-- -----------------------------------------------------------------------------
-- TMS 全量库结构初始化脚本
-- 适用范围：空库初始化 / Flyway 首次建库
-- 数据库：TiDB / MySQL 8+
--
-- 说明：
-- 1. 本文件是当前仓库唯一保留的数据库初始化 SQL。
-- 2. 结构已按当前最终状态汇总，不再依赖历史 V1~V12 逐步迁移。
-- 3. 执行前请先选中目标数据库，本文件不再包含 CREATE DATABASE / USE。
-- -----------------------------------------------------------------------------

CREATE DATABASE IF NOT EXISTS TMS
  DEFAULT CHARACTER SET utf8mb4
  COLLATE utf8mb4_general_ci;

USE TMS;

-- -----------------------------------------------------------------------------
-- 初始化任务
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_init_task (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    task_type VARCHAR(32) NOT NULL DEFAULT 'INIT' COMMENT '任务类型：INIT/RESET',
    version VARCHAR(32) NOT NULL,
    status VARCHAR(32) NOT NULL,
    product_type VARCHAR(16) NULL,
    org_code VARCHAR(32) NULL,
    mq_type VARCHAR(32) NULL,
    deploy_mode VARCHAR(16) NULL,
    init_plan_json LONGTEXT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_init_task_task_id (task_id)
);

CREATE TABLE IF NOT EXISTS tms_init_task_step (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    step_no INT NOT NULL,
    step_code VARCHAR(64) NOT NULL,
    status VARCHAR(32) NOT NULL,
    message VARCHAR(512) NULL,
    command_line VARCHAR(2048) NULL,
    log_path VARCHAR(512) NULL,
    exit_code INT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_init_task_step_task_no (task_id, step_no),
    KEY idx_tms_init_task_step_task_id (task_id)
);

-- -----------------------------------------------------------------------------
-- 资源备份与恢复
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_resource_backup_task (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    backup_id VARCHAR(64) NOT NULL,
    status VARCHAR(32) NOT NULL,
    product_type VARCHAR(16) NOT NULL,
    mq_type VARCHAR(32) NULL,
    org_code VARCHAR(32) NULL,
    source_device_id VARCHAR(128) NULL,
    package_name VARCHAR(255) NULL,
    package_path VARCHAR(1024) NULL,
    package_size BIGINT NULL,
    package_hash VARCHAR(128) NULL,
    storage_enc_key_fingerprint VARCHAR(128) NOT NULL,
    authenticity_key_fingerprint VARCHAR(128) NOT NULL,
    manifest_summary_json JSON NULL,
    error_code VARCHAR(64) NULL,
    error_message VARCHAR(1024) NULL,
    remark VARCHAR(1024) NULL,
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    start_time DATETIME(3) NULL,
    finish_time DATETIME(3) NULL,
    UNIQUE KEY uk_tms_resource_backup_task_task_id (task_id),
    UNIQUE KEY uk_tms_resource_backup_task_backup_id (backup_id),
    KEY idx_tms_resource_backup_task_status (status),
    KEY idx_tms_resource_backup_task_create_time (create_time)
);

CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    precheck_id VARCHAR(64) NOT NULL,
    backup_id VARCHAR(64) NOT NULL,
    status VARCHAR(32) NOT NULL,
    source_device_id VARCHAR(128) NULL,
    source_product_type VARCHAR(16) NOT NULL,
    target_product_type VARCHAR(16) NOT NULL,
    package_file_id VARCHAR(64) NOT NULL,
    package_path VARCHAR(1024) NULL,
    staging_dir VARCHAR(1024) NULL,
    runner_state_path VARCHAR(1024) NULL,
    storage_enc_key_fingerprint VARCHAR(128) NOT NULL,
    authenticity_key_fingerprint VARCHAR(128) NOT NULL,
    restore_plan_json JSON NULL,
    consistency_report_json JSON NULL,
    error_code VARCHAR(64) NULL,
    error_message VARCHAR(1024) NULL,
    remark VARCHAR(1024) NULL,
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    start_time DATETIME(3) NULL,
    finish_time DATETIME(3) NULL,
    UNIQUE KEY uk_tms_resource_restore_task_task_id (task_id),
    UNIQUE KEY uk_tms_resource_restore_task_precheck_id (precheck_id),
    KEY idx_tms_resource_restore_task_status (status),
    KEY idx_tms_resource_restore_task_create_time (create_time)
);

