feat(db): add workflow definitions, versions, and template asset tables

Introduce Phase 2 IAM-adjacent schema for versioned workflow definitions, template assets/versions, and workflow_defs permissions seed. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:22 +00:00
parent a24b00d393
commit edffe74009
11 changed files with 1417 additions and 1 deletions
@@ -0,0 +1,99 @@
+-- +goose Up
+-- Phase 2: 工作流定义版本化 + 模板资产库
+
+CREATE TABLE IF NOT EXISTS workflow_definitions (
+    id                      BIGSERIAL PRIMARY KEY,
+    def_key                 TEXT NOT NULL UNIQUE,
+    name                    TEXT NOT NULL,
+    description             TEXT NOT NULL DEFAULT '',
+    status                  TEXT NOT NULL DEFAULT 'active',
+    latest_published_version INT NOT NULL DEFAULT 0,
+    product_domain          TEXT NOT NULL DEFAULT '',
+    created_at              TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at              TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS workflow_versions (
+    id              BIGSERIAL PRIMARY KEY,
+    workflow_id     BIGINT NOT NULL REFERENCES workflow_definitions(id) ON DELETE CASCADE,
+    version         INT NOT NULL,
+    status          TEXT NOT NULL DEFAULT 'draft',
+    schema_version  INT NOT NULL DEFAULT 1,
+    definition_json JSONB NOT NULL DEFAULT '{}'::jsonb,
+    definition_hash TEXT NOT NULL DEFAULT '',
+    published_by    BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    published_at    TIMESTAMPTZ,
+    created_by      BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT uq_workflow_version UNIQUE (workflow_id, version),
+    CONSTRAINT chk_workflow_version_status CHECK (status IN ('draft', 'published', 'retired'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_workflow_one_draft
+    ON workflow_versions(workflow_id)
+    WHERE status = 'draft';
+
+CREATE INDEX IF NOT EXISTS idx_workflow_versions_status ON workflow_versions(status);
+CREATE INDEX IF NOT EXISTS idx_workflow_versions_workflow ON workflow_versions(workflow_id, version DESC);
+
+CREATE TABLE IF NOT EXISTS template_assets (
+    id          BIGSERIAL PRIMARY KEY,
+    asset_key   TEXT NOT NULL UNIQUE,
+    name        TEXT NOT NULL,
+    status      TEXT NOT NULL DEFAULT 'active',
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS template_versions (
+    id              BIGSERIAL PRIMARY KEY,
+    asset_id        BIGINT NOT NULL REFERENCES template_assets(id) ON DELETE CASCADE,
+    version         INT NOT NULL,
+    blob_sha256     TEXT NOT NULL,
+    mime_type       TEXT NOT NULL DEFAULT 'application/octet-stream',
+    size_bytes      BIGINT NOT NULL DEFAULT 0,
+    scan_status     TEXT NOT NULL DEFAULT 'pending',
+    variable_schema JSONB NOT NULL DEFAULT '[]'::jsonb,
+    created_by      BIGINT REFERENCES users(id) ON DELETE SET NULL,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT uq_template_asset_version UNIQUE (asset_id, version),
+    CONSTRAINT chk_template_scan_status CHECK (scan_status IN ('pending', 'ready', 'rejected'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_template_versions_asset ON template_versions(asset_id, version DESC);
+CREATE INDEX IF NOT EXISTS idx_template_versions_sha ON template_versions(blob_sha256);
+
+INSERT INTO system_permissions (perm_key, resource_type, action, risk_level) VALUES
+    ('workflow_defs.view', 'workflow', 'view', 'normal'),
+    ('workflow_defs.create', 'workflow', 'create', 'elevated'),
+    ('workflow_defs.edit_draft', 'workflow', 'edit_draft', 'elevated'),
+    ('workflow_defs.publish', 'workflow', 'publish', 'critical'),
+    ('workflow_defs.retire', 'workflow', 'retire', 'elevated'),
+    ('templates.upload', 'template', 'upload', 'elevated'),
+    ('templates.download', 'template', 'download', 'normal'),
+    ('templates.publish', 'template', 'publish', 'elevated')
+ON CONFLICT (perm_key) DO NOTHING;
+
+INSERT INTO system_role_permissions (role_id, permission_id, effect)
+SELECT 'role-admin', p.id, 'allow'
+FROM system_permissions p
+WHERE p.perm_key LIKE 'workflow_defs.%' OR p.perm_key LIKE 'templates.%'
+ON CONFLICT DO NOTHING;
+
+-- +goose Down
+DROP TABLE IF EXISTS template_versions;
+DROP TABLE IF EXISTS template_assets;
+DROP INDEX IF EXISTS uq_workflow_one_draft;
+DROP INDEX IF EXISTS idx_workflow_versions_status;
+DROP INDEX IF EXISTS idx_workflow_versions_workflow;
+DROP TABLE IF EXISTS workflow_versions;
+DROP TABLE IF EXISTS workflow_definitions;
+
+DELETE FROM system_role_permissions
+WHERE permission_id IN (
+    SELECT id FROM system_permissions
+    WHERE perm_key LIKE 'workflow_defs.%' OR perm_key LIKE 'templates.%'
+);
+DELETE FROM system_permissions
+WHERE perm_key LIKE 'workflow_defs.%' OR perm_key LIKE 'templates.%';