From d3183d8f2ce62dd6ed7cf36da0272a94e268400a Mon Sep 17 00:00:00 2001 From: ouyangxq <775153912@qq.com> Date: Thu, 20 Aug 2026 13:34:29 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/sql/头程数据库统一增量-MySQL8.sql | 62 +++++++++++++------ .../db/phase3-ocean-booking-schema.sql | 30 ++++++--- .../db/phase3-truck-appointment-schema.sql | 19 +++--- .../initialization-baseline-contract.test.mjs | 22 +++++++ scripts/local-db-full-acceptance.ps1 | 4 +- 5 files changed, 97 insertions(+), 40 deletions(-) diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql index dfb4d32e9..1b06852e8 100644 --- a/deploy/sql/头程数据库统一增量-MySQL8.sql +++ b/deploy/sql/头程数据库统一增量-MySQL8.sql @@ -9196,16 +9196,22 @@ CREATE PROCEDURE assert_ocean_booking_permission_ids_available() BEGIN IF EXISTS ( SELECT 1 FROM iam_permission - WHERE (id BETWEEN 5102140 AND 5102149 - AND permission_code <> CASE id - WHEN 5102140 THEN 'platform:firstleg:ocean-booking:list' - WHEN 5102141 THEN 'platform:firstleg:ocean-booking:list' - WHEN 5102142 THEN 'platform:firstleg:ocean-booking:create' - WHEN 5102146 THEN 'platform:firstleg:ocean-booking:release' - WHEN 5102147 THEN 'platform:firstleg:ocean-booking:edit' - WHEN 5102148 THEN 'platform:firstleg:ocean-booking:delete' - WHEN 5102149 THEN 'platform:firstleg:ocean-booking:allocate' - END) + WHERE (id = 5102140 AND permission_code <> 'platform:firstleg:ocean-booking:list') + OR (id = 5102141 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:list', + 'platform:firstleg:ocean-booking:view')) + OR (id = 5102142 AND permission_code <> 'platform:firstleg:ocean-booking:create') + OR (id = 5102143 AND permission_code <> 'platform:firstleg:ocean-booking:edit') + OR (id = 5102144 AND permission_code <> 'platform:firstleg:ocean-booking:submit') + OR (id = 5102145 AND permission_code <> 'platform:firstleg:ocean-booking:confirm') + OR (id = 5102146 AND permission_code <> 'platform:firstleg:ocean-booking:release') + OR (id = 5102147 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:cancel', + 'platform:firstleg:ocean-booking:edit')) + OR (id = 5102148 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:change', + 'platform:firstleg:ocean-booking:delete')) + OR (id = 5102149 AND permission_code <> 'platform:firstleg:ocean-booking:allocate') OR (permission_code LIKE 'platform:firstleg:ocean-booking:%' AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR id NOT BETWEEN 5102140 AND 5102149)) ) THEN @@ -9217,6 +9223,10 @@ DELIMITER ; CALL assert_ocean_booking_permission_ids_available(); DROP PROCEDURE IF EXISTS assert_ocean_booking_permission_ids_available; +UPDATE iam_permission + SET permission_code='platform:firstleg:ocean-booking:view',status='INACTIVE',deleted=1 + WHERE id=5102141 AND permission_code='platform:firstleg:ocean-booking:list'; + INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name, route_path,http_method,sort_no,status,built_in,deleted) @@ -9236,6 +9246,9 @@ SELECT role.id,permission.id,0 FROM iam_role role JOIN iam_permission permission ON permission.tenant_id=0 AND permission.permission_code LIKE 'platform:firstleg:ocean-booking:%' WHERE role.tenant_id=0 AND role.role_code IN ('PLATFORM_ADMIN','ORDER_OPERATOR'); +DELETE rp FROM iam_role_permission rp JOIN iam_permission p ON p.tenant_id=rp.tenant_id AND p.id=rp.permission_id +WHERE p.id=5102141; +UPDATE iam_permission SET status='INACTIVE',deleted=1 WHERE id=5102141; DELETE rp FROM iam_role_permission rp WHERE rp.permission_id IN (5102143,5102144,5102145); DELETE FROM iam_permission WHERE id IN (5102143,5102144,5102145); @@ -9321,14 +9334,13 @@ CREATE PROCEDURE assert_truck_appointment_permission_ids_available() BEGIN IF EXISTS ( SELECT 1 FROM iam_permission - WHERE (id BETWEEN 5102150 AND 5102154 - AND permission_code <> CASE id - WHEN 5102150 THEN 'platform:firstleg:truck-appointment:list' - WHEN 5102151 THEN 'platform:firstleg:truck-appointment:list' - WHEN 5102152 THEN 'platform:firstleg:truck-appointment:create' - WHEN 5102153 THEN 'platform:firstleg:truck-appointment:edit' - WHEN 5102154 THEN 'platform:firstleg:truck-appointment:operate' - END) + WHERE (id = 5102150 AND permission_code <> 'platform:firstleg:truck-appointment:list') + OR (id = 5102151 AND permission_code NOT IN ( + 'platform:firstleg:truck-appointment:list', + 'platform:firstleg:truck-appointment:view')) + OR (id = 5102152 AND permission_code <> 'platform:firstleg:truck-appointment:create') + OR (id = 5102153 AND permission_code <> 'platform:firstleg:truck-appointment:edit') + OR (id = 5102154 AND permission_code <> 'platform:firstleg:truck-appointment:operate') OR (permission_code LIKE 'platform:firstleg:truck-appointment:%' AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR id NOT BETWEEN 5102150 AND 5102154)) ) THEN @@ -9340,6 +9352,10 @@ DELIMITER ; CALL assert_truck_appointment_permission_ids_available(); DROP PROCEDURE IF EXISTS assert_truck_appointment_permission_ids_available; +UPDATE iam_permission + SET permission_code='platform:firstleg:truck-appointment:view',status='INACTIVE',deleted=1 + WHERE id=5102151 AND permission_code='platform:firstleg:truck-appointment:list'; + INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name, route_path,http_method,sort_no,status,built_in,deleted) @@ -9358,6 +9374,10 @@ SELECT role.id,permission.id,0 FROM iam_role role JOIN iam_permission permission AND permission.permission_code LIKE 'platform:firstleg:truck-appointment:%' WHERE role.tenant_id=0 AND role.role_code IN ('PLATFORM_ADMIN','ORDER_OPERATOR'); +DELETE rp FROM iam_role_permission rp JOIN iam_permission p ON p.tenant_id=rp.tenant_id AND p.id=rp.permission_id +WHERE p.id=5102151; +UPDATE iam_permission SET status='INACTIVE',deleted=1 WHERE id=5102151; + USE baiyue_firstleg; DROP PROCEDURE IF EXISTS assert_phase3_service_center_schema; @@ -9374,10 +9394,12 @@ BEGIN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：订舱或拖车预约表未完整创建'; END IF; IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission - WHERE tenant_id=0 AND app_code='PLATFORM' AND id BETWEEN 5102140 AND 5102149 + WHERE tenant_id=0 AND app_code='PLATFORM' AND status='ACTIVE' AND deleted=0 + AND id BETWEEN 5102140 AND 5102149 AND permission_code LIKE 'platform:firstleg:ocean-booking:%') <> 6 OR (SELECT COUNT(*) FROM baiyue_iam.iam_permission - WHERE tenant_id=0 AND app_code='PLATFORM' AND id BETWEEN 5102150 AND 5102154 + WHERE tenant_id=0 AND app_code='PLATFORM' AND status='ACTIVE' AND deleted=0 + AND id BETWEEN 5102150 AND 5102154 AND permission_code LIKE 'platform:firstleg:truck-appointment:%') <> 4 THEN SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：订舱或拖车预约权限未完整写入'; END IF; diff --git a/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql b/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql index a49ede7f6..9e50c4363 100644 --- a/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql +++ b/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql @@ -238,16 +238,22 @@ CREATE PROCEDURE assert_ocean_booking_permission_ids_available() BEGIN IF EXISTS ( SELECT 1 FROM iam_permission - WHERE (id BETWEEN 5102140 AND 5102149 - AND