CREATE TABLE IF NOT EXISTS tms_resource_task_step (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    task_type VARCHAR(32) NOT NULL COMMENT 'RESOURCE_BACKUP / RESOURCE_RESTORE',
    step_no INT NOT NULL,
    step_code VARCHAR(64) NOT NULL,
    status VARCHAR(32) NOT NULL,
    message VARCHAR(512) NULL,
    log_path VARCHAR(1024) NULL,
    exit_code INT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    start_time DATETIME(3) NULL,
    finish_time DATETIME(3) NULL,
    UNIQUE KEY uk_tms_resource_task_step_task_no (task_id, step_no),
    KEY idx_tms_resource_task_step_task_id (task_id),
    KEY idx_tms_resource_task_step_task_type (task_type)
);

-- -----------------------------------------------------------------------------
-- 认证与设备基础表
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_device_node (
    id BIGINT PRIMARY KEY,
    node_id VARCHAR(64) NOT NULL,
    host VARCHAR(128) NOT NULL,
    status VARCHAR(32) NOT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_device_node_node_id (node_id)
);

CREATE TABLE IF NOT EXISTS tms_file_record (
    id BIGINT PRIMARY KEY,
    file_id VARCHAR(64) NOT NULL,
    original_filename VARCHAR(255) NOT NULL,
    storage_path VARCHAR(1024) NOT NULL,
    status VARCHAR(32) NOT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_file_record_file_id (file_id)
);

-- -----------------------------------------------------------------------------
-- 设备软件版本
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_device_software_version (
    id BIGINT PRIMARY KEY,
    component_code VARCHAR(64) NOT NULL,
    component_name VARCHAR(128) NOT NULL,
    current_version VARCHAR(128) NOT NULL,
    source_type VARCHAR(32) NOT NULL,
    detected_at DATETIME NULL,
    remarks VARCHAR(255) NULL,
    create_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    update_time DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY uk_tms_device_software_version_component_code (component_code)
);

INSERT INTO tms_device_software_version
(id, component_code, component_name, current_version, source_type, detected_at, remarks)
VALUES
    (1001, 'RABBITMQ', '消息队列', 'V3.8.21', 'MANUAL', NOW(), '出厂预置'),
    (1002, 'TLQ', '消息队列', 'V8.1.11', 'MANUAL', NOW(), '出厂预置'),
    (1003, 'TIDB', '数据库', 'V8.1.0', 'MANUAL', NOW(), '出厂预置'),
    (1004, 'NGINX', 'Nginx', 'V1.20', 'MANUAL', NOW(), '出厂预置'),
    (1005, 'RECEIVER', '标准收发器', 'V1.3.2', 'MANUAL', NOW(), '出厂预置'),
    (1006, 'TMS', 'CISD终端管理服务', 'V1.0.0', 'MANUAL', NOW(), '出厂预置')
ON DUPLICATE KEY UPDATE
    component_name = VALUES(component_name),
    current_version = VALUES(current_version),
    source_type = VALUES(source_type),
    detected_at = VALUES(detected_at),
    remarks = VALUES(remarks),
    update_time = CURRENT_TIMESTAMP;

