郑龙捷
7d5e3e9a50
- 删除模型大类概览和细分银行概览中原型未包含的过渡跳转按钮，保留卡片点击、筛选、指标趋势和详情入口。 - 移除运维系统配置页中的模型平台新增页面依赖、登录角色来源等内部说明，仅保留实际配置内容。 - 将开发工作台访问控制统一收敛到 dashboard:view，业务团队仅保留运维工作台权限；直接访问开发工作台时自动回到运维工作台。 - 补充架构实现基线、外部写入协议、运维 API 清单、三角色权限验收说明和首条纵向链路联调手册。 - 按当前实现更新架构变更记录和本周目标完成情况。
189 lines
9.6 KiB
SQL
189 lines
9.6 KiB
SQL
-- A 卡运维平台角色权限矩阵初始化 V0.1
|
|
-- 目标库：model_platform
|
|
-- 说明：
|
|
-- 1. 本脚本只新增/恢复运维权限和业务团队角色，不删除既有权限。
|
|
-- 2. 重复执行幂等；已有软删除权限/关联会被恢复。
|
|
-- 3. admin、developer 使用现有角色；developer 对应模型团队。
|
|
-- 4. 业务账号不会在本脚本中被批量改角色，需确认用户名后再分配 business_team。
|
|
|
|
USE model_platform;
|
|
SET NAMES utf8mb4;
|
|
|
|
START TRANSACTION;
|
|
|
|
-- 业务团队角色：不存在时创建，存在时恢复并更新展示信息。
|
|
INSERT INTO roles (
|
|
role_id, role_code, role_name, role_scope, is_builtin,
|
|
description, is_deleted, deleted_at
|
|
) VALUES (
|
|
'0000000000VKFJ85E90FABHPGT',
|
|
'business_team',
|
|
'业务团队',
|
|
'platform',
|
|
1,
|
|
'A 卡运维平台业务团队角色',
|
|
0,
|
|
NULL
|
|
) AS incoming_role
|
|
ON DUPLICATE KEY UPDATE
|
|
role_name = incoming_role.role_name,
|
|
role_scope = incoming_role.role_scope,
|
|
is_builtin = incoming_role.is_builtin,
|
|
description = incoming_role.description,
|
|
is_deleted = 0,
|
|
deleted_at = NULL;
|
|
|
|
-- 运维页面和操作权限。
|
|
INSERT INTO permissions (
|
|
permission_id, permission_code, permission_name, module_code,
|
|
description, is_deleted, deleted_at
|
|
) VALUES
|
|
('10000000000000000000000001', 'operations:workbench:view', '查看运维工作台', 'operations', '查看运维工作台、KPI、待办和关注', 0, NULL),
|
|
('10000000000000000000000002', 'operations:usage:view', '查看平台使用统计', 'operations', '查看平台使用统计', 0, NULL),
|
|
('10000000000000000000000003', 'operations:model-overview:view', '查看模型大类概览', 'operations', '查看模型大类概览', 0, NULL),
|
|
('10000000000000000000000004', 'operations:bank-overview:view', '查看细分银行概览', 'operations', '查看细分银行概览', 0, NULL),
|
|
('10000000000000000000000005', 'operations:deployed-models:view', '查看已上线模型详情', 'operations', '查看已上线模型详情', 0, NULL),
|
|
('10000000000000000000000006', 'operations:monitoring-overview:view', '查看模型监控概览', 'operations', '查看模型监控概览和监控明细', 0, NULL),
|
|
('10000000000000000000000007', 'operations:monitoring-detail:view', '查看模型监控详情', 'operations', '查看模型监控详情和指标分布', 0, NULL),
|
|
('10000000000000000000000008', 'operations:monitoring-detail:model-review', '模型团队初审监控结果', 'operations', '模型团队处理监控结果并提交初审', 0, NULL),
|
|
('10000000000000000000000009', 'operations:monitoring-detail:business-review', '业务团队终审监控结果', 'operations', '业务团队确认监控处理结果', 0, NULL),
|
|
('1000000000000000000000000A', 'operations:report:view', '查看监控诊断报告', 'operations', '查看监控诊断报告', 0, NULL),
|
|
('1000000000000000000000000B', 'operations:report:edit', '编辑监控诊断报告', 'operations', '编辑监控诊断报告内容', 0, NULL),
|
|
('1000000000000000000000000D', 'operations:report:export', '导出监控诊断报告', 'operations', '导出监控诊断报告', 0, NULL),
|
|
('1000000000000000000000000E', 'operations:report:send', '发送监控诊断报告', 'operations', '发送监控诊断报告', 0, NULL),
