superidou
5759c1862e
M0-M7 已完成:核心网关(身份/RBAC/TOTP/OIDC/SAML/Provider/配额/路由/内容策略/审计/定价)+ 资源市场(MCP/Skills/数字员工)。 含 22 个 PostgreSQL 迁移、管理端/门户端前端源码、OpenAPI 契约、部署 compose。 Co-Authored-By: Claude <noreply@anthropic.com>
83 lines
3.3 KiB
SQL
83 lines
3.3 KiB
SQL
CREATE TABLE IF NOT EXISTS gateway.departments (
|
|
id uuid PRIMARY KEY,
|
|
tenant_id uuid,
|
|
code text NOT NULL,
|
|
name text NOT NULL,
|
|
active boolean NOT NULL DEFAULT true,
|
|
created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
UNIQUE NULLS NOT DISTINCT (tenant_id, code)
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway.admin_accounts (
|
|
id uuid PRIMARY KEY,
|
|
username varchar(64) NOT NULL,
|
|
password_hash text NOT NULL,
|
|
display_name varchar(64) NOT NULL DEFAULT '',
|
|
role varchar(24) NOT NULL DEFAULT 'operator'
|
|
CHECK (role IN ('superadmin', 'operator', 'auditor')),
|
|
active boolean NOT NULL DEFAULT true,
|
|
failed_logins integer NOT NULL DEFAULT 0 CHECK (failed_logins >= 0),
|
|
locked_until timestamptz,
|
|
last_login timestamptz,
|
|
encrypted_totp_secret bytea,
|
|
totp_kek_version integer,
|
|
totp_enabled boolean NOT NULL DEFAULT false,
|
|
totp_last_step bigint,
|
|
totp_backup_codes jsonb NOT NULL DEFAULT '[]'::jsonb,
|
|
totp_confirmed_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS admin_accounts_username_lower_idx
|
|
ON gateway.admin_accounts (lower(username));
|
|
|
|
CREATE TABLE IF NOT EXISTS gateway.portal_users (
|
|
id uuid PRIMARY KEY,
|
|
tenant_id uuid,
|
|
account varchar(128) NOT NULL,
|
|
name varchar(64) NOT NULL DEFAULT '',
|
|
department_id uuid REFERENCES gateway.departments(id),
|
|
password_hash text,
|
|
auth_source varchar(24) NOT NULL DEFAULT 'local'
|
|
CHECK (auth_source IN ('local', 'feishu', 'oidc', 'saml')),
|
|
external_subject text,
|
|
active boolean NOT NULL DEFAULT true,
|
|
provisioning_status varchar(24) NOT NULL DEFAULT 'active'
|
|
CHECK (provisioning_status IN ('active', 'pending', 'rejected')),
|
|
failed_logins integer NOT NULL DEFAULT 0 CHECK (failed_logins >= 0),
|
|
locked_until timestamptz,
|
|
last_login timestamptz,
|
|
encrypted_totp_secret bytea,
|
|
totp_kek_version integer,
|
|
totp_enabled boolean NOT NULL DEFAULT false,
|
|
totp_last_step bigint,
|
|
totp_backup_codes jsonb NOT NULL DEFAULT '[]'::jsonb,
|
|
totp_confirmed_at timestamptz,
|
|
deleted_name_snapshot varchar(128) NOT NULL DEFAULT '',
|
|
created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
|
|
updated_at timestamptz NOT NULL DEFAULT clock_timestamp()
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS portal_users_account_lower_idx
|
|
ON gateway.portal_users (lower(account));
|
|
CREATE INDEX IF NOT EXISTS portal_users_department_idx
|
|
ON gateway.portal_users (department_id, active);
|
|
CREATE UNIQUE INDEX IF NOT EXISTS portal_users_external_subject_idx
|
|
ON gateway.portal_users (auth_source, external_subject)
|
|
WHERE external_subject IS NOT NULL;
|
|
|
|
ALTER TABLE gateway.api_keys
|
|
ADD COLUMN IF NOT EXISTS user_id uuid REFERENCES gateway.portal_users(id),
|
|
ADD COLUMN IF NOT EXISTS department_id uuid REFERENCES gateway.departments(id);
|
|
|
|
ALTER TABLE gateway.providers
|
|
ADD COLUMN IF NOT EXISTS created_by uuid REFERENCES gateway.admin_accounts(id);
|
|
|
|
COMMENT ON COLUMN gateway.admin_accounts.password_hash IS
|
|
'PBKDF2-SHA256 self-describing hash; compatible with the Python gateway format.';
|
|
COMMENT ON TABLE gateway.portal_users IS
|
|
'Portal identities. Runtime API keys remain separate credentials.';
|
|
|