-- -----------------------------------------------------------------------------
-- 升级任务
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS t_upgrade_task (
    id BIGINT PRIMARY KEY,
    task_id VARCHAR(64) NOT NULL,
    upgrade_mode VARCHAR(16) NOT NULL,
    target_component VARCHAR(32) NOT NULL,
    package_file_id VARCHAR(64) NOT NULL,
    package_name VARCHAR(255) NOT NULL,
    package_hash VARCHAR(128) NOT NULL,
    current_version VARCHAR(64) NOT NULL,
    target_version VARCHAR(64) NOT NULL,
    status VARCHAR(32) NOT NULL,
    verify_passed TINYINT(1) NOT NULL DEFAULT 0,
    verify_message VARCHAR(1024) NULL,
    manifest_json TEXT NULL,
    detail_log_path VARCHAR(1024) NULL,
    error_message VARCHAR(1024) NULL,
    operator VARCHAR(64) NULL,
    started_at DATETIME(3) NULL,
    finished_at DATETIME(3) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_t_upgrade_task_task_id (task_id),
    KEY idx_t_upgrade_task_status (status),
    KEY idx_t_upgrade_task_component (target_component),
    KEY idx_t_upgrade_task_create_time (create_time)
);

-- -----------------------------------------------------------------------------
-- 新认证体系
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_role_account (
    id BIGINT PRIMARY KEY,
    role_code VARCHAR(64) NOT NULL,
    display_name VARCHAR(128) NOT NULL,
    required_ukey_count INT NOT NULL,
    status VARCHAR(32) NOT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_role_account_role_code (role_code)
);

CREATE TABLE IF NOT EXISTS tms_role_ukey_binding (
    id BIGINT PRIMARY KEY,
    role_code VARCHAR(64) NOT NULL,
    uid INT NOT NULL,
    ukey_serial VARCHAR(128) NOT NULL,
    ukey_pubkey TEXT NOT NULL,
    issuer_sign TEXT NULL,
    status VARCHAR(32) NOT NULL,
    bound_at DATETIME(3) NOT NULL,
    unbound_at DATETIME(3) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_role_ukey_binding_role_uid_serial (role_code, uid, ukey_serial),
    KEY idx_tms_role_ukey_binding_role_uid_status (role_code, uid, status),
    KEY idx_tms_role_ukey_binding_role_status (role_code, status)
);

CREATE TABLE IF NOT EXISTS tms_auth_full_account (
    id BIGINT PRIMARY KEY,
    role_code VARCHAR(64) NOT NULL,
    uid INT NOT NULL,
    account_name VARCHAR(64) NOT NULL,
    display_name VARCHAR(128) NOT NULL,
    password_hash VARCHAR(256) NOT NULL,
    password_salt VARCHAR(128) NOT NULL,
    status VARCHAR(32) NOT NULL,
    need_change_password TINYINT(1) NOT NULL DEFAULT 1,
    password_changed_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
    failed_count INT NOT NULL DEFAULT 0,
    locked_until DATETIME(3) NULL,
    last_login_at DATETIME(3) NULL,
    last_active_at DATETIME(3) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_auth_full_account_role_uid (role_code, uid),
    UNIQUE KEY uk_tms_auth_full_account_name (account_name),
    KEY idx_tms_auth_full_account_role_code (role_code)
);

CREATE TABLE IF NOT EXISTS tms_auth_session (
    id BIGINT PRIMARY KEY,
    session_token VARCHAR(128) NOT NULL,
    role_code VARCHAR(64) NOT NULL,
    authenticated_principals_json JSON NULL,
    auth_method VARCHAR(32) NOT NULL,
    auth_level VARCHAR(32) NOT NULL,
    issued_at DATETIME(3) NOT NULL,
    last_active_at DATETIME(3) NOT NULL,
    expires_at DATETIME(3) NOT NULL,
    logout_at DATETIME(3) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_auth_session_token (session_token),
    KEY idx_tms_auth_session_role_code (role_code)
);

