fix：日志记录

src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java

@@ -79,7 +79,7 @@ public class AuthAdminController {
 
     @PostMapping("/super-admin/ukeys/issue-sign")
     @Operation(summary = "签发并绑定超级管理员 UKey", description = "系统初始化后登记超级管理员 UKey，不要求已有登录态。")
-    @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定超级管理员 UKey")
+//    @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.BIND, summary = "签发并绑定超级管理员 UKey")
     public ApiResponse<UKeySignResult> issueSuperAdminUkeyBindingSign(
             @Valid @RequestBody UKeySignDTO request
     ) {

src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java

@@ -61,7 +61,7 @@ public class AuthController {
     @PostMapping("/logout")
     @Operation(summary = "退出当前会话", description = "使当前会话失效。")
     @AuditedOperation(module = ModuleCode.AUTH, action = ActionType.LOGOUT, summary = "退出当前会话")
-    @ReplayProtected
+//    @ReplayProtected
     public ApiResponse<Void> logout(HttpServletRequest request) {
         authService.logout((String) request.getAttribute(InternalApiAuthInterceptor.ATTR_SESSION_TOKEN));
         return ApiResponse.success();

src/main/java/com/cisd/tms/modules/device/controller/NetworkConfigController.java

@@ -44,7 +44,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "配置网卡", description = "配置指定网卡的 IPv4 或 IPv6 地址、前缀长度、网关和状态")
     @PostMapping("/card/configure")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置网卡")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置网卡")
     public ApiResponse<Void> configureNetworkCard(@RequestBody @Validated NetworkConfigureRequest request) {
         networkConfigService.configureNetworkCard(request);
         return ApiResponse.success();
@@ -52,7 +52,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "新增网卡配置", description = "新增或配置指定网卡的网络地址信息")
     @PostMapping("/card/add")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增网卡配置")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增网卡配置")
     public ApiResponse<Void> addNetworkCard(@RequestBody @Validated NetworkConfigureRequest req) {
         networkConfigService.configureNetworkCard(req);
         return ApiResponse.success();
@@ -60,7 +60,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "删除网卡 IP 配置", description = "删除指定网卡下的某条 IPv4 或 IPv6 地址配置")
     @PostMapping("/card/delete")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除网卡IP配置")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除网卡IP配置")
     public ApiResponse<Void> deleteNetworkCardRecord(@RequestBody NetworkDeleteRequest req) {
         networkConfigService.deleteNetworkCardRecord(req);
         return ApiResponse.success();
@@ -75,7 +75,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "删除 Bond", description = "删除指定 Bond 聚合接口及其从属网卡连接配置")
     @PostMapping("/bond/delete/{bondName}")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除Bond")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除Bond")
     public ApiResponse<Void> deleteBond(@PathVariable String bondName) {
         networkConfigService.deleteBond(bondName);
         return ApiResponse.success();
@@ -90,7 +90,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "创建Bond", description = "创建一个新的Bond聚合接口，需指定名称、模式和从属接口")
     @PostMapping("/bond/create")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "创建Bond")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "创建Bond")
     public ApiResponse<Void> createBond(@Valid @RequestBody BondCreateRequest req) {
         networkConfigService.createBond(req);
         return ApiResponse.success();
@@ -98,7 +98,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "配置 Bond", description = "修改指定 Bond 的模式、IP 地址、网关、从属物理网卡和激活状态")
     @PostMapping("/bond/config")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置Bond")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "配置Bond")
     public ApiResponse<Void> configBond(@Valid @RequestBody BondConfigRequest req) {
         networkConfigService.configBond(req);
         return ApiResponse.success();
@@ -112,7 +112,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "新增路由", description = "新增一条 IPv4 或 IPv6 静态路由配置，可指定目标地址、前缀长度、网口和下一跳")
     @PostMapping("/route/add")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增路由")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.CREATE, summary = "新增路由")
     public ApiResponse<Void> routeAdd(@Valid @RequestBody RouteCreateRequest req) {
         networkConfigService.addRoute(req);
         return ApiResponse.success();
@@ -120,7 +120,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "修改路由", description = "修改一条已有静态路由，通过删除旧路由并新增新路由实现")
     @PostMapping("/route/update")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "修改路由")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.UPDATE, summary = "修改路由")
     public ApiResponse<Void> routeUpdate(@Valid @RequestBody RouteUpdateRequest req) {
         networkConfigService.updateRoute(req);
         return ApiResponse.success();
@@ -128,7 +128,7 @@ public class NetworkConfigController {
 
     @Operation(summary = "删除路由", description = "删除指定网口下的一条 IPv4 或 IPv6 静态路由配置")
     @PostMapping("/route/delete")
-    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除路由")
+//    @AuditedOperation(module = ModuleCode.NETWORK, action = ActionType.DELETE, summary = "删除路由")
     public ApiResponse<Void> routeDelete(@Valid @RequestBody RouteDeleteRequest req) {
         networkConfigService.deleteRoute(req);
         return ApiResponse.success();

src/main/java/com/cisd/tms/modules/device/controller/TimeConfigController.java

@@ -27,7 +27,7 @@ public class TimeConfigController {
 
     @PostMapping("/time-config")
     @RequireInternalAuth(role = RoleCode.OPS_ADMIN, authLevel = AuthLevel.FULL, allowBeforeMasterKeyInitialized = true)
-    @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "配置系统时间")
+//    @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.UPDATE, summary = "配置系统时间")
     public ApiResponse<Void> configureTime(@RequestBody TimeConfigRequest request) {
         timeConfigService.processTimeConfig(request);
         return ApiResponse.success();

