java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(iam): 收敛仓库角色权限并纳入统一迁移

Browse Source
This commit is contained in:
ouyangxq
2026-08-10 12:22:29 +08:00
parent edd5108625
commit b294695169
29 changed files with 1009 additions and 424 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/sql/头程数据库统一增量-MySQL8.sql
+230 -2
View File
@@ -2545,6 +2545,7 @@ CREATE TABLE IF NOT EXISTS fl_inbound_measurement_item (
inbound_detail_id BIGINT UNSIGNED NULL COMMENT '绑定的订单货物明细ID，平台手工明细可为空',
external_detail_no VARCHAR(128) NULL COMMENT '第三方测量明细唯一号，平台手工明细可为空',
box_code VARCHAR(128) NULL COMMENT '柏悦唛头箱号；设备单箱测量时同一客户内唯一',
scanned_shipment_id VARCHAR(64) NULL COMMENT '设备从Amazon FBA箱标实扫的Shipment ID',
item_no VARCHAR(32) NOT NULL COMMENT '批次内明细号',
box_specification VARCHAR(64) NOT NULL COMMENT '箱规标识',
package_count INT UNSIGNED NOT NULL COMMENT '相同箱规箱数',
@@ -2582,6 +2583,7 @@ CREATE TABLE IF NOT EXISTS fl_mojia_measurement_receipt (
tenant_id BIGINT UNSIGNED NOT NULL COMMENT '客户隔离ID',
subject_id BIGINT UNSIGNED NOT NULL COMMENT '设备应用操作主体ID',
box_code VARCHAR(128) NOT NULL COMMENT '设备扫描的原始箱码',
scanned_shipment_id VARCHAR(64) NULL COMMENT '设备从Amazon FBA箱标实扫的Shipment ID',
length_cm DECIMAL(12,3) NOT NULL COMMENT '设备实测长度cm',
width_cm DECIMAL(12,3) NOT NULL COMMENT '设备实测宽度cm',
height_cm DECIMAL(12,3) NOT NULL COMMENT '设备实测高度cm',
@@ -3041,6 +3043,10 @@ CALL phase2_measure_add_column('fl_inbound_measurement_item', 'unit_weight_kg',
'DECIMAL(18,3) NULL COMMENT ''单箱重量kg'' AFTER girth_cm');
CALL phase2_measure_add_column('fl_inbound_measurement_item', 'unit_volume_cbm',
'DECIMAL(18,4) NOT NULL DEFAULT 0 COMMENT ''单箱业务体积m3'' AFTER unit_weight_kg');
CALL phase2_measure_add_column('fl_inbound_measurement_item', 'scanned_shipment_id',
'VARCHAR(64) NULL COMMENT ''设备从Amazon FBA箱标实扫的Shipment ID'' AFTER box_code');
CALL phase2_measure_add_column('fl_mojia_measurement_receipt', 'scanned_shipment_id',
'VARCHAR(64) NULL COMMENT ''设备从Amazon FBA箱标实扫的Shipment ID'' AFTER box_code');
CALL phase2_measure_add_column('fl_inbound_measurement_item', 'total_weight_kg',
'DECIMAL(18,3) NULL COMMENT ''本箱规总重量kg'' AFTER volume_cbm');
CALL phase2_measure_add_column('fl_inbound_measurement_item', 'total_volume_cbm',
@@ -7425,12 +7431,20 @@ BEGIN
WHERE table_schema = 'baiyue_firstleg'
AND table_name = 'fl_mojia_measurement_receipt'
AND column_name IN ('id', 'tenant_id', 'subject_id', 'box_code', 'length_cm', 'width_cm',
'height_cm', 'weight_kg', 'machine_no', 'measured_at', 'image_file_id',
'scanned_shipment_id', 'height_cm', 'weight_kg', 'machine_no', 'measured_at', 'image_file_id',
'status', 'match_failure_code', 'match_failure_reason', 'request_id',
'trace_id', 'created_at', 'updated_at')) <> 18 THEN
'trace_id', 'created_at', 'updated_at')) <> 19 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '统一迁移失败：墨家未匹配测量收件箱字段未完整创建';
END IF;
IF (SELECT COUNT(*) FROM information_schema.columns
WHERE table_schema = 'baiyue_firstleg'
AND table_name = 'fl_inbound_measurement_item'
AND column_name = 'scanned_shipment_id'
AND character_maximum_length = 64) <> 1 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '统一迁移失败：箱级测量实扫Shipment ID字段未创建';
END IF;
IF (SELECT character_maximum_length FROM information_schema.columns
WHERE table_schema = 'baiyue_firstleg'
AND table_name = 'fl_inbound_measurement_item'
@@ -8751,3 +8765,217 @@ DROP PROCEDURE IF EXISTS assert_phase3_pda_item_assignment_schema;
ALTER TABLE fl_inbound_pallet_allocation
ADD COLUMN IF NOT EXISTS reservation_id BIGINT UNSIGNED NULL COMMENT '仓库预占资源唯一ID，A0共享场景用于区分托盘' AFTER location_code;
-- 三期仓库常用角色初始化。模块来源：iam/src/main/resources/db/phase3-warehouse-roles.sql。
-- 三期仓库常用系统角色：仓库操作员、仓库拣货员、仓库理货员。
-- 本脚本只组合已经存在的权限资源，需在三期 Firstleg/IAM 权限脚本之后执行，可重复部署。
USE baiyue_iam;
SET NAMES utf8mb4;
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_role_ids_available;
DELIMITER $$
CREATE PROCEDURE assert_phase3_warehouse_role_ids_available()