CREATE TABLE IF NOT EXISTS tms_auth_challenge (
    id BIGINT PRIMARY KEY,
    challenge_id VARCHAR(128) NOT NULL,
    role_code VARCHAR(64) NOT NULL,
    purpose VARCHAR(32) NOT NULL,
    nonce VARCHAR(256) NOT NULL,
    expires_at DATETIME(3) NOT NULL,
    used TINYINT(1) NOT NULL DEFAULT 0,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_auth_challenge_challenge_id (challenge_id)
);

CREATE TABLE IF NOT EXISTS tms_auth_audit_log (
    id BIGINT PRIMARY KEY,
    event_type VARCHAR(64) NOT NULL,
    role_code VARCHAR(64) NULL,
    operator_role_code VARCHAR(64) NULL,
    result VARCHAR(32) NOT NULL,
    detail_json JSON NULL,
    remote_ip VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    KEY idx_tms_auth_audit_log_event_type (event_type),
    KEY idx_tms_auth_audit_log_role_code (role_code)
);

-- -----------------------------------------------------------------------------
-- 防重放与安全事件
-- -----------------------------------------------------------------------------

CREATE TABLE IF NOT EXISTS tms_replay_nonce (
    id BIGINT PRIMARY KEY,
    scope VARCHAR(32) NOT NULL COMMENT '防重放作用域：OPENAPI / INTERNAL_API',
    principal_id VARCHAR(128) NOT NULL COMMENT '主体标识：appId / sessionToken',
    nonce VARCHAR(128) NOT NULL,
    request_timestamp BIGINT NOT NULL,
    request_method VARCHAR(16) NULL,
    request_path VARCHAR(256) NULL,
    body_hash VARCHAR(128) NULL,
    remote_ip VARCHAR(64) NULL,
    user_agent VARCHAR(512) NULL,
    expires_at DATETIME(3) NOT NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_tms_replay_nonce_scope_principal_nonce (scope, principal_id, nonce),
    KEY idx_tms_replay_nonce_expires_at (expires_at),
    KEY idx_tms_replay_nonce_principal_time (principal_id, create_time)
);

CREATE TABLE IF NOT EXISTS tms_security_event (
    id BIGINT PRIMARY KEY,
    event_type VARCHAR(64) NOT NULL,
    scope VARCHAR(32) NOT NULL,
    principal_id VARCHAR(128) NULL,
    request_method VARCHAR(16) NULL,
    request_path VARCHAR(256) NULL,
    nonce VARCHAR(128) NULL,
    remote_ip VARCHAR(64) NULL,
    detail_json JSON NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    KEY idx_tms_security_event_event_type (event_type),
    KEY idx_tms_security_event_scope_principal (scope, principal_id)
);

INSERT IGNORE INTO tms_role_account (
    id,
    role_code,
    display_name,
    required_ukey_count,
    status,
    create_time,
    update_time
)
VALUES
    (
        11001,
        'SUPER_ADMIN',
        '超级管理员',
        2,
        'ACTIVE',
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        11002,
        'KEY_ADMIN',
        '密钥管理员',
        1,
        'ACTIVE',
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        11003,
        'AUDIT_ADMIN',
        '审计管理员',
        1,
        'UNENABLED',
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        11004,
        'OPS_ADMIN',
        '运维管理员',
        1,
        'UNENABLED',
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    );

