255 lines
12 KiB
SQL
255 lines
12 KiB
SQL
-- 三期仓库系统角色：国内仓后台、国内头程 PDA、海外仓 PDA、国内仓理货复核。
|
|
-- 本脚本只组合已经存在的权限资源，需在三期 Firstleg/IAM 权限脚本之后执行，可重复部署。
|
|
USE baiyue_iam;
|
|
SET NAMES utf8mb4;
|
|
|
|
DROP PROCEDURE IF EXISTS ensure_domestic_pda_operator_warehouse_column;
|
|
DELIMITER $$
|
|
CREATE PROCEDURE ensure_domestic_pda_operator_warehouse_column()
|
|
BEGIN
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM information_schema.columns
|
|
WHERE table_schema = DATABASE() AND table_name = 'iam_membership'
|
|
AND column_name = 'domestic_warehouse_id'
|
|
) THEN
|
|
ALTER TABLE iam_membership
|
|
ADD COLUMN domestic_warehouse_id BIGINT NULL
|
|
COMMENT '国内头程PDA操作员绑定的唯一国内作业仓ID'
|
|
AFTER overseas_warehouse_id,
|
|
ADD KEY idx_membership_domestic_warehouse (tenant_id, domestic_warehouse_id, status);
|
|
END IF;
|
|
END$$
|
|
DELIMITER ;
|
|
CALL ensure_domestic_pda_operator_warehouse_column();
|
|
DROP PROCEDURE ensure_domestic_pda_operator_warehouse_column;
|
|
|
|
UPDATE iam_role
|
|
SET role_code = 'OVERSEAS_WAREHOUSE_PDA_OPERATOR',
|
|
role_name = '海外仓 PDA 作业员',
|
|
description = '负责使用海外仓 PDA 执行接柜、入仓和库内作业，必须绑定一个海外仓'
|
|
WHERE id = 4000005 AND tenant_id = 0 AND app_code = 'PLATFORM'
|
|
AND role_code = 'WAREHOUSE_PICKER';
|
|
|
|
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_role_ids_available;
|
|
DELIMITER $$
|
|
CREATE PROCEDURE assert_phase3_warehouse_role_ids_available()
|
|
BEGIN
|
|
IF EXISTS (
|
|
SELECT 1
|
|
FROM iam_role
|
|
WHERE (id = 4000004 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'WAREHOUSE_OPERATOR'))
|
|
OR (id = 4000005 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'OVERSEAS_WAREHOUSE_PDA_OPERATOR'))
|
|
OR (id = 4000006 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'WAREHOUSE_TALLY'))
|
|
OR (id = 4000007 AND (tenant_id <> 0 OR app_code <> 'PLATFORM' OR role_code <> 'CN_FIRSTLEG_PDA_OPERATOR'))
|
|
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'WAREHOUSE_OPERATOR' AND id <> 4000004)
|
|
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'OVERSEAS_WAREHOUSE_PDA_OPERATOR' AND id <> 4000005)
|
|
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'WAREHOUSE_TALLY' AND id <> 4000006)
|
|
OR (tenant_id = 0 AND app_code = 'PLATFORM' AND role_code = 'CN_FIRSTLEG_PDA_OPERATOR' AND id <> 4000007)
|
|
) THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：4000004-4000007 或角色编码已被占用';
|
|
END IF;
|
|
IF EXISTS (
|
|
SELECT 1
|
|
FROM iam_data_scope
|
|
WHERE (id = 6000004 AND role_id <> 4000004)
|
|
OR (id = 6000005 AND role_id <> 4000005)
|
|
OR (id = 6000006 AND role_id <> 4000006)
|
|
OR (id = 6000007 AND role_id <> 4000007)
|
|
OR (role_id = 4000004 AND id <> 6000004)
|
|
OR (role_id = 4000005 AND id <> 6000005)
|
|
OR (role_id = 4000006 AND id <> 6000006)
|
|
OR (role_id = 4000007 AND id <> 6000007)
|
|
) THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：6000004-6000007 数据范围ID已被占用';
|
|
END IF;
|
|
END$$
|
|
DELIMITER ;
|
|
CALL assert_phase3_warehouse_role_ids_available();
|
|
DROP PROCEDURE assert_phase3_warehouse_role_ids_available;
|
|
|
|
INSERT INTO iam_role (
|
|
id, tenant_id, app_code, role_code, role_name, role_type, status,
|
|
description, deleted, version
|
|
) VALUES
|
|
(4000004, 0, 'PLATFORM', 'WAREHOUSE_OPERATOR', '国内仓后台操作员', 'SYSTEM', 'ACTIVE',
|
|
'负责查看入仓业务并在后台维护装柜证据', 0, 0),
|
|
(4000005, 0, 'PLATFORM', 'OVERSEAS_WAREHOUSE_PDA_OPERATOR', '海外仓 PDA 作业员', 'SYSTEM', 'ACTIVE',
|
|
'负责使用海外仓 PDA 执行接柜、入仓和库内作业，必须绑定一个海外仓', 0, 0),
|
|
(4000006, 0, 'PLATFORM', 'WAREHOUSE_TALLY', '国内仓理货复核员', 'SYSTEM', 'ACTIVE',
|
|
'负责国内入库测量、PDA复核和装柜证据维护', 0, 0),
|
|
(4000007, 0, 'PLATFORM', 'CN_FIRSTLEG_PDA_OPERATOR', '国内头程 PDA 作业员', 'SYSTEM', 'ACTIVE',
|
|
