From c4c178c8b13ce446bb52240990c6a6ab099d75d4 Mon Sep 17 00:00:00 2001 From: waner Date: Mon, 25 May 2026 15:14:25 +0800 Subject: [PATCH] =?UTF-8?q?fix=EF=BC=9A=E6=97=A5=E5=BF=97=E8=AE=B0?= =?UTF-8?q?=E5=BD=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../auth/controller/AuthAdminController.java | 2 +- .../auth/controller/AuthController.java | 2 +- .../controller/NetworkConfigController.java | 18 +- .../controller/TimeConfigController.java | 2 +- .../modules/mk/controller/LmkController.java | 4 - .../db/migration/V2__tms_schema_full.sql | 778 ++++++++++++++++++ .../com/cisd/tms/TmsApplicationTests.java | 18 +- .../ResourceTaskSchemaContractTest.java | 6 +- .../impl/CertSchemaContractTest.java | 10 +- 9 files changed, 809 insertions(+), 31 deletions(-) create mode 100644 src/main/resources/db/migration/V2__tms_schema_full.sql diff --git a/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java b/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java index 2e20ed5..279c947 100644 --- a/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java +++ b/src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java @@ -79,7 +79,7 @@ public class AuthAdminController { @PostMapping("/super-admin/ukeys/issue-sign") @Operation(summary = "签发并绑定超级管理员 UKey", description = "系统初始化后登记超级管理员 UKey，不要求已有登录态。") - @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定超级管理员 UKey") +// @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定超级管理员 UKey") public ApiResponse issueSuperAdminUkeyBindingSign( @Valid @RequestBody UKeySignDTO request ) { diff --git a/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java b/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java index ebe6964..27ec793 100644 --- a/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java +++ b/src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java @@ -61,7 +61,7 @@ public class AuthController { @PostMapping("/logout") @Operation(summary = "退出当前会话", description = "使当前会话失效。") @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.LOGOUT, summary = "退出当前会话") - @ReplayProtected +// @ReplayProtected public ApiResponse logout(HttpServletRequest request) { authService.logout((String) request.getAttribute(InternalApiAuthInterceptor.ATTR_SESSION_TOKEN)); return ApiResponse.success(); diff --git a/src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java b/src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java index e64a6ac..2fe835a 100644 --- a/src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java +++ b/src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java @@ -44,7 +44,7 @@ public class NetworkConfigController { @Operation(summary = "配置网卡", description = "配置指定网卡的 IPv4 或 IPv6 地址、前缀长度、网关和状态") @PostMapping("/card/configure") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置网卡") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置网卡") public ApiResponse configureNetworkCard(@RequestBody @Validated NetworkConfigureRequest request) { networkConfigService.configureNetworkCard(request); return ApiResponse.success(); @@ -52,7 +52,7 @@ public class NetworkConfigController { @Operation(summary = "新增网卡配置", description = "新增或配置指定网卡的网络地址信息") @PostMapping("/card/add") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增网卡配置") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增网卡配置") public ApiResponse addNetworkCard(@RequestBody @Validated NetworkConfigureRequest req) { networkConfigService.configureNetworkCard(req); return ApiResponse.success(); @@ -60,7 +60,7 @@ public class NetworkConfigController { @Operation(summary = "删除网卡 IP 配置", description = "删除指定网卡下的某条 IPv4 或 IPv6 地址配置") @PostMapping("/card/delete") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除网卡IP配置") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除网卡IP配置") public ApiResponse deleteNetworkCardRecord(@RequestBody NetworkDeleteRequest req) { networkConfigService.deleteNetworkCardRecord(req); return ApiResponse.success(); @@ -75,7 +75,7 @@ public class NetworkConfigController { @Operation(summary = "删除 Bond", description = "删除指定 Bond 聚合接口及其从属网卡连接配置") @PostMapping("/bond/delete/{bondName}") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除Bond") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除Bond") public ApiResponse deleteBond(@PathVariable String bondName) { networkConfigService.deleteBond(bondName); return ApiResponse.success(); @@ -90,7 +90,7 @@ public class NetworkConfigController { @Operation(summary = "创建Bond", description = "创建一个新的Bond聚合接口，需指定名称、模式和从属接口") @PostMapping("/bond/create") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "创建Bond") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "创建Bond") public ApiResponse createBond(@Valid @RequestBody BondCreateRequest req) { networkConfigService.createBond(req); return ApiResponse.success(); @@ -98,7 +98,7 @@ public class NetworkConfigController { @Operation(summary = "配置 Bond", description = "修改指定 Bond 的模式、IP 地址、网关、从属物理网卡和激活状态") @PostMapping("/bond/config") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置Bond") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置Bond") public