47 lines
2.0 KiB
MySQL
47 lines
2.0 KiB
MySQL
|
-- ============================================
|
|||
|
|
-- 创建审计日志表
|
|||
|
|
-- 用于记录敏感操作，便于安全审计
|
|||
|
|
-- ============================================
|
|||
|
|
|
|||
|
|
-- 创建审计日志表
|
|||
|
|
CREATE TABLE IF NOT EXISTS public.audit_logs (
|
|||
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|||
|
|
user_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
|
|||
|
|
company_id UUID REFERENCES public.companies(id) ON DELETE SET NULL,
|
|||
|
|
action TEXT NOT NULL, -- 操作类型：login, logout, create, update, delete, export, etc.
|
|||
|
|
resource_type TEXT NOT NULL, -- 资源类型：plan, factory, warehouse, payment, profile, etc.
|
|||
|
|
resource_id UUID, -- 被操作资源的ID
|
|||
|
|
details JSONB, -- 操作详情（JSON格式）
|
|||
|
|
ip_address TEXT, -- IP地址
|
|||
|
|
user_agent TEXT, -- 用户代理
|
|||
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
-- 创建索引
|
|||
|
|
CREATE INDEX idx_audit_logs_user_id ON public.audit_logs(user_id);
|
|||
|
|
CREATE INDEX idx_audit_logs_company_id ON public.audit_logs(company_id);
|
|||
|
|
CREATE INDEX idx_audit_logs_action ON public.audit_logs(action);
|
|||
|
|
CREATE INDEX idx_audit_logs_created_at ON public.audit_logs(created_at DESC);
|
|||
|
|
|
|||
|
|
-- 启用 RLS
|
|||
|
|
ALTER TABLE public.audit_logs ENABLE ROW LEVEL SECURITY;
|
|||
|
|
|
|||
|
|
-- 审计日志策略：用户只能查看自己公司的日志
|
|||
|
|
CREATE POLICY users_select_company_audit_logs ON public.audit_logs
|
|||
|
|
FOR SELECT USING (
|
|||
|
|
company_id = public.get_user_master_company_id()
|
|||
|
|
);
|
|||
|
|
|
|||
|
|
-- 允许插入日志（应用层写入）
|
|||
|
|
CREATE POLICY users_insert_audit_logs ON public.audit_logs
|
|||
|
|
FOR INSERT WITH CHECK (true);
|
|||
|
|
|
|||
|
|
-- 禁止修改和删除审计日志（保证不可篡改）
|
|||
|
|
-- 不提供 UPDATE 和 DELETE 策略
|
|||
|
|
|
|||
|
|
-- 注释
|
|||
|
|
COMMENT ON TABLE public.audit_logs IS '审计日志表，记录所有敏感操作';
|
|||
|
|
COMMENT ON COLUMN public.audit_logs.action IS '操作类型：login, logout, create, update, delete, export';
|
|||
|
|
COMMENT ON COLUMN public.audit_logs.resource_type IS '被操作的资源类型';
|
|||
|
|
COMMENT ON COLUMN public.audit_logs.details IS '操作详情，JSON格式存储变更前后数据';
|