feat: 将安全策略模板化，新建商户时自动复制初始策略
This commit is contained in:
Austin
@@ -0,0 +1,115 @@
|
||||
-- IM 安全策略模板表迁移（幂等，可重复执行）
|
||||
-- 背景：全局默认策略从 im_security_policy.tenant_id=0 记录改为独立模板表 im_security_policy_template（单行）。
|
||||
-- 每次新增商户时从模板复制一份为商户初始策略，商户后续修改只改副本。
|
||||
|
||||
-- 1. 建模板表（永远单行 id=1，平台级，宵禁规则以 JSON 数组存储）
|
||||
CREATE TABLE IF NOT EXISTS `im_security_policy_template` (
|
||||
`id` bigint unsigned NOT NULL AUTO_INCREMENT,
|
||||
`policy_name` varchar(100) NOT NULL DEFAULT '默认安全策略模板',
|
||||
`password_policy` text,
|
||||
`login_rate_limit` text,
|
||||
`sensitive_word_policy` text,
|
||||
`file_review_policy` text,
|
||||
`realname_policy` text,
|
||||
`risk_challenge_policy` text,
|
||||
`global_friend_enabled` tinyint NOT NULL DEFAULT 1,
|
||||
`friend_disabled_policy` text,
|
||||
`message_curfew_enabled` tinyint NOT NULL DEFAULT 0,
|
||||
`curfew_rules` text COMMENT '宵禁规则JSON数组',
|
||||
`remark` varchar(255) DEFAULT '',
|
||||
`created_at` datetime DEFAULT NULL,
|
||||
`created_by` bigint DEFAULT 0,
|
||||
`updated_at` datetime DEFAULT NULL,
|
||||
`updated_by` bigint DEFAULT 0,
|
||||
PRIMARY KEY (`id`)
|
||||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='IM安全策略模板（新建商户初始策略来源）';
|
||||
|
||||
-- 2. 从 tenant_id=0 published 记录迁入模板字段（仅当模板表为空）
|
||||
INSERT INTO `im_security_policy_template`
|
||||
(`policy_name`, `password_policy`, `login_rate_limit`, `sensitive_word_policy`, `file_review_policy`, `realname_policy`, `risk_challenge_policy`, `global_friend_enabled`, `friend_disabled_policy`, `message_curfew_enabled`, `curfew_rules`, `remark`, `created_at`, `created_by`)
|
||||
SELECT
|
||||
IFNULL(sp.policy_name, '默认安全策略模板'),
|
||||
IFNULL(CAST(sp.password_policy AS CHAR), '{}'),
|
||||
IFNULL(CAST(sp.login_rate_limit AS CHAR), '{"enabled":false}'),
|
||||
IFNULL(CAST(sp.sensitive_word_policy AS CHAR), '{}'),
|
||||
IFNULL(CAST(sp.file_review_policy AS CHAR), '{}'),
|
||||
IFNULL(CAST(sp.realname_policy AS CHAR), '{}'),
|
||||
IFNULL(CAST(sp.risk_challenge_policy AS CHAR), '{}'),
|
||||
IFNULL(sp.global_friend_enabled, 1),
|
||||
IFNULL(CAST(sp.friend_disabled_policy AS CHAR), '{}'),
|
||||
IFNULL(sp.message_curfew_enabled, 0),
|
||||
'[]',
|
||||
'由全局默认策略迁移',
|
||||
NOW(), 0
|
||||
FROM (SELECT 1) dummy
|
||||
LEFT JOIN `im_security_policy` sp ON sp.tenant_id = 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
|
||||
WHERE (SELECT COUNT(*) FROM `im_security_policy_template`) = 0
|
||||
ORDER BY sp.policy_version DESC
|
||||
LIMIT 1;
|
||||
|
||||
-- 3. 模板宵禁规则：从 tenant_id=0 记录的宵禁规则聚合为 JSON（仅当模板 curfew_rules 为空数组）
|
||||
UPDATE `im_security_policy_template` t
|
||||
SET t.curfew_rules = (
|
||||
SELECT COALESCE(JSON_ARRAYAGG(JSON_OBJECT(
|
||||
'ruleCode', r.rule_code, 'ruleName', r.rule_name, 'dateType', r.date_type,
|
||||
'customDates', CAST(r.custom_dates AS JSON), 'weekdays', CAST(r.weekdays AS JSON),
|
||||
'timezone', r.timezone,
|
||||
'startTime', TIME_FORMAT(r.start_time, '%H:%i'), 'endTime', TIME_FORMAT(r.end_time, '%H:%i'),
|
||||
'scope', r.scope,
|
||||
'whitelistUserIds', CAST(r.whitelist_user_ids AS JSON), 'whitelistGroupIds', CAST(r.whitelist_group_ids AS JSON),
|
||||
'message', r.message, 'status', r.status, 'sort', r.sort
|
||||
)), JSON_ARRAY())
|
||||
FROM `im_message_curfew_rules` r
|
||||
WHERE r.tenant_id = 0 AND r.deleted_at IS NULL
|
||||
AND r.policy_id = (SELECT sp.id FROM `im_security_policy` sp WHERE sp.tenant_id = 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL ORDER BY sp.policy_version DESC LIMIT 1)