ApiResponse configBond(@Valid @RequestBody BondConfigRequest req) { networkConfigService.configBond(req); return ApiResponse.success(); @@ -112,7 +112,7 @@ public class NetworkConfigController { @Operation(summary = "新增路由", description = "新增一条 IPv4 或 IPv6 静态路由配置，可指定目标地址、前缀长度、网口和下一跳") @PostMapping("/route/add") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增路由") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增路由") public ApiResponse routeAdd(@Valid @RequestBody RouteCreateRequest req) { networkConfigService.addRoute(req); return ApiResponse.success(); @@ -120,7 +120,7 @@ public class NetworkConfigController { @Operation(summary = "修改路由", description = "修改一条已有静态路由，通过删除旧路由并新增新路由实现") @PostMapping("/route/update") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "修改路由") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "修改路由") public ApiResponse routeUpdate(@Valid @RequestBody RouteUpdateRequest req) { networkConfigService.updateRoute(req); return ApiResponse.success(); @@ -128,7 +128,7 @@ public class NetworkConfigController { @Operation(summary = "删除路由", description = "删除指定网口下的一条 IPv4 或 IPv6 静态路由配置") @PostMapping("/route/delete") - @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除路由") +// @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除路由") public ApiResponse routeDelete(@Valid @RequestBody RouteDeleteRequest req) { networkConfigService.deleteRoute(req); return ApiResponse.success(); diff --git a/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java b/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java index 7f12273..794c4b1 100644 --- a/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java +++ b/src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java @@ -27,7 +27,7 @@ public class TimeConfigController { @PostMapping("/time-config") @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL, allowBeforeMasterKeyInitialized = true) - @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "配置系统时间") +// @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "配置系统时间") public ApiResponse configureTime(@RequestBody TimeConfigRequest request) { timeConfigService.processTimeConfig(request); return ApiResponse.success(); diff --git a/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java b/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java index 525fbb7..01e41ea 100644 --- a/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java +++ b/src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java @@ -38,7 +38,6 @@ public class LmkController { @PostMapping("/masterKey/init") @Operation(summary = "初始化主密钥", description = "执行密码卡初始化识别、主密钥生成加载、内部密钥生成，并返回主密钥状态与校验值。") - @AuditedOperation(module = ModuleCode.KEY, action = ActionType.CREATE, summary = "初始化主密钥") public ApiResponse initMasterKey() { return ApiResponse.success(lmkService.initMasterKey()); } @@ -47,7 +46,6 @@ public class LmkController { @Operation(summary = "销毁主密钥", description = "销毁当前密码卡中的主密钥，失败直接抛出异常。") @ReplayProtected @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL) - @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "销毁主密钥") public ApiResponse destroyMasterKey() { //销毁主密钥、内部密钥、用户密钥 lmkService.destroyMasterKey(); @@ -67,7 +65,6 @@ public class LmkController { */ @PostMapping("/masterKey/recover") @Operation(summary = "恢复全部密钥", description = "请求体需传入两份按 packetIndex 标识的备份包。两份备份包必须分别对应 packetIndex=1、2。服务端会依次恢复 LMK、IK 和用户密钥。") - @AuditedOperation(module = ModuleCode.KEY, action = ActionType.RECOVER, summary = "恢复全部密钥") public ApiResponse recoverLmkEx(@Valid @RequestBody MasterKeyRecoverPacketsRequest request) { validatePacketIndexes(request.getPackets()); lmkService.recoverKeyPackets(request.getPackets()); @@ -77,7 +74,6 @@ public class LmkController { @PostMapping("/masterKey/activate") @Operation(summary = "设备激活") - @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.ENABLE, summary = "设备激活") public ApiResponse Activate(@RequestBody MasterKeyActivateRequest masterKeyActivateRequest) { masterKeyActivateService.activate(masterKeyActivateRequest); return ApiResponse.success(); diff --git a/src/main/resources/db/migration/V2__tms_schema_full.sql b/src/main/resources/db/migration/V2__tms_schema_full.sql new file mode 100644 index 0000000..6dc4dcd --- /dev/null +++ b/src/main/resources/db/migration/V2__tms_schema_full.sql @@ -0,0 +1,778 @@ +-- ----------------------------------------------------------------------------- +-- TMS 全量库结构初始化脚本 +-- 适用范围：空库初始化 / Flyway 首次建库 +-- 数据库：TiDB / MySQL 8+ +-- +-- 说明： +-- 1. 本文件是当前仓库唯一保留的数据库初始化 SQL。 +-- 2. 结构已按当前最终状态汇总，不再依赖历史 V1~V12 逐步迁移。 +-- 3. 执行前请先选中目标数据库，本文件不再包含 CREATE DATABASE / USE。 +-- ----------------------------------------------------------------------------- + +CREATE DATABASE IF NOT EXISTS TMS + DEFAULT CHARACTER SET utf8mb4 + COLLATE utf8mb4_general_ci; + +USE TMS; + +-- ----------------------------------------------------------------------------- +-- 初始化任务 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_init_task ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + task_type VARCHAR(32) NOT NULL DEFAULT 'INIT' COMMENT '任务类型：INIT/RESET', + version VARCHAR(32) NOT NULL, + status VARCHAR(32) NOT NULL, + product_type VARCHAR(16) NULL, + org_code VARCHAR(32) NULL, + mq_type VARCHAR(32) NULL, + deploy_mode VARCHAR(16) NULL, + init_plan_json LONGTEXT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_init_task_task_id (task_id) +) COMMENT='初始化任务表'; + +CREATE TABLE IF NOT EXISTS tms_init_task_step ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + step_no INT NOT NULL, + step_code VARCHAR(64) NOT NULL, + status VARCHAR(32) NOT NULL, + message VARCHAR(512) NULL, + command_line VARCHAR(2048) NULL, + log_path VARCHAR(512) NULL, + exit_code INT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_init_task_step_task_no (task_id, step_no), + KEY idx_tms_init_task_step_task_id (task_id) +) COMMENT='初始化任务步骤表'; + +-- ----------------------------------------------------------------------------- +-- 资源备份与恢复 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_resource_backup_task ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + backup_id VARCHAR(64) NOT NULL, + status VARCHAR(32) NOT NULL, + product_type VARCHAR(16) NOT NULL, + mq_type VARCHAR(32) NULL, + org_code VARCHAR(32) NULL, + source_device_id VARCHAR(128) NULL, + package_name VARCHAR(255) NULL, + package_path VARCHAR(1024) NULL, + package_size BIGINT NULL, + package_hash VARCHAR(128) NULL, + storage_enc_key_fingerprint VARCHAR(128) NOT NULL, + authenticity_key_fingerprint VARCHAR(128) NOT NULL, + manifest_summary_json JSON NULL, + error_code VARCHAR(64) NULL, + error_message VARCHAR(1024) NULL, + remark VARCHAR(1024) NULL, + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + start_time DATETIME(3) NULL, + finish_time DATETIME(3) NULL, + UNIQUE KEY uk_tms_resource_backup_task_task_id (task_id), + UNIQUE KEY uk_tms_resource_backup_task_backup_id (backup_id), + KEY idx_tms_resource_backup_task_status (status), + KEY idx_tms_resource_backup_task_create_time (create_time) +) COMMENT='资源备份任务表'; + +CREATE TABLE IF NOT EXISTS tms_resource_restore_task ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + precheck_id VARCHAR(64) NOT NULL, + backup_id VARCHAR(64) NOT NULL, + status VARCHAR(32) NOT NULL, + source_device_id VARCHAR(128) NULL, + source_product_type VARCHAR(16) NOT NULL, + target_product_type VARCHAR(16) NOT NULL, + package_file_id VARCHAR(64) NOT NULL, + package_path VARCHAR(1024) NULL, + staging_dir VARCHAR(1024) NULL, + runner_state_path VARCHAR(1024) NULL, + storage_enc_key_fingerprint VARCHAR(128) NOT NULL, + authenticity_key_fingerprint VARCHAR(128) NOT NULL, + restore_plan_json JSON NULL, + consistency_report_json JSON NULL, + error_code VARCHAR(64) NULL, + error_message VARCHAR(1024) NULL, + remark VARCHAR(1024) NULL, + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + start_time DATETIME(3) NULL, + finish_time DATETIME(3) NULL, + UNIQUE KEY uk_tms_resource_restore_task_task_id (task_id), + UNIQUE KEY uk_tms_resource_restore_task_precheck_id (precheck_id), + KEY idx_tms_resource_restore_task_status (status), + KEY idx_tms_resource_restore_task_create_time (create_time) +) COMMENT='资源恢复任务表'; +-- ----------------------------------------------------------------------------- +-- 认证与设备基础表 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_device_node ( + id BIGINT PRIMARY KEY, + node_id VARCHAR(64) NOT NULL, + host VARCHAR(128) NOT NULL, + status VARCHAR(32) NOT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_device_node_node_id (node_id) +) COMMENT='设备节点表'; + +CREATE TABLE IF NOT EXISTS tms_file_record ( + id BIGINT PRIMARY KEY, + file_id VARCHAR(64) NOT NULL, + original_filename VARCHAR(255) NOT NULL, + storage_path VARCHAR(1024) NOT NULL, + status VARCHAR(32) NOT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_file_record_file_id (file_id) +) COMMENT='文件记录表'; + +-- ----------------------------------------------------------------------------- +-- 设备软件版本 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_device_software_version ( + id BIGINT PRIMARY KEY, + component_code VARCHAR(64) NOT NULL, + component_name VARCHAR(128) NOT NULL, + current_version VARCHAR(128) NOT NULL, + source_type VARCHAR(32) NOT NULL, + detected_at DATETIME NULL, + remarks VARCHAR(255) NULL, + create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP, + update_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, + UNIQUE KEY uk_tms_device_software_version_component_code (component_code) +) COMMENT='设备软件版本表'; + +INSERT INTO tms_device_software_version +(id, component_code, component_name, current_version, source_type, detected_at, remarks) +VALUES + (1001, 'RABBITMQ', '消息队列', 'V3.8.21', 'MANUAL', NOW(), '出厂预置'), + (1002, 'TLQ', '消息队列', 'V8.1.11', 'MANUAL', NOW(), '出厂预置'), + (1003, 'TIDB', '数据库', 'V8.1.0', 'MANUAL', NOW(), '出厂预置'), + (1004, 'NGINX', 'Nginx', 'V1.20', 'MANUAL', NOW(), '出厂预置'), + (1005, 'RECEIVER', '标准收发器', 'V1.3.2', 'MANUAL', NOW(), '出厂预置'), + (1006, 'TMS', 'CISD终端管理服务', 'V1.0.0', 