From b4b300bb8a4f8841d9325f01be717441afc79961 Mon Sep 17 00:00:00 2001 From: weichen Date: Thu, 17 Sep 2026 09:15:15 +0000 Subject: [PATCH] feat(db): add author-only approval policy revision and audit Seed workflow.allow_author_only_approval closed, add monotonic revision on system_settings, and a narrow policy audit table. Co-authored-by: Cursor --- ...2026-09-17-workflow-author-only-policy.sql | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 deploy/postgres/goose/00050_2026-09-17-workflow-author-only-policy.sql diff --git a/deploy/postgres/goose/00050_2026-09-17-workflow-author-only-policy.sql b/deploy/postgres/goose/00050_2026-09-17-workflow-author-only-policy.sql new file mode 100644 index 00000000..8d5da424 --- /dev/null +++ b/deploy/postgres/goose/00050_2026-09-17-workflow-author-only-policy.sql @@ -0,0 +1,30 @@ +-- +goose Up +-- 编制人兼任总授权：system_settings 增加 monotonic revision；种子目标 key；策略变更审计（仅本策略必需）。 + +ALTER TABLE system_settings + ADD COLUMN IF NOT EXISTS revision BIGINT NOT NULL DEFAULT 0; + +CREATE TABLE IF NOT EXISTS system_setting_policy_audits ( + id BIGSERIAL PRIMARY KEY, + setting_key TEXT NOT NULL, + before_value JSONB, + after_value JSONB NOT NULL, + before_revision BIGINT, + after_revision BIGINT NOT NULL, + actor_user_id BIGINT NOT NULL, + request_id TEXT, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() +); + +CREATE INDEX IF NOT EXISTS idx_system_setting_policy_audits_key_created + ON system_setting_policy_audits (setting_key, created_at DESC); + +-- 初始化目标行，避免激活事务对缺失行拿不到行锁。 +INSERT INTO system_settings (key, value, revision, updated_at) +VALUES ('workflow.allow_author_only_approval', 'false'::jsonb, 0, now()) +ON CONFLICT (key) DO NOTHING; + +-- +goose Down +DELETE FROM system_settings WHERE key = 'workflow.allow_author_only_approval'; +DROP TABLE IF EXISTS system_setting_policy_audits; +ALTER TABLE system_settings DROP COLUMN IF EXISTS revision;