|
|
('1000000000000000000000000F', 'operations:report-summary:view', '查看历史报告汇总', 'operations', '查看历史报告汇总', 0, NULL),
|
|
('10000000000000000000000010', 'operations:workflow:view', '查看全流程进度', 'operations', '查看全流程进度', 0, NULL),
|
|
('10000000000000000000000011', 'operations:workflow:create', '发起模型需求', 'operations', '业务团队发起模型开发或迭代需求', 0, NULL),
|
|
('10000000000000000000000012', 'operations:workflow:feedback', '流程反馈', 'operations', '业务团队填写方案设计等反馈', 0, NULL),
|
|
('10000000000000000000000013', 'operations:workflow:confirm', '流程确认', 'operations', '业务团队确认流程材料和结果', 0, NULL),
|
|
('10000000000000000000000014', 'operations:workflow:submit-material', '提交流程材料', 'operations', '模型团队提交流程材料', 0, NULL),
|
|
('10000000000000000000000015', 'operations:workflow:advance', '推进流程', 'operations', '模型团队推进流程环节', 0, NULL),
|
|
('10000000000000000000000016', 'operations:workflow:online', '模型上线', 'operations', '模型团队提交模型上线信息', 0, NULL),
|
|
('10000000000000000000000017', 'operations:knowledge:view', '查看文档知识库', 'operations', '按模型、名称和环节查看文档知识库', 0, NULL),
|
|
('10000000000000000000000018', 'operations:rules:view', '查看监控等级规则', 'operations', '查看监控等级规则', 0, NULL),
|
|
('10000000000000000000000019', 'operations:rules:publish', '发布监控等级规则', 'operations', '发布监控等级规则版本', 0, NULL),
|
|
('1000000000000000000000001A', 'operations:rules:rollback', '回滚监控等级规则', 'operations', '回滚监控等级规则版本', 0, NULL),
|
|
('1000000000000000000000001B', 'operations:rules:simulate', '测算监控等级规则', 'operations', '测算阈值变化影响', 0, NULL),
|
|
('1000000000000000000000001C', 'operations:prompt:view', '查看报告 Prompt', 'operations', '查看报告 Prompt 管理页面', 0, NULL),
|
|
('1000000000000000000000001D', 'operations:prompt:edit', '编辑报告 Prompt', 'operations', '编辑报告 Prompt', 0, NULL),
|
|
('1000000000000000000000001E', 'operations:prompt:regression', '提交 Prompt 回归', 'operations', '提交 Prompt 回归测试', 0, NULL),
|
|
('1000000000000000000000001F', 'operations:settings:view', '查看系统配置', 'operations', '查看和维护运维系统配置', 0, NULL) AS incoming_permission
|
|
ON DUPLICATE KEY UPDATE
|
|
permission_name = incoming_permission.permission_name,
|
|
module_code = incoming_permission.module_code,
|
|
description = incoming_permission.description,
|
|
is_deleted = 0,
|
|
deleted_at = NULL;
|
|
|
|
-- 业务团队：我的工作台、上线/监控/报告/流程的业务侧能力。
|
|
INSERT INTO role_permissions (role_id, permission_id)
|
|
SELECT r.role_id, p.permission_id
|
|
FROM roles AS r
|
|
JOIN permissions AS p
|
|
ON p.permission_code IN (
|
|
'operations:workbench:view',
|
|
'operations:model-overview:view',
|
|
'operations:bank-overview:view',
|
|
'operations:monitoring-overview:view',
|
|
'operations:monitoring-detail:view',
|
|
'operations:monitoring-detail:business-review',
|
|
'operations:report:view',
|
|
'operations:report:export',
|
|
'operations:report-summary:view',
|
|
'operations:workflow:view',
|
|
'operations:workflow:create',
|
|
'operations:workflow:feedback',
|
|
'operations:workflow:confirm'