'负责使用国内 PDA 执行柜次拣货、现场取证和装柜完成', 0, 0)
|
|
ON DUPLICATE KEY UPDATE
|
|
role_name = VALUES(role_name), role_type = 'SYSTEM', status = 'ACTIVE',
|
|
description = VALUES(description), deleted = 0;
|
|
|
|
DROP TEMPORARY TABLE IF EXISTS tmp_phase3_warehouse_role_permission;
|
|
CREATE TEMPORARY TABLE tmp_phase3_warehouse_role_permission (
|
|
role_code VARCHAR(64) NOT NULL,
|
|
permission_code VARCHAR(128) NOT NULL,
|
|
PRIMARY KEY (role_code, permission_code)
|
|
) ENGINE=MEMORY;
|
|
|
|
-- 仓管：可查看并确认预装、指定国内 PDA 作业员，不授予 PDA 执行或出仓动作。
|
|
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
|
|
('WAREHOUSE_OPERATOR', 'platform:order'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:list'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:view'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:loading:view'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:inbound:loading:edit'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:preload:list'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:preload:edit'),
|
|
('WAREHOUSE_OPERATOR', 'platform:firstleg:pda:assign');
|
|
|
|
-- 国内头程 PDA 作业员：只允许国内任务查询、作业和现场照片，不授予后台、海外、分派或复核权限。
|
|
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
|
|
('CN_FIRSTLEG_PDA_OPERATOR', 'platform:firstleg:pda:view'),
|
|
('CN_FIRSTLEG_PDA_OPERATOR', 'platform:firstleg:pda:work');
|
|
|
|
-- 理货员：负责到仓测量、装柜证据维护和PDA复核，不允许完成装柜或确认出仓。
|
|
INSERT INTO tmp_phase3_warehouse_role_permission (role_code, permission_code) VALUES
|
|
('WAREHOUSE_TALLY', 'platform:order'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:list'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:view'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:view'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:edit'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:measure:submit'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:weight:edit'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:weight:confirm'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:pda:view'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:pda:review'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:loading:view'),
|
|
('WAREHOUSE_TALLY', 'platform:firstleg:inbound:loading:edit');
|
|
|
|
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_role_permissions_available;
|
|
DELIMITER $$
|
|
CREATE PROCEDURE assert_phase3_warehouse_role_permissions_available()
|
|
BEGIN
|
|
DECLARE operator_permission_count INT DEFAULT 0;
|
|
DECLARE domestic_pda_permission_count INT DEFAULT 0;
|
|
DECLARE tally_permission_count INT DEFAULT 0;
|
|
SELECT COALESCE(SUM(role_code = 'WAREHOUSE_OPERATOR'), 0),
|
|
COALESCE(SUM(role_code = 'CN_FIRSTLEG_PDA_OPERATOR'), 0),
|
|
COALESCE(SUM(role_code = 'WAREHOUSE_TALLY'), 0)
|
|
INTO operator_permission_count, domestic_pda_permission_count, tally_permission_count
|
|
FROM tmp_phase3_warehouse_role_permission;
|
|
IF operator_permission_count <> 8
|
|
OR domestic_pda_permission_count <> 2
|
|
OR tally_permission_count <> 12 THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：角色权限组合数量不符合预期';
|
|
END IF;
|
|
IF EXISTS (
|
|
SELECT 1
|
|
FROM tmp_phase3_warehouse_role_permission expected
|
|
LEFT JOIN iam_permission permission
|
|
ON permission.tenant_id = 0
|
|
AND permission.app_code = 'PLATFORM'
|
|
AND permission.permission_code = expected.permission_code
|
|
AND permission.status = 'ACTIVE'
|
|
AND permission.deleted = 0
|
|
WHERE permission.id IS NULL
|
|
) THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：依赖的三期平台权限尚未完整部署';
|
|
END IF;
|
|
END$$
|
|
DELIMITER ;
|
|
CALL assert_phase3_warehouse_role_permissions_available();
|
|
DROP PROCEDURE assert_phase3_warehouse_role_permissions_available;
|
|
|
|