src/main/java/com/cisd/tms/modules/mk/controller/LmkController.java

@@ -38,7 +38,6 @@ public class LmkController {
 
     @PostMapping("/masterKey/init")
     @Operation(summary = "初始化主密钥", description = "执行密码卡初始化识别、主密钥生成加载、内部密钥生成，并返回主密钥状态与校验值。")
-    @AuditedOperation(module = ModuleCode.KEY, action = ActionType.CREATE, summary = "初始化主密钥")
     public ApiResponse<MasterKeyStateResult> initMasterKey() {
         return ApiResponse.success(lmkService.initMasterKey());
     }
@@ -47,7 +46,6 @@ public class LmkController {
     @Operation(summary = "销毁主密钥", description = "销毁当前密码卡中的主密钥，失败直接抛出异常。")
     @ReplayProtected
     @RequireInternalAuth(role = RoleCode.SUPER_ADMIN, authLevel = AuthLevel.FULL)
-    @AuditedOperation(module = ModuleCode.KEY, action = ActionType.DELETE, summary = "销毁主密钥")
     public ApiResponse<Void> destroyMasterKey() {
         //销毁主密钥、内部密钥、用户密钥
         lmkService.destroyMasterKey();
@@ -67,7 +65,6 @@ public class LmkController {
      */
     @PostMapping("/masterKey/recover")
     @Operation(summary = "恢复全部密钥", description = "请求体需传入两份按 packetIndex 标识的备份包。两份备份包必须分别对应 packetIndex=1、2。服务端会依次恢复 LMK、IK 和用户密钥。")
-    @AuditedOperation(module = ModuleCode.KEY, action = ActionType.RECOVER, summary = "恢复全部密钥")
     public ApiResponse<Void> recoverLmkEx(@Valid @RequestBody MasterKeyRecoverPacketsRequest request) {
         validatePacketIndexes(request.getPackets());
         lmkService.recoverKeyPackets(request.getPackets());
@@ -77,7 +74,6 @@ public class LmkController {
 
     @PostMapping("/masterKey/activate")
     @Operation(summary = "设备激活")
-    @AuditedOperation(module = ModuleCode.DEVICE, action = ActionType.ENABLE, summary = "设备激活")
     public ApiResponse<Void> Activate(@RequestBody MasterKeyActivateRequest masterKeyActivateRequest) {
         masterKeyActivateService.activate(masterKeyActivateRequest);
         return ApiResponse.success();

