my_local_kimi_dev2
3f46b64218
- agent_scope 新增 service_enabled 标记（Flyway V7 + 回滚），服务 Token 签发 由 sync 硬编码改为标记驱动，管理后台作用域 CRUD/前端支持该标记 - PermissionService 全部行过滤入口加 tenant_service 分支：服务主体总部视角 全量可见不做行过滤，用户身份行为不变；非服务主体的 null user 显式拒绝 - warehouse.todo.list.query 按当前登录人统计，服务身份返回 PERMISSION_DENIED - RateLimitService 新增 SERVICE-QUERY 独立限流档（默认 300/分钟） - seed-dev.sql 新增 ops-query 作用域并绑定全部在线查询工具 - 文档：tools-reference §0.3、README Open API 服务 Token 段
66 lines
5.1 KiB
SQL
66 lines
5.1 KiB
SQL
-- =============================================================
|
||
-- dev 种子数据（仅 dev 环境使用！）
|
||
-- 仅创建作用域并关联工具，不提交固定 token 或 ak。
|
||
-- token 请使用本地随机 ak 的 SHA-256 哈希手工创建，详见 README。
|
||
-- 依赖：tool 表已由应用启动时 ToolSyncService 同步。
|
||
-- =============================================================
|
||
|
||
USE xiaoqu_agent_svc_d;
|
||
|
||
START TRANSACTION;
|
||
|
||
-- 作用域：运营
|
||
INSERT INTO agent_scope (name, code, memo, status, create_id)
|
||
SELECT '运营', 'operation', 'dev 种子：运营作用域', 1, 0
|
||
WHERE NOT EXISTS (SELECT 1 FROM agent_scope WHERE code = 'operation');
|
||
|
||
-- 作用域-工具：sys.ping / agent.count / agent.list.query / property.list.query / agent.detail.query / property.detail.query
|
||
-- / mall.order.list.query / mall.order.detail.query / mall.order.logistics.query
|
||
-- / contract.list.query / contract.detail.query / integration.context.get
|
||
INSERT INTO scope_tool (scope_id, tool_id, create_id)
|
||
SELECT s.id, t.id, 0 FROM agent_scope s JOIN tool t
|
||
WHERE s.code = 'operation' AND t.name IN ('sys.ping', 'agent.count', 'agent.list.query', 'property.list.query', 'agent.detail.query', 'property.detail.query', 'mall.order.list.query', 'mall.order.detail.query', 'mall.order.logistics.query', 'contract.list.query', 'contract.detail.query', 'integration.context.get')
|
||
AND NOT EXISTS (SELECT 1 FROM scope_tool st WHERE st.scope_id = s.id AND st.tool_id = t.id);
|
||
|
||
-- 作用域：hardware（出纸机查询）
|
||
INSERT INTO agent_scope (name, code, memo, status, create_id)
|
||
SELECT '出纸机', 'hardware', 'dev 种子：出纸机查询作用域', 1, 0
|
||
WHERE NOT EXISTS (SELECT 1 FROM agent_scope WHERE code = 'hardware');
|
||
|
||
-- 作用域-工具：hardware.list.query / hardware.detail.query
|
||
INSERT INTO scope_tool (scope_id, tool_id, create_id)
|
||
SELECT s.id, t.id, 0 FROM agent_scope s JOIN tool t
|
||
WHERE s.code = 'hardware' AND t.name IN ('hardware.list.query', 'hardware.detail.query')
|
||
AND NOT EXISTS (SELECT 1 FROM scope_tool st WHERE st.scope_id = s.id AND st.tool_id = t.id);
|
||
|
||
-- 作用域：sync（SYNC 增量同步；changes 工具由 REQ-20260911-0013 注册并绑定到本作用域）
|
||
-- 个人 Token 禁调 SYNC 工具靠 token_scope 白名单天然生效：个人 Token 不绑定本作用域即 PERMISSION_DENIED，
|
||
-- 无需任何拦截代码。只为服务 Token（principal_type=service）勾选 sync 作用域。
|
||
-- service_enabled=1：允许服务主体签发（REQ-20260921-0004 起签发校验由该标记驱动，V7 迁移只覆盖存量行）。
|
||
INSERT INTO agent_scope (name, code, memo, status, service_enabled, create_id)
|
||
SELECT '数据同步', 'sync', 'SYNC 增量同步作用域（5628 注册 *.changes.list 工具后绑定，仅服务 Token 使用）', 1, 1, 0
|
||
WHERE NOT EXISTS (SELECT 1 FROM agent_scope WHERE code = 'sync');
|
||
|
||
-- sync 作用域-工具：服务 Token 自检、三条变化流及发送前合同复核
|
||
INSERT INTO scope_tool (scope_id, tool_id, create_id)
|
||
SELECT s.id, t.id, 0 FROM agent_scope s JOIN tool t
|
||
WHERE s.code = 'sync' AND t.name IN ('integration.context.get', 'users.changes.list', 'properties.changes.list', 'contracts.changes.list', 'contracts.current.batch_get')
|
||
AND NOT EXISTS (SELECT 1 FROM scope_tool st WHERE st.scope_id = s.id AND st.tool_id = t.id);
|
||
|
||
-- 作用域：ops-query（REQ-20260921-0004 服务身份免登录分页查询）
|
||
-- service_enabled=1 允许 tenant_service 服务 Token 签发；服务主体调查询工具按总部视角全量可见。
|
||
-- 只放查询类工具；warehouse.todo.list.query 按当前登录人统计，服务身份无语义，不绑。
|
||
INSERT INTO agent_scope (name, code, memo, status, service_enabled, create_id)
|
||
SELECT '运营查询', 'ops-query', 'dev 种子：服务身份免登录分页查询作用域（tenant_service 全量可见）', 1, 1, 0
|
||
WHERE NOT EXISTS (SELECT 1 FROM agent_scope WHERE code = 'ops-query');
|
||
|
||
INSERT INTO scope_tool (scope_id, tool_id, create_id)
|
||
SELECT s.id, t.id, 0 FROM agent_scope s JOIN tool t
|
||
WHERE s.code = 'ops-query' AND t.name IN ('sys.ping', 'integration.context.get', 'agent.count', 'agent.list.query', 'agent.detail.query', 'property.list.query', 'property.detail.query', 'district.list.query', 'district.detail.get', 'district.paper.statistics.query', 'hardware.list.query', 'hardware.detail.query', 'contract.list.query', 'contract.detail.query', 'mall.order.list.query', 'mall.order.detail.query', 'mall.order.logistics.query', 'install.order.list.query', 'install.order.detail.query', 'delivery.order.list.query', 'delivery.order.detail.query', 'pickup.order.list.query', 'pickup.order.detail.query', 'relocation.order.list.query', 'relocation.order.detail.query', 'withdraw.order.list.query', 'withdraw.order.detail.query', 'warehouse.in.list.query', 'warehouse.in.detail.query', 'warehouse.out.list.query', 'warehouse.out.detail.query', 'warehouse.stock.list.query')
|
||
AND NOT EXISTS (SELECT 1 FROM scope_tool st WHERE st.scope_id = s.id AND st.tool_id = t.id);
|
||
|
||
COMMIT;
|
||
|
||
-- 校验
|
||
SELECT s.id, s.code, t.name FROM agent_scope s JOIN scope_tool st ON s.id = st.scope_id JOIN tool t ON st.tool_id = t.id WHERE s.soft_delete = 0;
|