-- 四个系统角色的权限集合由初始化维护。重复执行时移除人工误授的越权项，
|
|
-- 避免最小权限角色因脚本升级只增不减。
|
|
DELETE role_permission
|
|
FROM iam_role_permission role_permission
|
|
JOIN iam_role role
|
|
ON role.id = role_permission.role_id
|
|
AND role.tenant_id = role_permission.tenant_id
|
|
JOIN iam_permission permission
|
|
ON permission.id = role_permission.permission_id
|
|
AND permission.tenant_id = role_permission.tenant_id
|
|
LEFT JOIN tmp_phase3_warehouse_role_permission expected
|
|
ON expected.role_code = role.role_code
|
|
AND expected.permission_code = permission.permission_code
|
|
WHERE role.tenant_id = 0
|
|
AND role.app_code = 'PLATFORM'
|
|
AND role.role_code IN ('WAREHOUSE_OPERATOR', 'OVERSEAS_WAREHOUSE_PDA_OPERATOR', 'WAREHOUSE_TALLY', 'CN_FIRSTLEG_PDA_OPERATOR')
|
|
AND NOT (role.role_code = 'OVERSEAS_WAREHOUSE_PDA_OPERATOR' AND permission.permission_code = 'lastleg:pda:operate')
|
|
AND expected.permission_code IS NULL;
|
|
|
|
INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)
|
|
SELECT role.id, permission.id, 0
|
|
FROM tmp_phase3_warehouse_role_permission expected
|
|
JOIN iam_role role
|
|
ON role.tenant_id = 0
|
|
AND role.app_code = 'PLATFORM'
|
|
AND role.role_code = expected.role_code
|
|
AND role.status = 'ACTIVE'
|
|
AND role.deleted = 0
|
|
JOIN iam_permission permission
|
|
ON permission.tenant_id = 0
|
|
AND permission.app_code = 'PLATFORM'
|
|
AND permission.permission_code = expected.permission_code
|
|
AND permission.status = 'ACTIVE'
|
|
AND permission.deleted = 0;
|
|
|
|
INSERT INTO iam_data_scope (id, role_id, tenant_id, scope_type, scope_expression) VALUES
|
|
(6000004, 4000004, 0, 'TENANT', NULL),
|
|
(6000005, 4000005, 0, 'TENANT', NULL),
|
|
(6000006, 4000006, 0, 'TENANT', NULL),
|
|
(6000007, 4000007, 0, 'TENANT', NULL)
|
|
ON DUPLICATE KEY UPDATE
|
|
tenant_id = 0, scope_type = 'TENANT', scope_expression = NULL;
|
|
|
|
DROP PROCEDURE IF EXISTS assert_phase3_warehouse_roles_ready;
|
|
DELIMITER $$
|
|
CREATE PROCEDURE assert_phase3_warehouse_roles_ready()
|
|
BEGIN
|
|
IF (SELECT COUNT(*)
|
|
FROM iam_role
|
|
WHERE tenant_id = 0
|
|
AND app_code = 'PLATFORM'
|
|
AND role_type = 'SYSTEM'
|
|
AND status = 'ACTIVE'
|
|
AND deleted = 0
|
|
AND role_code IN ('WAREHOUSE_OPERATOR', 'OVERSEAS_WAREHOUSE_PDA_OPERATOR', 'WAREHOUSE_TALLY', 'CN_FIRSTLEG_PDA_OPERATOR')) <> 4 THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：系统角色未完整启用';
|
|
END IF;
|
|
IF (SELECT COUNT(*)
|
|
FROM tmp_phase3_warehouse_role_permission expected
|
|
JOIN iam_role role
|
|
ON role.tenant_id = 0
|
|
AND role.app_code = 'PLATFORM'
|
|
AND role.role_code = expected.role_code
|
|
JOIN iam_permission permission
|
|
ON permission.tenant_id = 0
|
|
AND permission.app_code = 'PLATFORM'
|
|
AND permission.permission_code = expected.permission_code
|
|
JOIN iam_role_permission grant_row
|
|
ON grant_row.role_id = role.id
|
|
AND grant_row.permission_id = permission.id
|
|
AND grant_row.tenant_id = 0) <> 22 THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：最小权限授权未完整写入';
|
|
END IF;
|
|
IF (SELECT COUNT(*)
|
|
FROM iam_data_scope scope_row
|
|
JOIN iam_role role ON role.id = scope_row.role_id
|
|
WHERE role.tenant_id = 0
|
|
AND role.app_code = 'PLATFORM'
|
|
AND role.role_code IN ('WAREHOUSE_OPERATOR', 'OVERSEAS_WAREHOUSE_PDA_OPERATOR', 'WAREHOUSE_TALLY', 'CN_FIRSTLEG_PDA_OPERATOR')
|
|
AND scope_row.tenant_id = 0
|
|
AND scope_row.scope_type = 'TENANT') <> 4 THEN
|
|
SIGNAL SQLSTATE '45000'
|
|
SET MESSAGE_TEXT = '仓库角色初始化失败：数据范围未完整写入';
|
|
END IF;
|
|
END$$
|
|
DELIMITER ;
|
|
CALL assert_phase3_warehouse_roles_ready();
|
|
DROP PROCEDURE assert_phase3_warehouse_roles_ready;
|
|
|
|
DROP TEMPORARY TABLE IF EXISTS tmp_phase3_warehouse_role_permission;
|