src/main/resources/db/migration/V2__tms_schema_full.sql

@@ -0,0 +1,778 @@
+-- -----------------------------------------------------------------------------
+-- TMS 全量库结构初始化脚本
+-- 适用范围：空库初始化 / Flyway 首次建库
+-- 数据库：TiDB / MySQL 8+
+--
+-- 说明：
+-- 1. 本文件是当前仓库唯一保留的数据库初始化 SQL。
+-- 2. 结构已按当前最终状态汇总，不再依赖历史 V1~V12 逐步迁移。
+-- 3. 执行前请先选中目标数据库，本文件不再包含 CREATE DATABASE / USE。
+-- -----------------------------------------------------------------------------
+
+CREATE DATABASE IF NOT EXISTS TMS
+  DEFAULT CHARACTER SET utf8mb4
+  COLLATE utf8mb4_general_ci;
+
+USE TMS;
+
+-- -----------------------------------------------------------------------------
+-- 初始化任务
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_init_task (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    task_type VARCHAR(32) NOT NULL DEFAULT 'INIT' COMMENT '任务类型：INIT/RESET',
+    version VARCHAR(32) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    product_type VARCHAR(16) NULL,
+    org_code VARCHAR(32) NULL,
+    mq_type VARCHAR(32) NULL,
+    deploy_mode VARCHAR(16) NULL,
+    init_plan_json LONGTEXT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_init_task_task_id (task_id)
+) COMMENT='初始化任务表';
+
+CREATE TABLE IF NOT EXISTS tms_init_task_step (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    step_no INT NOT NULL,
+    step_code VARCHAR(64) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    message VARCHAR(512) NULL,
+    command_line VARCHAR(2048) NULL,
+    log_path VARCHAR(512) NULL,
+    exit_code INT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_init_task_step_task_no (task_id, step_no),
+    KEY idx_tms_init_task_step_task_id (task_id)
+) COMMENT='初始化任务步骤表';
+
+-- -----------------------------------------------------------------------------
+-- 资源备份与恢复
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_resource_backup_task (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    backup_id VARCHAR(64) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    product_type VARCHAR(16) NOT NULL,
+    mq_type VARCHAR(32) NULL,
+    org_code VARCHAR(32) NULL,
+    source_device_id VARCHAR(128) NULL,
+    package_name VARCHAR(255) NULL,
+    package_path VARCHAR(1024) NULL,
+    package_size BIGINT NULL,
+    package_hash VARCHAR(128) NULL,
+    storage_enc_key_fingerprint VARCHAR(128) NOT NULL,
+    authenticity_key_fingerprint VARCHAR(128) NOT NULL,
+    manifest_summary_json JSON NULL,
+    error_code VARCHAR(64) NULL,
+    error_message VARCHAR(1024) NULL,
+    remark VARCHAR(1024) NULL,
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    start_time DATETIME(3) NULL,
+    finish_time DATETIME(3) NULL,
+    UNIQUE KEY uk_tms_resource_backup_task_task_id (task_id),
+    UNIQUE KEY uk_tms_resource_backup_task_backup_id (backup_id),
+    KEY idx_tms_resource_backup_task_status (status),
+    KEY idx_tms_resource_backup_task_create_time (create_time)
+) COMMENT='资源备份任务表';
+
+CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    precheck_id VARCHAR(64) NOT NULL,
+    backup_id VARCHAR(64) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    source_device_id VARCHAR(128) NULL,
+    source_product_type VARCHAR(16) NOT NULL,
+    target_product_type VARCHAR(16) NOT NULL,
+    package_file_id VARCHAR(64) NOT NULL,
+    package_path VARCHAR(1024) NULL,
+    staging_dir VARCHAR(1024) NULL,
+    runner_state_path VARCHAR(1024) NULL,
+    storage_enc_key_fingerprint VARCHAR(128) NOT NULL,
+    authenticity_key_fingerprint VARCHAR(128) NOT NULL,
+    restore_plan_json JSON NULL,
+    consistency_report_json JSON NULL,
+    error_code VARCHAR(64) NULL,
+    error_message VARCHAR(1024) NULL,
+    remark VARCHAR(1024) NULL,
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    start_time DATETIME(3) NULL,
+    finish_time DATETIME(3) NULL,
+    UNIQUE KEY uk_tms_resource_restore_task_task_id (task_id),
+    UNIQUE KEY uk_tms_resource_restore_task_precheck_id (precheck_id),
+    KEY idx_tms_resource_restore_task_status (status),
+    KEY idx_tms_resource_restore_task_create_time (create_time)
+) COMMENT='资源恢复任务表';
+-- -----------------------------------------------------------------------------
+-- 认证与设备基础表
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_device_node (
+    id BIGINT PRIMARY KEY,
+    node_id VARCHAR(64) NOT NULL,
+    host VARCHAR(128) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_device_node_node_id (node_id)
+) COMMENT='设备节点表';
+
+CREATE TABLE IF NOT EXISTS tms_file_record (
+    id BIGINT PRIMARY KEY,
+    file_id VARCHAR(64) NOT NULL,
+    original_filename VARCHAR(255) NOT NULL,
+    storage_path VARCHAR(1024) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_file_record_file_id (file_id)
+) COMMENT='文件记录表';
+
+-- -----------------------------------------------------------------------------
+-- 设备软件版本
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_device_software_version (
+    id BIGINT PRIMARY KEY,
+    component_code VARCHAR(64) NOT NULL,
+    component_name VARCHAR(128) NOT NULL,
+    current_version VARCHAR(128) NOT NULL,
+    source_type VARCHAR(32) NOT NULL,
+    detected_at DATETIME NULL,
+    remarks VARCHAR(255) NULL,
+    create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    update_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY uk_tms_device_software_version_component_code (component_code)
+) COMMENT='设备软件版本表';
+
+INSERT INTO tms_device_software_version
+(id, component_code, component_name, current_version, source_type, detected_at, remarks)
