Initial commit: InternalAuditInterprise
This commit is contained in:
freedakgmail
@@ -0,0 +1,7 @@
|
||||
# 数据库迁移（Alembic）
|
||||
|
||||
- 生成迁移：`alembic revision --autogenerate -m "描述"`
|
||||
- 应用迁移：`alembic upgrade head`
|
||||
- 回滚一步：`alembic downgrade -1`
|
||||
|
||||
模型定义见 `app/datahub/models.py`；连接串取自应用配置（`DATABASE_URL`）。
|
||||
@@ -0,0 +1,59 @@
|
||||
"""Alembic 迁移环境。
|
||||
|
||||
从应用配置读取数据库 URL，并以 app.db.Base 的元数据作为 autogenerate 目标。
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from logging.config import fileConfig
|
||||
|
||||
from alembic import context
|
||||
from sqlalchemy import engine_from_config, pool
|
||||
|
||||
from app.audit import models as audit_models # noqa: F401,E402
|
||||
from app.clues import models as clue_models # noqa: F401,E402
|
||||
from app.config import get_settings
|
||||
|
||||
# 导入模型以注册到 Base.metadata
|
||||
from app.datahub import models # noqa: F401,E402
|
||||
from app.db import Base
|
||||
|
||||
config = context.config
|
||||
|
||||
if config.config_file_name is not None:
|
||||
fileConfig(config.config_file_name)
|
||||
|
||||
# 用应用配置覆盖 sqlalchemy.url
|
||||
config.set_main_option("sqlalchemy.url", get_settings().database_url)
|
||||
|
||||
target_metadata = Base.metadata
|
||||
|
||||
|
||||
def run_migrations_offline() -> None:
|
||||
url = config.get_main_option("sqlalchemy.url")
|
||||
context.configure(
|
||||
url=url,
|
||||
target_metadata=target_metadata,
|
||||
literal_binds=True,
|
||||
dialect_opts={"paramstyle": "named"},
|
||||
)
|
||||
with context.begin_transaction():
|
||||
context.run_migrations()
|
||||
|
||||
|
||||
def run_migrations_online() -> None:
|
||||
connectable = engine_from_config(
|
||||
config.get_section(config.config_ini_section, {}),
|
||||
prefix="sqlalchemy.",
|
||||
poolclass=pool.NullPool,
|
||||
)
|
||||
with connectable.connect() as connection:
|
||||
context.configure(connection=connection, target_metadata=target_metadata)
|
||||
with context.begin_transaction():
|
||||
context.run_migrations()
|
||||
|
||||
|
||||
if context.is_offline_mode():
|
||||
run_migrations_offline()
|
||||
else:
|
||||
run_migrations_online()
|
||||
@@ -0,0 +1,24 @@
|
||||
"""${message}
|
||||
|
||||
Revision ID: ${up_revision}
|
||||
Revises: ${down_revision | comma,n}
|
||||
Create Date: ${create_date}
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
${imports if imports else ""}
|
||||
|
||||
revision: str = ${repr(up_revision)}
|
||||
down_revision: Union[str, None] = ${repr(down_revision)}
|
||||
branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
|
||||
depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
${upgrades if upgrades else "pass"}
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
${downgrades if downgrades else "pass"}
|
||||
@@ -0,0 +1,140 @@
|
||||
"""初始化数据中台表：数据版本 / 实体 / 关系 / 双时态事实 / 时序事件
|
||||
|
||||
Revision ID: 0001_init_datahub
|
||||
Revises:
|
||||
Create Date: 2026-06
|
||||
"""
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
revision: str = "0001_init_datahub"
|
||||
down_revision: str | None = None
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
# data_version
|
||||
op.create_table(
|
||||
"data_version",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("source_system", sa.String(64), nullable=False),
|
||||
sa.Column("batch_label", sa.String(128), nullable=False),
|
||||
sa.Column("row_count", sa.Integer(), nullable=False, server_default="0"),
|
||||
sa.Column("ingested_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("note", sa.Text(), nullable=True),
|
||||
)
|
||||
|
||||
# entity
|
||||
op.create_table(
|
||||
"entity",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("entity_type", sa.String(32), nullable=False),
|
||||
sa.Column("business_key", sa.String(128), nullable=False),
|
||||
sa.Column("display_name", sa.String(256), nullable=True),
|
||||
sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("canonical_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.ForeignKeyConstraint(["canonical_id"], ["entity.id"]),
|
||||
sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
|
||||
sa.UniqueConstraint("entity_type", "business_key", name="uq_entity_type_bizkey"),
|
||||
)
|
||||
op.create_index("ix_entity_type", "entity", ["entity_type"])
|
||||
|
||||
# entity_relationship
|
||||
op.create_table(
|
||||
"entity_relationship",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("rel_type", sa.String(32), nullable=False),
|
||||
sa.Column("source_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("target_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.ForeignKeyConstraint(["source_id"], ["entity.id"]),