|
||||
)
|
||||
WHERE (t.curfew_rules IS NULL OR JSON_LENGTH(t.curfew_rules) = 0);
|
||||
|
||||
-- 4. 存量商户补齐：tenant_id>0 且无 published 记录的商户，从模板复制策略行（version=1, published）
|
||||
INSERT INTO `im_security_policy`
|
||||
(`tenant_id`, `policy_version`, `policy_name`, `publish_status`, `password_policy`, `login_rate_limit`, `sensitive_word_policy`, `file_review_policy`, `realname_policy`, `risk_challenge_policy`, `global_friend_enabled`, `friend_disabled_policy`, `message_curfew_enabled`, `remark`, `published_at`, `published_by`, `created_at`, `created_by`, `updated_at`, `updated_by`)
|
||||
SELECT
|
||||
tt.id, 1, t.policy_name, 'published',
|
||||
t.password_policy, t.login_rate_limit, t.sensitive_word_policy, t.file_review_policy, t.realname_policy, t.risk_challenge_policy,
|
||||
t.global_friend_enabled, t.friend_disabled_policy, t.message_curfew_enabled,
|
||||
'由默认模板补齐', NOW(), 0, NOW(), 0, NOW(), 0
|
||||
FROM `im_tenant` tt
|
||||
JOIN `im_security_policy_template` t ON t.id = (SELECT MIN(x.id) FROM `im_security_policy_template` x)
|
||||
WHERE tt.id > 0 AND tt.state = 1
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM `im_security_policy` sp
|
||||
WHERE sp.tenant_id = tt.id AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
|
||||
);
|
||||
|
||||
-- 5. 存量商户补齐宵禁规则：从模板 JSON 展开（仅对当前无任何宵禁规则的商户策略，已有配置的商户不覆盖）
|
||||
INSERT INTO `im_message_curfew_rules`
|
||||
(`tenant_id`, `policy_id`, `rule_code`, `rule_name`, `date_type`, `custom_dates`, `weekdays`, `timezone`, `start_time`, `end_time`, `scope`, `whitelist_user_ids`, `whitelist_group_ids`, `message`, `status`, `sort`, `created_at`, `created_by`, `updated_at`, `updated_by`)
|
||||
SELECT
|
||||
sp.tenant_id, sp.id,
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.ruleCode')),
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.ruleName')),
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.dateType')),
|
||||
JSON_EXTRACT(jt.r, '$.customDates'),
|
||||
JSON_EXTRACT(jt.r, '$.weekdays'),
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.timezone')),
|
||||
STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.startTime')), '%H:%i'),
|
||||
STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.endTime')), '%H:%i'),
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.scope')),
|
||||
JSON_EXTRACT(jt.r, '$.whitelistUserIds'),
|
||||
JSON_EXTRACT(jt.r, '$.whitelistGroupIds'),
|
||||
JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.message')),
|
||||
CAST(JSON_EXTRACT(jt.r, '$.status') AS SIGNED),
|
||||
CAST(JSON_EXTRACT(jt.r, '$.sort') AS SIGNED),
|
||||
NOW(), 0, NOW(), 0
|
||||
FROM `im_security_policy` sp
|
||||
JOIN `im_security_policy_template` tpl
|
||||
JOIN JSON_TABLE(tpl.curfew_rules, '$[*]' COLUMNS (r JSON PATH '$')) jt
|
||||
WHERE tpl.id = (SELECT MIN(x.id) FROM `im_security_policy_template` x)
|
||||
AND sp.tenant_id > 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
|
||||
AND NOT EXISTS (SELECT 1 FROM `im_message_curfew_rules` r WHERE r.policy_id = sp.id AND r.deleted_at IS NULL);
|
||||
|
||||
-- 6. 软删 tenant_id=0 的策略记录与其宵禁规则（模板化后不再使用，保留软删可回溯）
|
||||
UPDATE `im_security_policy` SET deleted_at = NOW(), deleted_by = 0
|
||||
WHERE tenant_id = 0 AND deleted_at IS NULL;
|
||||
UPDATE `im_message_curfew_rules` SET deleted_at = NOW(), deleted_by = 0
|
||||
WHERE tenant_id = 0 AND deleted_at IS NULL;
|
||||
Reference in New Issue
Block a user