BEGIN
IF EXISTS (
SELECT 1
FROM iam_role
WHERE (id = 4000004 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'WAREHOUSE_OPERATOR'))
OR (id = 4000005 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'WAREHOUSE_PICKER'))
OR (id = 4000006 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'WAREHOUSE_TALLY'))
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'WAREHOUSE_OPERATOR' AND id <> 4000004)
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'WAREHOUSE_PICKER' AND id <> 4000005)
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'WAREHOUSE_TALLY' AND id <> 4000006)
) THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：4000004-4000006 或角色编码已被占用';
END IF;
IF EXISTS (
SELECT 1
FROM iam_data_scope
WHERE (id = 6000004 AND role_id <> 4000004)
OR (id = 6000005 AND role_id <> 4000005)
OR (id = 6000006 AND role_id <> 4000006)
OR (role_id = 4000004 AND id <> 6000004)
OR (role_id = 4000005 AND id <> 6000005)
OR (role_id = 4000006 AND id <> 6000006)
) THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：6000004-6000006 数据范围ID已被占用';
END IF;
END$$
DELIMITER ;
CALL assert_phase3_warehouse_role_ids_available();
DROP PROCEDURE assert_phase3_warehouse_role_ids_available;
INSERT INTO iam_role (
id, tenant_id, app_code, role_code, role_name, role_type, status,
description, deleted, version
) VALUES
(4000004, 0, 'PLATFORM', 'WAREHOUSE_OPERATOR', '仓库操作员', 'SYSTEM', 'ACTIVE',
'负责查看入仓业务并在后台维护装柜证据', 0, 0),
(4000005, 0, 'PLATFORM', 'WAREHOUSE_PICKER', '仓库拣货员', 'SYSTEM', 'ACTIVE',
'负责使用PDA执行柜次拣货和现场拍照', 0, 0),
(4000006, 0, 'PLATFORM', 'WAREHOUSE_TALLY', '仓库理货员', 'SYSTEM', 'ACTIVE',
'负责入库测量、PDA复核和装柜证据维护', 0, 0)
ON DUPLICATE KEY UPDATE
role_name = VALUES(role_name), role_type = 'SYSTEM', status = 'ACTIVE',
description = VALUES(description), deleted = 0;
DROP TEMPORARY TABLE IF EXISTS tmp_phase3_warehouse_role_permission;
CREATE TEMPORARY TABLE tmp_phase3_warehouse_role_permission (
role_code VARCHAR(64) NOT NULL,
permission_code VARCHAR(128) NOT NULL,
PRIMARY KEY (role_code, permission_code)
) ENGINE=MEMORY;
-- 操作员：查看入仓业务并维护后台装柜证据，不授予完成装柜、任务分派或出仓动作。
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
('WAREHOUSE_OPERATOR', 'platform:order'),
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:list'),
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:view'),
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:loading:view'),
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:loading:edit');
-- 拣货员：只允许PDA任务查询、作业和现场照片，不授予后台页面、任务分派或复核权限。
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
('WAREHOUSE_PICKER', 'platform:firstleg:pda:view'),
('WAREHOUSE_PICKER', 'platform:firstleg:pda:work');
-- 理货员：负责到仓测量、装柜证据维护和PDA复核，不允许完成装柜或确认出仓。
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
('WAREHOUSE_TALLY', 'platform:order'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:list'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:view'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:view'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:edit'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:submit'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:weight:edit'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:weight:confirm'),
('WAREHOUSE_TALLY', 'platform:firstleg:pda:view'),
('WAREHOUSE_TALLY', 'platform:firstleg:pda:review'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:loading:view'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:loading:edit'),
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:picking:view');
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_role_permissions_available;
DELIMITER $$
CREATE PROCEDURE assert_phase3_warehouse_role_permissions_available()
BEGIN
IF (SELECT COUNT(*) FROM tmp_phase3_warehouse_role_permission
WHERE role_code = 'WAREHOUSE_OPERATOR') <> 5
OR (SELECT COUNT(*) FROM tmp_phase3_warehouse_role_permission