+VALUES
+    (1001, 'RABBITMQ', '消息队列', 'V3.8.21', 'MANUAL', NOW(), '出厂预置'),
+    (1002, 'TLQ', '消息队列', 'V8.1.11', 'MANUAL', NOW(), '出厂预置'),
+    (1003, 'TIDB', '数据库', 'V8.1.0', 'MANUAL', NOW(), '出厂预置'),
+    (1004, 'NGINX', 'Nginx', 'V1.20', 'MANUAL', NOW(), '出厂预置'),
+    (1005, 'RECEIVER', '标准收发器', 'V1.3.2', 'MANUAL', NOW(), '出厂预置'),
+    (1006, 'TMS', 'CISD终端管理服务', 'V1.0.0', 'MANUAL', NOW(), '出厂预置')
+ON DUPLICATE KEY UPDATE
+    component_name = VALUES(component_name),
+    current_version = VALUES(current_version),
+    source_type = VALUES(source_type),
+    detected_at = VALUES(detected_at),
+    remarks = VALUES(remarks),
+    update_time = CURRENT_TIMESTAMP;
+
+-- -----------------------------------------------------------------------------
+-- 升级任务
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_upgrade_task (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    upgrade_mode VARCHAR(16) NOT NULL,
+    task_type VARCHAR(32) NOT NULL,
+    product_type VARCHAR(16) NULL,
+    package_file_id VARCHAR(64) NOT NULL,
+    package_name VARCHAR(255) NOT NULL,
+    package_hash VARCHAR(128) NOT NULL,
+    current_version VARCHAR(64) NOT NULL,
+    target_version VARCHAR(64) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    verify_passed TINYINT(1) NOT NULL DEFAULT 0,
+    verify_message VARCHAR(1024) NULL,
+    manifest_json TEXT NULL,
+    detail_log_path VARCHAR(1024) NULL,
+    error_message VARCHAR(1024) NULL,
+    operator VARCHAR(64) NULL,
+    started_at DATETIME(3) NULL,
+    finished_at DATETIME(3) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_upgrade_task_task_id (task_id),
+    KEY idx_tms_upgrade_task_status (status),
+    KEY idx_tms_upgrade_task_task_type (task_type),
+    KEY idx_tms_upgrade_task_create_time (create_time)
+) COMMENT='升级任务表';
+
+-- -----------------------------------------------------------------------------
+-- 新认证体系
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_role_account (
+    id BIGINT PRIMARY KEY,
+    role_code VARCHAR(64) NOT NULL,
+    display_name VARCHAR(128) NOT NULL,
+    required_ukey_count INT NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_role_account_role_code (role_code)
+) COMMENT='角色账号表';
+
+CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
+    id BIGINT PRIMARY KEY,
+    role_code VARCHAR(64) NOT NULL,
+    uid INT NOT NULL,
+    ukey_serial VARCHAR(128) NOT NULL,
+    ukey_pubkey TEXT NOT NULL,
+    issuer_sign TEXT NULL,
+    status VARCHAR(32) NOT NULL,
+    bound_at DATETIME(3) NOT NULL,
+    unbound_at DATETIME(3) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_role_ukey_binding_role_uid_serial (role_code, uid, ukey_serial),
+    KEY idx_tms_role_ukey_binding_role_uid_status (role_code, uid, status),
+    KEY idx_tms_role_ukey_binding_role_status (role_code, status)
+) COMMENT='角色UKey绑定表';
+
+CREATE TABLE IF NOT EXISTS tms_auth_full_account (
+    id BIGINT PRIMARY KEY,
+    role_code VARCHAR(64) NOT NULL,
+    uid INT NOT NULL,
+    account_name VARCHAR(64) NOT NULL,
+    display_name VARCHAR(128) NOT NULL,
+    password_hash VARCHAR(256) NOT NULL,
+    password_salt VARCHAR(128) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    need_change_password TINYINT(1) NOT NULL DEFAULT 1,
+    password_changed_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    failed_count INT NOT NULL DEFAULT 0,
+    locked_until DATETIME(3) NULL,
+    last_login_at DATETIME(3) NULL,
+    last_active_at DATETIME(3) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_auth_full_account_role_uid (role_code, uid),
+    UNIQUE KEY uk_tms_auth_full_account_name (account_name),
+    KEY idx_tms_auth_full_account_role_code (role_code)
+) COMMENT='完整认证账号表';
+
+CREATE TABLE IF NOT EXISTS tms_auth_session (
+    id BIGINT PRIMARY KEY,
+    session_token VARCHAR(128) NOT NULL,
+    role_code VARCHAR(64) NOT NULL,
+    authenticated_principals_json JSON NULL,
+    auth_method VARCHAR(32) NOT NULL,
+    auth_level VARCHAR(32) NOT NULL,
+    issued_at DATETIME(3) NOT NULL,
+    last_active_at DATETIME(3) NOT NULL,
+    expires_at DATETIME(3) NOT NULL,
+    logout_at DATETIME(3) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_auth_session_token (session_token),
+    KEY idx_tms_auth_session_role_code (role_code)
+) COMMENT='认证会话表';
+
+-- -----------------------------------------------------------------------------
+-- 防重放与安全事件
+-- -----------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS tms_replay_nonce (
+    id BIGINT PRIMARY KEY,
+    scope VARCHAR(32) NOT NULL COMMENT '防重放作用域：OPENAPI / INTERNAL_API',
+    principal_id VARCHAR(128) NOT NULL COMMENT '主体标识：appId / sessionToken',
+    nonce VARCHAR(128) NOT NULL,
+    request_timestamp BIGINT NOT NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    body_hash VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    user_agent VARCHAR(512) NULL,
+    expires_at DATETIME(3) NOT NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
+    KEY idx_tms_replay_nonce_expires_at (expires_at),
+    KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
+) COMMENT='防重放nonce表';
+
+CREATE TABLE IF NOT EXISTS tms_security_event (
+    id BIGINT PRIMARY KEY,
+    event_type VARCHAR(64) NOT NULL,
+    scope VARCHAR(32) NOT NULL,
+    principal_id VARCHAR(128) NULL,
+    request_method VARCHAR(16) NULL,
+    request_path VARCHAR(256) NULL,
+    nonce VARCHAR(128) NULL,
+    remote_ip VARCHAR(64) NULL,
+    detail_json JSON NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    KEY idx_tms_security_event_event_type (event_type),