INSERT IGNORE INTO tms_auth_full_account (
    id,
    role_code,
    uid,
    account_name,
    display_name,
    password_hash,
    password_salt,
    status,
    need_change_password,
    password_changed_at,
    failed_count,
    locked_until,
    last_login_at,
    last_active_at,
    create_time,
    update_time
)
VALUES
    (
        12101,
        'SUPER_ADMIN',
        1,
        'super-admin-full-01',
        '超级管理员UKey席位一',
        'Viuew8WE+qziUZwGGU0x25cUpzsTF+QvQFU0uhb+yVA=',
        'init-super-admin-salt-20260325',
        'ACTIVE',
        1,
        CURRENT_TIMESTAMP(3),
        0,
        NULL,
        NULL,
        NULL,
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        12102,
        'SUPER_ADMIN',
        2,
        'super-admin-full-02',
        '超级管理员UKey席位二',
        'Viuew8WE+qziUZwGGU0x25cUpzsTF+QvQFU0uhb+yVA=',
        'init-super-admin-salt-20260325',
        'ACTIVE',
        1,
        CURRENT_TIMESTAMP(3),
        0,
        NULL,
        NULL,
        NULL,
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        12103,
        'KEY_ADMIN',
        1,
        'key-admin-full-01',
        '密钥管理员UKey席位',
        '/xqmDy3A/q9X5p7XWznIPSBabQ6bxTLAPgtHQ6Be33c=',
        'init-key-admin-salt-20260325',
        'ACTIVE',
        1,
        CURRENT_TIMESTAMP(3),
        0,
        NULL,
        NULL,
        NULL,
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        12104,
        'AUDIT_ADMIN',
        1,
        'audit-admin-full-01',
        '审计管理员UKey席位',
        'j/J1LKyUOzVEJfbbHe2dwKBKNdabRk502olk/LWIwhg=',
        'init-audit-admin-salt-20260325',
        'ACTIVE',
        1,
        CURRENT_TIMESTAMP(3),
        0,
        NULL,
        NULL,
        NULL,
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    ),
    (
        12105,
        'OPS_ADMIN',
        1,
        'ops-admin-full-01',
        '运维管理员UKey席位',
        '2e9F4aCgsDb+AuD1LrBEqEg8yjy3ODo27UHtx06vj/A=',
        'init-ops-admin-salt-20260325',
        'ACTIVE',
        1,
        CURRENT_TIMESTAMP(3),
        0,
        NULL,
        NULL,
        NULL,
        CURRENT_TIMESTAMP(3),
        CURRENT_TIMESTAMP(3)
    );


-- -----------------------------------------------------------------------------
-- IP白名单表
-- -----------------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS tms_access_whitelist (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    ip VARCHAR(32) NOT NULL,
    mask VARCHAR(10) NOT NULL,
    create_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
    update_time DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)
    );


-- -----------------------------------------------------------------------------
-- Cert module tables
-- -----------------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS t_key_entity (
    id BIGINT PRIMARY KEY,
    org_code VARCHAR(64) NOT NULL COMMENT 'organization code',
    org_name VARCHAR(255) NOT NULL COMMENT 'organization name',
    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 / RSA',
    key_len INT NOT NULL COMMENT 'SM2 fixed 256 in V1',
    key_idx INT NOT NULL COMMENT 'card key index, allowed range [2..8]',
    backup_data VARCHAR(500) NOT NULL COMMENT 'SDFE_BackupUserKey output',
    public_key VARCHAR(500) NOT NULL COMMENT 'public key, Base64/PEM',
    p10_data VARCHAR(2000) NULL COMMENT 'PKCS#10 PEM content',
    subject_dn VARCHAR(500) NULL COMMENT 'DN used when generating P10',
    cert_mode VARCHAR(16) NULL COMMENT 'SINGLE / DOUBLE',
    status VARCHAR(32) NOT NULL COMMENT 'CREATED / P10_GENERATED / CERT_IMPORTED',
    allow_ips VARCHAR(500) NULL COMMENT 'allowed source IP list',
    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_t_key_entity_key_idx (key_idx),
    KEY idx_t_key_entity_org_code (org_code),
    KEY idx_t_key_entity_algo (algo_type),
    KEY idx_t_key_entity_status (status),
    KEY idx_t_key_entity_create_time (create_time)
);