WHERE role_code = 'WAREHOUSE_PICKER') <> 2
OR (SELECT COUNT(*) FROM tmp_phase3_warehouse_role_permission
WHERE role_code = 'WAREHOUSE_TALLY') <> 12 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：角色权限组合数量不符合预期';
END IF;
IF EXISTS (
SELECT 1
FROM tmp_phase3_warehouse_role_permission expected
LEFT JOIN iam_permission permission
ON permission.tenant_id = 0
AND permission.app_code = 'PLATFORM'
AND permission.permission_code = expected.permission_code
AND permission.status = 'ACTIVE'
AND permission.deleted = 0
WHERE permission.id IS NULL
) THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：依赖的三期平台权限尚未完整部署';
END IF;
END$$
DELIMITER ;
CALL assert_phase3_warehouse_role_permissions_available();
DROP PROCEDURE assert_phase3_warehouse_role_permissions_available;
-- 三个系统角色的权限集合由迁移维护。重复执行时移除历史版本或人工误授的越权项，
-- 避免最小权限角色因脚本升级只增不减。
DELETE role_permission
FROM iam_role_permission role_permission
JOIN iam_role role
ON role.id = role_permission.role_id
AND role.tenant_id = role_permission.tenant_id
JOIN iam_permission permission
ON permission.id = role_permission.permission_id
AND permission.tenant_id = role_permission.tenant_id
LEFT JOIN tmp_phase3_warehouse_role_permission expected
ON expected.role_code = role.role_code
AND expected.permission_code = permission.permission_code
WHERE role.tenant_id = 0
AND role.app_code = 'PLATFORM'
AND role.role_code IN ('WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY')
AND expected.permission_code IS NULL;
INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)
SELECT role.id, permission.id, 0
FROM tmp_phase3_warehouse_role_permission expected
JOIN iam_role role
ON role.tenant_id = 0
AND role.app_code = 'PLATFORM'
AND role.role_code = expected.role_code
AND role.status = 'ACTIVE'
AND role.deleted = 0
JOIN iam_permission permission
ON permission.tenant_id = 0
AND permission.app_code = 'PLATFORM'
AND permission.permission_code = expected.permission_code
AND permission.status = 'ACTIVE'
AND permission.deleted = 0;
INSERT INTO iam_data_scope (id, role_id, tenant_id, scope_type, scope_expression) VALUES
(6000004, 4000004, 0, 'TENANT', NULL),
(6000005, 4000005, 0, 'TENANT', NULL),
(6000006, 4000006, 0, 'TENANT', NULL)
ON DUPLICATE KEY UPDATE
tenant_id = 0, scope_type = 'TENANT', scope_expression = NULL;
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_roles_ready;
DELIMITER $$
CREATE PROCEDURE assert_phase3_warehouse_roles_ready()
BEGIN
IF (SELECT COUNT(*)
FROM iam_role
WHERE tenant_id = 0
AND app_code = 'PLATFORM'
AND role_type = 'SYSTEM'
AND status = 'ACTIVE'
AND deleted = 0
AND role_code IN ('WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY')) <> 3 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：系统角色未完整启用';
END IF;
IF (SELECT COUNT(*)
FROM tmp_phase3_warehouse_role_permission expected
JOIN iam_role role
ON role.tenant_id = 0
AND role.app_code = 'PLATFORM'
AND role.role_code = expected.role_code
JOIN iam_permission permission
ON permission.tenant_id = 0
AND permission.app_code = 'PLATFORM'
AND permission.permission_code = expected.permission_code
JOIN iam_role_permission grant_row
ON grant_row.role_id = role.id
AND grant_row.permission_id = permission.id
AND grant_row.tenant_id = 0) <> 19 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：最小权限授权未完整写入';
END IF;
IF (SELECT COUNT(*)
FROM iam_data_scope scope_row
JOIN iam_role role ON role.id = scope_row.role_id
WHERE role.tenant_id = 0
AND role.app_code = 'PLATFORM'
AND role.role_code IN ('WAREHOUSE_OPERATOR', 'WAREHOUSE_PICKER', 'WAREHOUSE_TALLY')
AND scope_row.tenant_id = 0
AND scope_row.scope_type = 'TENANT') <> 3 THEN
SIGNAL SQLSTATE '45000'
SET MESSAGE_TEXT = '仓库角色初始化失败：数据范围未完整写入';
END IF;
END$$
DELIMITER ;
CALL assert_phase3_warehouse_roles_ready();
DROP PROCEDURE assert_phase3_warehouse_roles_ready;
DROP TEMPORARY TABLE IF EXISTS tmp_phase3_warehouse_role_permission;