+    KEY idx_tms_security_event_scope_principal (scope, principal_id)
+) COMMENT='安全事件表';
+
+INSERT IGNORE INTO tms_role_account (
+    id,
+    role_code,
+    display_name,
+    required_ukey_count,
+    status,
+    create_time,
+    update_time
+)
+VALUES
+    (
+        11001,
+        'SUPER_ADMIN',
+        '超级管理员',
+        2,
+        'ACTIVE',
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        11002,
+        'KEY_ADMIN',
+        '密钥管理员',
+        1,
+        'UNENABLED',
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        11003,
+        'AUDIT_ADMIN',
+        '审计管理员',
+        1,
+        'UNENABLED',
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        11004,
+        'OPS_ADMIN',
+        '运维管理员',
+        1,
+        'UNENABLED',
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    );
+
+INSERT IGNORE INTO tms_auth_full_account (
+    id,
+    role_code,
+    uid,
+    account_name,
+    display_name,
+    password_hash,
+    password_salt,
+    status,
+    need_change_password,
+    password_changed_at,
+    failed_count,
+    locked_until,
+    last_login_at,
+    last_active_at,
+    create_time,
+    update_time
+)
+VALUES
+    (
+        12101,
+        'SUPER_ADMIN',
+        1,
+        'super-admin-full-01',
+        '超级管理员UKey席位一',
+        'vVPlH2UGQcXUo7NblMJMaof32um6UinF8zsckZuxe9E=',
+        '3df85c2988a5de2b9eeaa8109639641a',
+        'ACTIVE',
+        1,
+        CURRENT_TIMESTAMP(3),
+        0,
+        NULL,
+        NULL,
+        NULL,
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        12102,
+        'SUPER_ADMIN',
+        2,
+        'super-admin-full-02',
+        '超级管理员UKey席位二',
+        '25e83ejpUmjU64cYAKcDV5hhqClEu6aol8YyR3Jey7E=',
+        '50de03346bb1f6afc74938acf5e88560',
+        'ACTIVE',
+        1,
+        CURRENT_TIMESTAMP(3),
+        0,
+        NULL,
+        NULL,
+        NULL,
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        12103,
+        'KEY_ADMIN',
+        1,
+        'key-admin-full-01',
+        '密钥管理员UKey席位',
+        'l65Pr7MxOvqPOe0u6ozGGZcT4raTXUgDYMQfLTINTyE=',
+        '073cd5fd30701edfcf033e8f501b2b43',
+        'ACTIVE',
+        1,
+        CURRENT_TIMESTAMP(3),
+        0,
+        NULL,
+        NULL,
+        NULL,
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        12104,
+        'AUDIT_ADMIN',
+        1,
+        'audit-admin-full-01',
+        '审计管理员UKey席位',
+        'ZRwdn3TOotyXAytO4zeSpxRm/68Rm8VcB7w7VJmZPYc=',
+        '57e2616077bd8af5cb90fc9790f69573',
+        'ACTIVE',
+        1,
+        CURRENT_TIMESTAMP(3),
+        0,
+        NULL,
+        NULL,
+        NULL,
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    ),
+    (
+        12105,
+        'OPS_ADMIN',
+        1,
+        'ops-admin-full-01',
+        '运维管理员UKey席位',
+        '5Wu8Mf5hC3kq4gm/62/T7pO+aZIw8Y7uYoMIztWyT1w=',
+        'a6bea7601138e90a540b39c73d53df81',
+        'ACTIVE',
+        1,
+        CURRENT_TIMESTAMP(3),
+        0,
+        NULL,
+        NULL,
+        NULL,
+        CURRENT_TIMESTAMP(3),
+        CURRENT_TIMESTAMP(3)
+    );
+
+-- -----------------------------------------------------------------------------
+-- 兼容旧库默认口令摘要升级
+-- -----------------------------------------------------------------------------
+-- 旧版本默认账号保存的是 PBKDF2('Sunyard@123', password_salt)。
+-- 当前版本前端提交 password=SM3('Sunyard@123')，因此默认账号统一重置为
+-- 固定 salt + PBKDF2(SM3('Sunyard@123'), salt)，便于旧库直接切换到摘要口径。
+UPDATE tms_auth_full_account
+SET password_hash = 'vVPlH2UGQcXUo7NblMJMaof32um6UinF8zsckZuxe9E=',
+    password_salt = '3df85c2988a5de2b9eeaa8109639641a',
+    update_time = CURRENT_TIMESTAMP(3)
+WHERE role_code = 'SUPER_ADMIN'
+  AND uid = 1;
+
+UPDATE tms_auth_full_account
+SET password_hash = '25e83ejpUmjU64cYAKcDV5hhqClEu6aol8YyR3Jey7E=',
+    password_salt = '50de03346bb1f6afc74938acf5e88560',
+    update_time = CURRENT_TIMESTAMP(3)
+WHERE role_code = 'SUPER_ADMIN'
+  AND uid = 2;
+
+UPDATE tms_auth_full_account
+SET password_hash = 'l65Pr7MxOvqPOe0u6ozGGZcT4raTXUgDYMQfLTINTyE=',
+    password_salt = '073cd5fd30701edfcf033e8f501b2b43',
+    update_time = CURRENT_TIMESTAMP(3)
+WHERE role_code = 'KEY_ADMIN'
+  AND uid = 1;
+
+UPDATE tms_auth_full_account
+SET password_hash = 'ZRwdn3TOotyXAytO4zeSpxRm/68Rm8VcB7w7VJmZPYc=',
+    password_salt = '57e2616077bd8af5cb90fc9790f69573',
+    update_time = CURRENT_TIMESTAMP(3)
+WHERE role_code = 'AUDIT_ADMIN'
+  AND uid = 1;
+
+UPDATE tms_auth_full_account
+SET password_hash = '5Wu8Mf5hC3kq4gm/62/T7pO+aZIw8Y7uYoMIztWyT1w=',
+    password_salt = 'a6bea7601138e90a540b39c73d53df81',
+    update_time = CURRENT_TIMESTAMP(3)
+WHERE role_code = 'OPS_ADMIN'
+  AND uid = 1;
+
+
+-- -----------------------------------------------------------------------------
+-- IP白名单表
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS tms_access_whitelist (
+    id BIGINT PRIMARY KEY AUTO_INCREMENT,
+    ip VARCHAR(32) NOT NULL,
+    mask VARCHAR(10) NOT NULL,
+    create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
+) COMMENT='访问白名单表';
+
+
+-- -----------------------------------------------------------------------------
+-- Cert module tables
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS tms_key_entity (
+    id BIGINT PRIMARY KEY,
+    org_code VARCHAR(64) NOT NULL COMMENT 'organization code',
+    org_name VARCHAR(255) NOT NULL COMMENT 'organization name',
+    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 / RSA',