CREATE TABLE IF NOT EXISTS t_certificate (
    id BIGINT PRIMARY KEY,
    entity_id BIGINT NULL COMMENT 'required when cert_type=ENTITY',
    cert_type VARCHAR(16) NOT NULL COMMENT 'ENTITY / USER',
    subject_dn VARCHAR(500) NOT NULL,
    issuer_dn VARCHAR(1024) NOT NULL,
    serial_number VARCHAR(128) NOT NULL,
    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
    cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content',
    valid_from DATETIME(3) NOT NULL,
    valid_to DATETIME(3) NOT NULL,
    import_time DATETIME(3) NOT NULL,
    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_t_certificate_fingerprint (fingerprint),
    KEY idx_t_certificate_entity_id (entity_id),
    KEY idx_t_certificate_cert_type (cert_type),
    KEY idx_t_certificate_issuer_dn (issuer_dn(512)),
    KEY idx_t_certificate_valid_to (valid_to),
    KEY idx_t_certificate_import_time (import_time)
);

CREATE TABLE IF NOT EXISTS t_trusted_cert (
    id BIGINT PRIMARY KEY,
    alias VARCHAR(128) NOT NULL,
    subject_dn VARCHAR(1024) NOT NULL,
    issuer_dn VARCHAR(1024) NOT NULL,
    serial_number VARCHAR(128) NOT NULL,
    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
    cert_data VARCHAR(2000) NOT NULL COMMENT 'certificate PEM content',
    ca_level TINYINT NOT NULL COMMENT '0:Root, 1:Intermediate',
    valid_from DATETIME(3) NOT NULL,
    valid_to DATETIME(3) NOT NULL,
    import_time DATETIME(3) NOT NULL,
    sign_data VARCHAR(512) NULL COMMENT 'reserved, not used in V1',
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_t_trusted_cert_fingerprint (fingerprint),
    KEY idx_t_trusted_cert_subject_dn (subject_dn(512)),
    KEY idx_t_trusted_cert_issuer_dn (issuer_dn(512)),
    KEY idx_t_trusted_cert_valid_to (valid_to)
);

CREATE TABLE IF NOT EXISTS t_certificate_crl (
    id BIGINT PRIMARY KEY,
    issuer_dn VARCHAR(1024) NOT NULL,
    crl_number VARCHAR(128) NULL,
    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
    fingerprint VARCHAR(128) NOT NULL COMMENT 'SHA-256 fingerprint',
    crl_data MEDIUMTEXT NOT NULL COMMENT 'CRL PEM content',
    this_update DATETIME(3) NOT NULL,
    next_update DATETIME(3) NULL,
    revoked_count INT NOT NULL,
    import_time DATETIME(3) NOT NULL,
    create_by VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    UNIQUE KEY uk_t_certificate_crl_fingerprint (fingerprint),
    KEY idx_t_certificate_crl_issuer_dn (issuer_dn(512)),
    KEY idx_t_certificate_crl_this_update (this_update),
    KEY idx_t_certificate_crl_next_update (next_update)
);

CREATE TABLE IF NOT EXISTS t_certificate_crl_revoked (
    id BIGINT PRIMARY KEY,
    crl_id BIGINT NOT NULL,
    issuer_dn VARCHAR(1024) NOT NULL,
    serial_number VARCHAR(128) NOT NULL,
    subject_dn VARCHAR(1024) NULL,
    algo_type VARCHAR(16) NOT NULL COMMENT 'SM2 in V1',
    crl_number VARCHAR(128) NULL,
    revocation_time DATETIME(3) NOT NULL,
    revocation_reason VARCHAR(64) NULL,
    create_time DATETIME(3) NOT NULL,
    update_time DATETIME(3) NOT NULL,
    KEY idx_t_certificate_crl_revoked_crl_id (crl_id),
    KEY idx_t_certificate_crl_revoked_issuer_serial (issuer_dn(512), serial_number),
    KEY idx_t_certificate_crl_revoked_subject_dn (subject_dn(512)),
    KEY idx_t_certificate_crl_revoked_revocation_time (revocation_time)
);