permission_code <> CASE id - WHEN 5102140 THEN 'platform:firstleg:ocean-booking:list' - WHEN 5102141 THEN 'platform:firstleg:ocean-booking:list' - WHEN 5102142 THEN 'platform:firstleg:ocean-booking:create' - WHEN 5102146 THEN 'platform:firstleg:ocean-booking:release' - WHEN 5102147 THEN 'platform:firstleg:ocean-booking:edit' - WHEN 5102148 THEN 'platform:firstleg:ocean-booking:delete' - WHEN 5102149 THEN 'platform:firstleg:ocean-booking:allocate' - END) + WHERE (id = 5102140 AND permission_code <> 'platform:firstleg:ocean-booking:list') + OR (id = 5102141 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:list', + 'platform:firstleg:ocean-booking:view')) + OR (id = 5102142 AND permission_code <> 'platform:firstleg:ocean-booking:create') + OR (id = 5102143 AND permission_code <> 'platform:firstleg:ocean-booking:edit') + OR (id = 5102144 AND permission_code <> 'platform:firstleg:ocean-booking:submit') + OR (id = 5102145 AND permission_code <> 'platform:firstleg:ocean-booking:confirm') + OR (id = 5102146 AND permission_code <> 'platform:firstleg:ocean-booking:release') + OR (id = 5102147 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:cancel', + 'platform:firstleg:ocean-booking:edit')) + OR (id = 5102148 AND permission_code NOT IN ( + 'platform:firstleg:ocean-booking:change', + 'platform:firstleg:ocean-booking:delete')) + OR (id = 5102149 AND permission_code <> 'platform:firstleg:ocean-booking:allocate') OR (permission_code LIKE 'platform:firstleg:ocean-booking:%' AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR id NOT BETWEEN 5102140 AND 5102149)) ) THEN @@ -259,6 +265,10 @@ DELIMITER ; CALL assert_ocean_booking_permission_ids_available(); DROP PROCEDURE IF EXISTS assert_ocean_booking_permission_ids_available; +UPDATE iam_permission + SET permission_code='platform:firstleg:ocean-booking:view',status='INACTIVE',deleted=1 + WHERE id=5102141 AND permission_code='platform:firstleg:ocean-booking:list'; + INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name, route_path,http_method,sort_no,status,built_in,deleted) diff --git a/firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql b/firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql index 311cfa4ed..efc2bab89 100644 --- a/firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql +++ b/firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql @@ -109,14 +109,13 @@ CREATE PROCEDURE assert_truck_appointment_permission_ids_available() BEGIN IF EXISTS ( SELECT 1 FROM iam_permission - WHERE (id BETWEEN 5102150 AND 5102154 - AND permission_code <> CASE id - WHEN 5102150 THEN 'platform:firstleg:truck-appointment:list' - WHEN 5102151 THEN 'platform:firstleg:truck-appointment:list' - WHEN 5102152 THEN 'platform:firstleg:truck-appointment:create' - WHEN 5102153 THEN 'platform:firstleg:truck-appointment:edit' - WHEN 5102154 THEN 'platform:firstleg:truck-appointment:operate' - END) + WHERE (id = 5102150 AND permission_code <> 'platform:firstleg:truck-appointment:list') + OR (id = 5102151 AND permission_code NOT IN ( + 'platform:firstleg:truck-appointment:list', + 'platform:firstleg:truck-appointment:view')) + OR (id = 5102152 AND permission_code <> 'platform:firstleg:truck-appointment:create') + OR (id = 5102153 AND permission_code <> 'platform:firstleg:truck-appointment:edit') + OR (id = 5102154 AND permission_code <> 'platform:firstleg:truck-appointment:operate') OR (permission_code LIKE 'platform:firstleg:truck-appointment:%' AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR id NOT BETWEEN 5102150 AND 