47 lines
2.0 KiB
SQL
47 lines
2.0 KiB
SQL
-- ============================================
|
||
-- 创建审计日志表
|
||
-- 用于记录敏感操作，便于安全审计
|
||
-- ============================================
|
||
|
||
-- 创建审计日志表
|
||
CREATE TABLE IF NOT EXISTS public.audit_logs (
|
||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||
user_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
|
||
company_id UUID REFERENCES public.companies(id) ON DELETE SET NULL,
|
||
action TEXT NOT NULL, -- 操作类型：login, logout, create, update, delete, export, etc.
|
||
resource_type TEXT NOT NULL, -- 资源类型：plan, factory, warehouse, payment, profile, etc.
|
||
resource_id UUID, -- 被操作资源的ID
|
||
details JSONB, -- 操作详情（JSON格式）
|
||
ip_address TEXT, -- IP地址
|
||
user_agent TEXT, -- 用户代理
|
||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||
);
|
||
|
||
-- 创建索引
|
||
CREATE INDEX idx_audit_logs_user_id ON public.audit_logs(user_id);
|
||
CREATE INDEX idx_audit_logs_company_id ON public.audit_logs(company_id);
|
||
CREATE INDEX idx_audit_logs_action ON public.audit_logs(action);
|
||
CREATE INDEX idx_audit_logs_created_at ON public.audit_logs(created_at DESC);
|
||
|
||
-- 启用 RLS
|
||
ALTER TABLE public.audit_logs ENABLE ROW LEVEL SECURITY;
|
||
|
||
-- 审计日志策略：用户只能查看自己公司的日志
|
||
CREATE POLICY users_select_company_audit_logs ON public.audit_logs
|
||
FOR SELECT USING (
|
||
company_id = public.get_user_master_company_id()
|
||
);
|
||
|
||
-- 允许插入日志（应用层写入）
|
||
CREATE POLICY users_insert_audit_logs ON public.audit_logs
|
||
FOR INSERT WITH CHECK (true);
|
||
|
||
-- 禁止修改和删除审计日志（保证不可篡改）
|
||
-- 不提供 UPDATE 和 DELETE 策略
|
||
|
||
-- 注释
|
||
COMMENT ON TABLE public.audit_logs IS '审计日志表，记录所有敏感操作';
|
||
COMMENT ON COLUMN public.audit_logs.action IS '操作类型：login, logout, create, update, delete, export';
|
||
COMMENT ON COLUMN public.audit_logs.resource_type IS '被操作的资源类型';
|
||
COMMENT ON COLUMN public.audit_logs.details IS '操作详情，JSON格式存储变更前后数据';
|