+    key_len INT NOT NULL COMMENT 'SM2 fixed 256 in V1',
+    key_idx INT NOT NULL COMMENT 'card key index, allowed range [2..8]',
+    backup_data TEXT NOT NULL COMMENT 'SDFE_BackupUserKey output',
+    public_key VARCHAR(500) NOT NULL COMMENT 'public key, Base64/PEM',
+    p10_data VARCHAR(2000) NULL COMMENT 'PKCS#10 PEM content',
+    subject_dn VARCHAR(500) NULL COMMENT 'DN used when generating P10',
+    cert_mode VARCHAR(16) NULL COMMENT 'SINGLE / DOUBLE',
+    status VARCHAR(32) NOT NULL COMMENT 'CREATED / P10_GENERATED / CERT_IMPORTED',
+    allow_ips VARCHAR(500) NULL COMMENT 'allowed source IP list',
+    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_key_entity_key_idx (key_idx),
+    KEY idx_tms_key_entity_org_code (org_code),
+    KEY idx_tms_key_entity_algo (algo_type),
+    KEY idx_tms_key_entity_status (status),
+    KEY idx_tms_key_entity_create_time (create_time)
+) COMMENT='密钥实体表';
+
+CREATE TABLE IF NOT EXISTS tms_certificate (
+    id BIGINT PRIMARY KEY,
+    entity_id BIGINT NULL COMMENT 'required when cert_type=ENTITY',
+    cert_type VARCHAR(16) NOT NULL COMMENT 'ENTITY / USER',
+    subject_dn VARCHAR(500) NOT NULL,
+    issuer_dn VARCHAR(1024) NOT NULL,
+    serial_number VARCHAR(128) NOT NULL,
+    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
+    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
+    cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content',
+    valid_from DATETIME(3) NOT NULL,
+    valid_to DATETIME(3) NOT NULL,
+    import_time DATETIME(3) NOT NULL,
+    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_certificate_fingerprint (fingerprint),
+    KEY idx_tms_certificate_entity_id (entity_id),
+    KEY idx_tms_certificate_cert_type (cert_type),
+    KEY idx_tms_certificate_issuer_dn (issuer_dn(512)),
+    KEY idx_tms_certificate_valid_to (valid_to),
+    KEY idx_tms_certificate_import_time (import_time)
+) COMMENT='证书表';
+
+CREATE TABLE IF NOT EXISTS tms_trusted_cert (
+    id BIGINT PRIMARY KEY,
+    alias VARCHAR(128) NULL,
+    subject_dn VARCHAR(1024) NOT NULL,
+    issuer_dn VARCHAR(1024) NOT NULL,
+    serial_number VARCHAR(128) NOT NULL,
+    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
+    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
+    cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content',
+    ca_level TINYINT NOT NULL COMMENT '0:Root, 1:Intermediate',
+    valid_from DATETIME(3) NOT NULL,
+    valid_to DATETIME(3) NOT NULL,
+    import_time DATETIME(3) NOT NULL,
+    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_trusted_cert_fingerprint (fingerprint),
+    KEY idx_tms_trusted_cert_subject_dn (subject_dn(512)),
+    KEY idx_tms_trusted_cert_issuer_dn (issuer_dn(512)),
+    KEY idx_tms_trusted_cert_valid_to (valid_to)
+) COMMENT='可信证书表';
+
+CREATE TABLE IF NOT EXISTS tms_certificate_crl (
+    id BIGINT PRIMARY KEY,
+    issuer_dn VARCHAR(1024) NOT NULL,
+    crl_number VARCHAR(128) NULL,
+    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
+    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
+    crl_data MEDIUMTEXT NOT NULL COMMENT 'reserved legacy CRL PEM content; large CRLs are not stored inline',
+    this_update DATETIME(3) NOT NULL,
+    next_update DATETIME(3) NULL,
+    revoked_count INT NOT NULL,
+    import_time DATETIME(3) NOT NULL,
+    create_by VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_certificate_crl_fingerprint (fingerprint),
+    KEY idx_tms_certificate_crl_issuer_dn (issuer_dn(512)),
+    KEY idx_tms_certificate_crl_this_update (this_update),
+    KEY idx_tms_certificate_crl_next_update (next_update)
+) COMMENT='证书CRL表';
+
+CREATE TABLE IF NOT EXISTS tms_certificate_crl_revoked (
+    id BIGINT PRIMARY KEY,
+    crl_id BIGINT NOT NULL,
+    issuer_dn VARCHAR(1024) NOT NULL,
+    serial_number VARCHAR(128) NOT NULL,
+    subject_dn VARCHAR(1024) NULL,
+    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
+    crl_number VARCHAR(128) NULL,
+    revocation_time DATETIME(3) NOT NULL,
+    revocation_reason VARCHAR(64) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    KEY idx_tms_certificate_crl_revoked_crl_id (crl_id),
+    KEY idx_tms_certificate_crl_revoked_issuer_serial (issuer_dn(512), serial_number),
+    KEY idx_tms_certificate_crl_revoked_subject_dn (subject_dn(512)),
+    KEY idx_tms_certificate_crl_revoked_revocation_time (revocation_time)
+) COMMENT='证书CRL吊销明细表';
+
+CREATE TABLE IF NOT EXISTS tms_certificate_crl_import_task (
+    id BIGINT PRIMARY KEY,
+    task_id VARCHAR(64) NOT NULL,
+    original_filename VARCHAR(255) NULL,
+    file_size BIGINT NULL,
+    status VARCHAR(32) NOT NULL COMMENT 'PENDING/RUNNING/SUCCESS/FAILED',
+    fingerprint VARCHAR(128) NULL COMMENT 'SHA-256 fingerprint after successful parse',
+    crl_id BIGINT NULL,
+    revoked_count INT NOT NULL DEFAULT 0,
+    error_message VARCHAR(512) NULL,
+    started_at DATETIME(3) NULL,
+    finished_at DATETIME(3) NULL,
+    create_time DATETIME(3) NOT NULL,
+    update_time DATETIME(3) NOT NULL,
+    UNIQUE KEY uk_tms_certificate_crl_import_task_task_id (task_id),
+    KEY idx_tms_certificate_crl_import_task_status (status),
+    KEY idx_tms_certificate_crl_import_task_create_time (create_time)
+) COMMENT='证书CRL导入任务表';
+
+
+-- -----------------------------------------------------------------------------
+-- 日志表
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS tms_operation_audit_log (
+    id BIGINT PRIMARY KEY,