'MANUAL', NOW(), '出厂预置') +ON DUPLICATE KEY UPDATE + component_name = VALUES(component_name), + current_version = VALUES(current_version), + source_type = VALUES(source_type), + detected_at = VALUES(detected_at), + remarks = VALUES(remarks), + update_time = CURRENT_TIMESTAMP; + +-- ----------------------------------------------------------------------------- +-- 升级任务 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_upgrade_task ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + upgrade_mode VARCHAR(16) NOT NULL, + task_type VARCHAR(32) NOT NULL, + product_type VARCHAR(16) NULL, + package_file_id VARCHAR(64) NOT NULL, + package_name VARCHAR(255) NOT NULL, + package_hash VARCHAR(128) NOT NULL, + current_version VARCHAR(64) NOT NULL, + target_version VARCHAR(64) NOT NULL, + status VARCHAR(32) NOT NULL, + verify_passed TINYINT(1) NOT NULL DEFAULT 0, + verify_message VARCHAR(1024) NULL, + manifest_json TEXT NULL, + detail_log_path VARCHAR(1024) NULL, + error_message VARCHAR(1024) NULL, + operator VARCHAR(64) NULL, + started_at DATETIME(3) NULL, + finished_at DATETIME(3) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_upgrade_task_task_id (task_id), + KEY idx_tms_upgrade_task_status (status), + KEY idx_tms_upgrade_task_task_type (task_type), + KEY idx_tms_upgrade_task_create_time (create_time) +) COMMENT='升级任务表'; + +-- ----------------------------------------------------------------------------- +-- 新认证体系 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_role_account ( + id BIGINT PRIMARY KEY, + role_code VARCHAR(64) NOT NULL, + display_name VARCHAR(128) NOT NULL, + required_ukey_count INT NOT NULL, + status VARCHAR(32) NOT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_role_account_role_code (role_code) +) COMMENT='角色账号表'; + +CREATE TABLE IF NOT EXISTS tms_role_ukey_binding ( + id BIGINT PRIMARY KEY, + role_code VARCHAR(64) NOT NULL, + uid INT NOT NULL, + ukey_serial VARCHAR(128) NOT NULL, + ukey_pubkey TEXT NOT NULL, + issuer_sign TEXT NULL, + status VARCHAR(32) NOT NULL, + bound_at DATETIME(3) NOT NULL, + unbound_at DATETIME(3) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_role_ukey_binding_role_uid_serial (role_code, uid, ukey_serial), + KEY idx_tms_role_ukey_binding_role_uid_status (role_code, uid, status), + KEY idx_tms_role_ukey_binding_role_status (role_code, status) +) COMMENT='角色UKey绑定表'; + +CREATE TABLE IF NOT EXISTS tms_auth_full_account ( + id BIGINT PRIMARY KEY, + role_code VARCHAR(64) NOT NULL, + uid INT NOT NULL, + account_name VARCHAR(64) NOT NULL, + display_name VARCHAR(128) NOT NULL, + password_hash VARCHAR(256) NOT NULL, + password_salt VARCHAR(128) NOT NULL, + status VARCHAR(32) NOT NULL, + need_change_password TINYINT(1) NOT NULL DEFAULT 1, + password_changed_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + failed_count INT NOT NULL DEFAULT 0, + locked_until DATETIME(3) NULL, + last_login_at DATETIME(3) NULL, + last_active_at DATETIME(3) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_auth_full_account_role_uid (role_code, uid), + UNIQUE KEY uk_tms_auth_full_account_name (account_name), + KEY idx_tms_auth_full_account_role_code (role_code) +) COMMENT='完整认证账号表'; + +CREATE TABLE IF NOT EXISTS tms_auth_session ( + id BIGINT PRIMARY KEY, + session_token VARCHAR(128) NOT NULL, + role_code VARCHAR(64) NOT NULL, + authenticated_principals_json JSON NULL, + auth_method VARCHAR(32) NOT NULL, + auth_level VARCHAR(32) NOT NULL, + issued_at DATETIME(3) NOT NULL, + last_active_at DATETIME(3) NOT NULL, + expires_at DATETIME(3) NOT NULL, + logout_at DATETIME(3) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_auth_session_token (session_token), + KEY idx_tms_auth_session_role_code (role_code) +) COMMENT='认证会话表'; + +-- ----------------------------------------------------------------------------- +-- 防重放与安全事件 +-- ----------------------------------------------------------------------------- + +CREATE TABLE IF NOT EXISTS tms_replay_nonce ( + id BIGINT PRIMARY KEY, + scope VARCHAR(32) NOT NULL COMMENT '防重放作用域：OPENAPI / INTERNAL_API', + principal_id VARCHAR(128) NOT NULL COMMENT '主体标识：appId / sessionToken', + nonce VARCHAR(128) NOT NULL, + request_timestamp BIGINT NOT NULL, + request_method VARCHAR(16) NULL, + request_path VARCHAR(256) NULL, + body_hash VARCHAR(128) NULL, + remote_ip VARCHAR(64) NULL, + user_agent VARCHAR(512) NULL, + expires_at DATETIME(3) NOT NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce), + KEY idx_tms_replay_nonce_expires_at (expires_at), + KEY idx_tms_replay_nonce_principal_time (principal_id, create_time) +) COMMENT='防重放nonce表'; + +CREATE TABLE IF NOT EXISTS tms_security_event ( + id BIGINT PRIMARY KEY, + event_type VARCHAR(64) NOT NULL, + scope VARCHAR(32) NOT NULL, + principal_id VARCHAR(128) NULL, + request_method VARCHAR(16) NULL, + request_path VARCHAR(256) NULL, + nonce VARCHAR(128) NULL, + remote_ip VARCHAR(64) NULL, + detail_json JSON NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + KEY idx_tms_security_event_event_type (event_type), + KEY idx_tms_security_event_scope_principal (scope, principal_id) +) COMMENT='安全事件表'; + +INSERT IGNORE INTO tms_role_account ( + id, + role_code, + display_name, + required_ukey_count, + status, + create_time, + update_time +) +VALUES + ( + 11001, + 'SUPER_ADMIN', + '超级管理员', + 2, + 'ACTIVE', + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 11002, + 'KEY_ADMIN', + '密钥管理员', + 1, + 'UNENABLED', + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 11003, + 'AUDIT_ADMIN', + '审计管理员', + 1, + 'UNENABLED', + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 11004, + 'OPS_ADMIN', + '运维管理员', + 1, + 'UNENABLED', + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ); + +INSERT IGNORE INTO tms_auth_full_account ( + id, + role_code, + uid, + account_name, + display_name, + password_hash, + password_salt, + status, + need_change_password, + password_changed_at, + failed_count, + locked_until, + last_login_at, + last_active_at, + create_time, + update_time +) +VALUES + ( + 12101, + 'SUPER_ADMIN', + 1, + 'super-admin-full-01', + '超级管理员UKey席位一', + 'vVPlH2UGQcXUo7NblMJMaof32um6UinF8zsckZuxe9E=', + '3df85c2988a5de2b9eeaa8109639641a', + 'ACTIVE', + 1, + CURRENT_TIMESTAMP(3), + 0, + NULL, + NULL, + NULL, + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 12102, + 'SUPER_ADMIN', + 2, + 'super-admin-full-02', + '超级管理员UKey席位二', + '25e83ejpUmjU64cYAKcDV5hhqClEu6aol8YyR3Jey7E=', + '50de03346bb1f6afc74938acf5e88560', + 'ACTIVE', + 1, + CURRENT_TIMESTAMP(3), + 0, + NULL, + NULL, + NULL, + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 12103, + 'KEY_ADMIN', + 1, + 'key-admin-full-01', + '密钥管理员UKey席位', + 'l65Pr7MxOvqPOe0u6ozGGZcT4raTXUgDYMQfLTINTyE=', + '073cd5fd30701edfcf033e8f501b2b43', + 'ACTIVE', + 1, + CURRENT_TIMESTAMP(3), + 0, + NULL, + NULL, + NULL, + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 12104, + 'AUDIT_ADMIN', + 1, + 'audit-admin-full-01', + '审计管理员UKey席位', + 'ZRwdn3TOotyXAytO4zeSpxRm/68Rm8VcB7w7VJmZPYc=', + '57e2616077bd8af5cb90fc9790f69573', + 'ACTIVE', + 1, + CURRENT_TIMESTAMP(3), + 0, + NULL, + NULL, + NULL, + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ), + ( + 12105, + 'OPS_ADMIN', + 1, + 'ops-admin-full-01', + '运维管理员UKey席位', + '5Wu8Mf5hC3kq4gm/62/T7pO+aZIw8Y7uYoMIztWyT1w=', + 'a6bea7601138e90a540b39c73d53df81', + 'ACTIVE', + 1, + CURRENT_TIMESTAMP(3), + 0, + NULL, + NULL, + NULL, + CURRENT_TIMESTAMP(3), + CURRENT_TIMESTAMP(3) + ); + +-- ----------------------------------------------------------------------------- +-- 兼容旧库默认口令摘要升级 +-- ----------------------------------------------------------------------------- +-- 旧版本默认账号保存的是 PBKDF2('Sunyard@123', password_salt)。 +-- 当前版本前端提交 password=SM3('Sunyard@123')，因此默认账号统一重置为 +-- 固定 salt + PBKDF2(SM3('Sunyard@123'), salt)，便于旧库直接切换到摘要口径。 +UPDATE tms_auth_full_account +SET password_hash = 'vVPlH2UGQcXUo7NblMJMaof32um6UinF8zsckZuxe9E=', + password_salt = '3df85c2988a5de2b9eeaa8109639641a', + update_time = CURRENT_TIMESTAMP(3) +WHERE role_code = 'SUPER_ADMIN' + AND uid = 1; + +UPDATE tms_auth_full_account +SET password_hash = '25e83ejpUmjU64cYAKcDV5hhqClEu6aol8YyR3Jey7E=', + password_salt = '50de03346bb1f6afc74938acf5e88560', + update_time = CURRENT_TIMESTAMP(3) +WHERE role_code = 'SUPER_ADMIN' + AND uid = 2; + +UPDATE tms_auth_full_account +SET password_hash = 'l65Pr7MxOvqPOe0u6ozGGZcT4raTXUgDYMQfLTINTyE=', + password_salt = '073cd5fd30701edfcf033e8f501b2b43', + update_time = CURRENT_TIMESTAMP(3) +WHERE role_code = 'KEY_ADMIN' + AND uid = 1; + +UPDATE tms_auth_full_account +SET password_hash = 'ZRwdn3TOotyXAytO4zeSpxRm/68Rm8VcB7w7VJmZPYc=', + password_salt = '57e2616077bd8af5cb90fc9790f69573', + update_time = CURRENT_TIMESTAMP(3) +WHERE role_code = 'AUDIT_ADMIN' + AND uid = 1; + +UPDATE tms_auth_full_account +SET password_hash = '5Wu8Mf5hC3kq4gm/62/T7pO+aZIw8Y7uYoMIztWyT1w=', + password_salt = 'a6bea7601138e90a540b39c73d53df81', + update_time = CURRENT_TIMESTAMP(3) +WHERE role_code = 'OPS_ADMIN' + AND uid = 1; + + +-- ----------------------------------------------------------------------------- +-- IP白名单表 +-- ----------------------------------------------------------------------------- +CREATE TABLE IF NOT EXISTS tms_access_whitelist ( + id BIGINT PRIMARY KEY AUTO_INCREMENT, + ip VARCHAR(32) NOT NULL, + mask VARCHAR(10) NOT NULL, + create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) +) COMMENT='访问白名单表'; + + +-- ----------------------------------------------------------------------------- +-- Cert module tables +-- ----------------------------------------------------------------------------- +CREATE TABLE IF NOT EXISTS tms_key_entity ( + id BIGINT PRIMARY KEY, + org_code VARCHAR(64) NOT NULL COMMENT 'organization code', + org_name VARCHAR(255) NOT NULL COMMENT 'organization name', + algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 / RSA', + key_len INT NOT NULL COMMENT 'SM2 fixed 256 in V1', + key_idx INT NOT NULL COMMENT 'card key index, allowed range [2..8]', + backup_data TEXT NOT NULL COMMENT 'SDFE_BackupUserKey output', + public_key VARCHAR(500) NOT NULL COMMENT 'public key, Base64/PEM', + p10_data