5102154)) ) THEN @@ -128,6 +127,10 @@ DELIMITER ; CALL assert_truck_appointment_permission_ids_available(); DROP PROCEDURE IF EXISTS assert_truck_appointment_permission_ids_available; +UPDATE iam_permission + SET permission_code='platform:firstleg:truck-appointment:view',status='INACTIVE',deleted=1 + WHERE id=5102151 AND permission_code='platform:firstleg:truck-appointment:list'; + INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name, route_path,http_method,sort_no,status,built_in,deleted) diff --git a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs index 9d12972a5..87fd77314 100644 --- a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs +++ b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs @@ -4,6 +4,8 @@ import test from 'node:test' const sql = readFileSync(new URL('../../deploy/sql/头程数据库统一增量-MySQL8.sql', import.meta.url), 'utf8') const iamSeed = readFileSync(new URL('../../iam/src/main/resources/db/phase1-admin-rbac.sql', import.meta.url), 'utf8') +const oceanBookingSchema = readFileSync(new URL('../../firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql', import.meta.url), 'utf8') +const truckAppointmentSchema = readFileSync(new URL('../../firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql', import.meta.url), 'utf8') test('统一初始化 SQL 保留最小登录与客户主体', () => { assert.match(sql, /一个平台系统管理员和一个 IT 测试客户管理员/) @@ -31,3 +33,23 @@ test('统一初始化 SQL 提供人工验收所需公共仓储主数据', () => assert.ok(palletSeed, 'missing pallet initialization seed') assert.doesNotMatch(palletSeed, /\bstatus\b|'AVAILABLE'/) }) + +test('三期权限迁移允许脚本历史版本写入的旧权限并在随后收敛', () => { + for (const source of [sql, oceanBookingSchema]) { + assert.match(source, /id = 5102141[\s\S]*?ocean-booking:view/) + assert.match(source, /id = 5102147[\s\S]*?ocean-booking:cancel[\s\S]*?ocean-booking:edit/) + assert.match(source, /id = 5102148[\s\S]*?ocean-booking:change[\s\S]*?ocean-booking:delete/) + assert.match(source, /SET permission_code='platform:firstleg:ocean-booking:view',status='INACTIVE',deleted=1/) + assert.match(source, /UPDATE iam_permission SET status='INACTIVE',deleted=1 WHERE id=5102141/) + assert.match(source, /DELETE FROM iam_permission WHERE id IN \(5102143,5102144,5102145\)/) + } + + for (const source of [sql, truckAppointmentSchema]) { + assert.match(source, /id = 5102151[\s\S]*?truck-appointment:view/) + assert.match(source, /SET permission_code='platform:firstleg:truck-appointment:view',status='INACTIVE',deleted=1/) + assert.match(source, /UPDATE iam_permission SET status='INACTIVE',deleted=1 WHERE id=5102151/) + } + + assert.match(sql, /status='ACTIVE' AND deleted=0[\s\S]*?id BETWEEN 5102140 AND 5102149/) + assert.match(sql, /status='ACTIVE' AND deleted=0[\s\S]*?id BETWEEN 5102150 AND 5102154/) +}) diff --git a/scripts/local-db-full-acceptance.ps1 b/scripts/local-db-full-acceptance.ps1 index 1eff76bdd..cc401e801 100644 --- a/scripts/local-db-full-acceptance.ps1 +++ b/scripts/local-db-full-acceptance.ps1 @@ -11,8 +11,8 @@ $ErrorActionPreference = 'Stop' $Repo = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path $Workspace = (Resolve-Path (Join-Path $Repo '..')).Path $Acceptance = Join-Path $Workspace '.codex-tmp\p23-04-acceptance' -$ExpectedSha256 = '00E8F9C24CE16FE6B4D2B6AF60460AE1AF1D264DFE110D4BDCE611F09EB69EAA' -$ExpectedLines = 15403 +$ExpectedSha256 = '8A269D219F8824352818BB427033F46F79CFB4652F36F0A9DA01A5913ABB50C6' +$ExpectedLines = 15673 if ($TargetHost -notin @('127.0.0.1', 'localhost')) { [Console]::Error.WriteLine('Refusing non-local database; only 127.0.0.1 or localhost is allowed.')