|
||||
sa.ForeignKeyConstraint(["target_id"], ["entity.id"]),
|
||||
sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
|
||||
)
|
||||
op.create_index("ix_rel_source", "entity_relationship", ["source_id"])
|
||||
op.create_index("ix_rel_target", "entity_relationship", ["target_id"])
|
||||
op.create_index("ix_rel_type", "entity_relationship", ["rel_type"])
|
||||
|
||||
# bitemporal_fact
|
||||
op.create_table(
|
||||
"bitemporal_fact",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("entity_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("attr_name", sa.String(64), nullable=False),
|
||||
sa.Column("attr_value", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("valid_from", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("valid_to", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("system_from", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("system_to", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.ForeignKeyConstraint(["entity_id"], ["entity.id"]),
|
||||
sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
|
||||
)
|
||||
op.create_index("ix_btf_entity_attr", "bitemporal_fact", ["entity_id", "attr_name"])
|
||||
|
||||
# metric_event（时序）
|
||||
op.create_table(
|
||||
"metric_event",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("event_time", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("subject_type", sa.String(32), nullable=False),
|
||||
sa.Column("subject_key", sa.String(128), nullable=False),
|
||||
sa.Column("metric_name", sa.String(64), nullable=False),
|
||||
sa.Column("metric_value", sa.Float(), nullable=False, server_default="0"),
|
||||
sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
# 超表主键需包含分区列 event_time
|
||||
sa.PrimaryKeyConstraint("id", "event_time"),
|
||||
sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
|
||||
)
|
||||
op.create_index(
|
||||
"ix_metric_subject_time",
|
||||
"metric_event",
|
||||
["subject_type", "subject_key", "event_time"],
|
||||
)
|
||||
op.create_index("ix_metric_name_time", "metric_event", ["metric_name", "event_time"])
|
||||
|
||||
# 转为 TimescaleDB 超表（若扩展不存在则跳过，便于无 timescaledb 环境运行测试）
|
||||
op.execute(
|
||||
"""
|
||||
DO $$
|
||||
BEGIN
|
||||
IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'timescaledb') THEN
|
||||
PERFORM create_hypertable('metric_event', 'event_time', if_not_exists => TRUE);
|
||||
END IF;
|
||||
END$$;
|
||||
"""
|
||||
)
|
||||
|
||||
# 双时态排他约束：同一实体同一属性，业务有效期不重叠（需 btree_gist）
|
||||
op.execute(
|
||||
"""
|
||||
DO $$
|
||||
BEGIN
|
||||
IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'btree_gist') THEN
|
||||
ALTER TABLE bitemporal_fact
|
||||
ADD CONSTRAINT ex_btf_no_overlap
|
||||
EXCLUDE USING gist (
|
||||
entity_id WITH =,
|
||||
attr_name WITH =,
|
||||
tstzrange(valid_from, valid_to) WITH &&
|
||||
) WHERE (system_to IS NULL);
|
||||
END IF;
|
||||
END$$;
|
||||
"""
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_table("metric_event")
|
||||
op.drop_table("bitemporal_fact")
|
||||
op.drop_table("entity_relationship")
|
||||
op.drop_index("ix_entity_type", table_name="entity")
|
||||
op.drop_table("entity")
|
||||
op.drop_table("data_version")
|
||||
@@ -0,0 +1,146 @@
|
||||
"""线索引擎与系统自审计表：clue / clue_status_history / working_paper / audit_log
|
||||
|
||||
Revision ID: 0002_clues_audit
|
||||
Revises: 0001_init_datahub
|
||||
Create Date: 2026-06
|
||||
"""
|
||||
from collections.abc import Sequence
|
||||
|
||||
import sqlalchemy as sa
|
||||
from alembic import op
|
||||
from sqlalchemy.dialects import postgresql
|
||||
|
||||
revision: str = "0002_clues_audit"
|
||||
down_revision: str | None = "0001_init_datahub"
|
||||
branch_labels: str | Sequence[str] | None = None
|
||||
depends_on: str | Sequence[str] | None = None
|
||||
|
||||
confidence_tier = postgresql.ENUM(
|
||||
"high", "medium", "low", name="confidence_tier", create_type=False
|
||||
)
|
||||
clue_status = postgresql.ENUM(
|
||||
"new", "assigned", "reviewing", "confirmed", "dismissed",
|
||||
"rectifying", "transferred", "closed", name="clue_status", create_type=False,
|
||||
)
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
bind = op.get_bind()
|
||||
confidence_tier.create(bind, checkfirst=True)
|
||||
clue_status.create(bind, checkfirst=True)
|
||||
|
||||
op.create_table(
|
||||
"clue",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("title", sa.String(256), nullable=False),
|
||||
sa.Column("risk_domain", sa.String(32), nullable=False),
|
||||
sa.Column("scenario_code", sa.String(32), nullable=False),