+    log_id VARCHAR(64) NOT NULL COMMENT '日志唯一标识',
+    operator_role_code VARCHAR(64) NULL COMMENT '操作角色编码',
+    operator_auth_level VARCHAR(32) NULL COMMENT '操作时认证等级',
+    module_code VARCHAR(32) NOT NULL COMMENT '业务模块',
+    action_type VARCHAR(32) NOT NULL COMMENT '操作动作',
+    remote_ip VARCHAR(64) NULL COMMENT '来源IP',
+    operation_result VARCHAR(16) NOT NULL COMMENT '操作结果: SUCCESS/FAILED/DENIED',
+    summary VARCHAR(512) NOT NULL COMMENT '操作摘要',
+    error_message VARCHAR(1024) NULL COMMENT '失败原因',
+    audit_status VARCHAR(16) NOT NULL COMMENT '审计状态: PENDING/REVIEWED',
+    audit_result VARCHAR(16) NULL COMMENT '审计结果: PASS/REJECT/NEED_VERIFY',
+    audit_comment VARCHAR(1024) NULL COMMENT '审计意见',
+    audited_by VARCHAR(64) NULL COMMENT '审计人',
+    audited_at DATETIME(3) NULL COMMENT '审计时间',
+    payload_hash VARCHAR(128) NOT NULL COMMENT 'SM3摘要',
+    sign_value TEXT NOT NULL COMMENT 'SM2签名值',
+    occurred_at DATETIME(3) NOT NULL COMMENT '操作发生时间',
+    create_time DATETIME(3) NOT NULL COMMENT '落库时间',
+    UNIQUE KEY uk_tms_operation_audit_log_log_id (log_id),
+    KEY idx_tms_operation_audit_log_role_code (operator_role_code),
+    KEY idx_tms_operation_audit_log_module_code (module_code),
+    KEY idx_tms_operation_audit_log_action_type (action_type),
+    KEY idx_tms_operation_audit_log_result (operation_result),
+    KEY idx_tms_operation_audit_log_audit_status (audit_status),
+    KEY idx_tms_operation_audit_log_occurred_at (occurred_at)
+) COMMENT='操作审计日志表';
+
+
+
+-- -----------------------------------------------------------------------------
+-- 日志备份记录表
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS tms_log_backup_record (
+     id BIGINT NOT NULL AUTO_INCREMENT COMMENT '主键ID',
+     record_id VARCHAR(64) NOT NULL COMMENT '备份记录ID',
+     file_name VARCHAR(255) NOT NULL COMMENT '备份文件名',
+     backup_type VARCHAR(32) NOT NULL COMMENT '备份类型（如：AUTO/MANUAL）',
+     file_path VARCHAR(500) NOT NULL COMMENT '文件存储路径',
+     file_hash VARCHAR(128) NOT NULL COMMENT '文件哈希值',
+     file_sign VARCHAR(256) DEFAULT NULL COMMENT '文件签名',
+     backup_result VARCHAR(32) NOT NULL COMMENT '备份结果（SUCCESS/FAILED）',
+     create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
+     sign_data TEXT DEFAULT NULL COMMENT '其他字段签名',
+     PRIMARY KEY (`id`),
+     UNIQUE KEY `uk_record_id` (`record_id`),
+     KEY `idx_create_time` (`create_time`),
+     KEY `idx_backup_type` (`backup_type`)
+) COMMENT='日志备份记录表';
+
+
+
+-- -----------------------------------------------------------------------------
+-- 日志备份配置表
+-- -----------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS tms_backup_config (
+     id int(11) NOT NULL AUTO_INCREMENT COMMENT '主键',
+     enable tinyint(4) NOT NULL DEFAULT '0' COMMENT '启用状态 1:启用 0:禁用',
+     cron_exp varchar(64) DEFAULT NULL COMMENT 'Cron表达式',
+     retention_count int(11) DEFAULT '1' COMMENT '保留份数',
+     last_backup_time datetime DEFAULT NULL COMMENT '上次执行时间',
+     sign_data varchar(255) NOT NULL COMMENT '其他字段的签名值',
+     PRIMARY KEY (`id`)
+) COMMENT='日志备份配置表';
+
+
+CREATE TABLE IF NOT EXISTS tms_master_key_activate (
+     id BIGINT PRIMARY KEY AUTO_INCREMENT,
+
+     ever_initialized BOOLEAN NOT NULL,
+
+     activation_status BOOLEAN NOT NULL,
+
+     create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+     update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
+) COMMENT='主密钥激活状态表';
+
+INSERT IGNORE INTO tms_master_key_activate (
+    id,
+    ever_initialized,
+    activation_status
+) VALUES (1, true, true);
+
+
+ALTER TABLE 	tms_access_whitelist			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_auth_audit_log			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_auth_challenge			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_auth_full_account			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_auth_session			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_backup_config			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_certificate			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_certificate_crl			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_certificate_crl_import_task			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_certificate_crl_revoked			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_device_node			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_device_software_version			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_file_record			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_init_task			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_init_task_step			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_key_entity			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_log_backup_record			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_master_key_activate			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_operation_audit_log			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_replay_nonce			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_resource_backup_task			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_resource_restore_task			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_role_account			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_role_ukey_binding			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_security_event			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_trusted_cert			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';
+ALTER TABLE 	tms_upgrade_task			ADD signature varchar(250) NULL COMMENT '数据真实性签名值';