|
|
)
|
|
WHERE r.role_code = 'business_team'
|
|
AND r.is_deleted = 0
|
|
AND p.is_deleted = 0
|
|
ON DUPLICATE KEY UPDATE
|
|
is_deleted = 0,
|
|
deleted_at = NULL;
|
|
|
|
-- 矩阵修正：业务团队只进入运维工作台，不允许进入开发工作台。
|
|
UPDATE role_permissions AS rp
|
|
JOIN roles AS r ON r.role_id = rp.role_id
|
|
JOIN permissions AS p ON p.permission_id = rp.permission_id
|
|
SET rp.is_deleted = 1,
|
|
rp.deleted_at = CURRENT_TIMESTAMP(3)
|
|
WHERE r.role_code = 'business_team'
|
|
AND p.permission_code = 'dashboard:view'
|
|
AND rp.is_deleted = 0;
|
|
|
|
-- 模型团队：developer 角色对应模型团队。
|
|
INSERT INTO role_permissions (role_id, permission_id)
|
|
SELECT r.role_id, p.permission_id
|
|
FROM roles AS r
|
|
JOIN permissions AS p
|
|
ON p.permission_code IN (
|
|
'dashboard:view',
|
|
'operations:workbench:view',
|
|
'operations:model-overview:view',
|
|
'operations:bank-overview:view',
|
|
'operations:deployed-models:view',
|
|
'operations:monitoring-overview:view',
|
|
'operations:monitoring-detail:view',
|
|
'operations:monitoring-detail:model-review',
|
|
'operations:report:view',
|
|
'operations:report:edit',
|
|
'operations:report:export',
|
|
'operations:report:send',
|
|
'operations:report-summary:view',
|
|
'operations:workflow:view',
|
|
'operations:workflow:submit-material',
|
|
'operations:workflow:advance',
|
|
'operations:workflow:online',
|
|
'operations:knowledge:view',
|
|
'operations:rules:view',
|
|
'operations:prompt:view',
|
|
'operations:prompt:edit',
|
|
'operations:prompt:regression'
|
|
)
|
|
WHERE r.role_code = 'developer'
|
|
AND r.is_deleted = 0
|
|
AND p.is_deleted = 0
|
|
ON DUPLICATE KEY UPDATE
|
|
is_deleted = 0,
|
|
deleted_at = NULL;
|
|
|
|
-- 管理员：拥有全部运维页面和操作权限；既有系统权限不受影响。
|
|
INSERT INTO role_permissions (role_id, permission_id)
|
|
SELECT r.role_id, p.permission_id
|
|
FROM roles AS r
|
|
JOIN permissions AS p
|
|
ON p.module_code = 'operations'
|
|
AND p.is_deleted = 0
|
|
WHERE r.role_code = 'admin'
|
|
AND r.is_deleted = 0
|
|
ON DUPLICATE KEY UPDATE
|
|
is_deleted = 0,
|
|
deleted_at = NULL;
|
|
|
|
COMMIT;
|
|
|
|
-- 执行后核验：应看到 admin、developer、business_team 三个角色的运维权限。
|
|
SELECT
|
|
r.role_code,
|
|
r.role_name,
|
|
COUNT(p.permission_id) AS operations_permission_count
|
|
FROM roles AS r
|
|
LEFT JOIN role_permissions AS rp
|
|
ON rp.role_id = r.role_id
|
|
AND rp.is_deleted = 0
|
|
LEFT JOIN permissions AS p
|
|
ON p.permission_id = rp.permission_id
|
|
AND p.module_code = 'operations'
|
|
AND p.is_deleted = 0
|
|
WHERE r.role_code IN ('admin', 'developer', 'business_team')
|
|
GROUP BY r.role_code, r.role_name
|
|
ORDER BY FIELD(r.role_code, 'admin', 'developer', 'business_team');
|
|
|
|
-- 如需给某个业务账号分配业务团队角色，请先确认用户名，再单独执行：
|
|
-- UPDATE users
|
|
-- SET platform_role_id = (SELECT role_id FROM roles WHERE role_code = 'business_team'),
|
|
-- updated_at = CURRENT_TIMESTAMP(3)
|
|
-- WHERE username = '<确认后的业务账号>'
|
|
-- AND is_deleted = 0;
|