|
||||
sa.Column("confidence", confidence_tier, nullable=False),
|
||||
sa.Column("score", sa.Float(), nullable=False, server_default="0"),
|
||||
sa.Column("status", clue_status, nullable=False, server_default="new"),
|
||||
sa.Column("rationale", sa.Text(), nullable=False, server_default=""),
|
||||
sa.Column("evidence", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("subjects", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("amount_involved", sa.Float(), nullable=True),
|
||||
sa.Column("assignee", sa.String(64), nullable=True),
|
||||
sa.Column("feedback", sa.String(16), nullable=True),
|
||||
sa.Column("model_version", sa.String(64), nullable=True),
|
||||
sa.Column("rule_version", sa.String(64), nullable=True),
|
||||
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
op.create_index("ix_clue_status", "clue", ["status"])
|
||||
op.create_index("ix_clue_scenario", "clue", ["scenario_code"])
|
||||
op.create_index("ix_clue_assignee", "clue", ["assignee"])
|
||||
|
||||
op.create_table(
|
||||
"clue_status_history",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("from_status", sa.String(16), nullable=True),
|
||||
sa.Column("to_status", sa.String(16), nullable=False),
|
||||
sa.Column("actor", sa.String(64), nullable=False),
|
||||
sa.Column("note", sa.Text(), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
|
||||
)
|
||||
op.create_index("ix_csh_clue", "clue_status_history", ["clue_id"])
|
||||
|
||||
op.create_table(
|
||||
"working_paper",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
|
||||
sa.Column("content", sa.Text(), nullable=False, server_default=""),
|
||||
sa.Column("conclusion", sa.String(32), nullable=True),
|
||||
sa.Column("author", sa.String(64), nullable=False),
|
||||
sa.Column("snapshot", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
|
||||
)
|
||||
op.create_index("ix_wp_clue", "working_paper", ["clue_id"])
|
||||
|
||||
op.create_table(
|
||||
"audit_log",
|
||||
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
||||
sa.Column("seq", sa.BigInteger(), sa.Identity(always=False), nullable=False),
|
||||
sa.Column("actor", sa.String(64), nullable=False),
|
||||
sa.Column("role", sa.String(32), nullable=True),
|
||||
sa.Column("action", sa.String(64), nullable=False),
|
||||
sa.Column("target_type", sa.String(64), nullable=True),
|
||||
sa.Column("target_id", sa.String(128), nullable=True),
|
||||
sa.Column("detail", postgresql.JSONB(), nullable=False, server_default="{}"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("prev_hash", sa.String(64), nullable=True),
|
||||
sa.Column("entry_hash", sa.String(64), nullable=False),
|
||||
)
|
||||
op.create_index("ix_audit_actor", "audit_log", ["actor"])
|
||||
op.create_index("ix_audit_action", "audit_log", ["action"])
|
||||
op.create_index("ix_audit_seq", "audit_log", ["seq"], unique=True)
|
||||
|
||||
# R19：禁止物理删除线索与审计日志（数据库级触发器兜底）
|
||||
op.execute(
|
||||
"""
|
||||
CREATE OR REPLACE FUNCTION forbid_delete() RETURNS trigger AS $$
|
||||
BEGIN
|
||||
RAISE EXCEPTION '禁止删除：% 表受 R19 不可删除约束保护', TG_TABLE_NAME;
|
||||
END;
|
||||
$$ LANGUAGE plpgsql;
|
||||
"""
|
||||
)
|
||||
op.execute(
|
||||
"CREATE TRIGGER trg_clue_no_delete BEFORE DELETE ON clue "
|
||||
"FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
|
||||
)
|
||||
op.execute(
|
||||
"CREATE TRIGGER trg_audit_no_delete BEFORE DELETE ON audit_log "
|
||||
"FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
|
||||
)
|
||||
# 审计日志禁止更新（仅追加）
|
||||
op.execute(
|
||||
"""
|
||||
CREATE OR REPLACE FUNCTION forbid_update() RETURNS trigger AS $$
|
||||
BEGIN
|
||||
RAISE EXCEPTION '禁止更新：% 表为仅追加日志', TG_TABLE_NAME;
|
||||
END;
|
||||
$$ LANGUAGE plpgsql;
|
||||
"""
|
||||
)
|
||||
op.execute(
|
||||
"CREATE TRIGGER trg_audit_no_update BEFORE UPDATE ON audit_log "
|
||||
"FOR EACH ROW EXECUTE FUNCTION forbid_update();"
|
||||
)
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.execute("DROP TRIGGER IF EXISTS trg_audit_no_update ON audit_log;")
|
||||
op.execute("DROP TRIGGER IF EXISTS trg_audit_no_delete ON audit_log;")
|
||||
op.execute("DROP TRIGGER IF EXISTS trg_clue_no_delete ON clue;")
|
||||
op.drop_table("audit_log")
|
||||
op.drop_table("working_paper")
|
||||
op.drop_table("clue_status_history")
|
||||
op.drop_table("clue")
|
||||
clue_status.drop(op.get_bind(), checkfirst=True)
|
||||
confidence_tier.drop(op.get_bind(), checkfirst=True)
|
||||
op.execute("DROP FUNCTION IF EXISTS forbid_update();")
|
||||
op.execute("DROP FUNCTION IF EXISTS forbid_delete();")
|
||||
Reference in New Issue
Block a user