-- -----------------------------------------------------------------------------
-- TMS 旧库口令摘要迁移脚本
-- 适用范围：已经存在旧认证表的数据库，从旧 password_hash 方案迁移到
--          password_digest = SM3(password_salt + 原始口令) 方案。
-- 数据库：TiDB / MySQL 8+
--
-- 重要说明：
-- 1. 本文件不是空库全量初始化脚本。空库初始化请使用 V2__tms_schema_full.sql。
-- 2. 旧 password_hash 通常是不可逆摘要，无法还原用户原始口令后生成新摘要。
-- 3. 因此迁移时将固定角色席位统一重置为默认口令 Sunyard@123，并置为强制改密。
-- 4. 旧 password_hash 字段保留，便于现场回滚或排查；新代码只读取 password_digest。
-- -----------------------------------------------------------------------------

CREATE DATABASE IF NOT EXISTS TMS
  DEFAULT CHARACTER SET utf8mb4
  COLLATE utf8mb4_general_ci;

USE TMS;

ALTER TABLE tms_auth_full_account
  ADD COLUMN password_digest VARCHAR(64) NULL COMMENT '口令静态摘要：SM3(password_salt + 原始口令)' AFTER password_hash;

-- 默认口令摘要：SM3(password_salt + 'Sunyard@123')。
-- 迁移会把固定席位盐值同步为后端当前标准盐值，后续 issue-sign 会返回该盐值供前端写入 UKey。
UPDATE tms_auth_full_account
SET password_salt = '3df85c2988a5de2b9eeaa8109639641a',
    password_digest = '00718a8319e67ef6cf9fc389c14ce16784278d55439a7a30a63fa7be8e42bbdf',
    need_change_password = 1,
    failed_count = 0,
    locked_until = NULL,
    password_changed_at = CURRENT_TIMESTAMP(3),
    update_time = CURRENT_TIMESTAMP(3)
WHERE role_code = 'SUPER_ADMIN'
  AND uid = 1;

UPDATE tms_auth_full_account
SET password_salt = '50de03346bb1f6afc74938acf5e88560',
    password_digest = '169731d7c897649a16a073cdfddf48d2e98f72f10da5cead5cbbd51f8a9ffea6',
    need_change_password = 1,
    failed_count = 0,
    locked_until = NULL,
    password_changed_at = CURRENT_TIMESTAMP(3),
    update_time = CURRENT_TIMESTAMP(3)
WHERE role_code = 'SUPER_ADMIN'
  AND uid = 2;

UPDATE tms_auth_full_account
SET password_salt = '073cd5fd30701edfcf033e8f501b2b43',
    password_digest = '6d386b2a13550befb821795dcc0e9bda3d1cffc0d565ad539de16117e28f6a81',
    need_change_password = 1,
    failed_count = 0,
    locked_until = NULL,
    password_changed_at = CURRENT_TIMESTAMP(3),
    update_time = CURRENT_TIMESTAMP(3)
WHERE role_code = 'KEY_ADMIN'
  AND uid = 1;

UPDATE tms_auth_full_account
SET password_salt = '57e2616077bd8af5cb90fc9790f69573',
    password_digest = '72a53b0cb8dd15775516f5085c7a3ee09d65a130dc1b17e18545d24930826d0c',
    need_change_password = 1,
    failed_count = 0,
    locked_until = NULL,
    password_changed_at = CURRENT_TIMESTAMP(3),
    update_time = CURRENT_TIMESTAMP(3)
WHERE role_code = 'AUDIT_ADMIN'
  AND uid = 1;

UPDATE tms_auth_full_account
SET password_salt = 'a6bea7601138e90a540b39c73d53df81',
    password_digest = '58655960343a1efb0c1b281ce4c384ac699d01ab61c2c710d35e54b798f6e4c5',
    need_change_password = 1,
    failed_count = 0,
    locked_until = NULL,
    password_changed_at = CURRENT_TIMESTAMP(3),
    update_time = CURRENT_TIMESTAMP(3)
WHERE role_code = 'OPS_ADMIN'
  AND uid = 1;

ALTER TABLE tms_auth_full_account
DROP COLUMN password_hash;

-- 如果这里失败，说明旧库中存在不属于上述固定席位的认证账号，需要先明确其迁移策略。
ALTER TABLE tms_auth_full_account
  MODIFY COLUMN password_digest VARCHAR(64) NOT NULL COMMENT '口令静态摘要：SM3(password_salt + 原始口令)';