feat: 增加商户消息加密密钥管理

2026-09-20 23:43:33 +08:00
parent 42cfe232fe
commit e8dd1eaa7d
23 changed files with 1417 additions and 122 deletions
@@ -0,0 +1,137 @@
+-- 消息加密密钥管理。
+-- 可重复执行。根 KEK 只在首次执行时生成，重复执行不会覆盖已有值。
+
+SET NAMES utf8mb4;
+SET @now := NOW();
+
+SET @im_sql = IF(
+  (SELECT COUNT(*) FROM information_schema.COLUMNS
+   WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'im_tenant_config'
+     AND COLUMN_NAME = 'message_encryption_enabled') = 0,
+  'ALTER TABLE `im_tenant_config` ADD COLUMN `message_encryption_enabled` TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否启用消息加密'' AFTER `local_moderation_enabled`',
+  'SELECT 1'
+);
+PREPARE im_stmt FROM @im_sql;
+EXECUTE im_stmt;
+DEALLOCATE PREPARE im_stmt;
+
+CREATE TABLE IF NOT EXISTS `im_message_encryption_keys` (
+  `id` bigint NOT NULL AUTO_INCREMENT,
+  `tenant_id` bigint NOT NULL COMMENT '商户ID',
+  `key_version` int unsigned NOT NULL COMMENT '密钥版本',
+  `algorithm` varchar(32) NOT NULL DEFAULT 'AES-256-GCM' COMMENT '数据加密算法',
+  `encrypted_dek` blob NOT NULL COMMENT '由根KEK包裹后的商户DEK',
+  `dek_nonce` varbinary(12) NOT NULL COMMENT '包裹DEK使用的随机nonce',
+  `status` varchar(16) NOT NULL DEFAULT 'pending' COMMENT 'pending/active/retired/disabled',
+  `activated_at` datetime DEFAULT NULL,
+  `retired_at` datetime DEFAULT NULL,
+  `remark` varchar(255) NOT NULL DEFAULT '',
+  `created_at` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `created_by` bigint NOT NULL DEFAULT 0,
+  `updated_at` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `updated_by` bigint NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_im_message_key_tenant_version` (`tenant_id`, `key_version`),
+  KEY `idx_im_message_key_tenant_status` (`tenant_id`, `status`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='商户消息加密密钥版本';
+
+INSERT INTO `hg_sys_dict_type`
+  (`pid`, `name`, `type`, `sort`, `remark`, `status`, `created_at`, `updated_at`)
+SELECT 0, 'IM内部安全材料', 'im_internal_secret', 9999,
+       '仅供服务端读取，通用字典接口禁止查询和维护', 1, @now, @now
+WHERE NOT EXISTS (
+  SELECT 1 FROM `hg_sys_dict_type` WHERE `type` = 'im_internal_secret'
+);
+
+INSERT INTO `hg_sys_dict_data`
+  (`label`, `value`, `value_type`, `type`, `list_class`, `is_default`, `sort`, `remark`, `status`, `created_at`, `updated_at`)
+SELECT 'core_material_01', TO_BASE64(RANDOM_BYTES(32)), 'string', 'im_internal_secret',
+       '', 2, 1, '消息DEK包裹根密钥KEK，请勿通过后台展示或修改', 1, @now, @now
+WHERE NOT EXISTS (
+  SELECT 1 FROM `hg_sys_dict_data`
+  WHERE `type` = 'im_internal_secret' AND `label` = 'core_material_01'
+);
+
+SET @imRootId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imManager' LIMIT 1);
+SET @settingsId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imSystemSettings' LIMIT 1);
+
+INSERT INTO `hg_admin_menu`
+  (`pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`,
+   `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`,
+   `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`,
+   `status`, `created_at`, `updated_at`)
+SELECT @settingsId, '消息密钥管理', 'imMessageEncryptionIndex', 'message-encryption/index',
+       'KeyOutlined', 2, '', '/imMessageEncryption/list', '', '/imMessageEncryption/index',
+       1, 'imManager', 0, 0, '', 0, 0, 0, 3,
+       CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), 80,
+       '商户消息加密开关及密钥版本管理', 1, @now, @now
+WHERE @settingsId IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imMessageEncryptionIndex');
+
+SET @keyMenuId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imMessageEncryptionIndex' LIMIT 1);
+
+UPDATE `hg_admin_menu`
+SET `pid` = @settingsId,
+    `title` = '消息密钥管理',
+    `path` = 'message-encryption/index',
+    `icon` = 'KeyOutlined',
+    `permissions` = '/imMessageEncryption/list',
+    `component` = '/imMessageEncryption/index',
+    `active_menu` = 'imManager',
+    `level` = 3,
+    `tree` = CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '),
+    `sort` = 80,
+    `hidden` = 0,
+    `status` = 1,
+    `updated_at` = @now
+WHERE `id` = @keyMenuId;
+
+INSERT INTO `hg_admin_menu`
+  (`pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`,
+   `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`,
+   `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`,
+   `status`, `created_at`, `updated_at`)
+SELECT @keyMenuId, '初始化密钥', 'imMessageEncryptionInitialize', '', '', 3, '',
+       '/imMessageEncryption/initialize', '', '', 1, '', 0, 0, '', 0, 1, 0, 4,
+       CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' tr_', @keyMenuId, ' '), 10, '', 1, @now, @now
+WHERE @keyMenuId IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imMessageEncryptionInitialize');
+
+INSERT INTO `hg_admin_menu`
+  (`pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`,
+   `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`,
+   `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`,
+   `status`, `created_at`, `updated_at`)
+SELECT @keyMenuId, '轮换密钥', 'imMessageEncryptionRotate', '', '', 3, '',
+       '/imMessageEncryption/rotate', '', '', 1, '', 0, 0, '', 0, 1, 0, 4,
+       CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' tr_', @keyMenuId, ' '), 20, '', 1, @now, @now
+WHERE @keyMenuId IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imMessageEncryptionRotate');
+
+INSERT INTO `hg_admin_menu`
+  (`pid`, `title`, `name`, `path`, `icon`, `type`, `redirect`, `permissions`,
+   `permission_name`, `component`, `always_show`, `active_menu`, `is_root`, `is_frame`,
+   `frame_src`, `keep_alive`, `hidden`, `affix`, `level`, `tree`, `sort`, `remark`,
+   `status`, `created_at`, `updated_at`)
+SELECT @keyMenuId, '切换消息加密', 'imMessageEncryptionSwitch', '', '', 3, '',
+       '/imMessageEncryption/switch', '', '', 1, '', 0, 0, '', 0, 1, 0, 4,
+       CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' tr_', @keyMenuId, ' '), 30, '', 1, @now, @now
+WHERE @keyMenuId IS NOT NULL
+  AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imMessageEncryptionSwitch');
+
+UPDATE `hg_admin_menu`
+SET `level` = 4,
+    `tree` = CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' tr_', @keyMenuId, ' '),
+    `updated_at` = @now
+WHERE `pid` = @keyMenuId AND `type` = 3;
+
+INSERT IGNORE INTO `hg_admin_role_menu` (`role_id`, `menu_id`)
+SELECT 1, `id` FROM `hg_admin_menu`
+WHERE `name` IN (
+  'imManager',
+  'imSystemSettings',
+  'imMessageEncryptionIndex',
+  'imMessageEncryptionInitialize',
+  'imMessageEncryptionRotate',
+  'imMessageEncryptionSwitch'
+);