VARCHAR(2000) NULL COMMENT 'PKCS#10 PEM content', + subject_dn VARCHAR(500) NULL COMMENT 'DN used when generating P10', + cert_mode VARCHAR(16) NULL COMMENT 'SINGLE / DOUBLE', + status VARCHAR(32) NOT NULL COMMENT 'CREATED / P10_GENERATED / CERT_IMPORTED', + allow_ips VARCHAR(500) NULL COMMENT 'allowed source IP list', + sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1', + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_key_entity_key_idx (key_idx), + KEY idx_tms_key_entity_org_code (org_code), + KEY idx_tms_key_entity_algo (algo_type), + KEY idx_tms_key_entity_status (status), + KEY idx_tms_key_entity_create_time (create_time) +) COMMENT='密钥实体表'; + +CREATE TABLE IF NOT EXISTS tms_certificate ( + id BIGINT PRIMARY KEY, + entity_id BIGINT NULL COMMENT 'required when cert_type=ENTITY', + cert_type VARCHAR(16) NOT NULL COMMENT 'ENTITY / USER', + subject_dn VARCHAR(500) NOT NULL, + issuer_dn VARCHAR(1024) NOT NULL, + serial_number VARCHAR(128) NOT NULL, + algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1', + fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint', + cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content', + valid_from DATETIME(3) NOT NULL, + valid_to DATETIME(3) NOT NULL, + import_time DATETIME(3) NOT NULL, + sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1', + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_certificate_fingerprint (fingerprint), + KEY idx_tms_certificate_entity_id (entity_id), + KEY idx_tms_certificate_cert_type (cert_type), + KEY idx_tms_certificate_issuer_dn (issuer_dn(512)), + KEY idx_tms_certificate_valid_to (valid_to), + KEY idx_tms_certificate_import_time (import_time) +) COMMENT='证书表'; + +CREATE TABLE IF NOT EXISTS tms_trusted_cert ( + id BIGINT PRIMARY KEY, + alias VARCHAR(128) NULL, + subject_dn VARCHAR(1024) NOT NULL, + issuer_dn VARCHAR(1024) NOT NULL, + serial_number VARCHAR(128) NOT NULL, + algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1', + fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint', + cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content', + ca_level TINYINT NOT NULL COMMENT '0:Root, 1:Intermediate', + valid_from DATETIME(3) NOT NULL, + valid_to DATETIME(3) NOT NULL, + import_time DATETIME(3) NOT NULL, + sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1', + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_trusted_cert_fingerprint (fingerprint), + KEY idx_tms_trusted_cert_subject_dn (subject_dn(512)), + KEY idx_tms_trusted_cert_issuer_dn (issuer_dn(512)), + KEY idx_tms_trusted_cert_valid_to (valid_to) +) COMMENT='可信证书表'; + +CREATE TABLE IF NOT EXISTS tms_certificate_crl ( + id BIGINT PRIMARY KEY, + issuer_dn VARCHAR(1024) NOT NULL, + crl_number VARCHAR(128) NULL, + algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1', + fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint', + crl_data MEDIUMTEXT NOT NULL COMMENT 'reserved legacy CRL PEM content; large CRLs are not stored inline', + this_update DATETIME(3) NOT NULL, + next_update DATETIME(3) NULL, + revoked_count INT NOT NULL, + import_time DATETIME(3) NOT NULL, + create_by VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_certificate_crl_fingerprint (fingerprint), + KEY idx_tms_certificate_crl_issuer_dn (issuer_dn(512)), + KEY idx_tms_certificate_crl_this_update (this_update), + KEY idx_tms_certificate_crl_next_update (next_update) +) COMMENT='证书CRL表'; + +CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked ( + id BIGINT PRIMARY KEY, + crl_id BIGINT NOT NULL, + issuer_dn VARCHAR(1024) NOT NULL, + serial_number VARCHAR(128) NOT NULL, + subject_dn VARCHAR(1024) NULL, + algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1', + crl_number VARCHAR(128) NULL, + revocation_time DATETIME(3) NOT NULL, + revocation_reason VARCHAR(64) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + KEY idx_tms_certificate_crl_revoked_crl_id (crl_id), + KEY idx_tms_certificate_crl_revoked_issuer_serial (issuer_dn(512), serial_number), + KEY idx_tms_certificate_crl_revoked_subject_dn (subject_dn(512)), + KEY idx_tms_certificate_crl_revoked_revocation_time (revocation_time) +) COMMENT='证书CRL吊销明细表'; + +CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task ( + id BIGINT PRIMARY KEY, + task_id VARCHAR(64) NOT NULL, + original_filename VARCHAR(255) NULL, + file_size BIGINT NULL, + status VARCHAR(32) NOT NULL COMMENT 'PENDING/RUNNING/SUCCESS/FAILED', + fingerprint VARCHAR(128) NULL COMMENT 'SHA-256 fingerprint after successful parse', + crl_id BIGINT NULL, + revoked_count INT NOT NULL DEFAULT 0, + error_message VARCHAR(512) NULL, + started_at DATETIME(3) NULL, + finished_at DATETIME(3) NULL, + create_time DATETIME(3) NOT NULL, + update_time DATETIME(3) NOT NULL, + UNIQUE KEY uk_tms_certificate_crl_import_task_task_id (task_id), + KEY idx_tms_certificate_crl_import_task_status (status), + KEY idx_tms_certificate_crl_import_task_create_time (create_time) +) COMMENT='证书CRL导入任务表'; + + +-- ----------------------------------------------------------------------------- +-- 