86 lines
3.5 KiB
SQL
86 lines
3.5 KiB
SQL
-- -----------------------------------------------------------------------------
|
|
-- TMS 旧库口令摘要迁移脚本
|
|
-- 适用范围：已经存在旧认证表的数据库，从旧 password_hash 方案迁移到
|
|
-- password_digest = SM3(password_salt + 原始口令) 方案。
|
|
-- 数据库：TiDB / MySQL 8+
|
|
--
|
|
-- 重要说明：
|
|
-- 1. 本文件不是空库全量初始化脚本。空库初始化请使用 V2__tms_schema_full.sql。
|
|
-- 2. 旧 password_hash 通常是不可逆摘要，无法还原用户原始口令后生成新摘要。
|
|
-- 3. 因此迁移时将固定角色席位统一重置为默认口令 Sunyard@123，并置为强制改密。
|
|
-- 4. 旧 password_hash 字段保留，便于现场回滚或排查；新代码只读取 password_digest。
|
|
-- -----------------------------------------------------------------------------
|
|
|
|
CREATE DATABASE IF NOT EXISTS TMS
|
|
DEFAULT CHARACTER SET utf8mb4
|
|
COLLATE utf8mb4_general_ci;
|
|
|
|
USE TMS;
|
|
|
|
ALTER TABLE tms_auth_full_account
|
|
ADD COLUMN password_digest VARCHAR(64) NULL COMMENT '口令静态摘要：SM3(password_salt + 原始口令)' AFTER password_hash;
|
|
|
|
-- 默认口令摘要：SM3(password_salt + 'Sunyard@123')。
|
|
-- 迁移会把固定席位盐值同步为后端当前标准盐值，后续 issue-sign 会返回该盐值供前端写入 UKey。
|
|
UPDATE tms_auth_full_account
|
|
SET password_salt = '3df85c2988a5de2b9eeaa8109639641a',
|
|
password_digest = '00718a8319e67ef6cf9fc389c14ce16784278d55439a7a30a63fa7be8e42bbdf',
|
|
need_change_password = 1,
|
|
failed_count = 0,
|
|
locked_until = NULL,
|
|
password_changed_at = CURRENT_TIMESTAMP(3),
|
|
update_time = CURRENT_TIMESTAMP(3)
|
|
WHERE role_code = 'SUPER_ADMIN'
|
|
AND uid = 1;
|
|
|
|
UPDATE tms_auth_full_account
|
|
SET password_salt = '50de03346bb1f6afc74938acf5e88560',
|
|
password_digest = '169731d7c897649a16a073cdfddf48d2e98f72f10da5cead5cbbd51f8a9ffea6',
|
|
need_change_password = 1,
|
|
failed_count = 0,
|
|
locked_until = NULL,
|
|
password_changed_at = CURRENT_TIMESTAMP(3),
|
|
update_time = CURRENT_TIMESTAMP(3)
|
|
WHERE role_code = 'SUPER_ADMIN'
|
|
AND uid = 2;
|
|
|
|
UPDATE tms_auth_full_account
|
|
SET password_salt = '073cd5fd30701edfcf033e8f501b2b43',
|
|
password_digest = '6d386b2a13550befb821795dcc0e9bda3d1cffc0d565ad539de16117e28f6a81',
|
|
need_change_password = 1,
|
|
failed_count = 0,
|
|
locked_until = NULL,
|
|
password_changed_at = CURRENT_TIMESTAMP(3),
|
|
update_time = CURRENT_TIMESTAMP(3)
|
|
WHERE role_code = 'KEY_ADMIN'
|
|
AND uid = 1;
|
|
|
|
UPDATE tms_auth_full_account
|
|
SET password_salt = '57e2616077bd8af5cb90fc9790f69573',
|
|
password_digest = '72a53b0cb8dd15775516f5085c7a3ee09d65a130dc1b17e18545d24930826d0c',
|
|
need_change_password = 1,
|
|
failed_count = 0,
|
|
locked_until = NULL,
|
|
password_changed_at = CURRENT_TIMESTAMP(3),
|
|
update_time = CURRENT_TIMESTAMP(3)
|
|
WHERE role_code = 'AUDIT_ADMIN'
|
|
AND uid = 1;
|
|
|
|
UPDATE tms_auth_full_account
|
|
SET password_salt = 'a6bea7601138e90a540b39c73d53df81',
|
|
password_digest = '58655960343a1efb0c1b281ce4c384ac699d01ab61c2c710d35e54b798f6e4c5',
|
|
need_change_password = 1,
|
|
failed_count = 0,
|
|
locked_until = NULL,
|
|
password_changed_at = CURRENT_TIMESTAMP(3),
|
|
update_time = CURRENT_TIMESTAMP(3)
|
|
WHERE role_code = 'OPS_ADMIN'
|
|
AND uid = 1;
|
|
|
|
ALTER TABLE tms_auth_full_account
|
|
DROP COLUMN password_hash;
|
|
|
|
-- 如果这里失败，说明旧库中存在不属于上述固定席位的认证账号，需要先明确其迁移策略。
|
|
ALTER TABLE tms_auth_full_account
|
|
MODIFY COLUMN password_digest VARCHAR(64) NOT NULL COMMENT '口令静态摘要：SM3(password_salt + 原始口令)';
|