src/test/java/com/cisd/tms/TmsApplicationTests.java

@@ -63,7 +63,7 @@ class TmsApplicationTests {
 
     @Test
     void shouldCreateAuthRoleTablesAndSeedFixedRoleAccounts() {
-        ClassPathResource migration = new ClassPathResource("db/migration/V1__tms_schema_full.sql");
+        ClassPathResource migration = new ClassPathResource("db/migration/V2__tms_schema_full.sql");
 
         org.junit.jupiter.api.Assertions.assertTrue(migration.exists());
 
@@ -87,18 +87,22 @@ class TmsApplicationTests {
     }
 
     @Test
-    void shouldKeepOnlyOneFullMigrationWithTmsTableNamesAndRandomDefaultPasswordSalts() throws Exception {
-        ClassPathResource migration = new ClassPathResource("db/migration/V1__tms_schema_full.sql");
+    void shouldKeepRetainedV1AndCurrentV2FullMigrationsWithTmsTableNamesAndRandomDefaultPasswordSalts() throws Exception {
+        ClassPathResource migration = new ClassPathResource("db/migration/V2__tms_schema_full.sql");
         String sql = new String(migration.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
 
-        long migrationCount;
+        java.util.Set<String> migrationFiles;
         try (java.util.stream.Stream<java.nio.file.Path> paths =
                      java.nio.file.Files.list(java.nio.file.Path.of("src/main/resources/db/migration"))) {
-            migrationCount = paths
+            migrationFiles = paths
                     .filter(path -> path.getFileName().toString().endsWith(".sql"))
-                    .count();
+                    .map(path -> path.getFileName().toString())
+                    .collect(java.util.stream.Collectors.toSet());
         }
-        org.junit.jupiter.api.Assertions.assertEquals(1, migrationCount);
+        org.junit.jupiter.api.Assertions.assertEquals(
+                java.util.Set.of("V1__tms_schema_full.sql", "V2__tms_schema_full.sql"),
+                migrationFiles
+        );
 
         org.junit.jupiter.api.Assertions.assertFalse(sql.contains("CREATE TABLE IF NOT EXISTS t_"));
         org.junit.jupiter.api.Assertions.assertFalse(sql.contains("FROM t_"));

src/test/java/com/cisd/tms/modules/backup/repository/ResourceTaskSchemaContractTest.java

@@ -9,9 +9,9 @@ class ResourceTaskSchemaContractTest {
 
     @Test
     void shouldExposeResourceTaskSchemaAndEnums() throws Exception {
-        String v1Sql = readClasspathResource("db/migration/V1__tms_schema_full.sql");
+        String fullSql = readClasspathResource("db/migration/V2__tms_schema_full.sql");
 
-        assertContainsAll(v1Sql,
+        assertContainsAll(fullSql,
                 "CREATE TABLE IF NOT EXISTS tms_resource_backup_task",
                 "backup_id VARCHAR(64) NOT NULL",
                 "package_path VARCHAR(1024) NULL",
@@ -28,7 +28,7 @@ class ResourceTaskSchemaContractTest {
                 "consistency_report_json JSON NULL",
                 "error_code VARCHAR(64) NULL");
 
-        Assertions.assertFalse(v1Sql.contains("tms_resource_task_step"));
+        Assertions.assertFalse(fullSql.contains("tms_resource_task_step"));
     }
 
     private static String readClasspathResource(String path) throws Exception {

src/test/java/com/cisd/tms/modules/cert/repository/impl/CertSchemaContractTest.java

@@ -12,12 +12,12 @@ class CertSchemaContractTest {
 
     @Test
     void certSchemaShouldAllowTrustedAliasToBeNullAndStoreLargeKeyBackupData() throws Exception {
-        String v1Sql = readClasspathResource("db/migration/V1__tms_schema_full.sql");
+        String fullSql = readClasspathResource("db/migration/V2__tms_schema_full.sql");
 
-        assertFalse(v1Sql.contains("alias VARCHAR(128) NOT NULL"), v1Sql);
-        assertTrue(v1Sql.contains("alias VARCHAR(128) NULL"), v1Sql);
-        assertFalse(v1Sql.contains("backup_data VARCHAR(500)"), v1Sql);
-        assertTrue(v1Sql.contains("backup_data TEXT NOT NULL"), v1Sql);
+        assertFalse(fullSql.contains("alias VARCHAR(128) NOT NULL"), fullSql);
+        assertTrue(fullSql.contains("alias VARCHAR(128) NULL"), fullSql);
+        assertFalse(fullSql.contains("backup_data VARCHAR(500)"), fullSql);
+        assertTrue(fullSql.contains("backup_data TEXT NOT NULL"), fullSql);
     }
 
     private String readClasspathResource(String location) throws Exception {