日志表 +-- ----------------------------------------------------------------------------- +CREATE TABLE IF NOT EXISTS tms_operation_audit_log ( + id BIGINT PRIMARY KEY, + log_id VARCHAR(64) NOT NULL COMMENT '日志唯一标识', + operator_role_code VARCHAR(64) NULL COMMENT '操作角色编码', + operator_auth_level VARCHAR(32) NULL COMMENT '操作时认证等级', + module_code VARCHAR(32) NOT NULL COMMENT '业务模块', + action_type VARCHAR(32) NOT NULL COMMENT '操作动作', + remote_ip VARCHAR(64) NULL COMMENT '来源IP', + operation_result VARCHAR(16) NOT NULL COMMENT '操作结果: SUCCESS/FAILED/DENIED', + summary VARCHAR(512) NOT NULL COMMENT '操作摘要', + error_message VARCHAR(1024) NULL COMMENT '失败原因', + audit_status VARCHAR(16) NOT NULL COMMENT '审计状态: PENDING/REVIEWED', + audit_result VARCHAR(16) NULL COMMENT '审计结果: PASS/REJECT/NEED_VERIFY', + audit_comment VARCHAR(1024) NULL COMMENT '审计意见', + audited_by VARCHAR(64) NULL COMMENT '审计人', + audited_at DATETIME(3) NULL COMMENT '审计时间', + payload_hash VARCHAR(128) NOT NULL COMMENT 'SM3摘要', + sign_value TEXT NOT NULL COMMENT 'SM2签名值', + occurred_at DATETIME(3) NOT NULL COMMENT '操作发生时间', + create_time DATETIME(3) NOT NULL COMMENT '落库时间', + UNIQUE KEY uk_tms_operation_audit_log_log_id (log_id), + KEY idx_tms_operation_audit_log_role_code (operator_role_code), + KEY idx_tms_operation_audit_log_module_code (module_code), + KEY idx_tms_operation_audit_log_action_type (action_type), + KEY idx_tms_operation_audit_log_result (operation_result), + KEY idx_tms_operation_audit_log_audit_status (audit_status), + KEY idx_tms_operation_audit_log_occurred_at (occurred_at) +) COMMENT='操作审计日志表'; + + + +-- ----------------------------------------------------------------------------- +-- 日志备份记录表 +-- ----------------------------------------------------------------------------- +CREATE TABLE IF NOT EXISTS tms_log_backup_record ( + id BIGINT NOT NULL AUTO_INCREMENT COMMENT '主键ID', + record_id VARCHAR(64) NOT NULL COMMENT '备份记录ID', + file_name VARCHAR(255) NOT NULL COMMENT '备份文件名', + backup_type VARCHAR(32) NOT NULL COMMENT '备份类型（如：AUTO/MANUAL）', + file_path VARCHAR(500) NOT NULL COMMENT '文件存储路径', + file_hash VARCHAR(128) NOT NULL COMMENT '文件哈希值', + file_sign VARCHAR(256) DEFAULT NULL COMMENT '文件签名', + backup_result VARCHAR(32) NOT NULL COMMENT '备份结果（SUCCESS/FAILED）', + create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间', + sign_data TEXT DEFAULT NULL COMMENT '其他字段签名', + PRIMARY KEY (`id`), + UNIQUE KEY `uk_record_id` (`record_id`), + KEY `idx_create_time` (`create_time`), + KEY `idx_backup_type` (`backup_type`) +) COMMENT='日志备份记录表'; + + + +-- ----------------------------------------------------------------------------- +-- 日志备份配置表 +-- ----------------------------------------------------------------------------- +CREATE TABLE IF NOT EXISTS tms_backup_config ( + id int(11) NOT NULL AUTO_INCREMENT COMMENT '主键', + enable tinyint(4) NOT NULL DEFAULT '0' COMMENT '启用状态 1:启用 0:禁用', + cron_exp varchar(64) DEFAULT NULL COMMENT 'Cron表达式', + retention_count int(11) DEFAULT '1' COMMENT '保留份数', + last_backup_time datetime DEFAULT NULL COMMENT '上次执行时间', + sign_data varchar(255) NOT NULL COMMENT '其他字段的签名值', + PRIMARY KEY (`id`) +) COMMENT='日志备份配置表'; + + +CREATE TABLE IF NOT EXISTS tms_master_key_activate ( + id BIGINT PRIMARY KEY AUTO_INCREMENT, + + ever_initialized BOOLEAN NOT NULL, + + activation_status BOOLEAN NOT NULL, + + create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), + update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) +) COMMENT='主密钥激活状态表'; + +INSERT IGNORE INTO tms_master_key_activate ( + id, + ever_initialized, + activation_status +) VALUES (1, true, true); + + +ALTER TABLE tms_access_whitelist ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_auth_audit_log ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_auth_challenge ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_auth_full_account ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_auth_session ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_backup_config ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_certificate ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_certificate_crl ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_certificate_crl_import_task ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_certificate_crl_revoked ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_device_node ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_device_software_version ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_file_record ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_init_task ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_init_task_step ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_key_entity ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_log_backup_record ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_master_key_activate ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_operation_audit_log ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_replay_nonce ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_resource_backup_task ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_resource_restore_task ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_role_account ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_role_ukey_binding ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_security_event ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_trusted_cert ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; +ALTER TABLE tms_upgrade_task ADD signature varchar(250) NULL COMMENT '数据真实性签名值'; diff --git a/src/test/java/com/cisd/tms/TmsApplicationTests.java b/src/test/java/com/cisd/tms/TmsApplicationTests.java index 9178d58..5d3b6b9 100644 --- a/src/test/java/com/cisd/tms/TmsApplicationTests.java +++ b/src/test/java/com/cisd/tms/TmsApplicationTests.java @@ -63,7 +63,7 @@ class TmsApplicationTests { @Test void shouldCreateAuthRoleTablesAndSeedFixedRoleAccounts() { - ClassPathResource migration = new ClassPathResource("db/migration/V1__tms_schema_full.sql"); + ClassPathResource migration = new ClassPathResource("db/migration/V2__tms_schema_full.sql"); org.junit.jupiter.api.Assertions.assertTrue(migration.exists()); @@ -87,18 +87,22 @@ class TmsApplicationTests { } @Test - void shouldKeepOnlyOneFullMigrationWithTmsTableNamesAndRandomDefaultPasswordSalts() throws Exception { - ClassPathResource migration = new ClassPathResource("db/migration/V1__tms_schema_full.sql"); + void shouldKeepRetainedV1AndCurrentV2FullMigrationsWithTmsTableNamesAndRandomDefaultPasswordSalts() throws Exception { + ClassPathResource migration = new ClassPathResource("db/migration/V2__tms_schema_full.sql"); String sql = new String(migration.getInputStream().readAllBytes(), StandardCharsets.UTF_8); - long migrationCount; + java.util.Set migrationFiles; try (java.util.stream.Stream paths = java.nio.file.Files.list(java.nio.file.Path.of("src/main/resources/db/migration"))) { - migrationCount = paths + migrationFiles = paths .filter(path -> path.getFileName().toString().endsWith(".sql")) - .count(); + .map(path -> path.getFileName().toString()) + .collect(java.util.stream.Collectors.toSet()); } - org.junit.jupiter.api.Assertions.assertEquals(1, migrationCount); + org.junit.jupiter.api.Assertions.assertEquals( + java.util.Set.of("V1__tms_schema_full.sql", "V2__tms_schema_full.sql"), + migrationFiles + ); org.junit.jupiter.api.Assertions.assertFalse(sql.contains("CREATE TABLE IF NOT EXISTS t_")); org.junit.jupiter.api.Assertions.assertFalse(sql.contains("FROM t_")); diff --git a/src/test/java/com/cisd/tms/modules/backup/repository/ResourceTaskSchemaContractTest.java b/src/test/java/com/cisd/tms/modules/backup/repository/ResourceTaskSchemaContractTest.java index c796917..00abcbe 100644 --- a/src/test/java/com/cisd/tms/modules/backup/repository/ResourceTaskSchemaContractTest.java +++ b/src/test/java/com/cisd/tms/modules/backup/repository/ResourceTaskSchemaContractTest.java @@ -9,9 +9,9 @@ class ResourceTaskSchemaContractTest { @Test void shouldExposeResourceTaskSchemaAndEnums() throws Exception { - String v1Sql = readClasspathResource("db/migration/V1__tms_schema_full.sql"); + String fullSql = readClasspathResource("db/migration/V2__tms_schema_full.sql"); - assertContainsAll(v1Sql, + assertContainsAll(fullSql, "CREATE TABLE IF NOT EXISTS tms_resource_backup_task", "backup_id VARCHAR(64) NOT NULL", "package_path VARCHAR(1024) NULL", @@ -28,7 +28,7 @@ class ResourceTaskSchemaContractTest { "consistency_report_json JSON NULL", "error_code VARCHAR(64) NULL"); - Assertions.assertFalse(v1Sql.contains("tms_resource_task_step")); + Assertions.assertFalse(fullSql.contains("tms_resource_task_step")); } private static String readClasspathResource(String path) throws Exception { diff --git a/src/test/java/com/cisd/tms/modules/cert/repository/impl/CertSchemaContractTest.java b/src/test/java/com/cisd/tms/modules/cert/repository/impl/CertSchemaContractTest.java index b34c378..690daa2 100644 --- a/src/test/java/com/cisd/tms/modules/cert/repository/impl/CertSchemaContractTest.java +++ b/src/test/java/com/cisd/tms/modules/cert/repository/impl/CertSchemaContractTest.java @@ -12,12 +12,12 @@ class CertSchemaContractTest { @Test void certSchemaShouldAllowTrustedAliasToBeNullAndStoreLargeKeyBackupData() throws Exception { - String v1Sql = readClasspathResource("db/migration/V1__tms_schema_full.sql"); + String fullSql = readClasspathResource("db/migration/V2__tms_schema_full.sql"); - assertFalse(v1Sql.contains("alias VARCHAR(128) NOT NULL"), v1Sql); - assertTrue(v1Sql.contains("alias VARCHAR(128) NULL"), v1Sql); - assertFalse(v1Sql.contains("backup_data VARCHAR(500)"), v1Sql); - assertTrue(v1Sql.contains("backup_data TEXT NOT NULL"), v1Sql); + assertFalse(fullSql.contains("alias VARCHAR(128) NOT NULL"), fullSql); + assertTrue(fullSql.contains("alias VARCHAR(128) NULL"), fullSql); + assertFalse(fullSql.contains("backup_data VARCHAR(500)"), fullSql); + assertTrue(fullSql.contains("backup_data TEXT NOT NULL"), fullSql); } private String readClasspathResource(String location) throws Exception {