100 lines
6.5 KiB
SQL
100 lines
6.5 KiB
SQL
-- 权限资源维护与平台主数据权限迁移。
|
|
-- 在 phase1-admin-rbac.sql、rbac-role-management-v2.sql 之后执行，可重复执行。
|
|
USE baiyue_iam;
|
|
|
|
-- 兼容不支持 ADD COLUMN IF NOT EXISTS 的 MySQL 版本，通过元数据判断后执行。
|
|
SET @iam_permission_built_in_sql = IF(
|
|
EXISTS(SELECT 1 FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = 'iam_permission' AND column_name = 'built_in'),
|
|
'SELECT 1',
|
|
"ALTER TABLE iam_permission ADD COLUMN built_in TINYINT NOT NULL DEFAULT 0 COMMENT '是否为系统预置权限；预置资源不可通过管理接口修改' AFTER status"
|
|
);
|
|
PREPARE iam_permission_built_in_stmt FROM @iam_permission_built_in_sql;
|
|
EXECUTE iam_permission_built_in_stmt;
|
|
DEALLOCATE PREPARE iam_permission_built_in_stmt;
|
|
|
|
-- 一期固定编号范围内的资源均为种子资源，运行期生成的雪花编号不作预置标记。
|
|
UPDATE iam_permission
|
|
SET built_in = 1
|
|
WHERE id BETWEEN 5000000 AND 5399999 AND built_in = 0;
|
|
|
|
INSERT INTO iam_permission
|
|
(id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name,
|
|
route_path, sort_no, status, built_in, deleted)
|
|
VALUES
|
|
(5103040, 0, 'PLATFORM', 'MENU', 5103000, 'platform:download:list', '下载中心',
|
|
'/downloads', 40, 'ACTIVE', 1, 0)
|
|
ON DUPLICATE KEY UPDATE
|
|
permission_name = VALUES(permission_name), route_path = VALUES(route_path), sort_no = VALUES(sort_no),
|
|
status = 'ACTIVE', built_in = 1, deleted = 0;
|
|
|
|
INSERT INTO iam_permission
|
|
(id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name,
|
|
sort_no, status, built_in, deleted)
|
|
VALUES
|
|
(5100014, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:view', '查看企业客户档案', 15, 'ACTIVE', 1, 0),
|
|
(5100012, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:edit', '编辑企业客户', 20, 'ACTIVE', 1, 0),
|
|
(5100013, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:status', '启停企业客户', 30, 'ACTIVE', 1, 0),
|
|
(5100015, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:export', '导出企业客户', 40, 'ACTIVE', 1, 0),
|
|
(5100016, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:reset-password', '重置客户管理员密码', 50, 'ACTIVE', 1, 0),
|
|
(5100017, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:delete', '归档企业客户', 60, 'ACTIVE', 1, 0),
|
|
(5100018, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:impersonate', '跳转客户登录', 70, 'ACTIVE', 1, 0),
|
|
(5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 1, 0),
|
|
(5101032, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:edit', '编辑权限资源', 20, 'ACTIVE', 1, 0),
|
|
(5101033, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:status', '启停权限资源', 30, 'ACTIVE', 1, 0),
|
|
(5101034, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:delete', '删除权限资源', 40, 'ACTIVE', 1, 0),
|
|
(5103021, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:create', '新增快递公司', 10, 'ACTIVE', 1, 0),
|
|
(5103022, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:edit', '编辑快递公司', 20, 'ACTIVE', 1, 0),
|
|
(5103023, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:status', '启停快递公司', 30, 'ACTIVE', 1, 0),
|
|
(5103024, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:import', '批量导入快递公司', 40, 'ACTIVE', 1, 0),
|
|
(5103031, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:create', '新增往来单位', 10, 'ACTIVE', 1, 0),
|
|
(5103032, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:edit', '编辑往来单位', 20, 'ACTIVE', 1, 0),
|
|
(5103033, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:status', '启停往来单位', 30, 'ACTIVE', 1, 0),
|
|
(5103041, 0, 'PLATFORM', 'BUTTON', 5103040, 'platform:download:all', '查看全部下载任务', 10, 'ACTIVE', 1, 0)
|
|
ON DUPLICATE KEY UPDATE
|
|
permission_name = VALUES(permission_name), sort_no = VALUES(sort_no), status = 'ACTIVE',
|
|
built_in = 1, deleted = 0;
|
|
|
|
-- 新增平台操作权限默认只授予系统管理员。
|
|
INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
|
|
SELECT 4000001, id, 0
|
|
FROM iam_permission
|
|
WHERE tenant_id = 0 AND app_code = 'PLATFORM'
|
|
AND permission_code IN (
|
|
'platform:customer:edit', 'platform:customer:status', 'platform:customer:reset-password',
|
|
'platform:customer:delete', 'platform:customer:impersonate', 'platform:user:grant-role',
|
|
'platform:permission:edit', 'platform:permission:status', 'platform:permission:delete',
|
|
'platform:express:list', 'platform:express:create', 'platform:express:edit', 'platform:express:status', 'platform:express:import',
|
|
'platform:counterparty:list', 'platform:counterparty:create', 'platform:counterparty:edit', 'platform:counterparty:status',
|
|
'platform:customer:export', 'platform:download:list', 'platform:download:all'
|
|
)
|
|
ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
|
|
|
|
-- 已有客户运营角色继续具备客户导出与本人下载任务查询能力，但不授予查看全部任务。
|
|
INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
|
|
SELECT DISTINCT existing_grant.role_id, added_permission.id, existing_grant.tenant_id
|
|
FROM iam_role_permission existing_grant
|
|
JOIN iam_permission existing_permission ON existing_permission.id = existing_grant.permission_id
|
|
JOIN iam_permission added_permission
|
|
ON added_permission.tenant_id = 0 AND added_permission.app_code = 'PLATFORM'
|
|
AND added_permission.permission_code IN ('platform:customer:export', 'platform:download:list')
|
|
WHERE existing_permission.tenant_id = 0
|
|
AND existing_permission.app_code = 'PLATFORM'
|
|
AND existing_permission.permission_code IN ('platform:customer:list', 'platform:customer:review')
|
|
ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
|
|
|
|
-- 详情查看从列表和审核权限中拆分；升级时保留既有运营角色的查询能力。
|
|
INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
|
|
SELECT DISTINCT existing_grant.role_id, view_permission.id, existing_grant.tenant_id
|
|
FROM iam_role_permission existing_grant
|
|
JOIN iam_permission existing_permission
|
|
ON existing_permission.id = existing_grant.permission_id
|
|
JOIN iam_permission view_permission
|
|
ON view_permission.tenant_id = 0
|
|
AND view_permission.app_code = 'PLATFORM'
|
|
AND view_permission.permission_code = 'platform:customer:view'
|
|
WHERE existing_permission.tenant_id = 0
|
|
AND existing_permission.app_code = 'PLATFORM'
|
|
AND existing_permission.permission_code IN ('platform:customer:list', 'platform:customer:review')
|
|
ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
|