限)
|
||
DELETE FROM public.sys_role_menu
|
||
WHERE role_id = 3 AND menu_id = 2192;
|
||
|
||
-- 确保培训管理员 (role_id = 3) 拥有 2263 (train:accommodation:edit，办理入住/退宿/调房)
|
||
INSERT INTO public.sys_role_menu (role_id, menu_id)
|
||
SELECT 3, 2263
|
||
WHERE NOT EXISTS (SELECT 1 FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2263);
|
||
|
||
|
||
|
||
-- 5. 状态机约束兼容性加固 (train_external_operation)
|
||
-- 确保 operation_status 允许 DISPATCHING 与 AMBIGUOUS
|
||
ALTER TABLE train_external_operation DROP CONSTRAINT IF EXISTS chk_external_operation_status;
|
||
|
||
ALTER TABLE train_external_operation ADD CONSTRAINT chk_external_operation_status
|
||
CHECK (operation_status IN ('CREATED','DISPATCHING','REQUESTED','ACCEPTED','PENDING','RETRY_WAIT','AMBIGUOUS','SUCCESS','FAILED','TIMEOUT'));
|
||
|
||
-- 6. 后置断言验证
|
||
DO $$
|
||
BEGIN
|
||
-- 断言 1: 2194 已正确注册
|
||
IF (SELECT count(*) FROM public.sys_menu WHERE menu_id = 2194 AND perms = 'train:access:credential' AND status = '0') <> 1 THEN
|
||
RAISE EXCEPTION 'Assertion failed: menu 2194 train:access:credential not found or invalid';
|
||
END IF;
|
||
|
||
-- 断言 2: train_admin (role_id = 3) 拥有 2194 (train:access:credential)
|
||
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2194) <> 1 THEN
|
||
RAISE EXCEPTION 'Assertion failed: role 3 not granted menu 2194';
|
||
END IF;
|
||
|
||
-- 断言 3: train_admin (role_id = 3) 不得拥有 2192 (train:access:manage)
|
||
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2192) <> 0 THEN
|
||
RAISE EXCEPTION 'Assertion failed: role 3 still has menu 2192 (train:access:manage)';
|
||
END IF;
|
||
|
||
-- 断言 4: train_admin (role_id = 3) 必须拥有 2263 (train:accommodation:edit，办理入住/退宿/调房)
|
||
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2263) <> 1 THEN
|
||
RAISE EXCEPTION 'Assertion failed: role 3 missing menu 2263 (train:accommodation:edit)';
|
||
END IF;
|
||
|
||
-- 断言 4b: train_admin (role_id = 3) 严禁拥有破坏性删除权限 train:accommodation:remove
|
||
IF (SELECT count(*) FROM public.sys_role_menu rm
|
||
JOIN public.sys_menu m ON m.menu_id = rm.menu_id
|
||
WHERE rm.role_id = 3 AND m.perms = 'train:accommodation:remove') <> 0 THEN
|
||
RAISE EXCEPTION 'Security violation: role 3 has forbidden permission train:accommodation:remove';
|
||
END IF;
|
||
|
||
-- 断言 5: train_admin 拥有 2264 (train:accommodation:add)
|
||
IF (SELECT count(*) FROM public.sys_role_menu WHERE role_id = 3 AND menu_id = 2264) <> 1 THEN
|
||
RAISE EXCEPTION 'Assertion failed: role 3 missing menu 2264 (train:accommodation:add)';
|
||
END IF;
|
||
|
||
-- 断言 6: operation_status CHECK 约束已生效且包含 DISPATCHING 与 AMBIGUOUS
|
||
IF NOT EXISTS (
|
||
SELECT 1 FROM pg_constraint
|
||
WHERE conrelid = 'train_external_operation'::regclass
|
||
AND contype = 'c'
|
||
AND pg_get_constraintdef(oid) LIKE '%DISPATCHING%'
|
||
AND pg_get_constraintdef(oid) LIKE '%AMBIGUOUS%'
|
||
) THEN
|
||
RAISE EXCEPTION 'Assertion failed: operation_status constraint invalid or missing DISPATCHING/AMBIGUOUS';
|
||
END IF;
|
||
END $$;
|
||
|
||
COMMIT;
|