forked from xiaohei/taiji-AI-PAD
72 lines
3.7 KiB
SQL
72 lines
3.7 KiB
SQL
-- Migration 025: Heicode P1 资源模型
|
||
-- 新增 resource_bindings 和 resource_grants 两张表
|
||
-- 完全增量，不修改已有表/列。
|
||
--
|
||
-- 依据：
|
||
-- Docs/项目文档/heicode.md §五 资源绑定与密钥托管
|
||
-- Docs/项目文档/plan.md §P1 Manager 资源模型
|
||
--
|
||
-- 安全红线：DB 只保存 secret_ref，不保存明文密钥；任何 metadata/constraints/audit
|
||
-- 字段中出现 password/token/secret/private_key/access_key/credential 都应被应用层拒绝。
|
||
|
||
-- ==================== resource_bindings ====================
|
||
|
||
CREATE TABLE IF NOT EXISTS resource_bindings (
|
||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||
user_id UUID NOT NULL REFERENCES users(id),
|
||
type VARCHAR(50) NOT NULL,
|
||
-- 允许值：git | sk | project_doc | cloud_account | cloud_resource
|
||
name VARCHAR(255) NOT NULL,
|
||
external_ref TEXT,
|
||
-- repo URL / subscription ID / resource ID 等非密钥标识
|
||
binding_metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
|
||
-- API 字段名 "metadata"；列名加前缀避免与 SQLAlchemy 保留名冲突
|
||
permission_scope JSONB NOT NULL DEFAULT '[]'::jsonb,
|
||
-- 字符串数组，例如 ["repo:read", "repo:write:current-branch"]
|
||
constraints JSONB NOT NULL DEFAULT '{}'::jsonb,
|
||
secret_ref VARCHAR(500),
|
||
-- vault://... 等引用；为 NULL 表示该资源无凭据（如 project_doc）
|
||
status VARCHAR(20) NOT NULL DEFAULT 'pending',
|
||
-- 允许值：pending | active | disabled | revoked
|
||
created_by UUID,
|
||
updated_by UUID,
|
||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
|
||
);
|
||
|
||
CREATE INDEX IF NOT EXISTS idx_resource_bindings_user ON resource_bindings(user_id);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_bindings_type ON resource_bindings(type);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_bindings_status ON resource_bindings(status);
|
||
|
||
-- ==================== resource_grants ====================
|
||
|
||
CREATE TABLE IF NOT EXISTS resource_grants (
|
||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||
user_id UUID NOT NULL REFERENCES users(id),
|
||
binding_scope VARCHAR(255) NOT NULL,
|
||
-- repo/ref/path 或云资源引用，作为 grant 的归属作用域
|
||
resource_id UUID NOT NULL REFERENCES resource_bindings(id) ON DELETE CASCADE,
|
||
role VARCHAR(100),
|
||
-- 子 Agnet 角色：product/frontend/backend/reviewer/ops/...
|
||
agent_id UUID,
|
||
-- 可空；为空表示授予下一次该角色部署
|
||
allowed_actions JSONB NOT NULL DEFAULT '[]'::jsonb,
|
||
-- 必须是对应 binding.permission_scope 的子集
|
||
constraints JSONB NOT NULL DEFAULT '{}'::jsonb,
|
||
-- 不得放宽 binding.constraints 的限制
|
||
status VARCHAR(20) NOT NULL DEFAULT 'active',
|
||
-- 允许值：active | suspended | revoked | expired
|
||
expires_at TIMESTAMP WITH TIME ZONE,
|
||
created_by UUID,
|
||
revoked_by UUID,
|
||
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||
updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
|
||
revoked_at TIMESTAMP WITH TIME ZONE
|
||
);
|
||
|
||
CREATE INDEX IF NOT EXISTS idx_resource_grants_user ON resource_grants(user_id);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_grants_resource ON resource_grants(resource_id);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_grants_status ON resource_grants(status);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_grants_binding_scope ON resource_grants(binding_scope);
|
||
CREATE INDEX IF NOT EXISTS idx_resource_grants_role ON resource_grants(role);
|