Initial commit: InternalAuditInterprise

2026-06-16 00:38:57 +08:00
commit 7b1e2b10a8
57 changed files with 4622 additions and 0 deletions
@@ -0,0 +1,140 @@
+"""初始化数据中台表：数据版本 / 实体 / 关系 / 双时态事实 / 时序事件
+
+Revision ID: 0001_init_datahub
+Revises:
+Create Date: 2026-06
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0001_init_datahub"
+down_revision: str | None = None
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    # data_version
+    op.create_table(
+        "data_version",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("source_system", sa.String(64), nullable=False),
+        sa.Column("batch_label", sa.String(128), nullable=False),
+        sa.Column("row_count", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("ingested_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("note", sa.Text(), nullable=True),
+    )
+
+    # entity
+    op.create_table(
+        "entity",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("entity_type", sa.String(32), nullable=False),
+        sa.Column("business_key", sa.String(128), nullable=False),
+        sa.Column("display_name", sa.String(256), nullable=True),
+        sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("canonical_id", postgresql.UUID(as_uuid=True), nullable=True),
+        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
+        sa.ForeignKeyConstraint(["canonical_id"], ["entity.id"]),
+        sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
+        sa.UniqueConstraint("entity_type", "business_key", name="uq_entity_type_bizkey"),
+    )
+    op.create_index("ix_entity_type", "entity", ["entity_type"])
+
+    # entity_relationship
+    op.create_table(
+        "entity_relationship",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("rel_type", sa.String(32), nullable=False),
+        sa.Column("source_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("target_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
+        sa.ForeignKeyConstraint(["source_id"], ["entity.id"]),
+        sa.ForeignKeyConstraint(["target_id"], ["entity.id"]),
+        sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
+    )
+    op.create_index("ix_rel_source", "entity_relationship", ["source_id"])
+    op.create_index("ix_rel_target", "entity_relationship", ["target_id"])
+    op.create_index("ix_rel_type", "entity_relationship", ["rel_type"])
+
+    # bitemporal_fact
+    op.create_table(
+        "bitemporal_fact",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("entity_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("attr_name", sa.String(64), nullable=False),
+        sa.Column("attr_value", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("valid_from", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("valid_to", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("system_from", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("system_to", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
+        sa.ForeignKeyConstraint(["entity_id"], ["entity.id"]),
+        sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
+    )
+    op.create_index("ix_btf_entity_attr", "bitemporal_fact", ["entity_id", "attr_name"])
+
+    # metric_event（时序）
+    op.create_table(
+        "metric_event",
+        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("event_time", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("subject_type", sa.String(32), nullable=False),
+        sa.Column("subject_key", sa.String(128), nullable=False),
+        sa.Column("metric_name", sa.String(64), nullable=False),
+        sa.Column("metric_value", sa.Float(), nullable=False, server_default="0"),
+        sa.Column("attributes", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
+        # 超表主键需包含分区列 event_time
+        sa.PrimaryKeyConstraint("id", "event_time"),
+        sa.ForeignKeyConstraint(["data_version_id"], ["data_version.id"]),
+    )
+    op.create_index(
+        "ix_metric_subject_time",
+        "metric_event",
+        ["subject_type", "subject_key", "event_time"],
+    )
+    op.create_index("ix_metric_name_time", "metric_event", ["metric_name", "event_time"])
+
+    # 转为 TimescaleDB 超表（若扩展不存在则跳过，便于无 timescaledb 环境运行测试）
+    op.execute(
+        """
+        DO $$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'timescaledb') THEN
+                PERFORM create_hypertable('metric_event', 'event_time', if_not_exists => TRUE);
+            END IF;
+        END$$;
+        """
+    )
+
+    # 双时态排他约束：同一实体同一属性，业务有效期不重叠（需 btree_gist）
+    op.execute(
+        """
+        DO $$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'btree_gist') THEN
+                ALTER TABLE bitemporal_fact
+                ADD CONSTRAINT ex_btf_no_overlap
+                EXCLUDE USING gist (
+                    entity_id WITH =,
+                    attr_name WITH =,
+                    tstzrange(valid_from, valid_to) WITH &&
+                ) WHERE (system_to IS NULL);
+            END IF;
+        END$$;
+        """
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("metric_event")
+    op.drop_table("bitemporal_fact")
+    op.drop_table("entity_relationship")
+    op.drop_index("ix_entity_type", table_name="entity")
+    op.drop_table("entity")
+    op.drop_table("data_version")
@@ -0,0 +1,146 @@
+"""线索引擎与系统自审计表：clue / clue_status_history / working_paper / audit_log
+
+Revision ID: 0002_clues_audit
+Revises: 0001_init_datahub
+Create Date: 2026-06
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects import postgresql
+
+revision: str = "0002_clues_audit"
+down_revision: str | None = "0001_init_datahub"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+confidence_tier = postgresql.ENUM(
+    "high", "medium", "low", name="confidence_tier", create_type=False
+)
+clue_status = postgresql.ENUM(
+    "new", "assigned", "reviewing", "confirmed", "dismissed",
+    "rectifying", "transferred", "closed", name="clue_status", create_type=False,
+)
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    confidence_tier.create(bind, checkfirst=True)
+    clue_status.create(bind, checkfirst=True)
+
+    op.create_table(
+        "clue",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("title", sa.String(256), nullable=False),
+        sa.Column("risk_domain", sa.String(32), nullable=False),
+        sa.Column("scenario_code", sa.String(32), nullable=False),
+        sa.Column("confidence", confidence_tier, nullable=False),
+        sa.Column("score", sa.Float(), nullable=False, server_default="0"),
+        sa.Column("status", clue_status, nullable=False, server_default="new"),
+        sa.Column("rationale", sa.Text(), nullable=False, server_default=""),
+        sa.Column("evidence", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("subjects", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("amount_involved", sa.Float(), nullable=True),
+        sa.Column("assignee", sa.String(64), nullable=True),
+        sa.Column("feedback", sa.String(16), nullable=True),
+        sa.Column("model_version", sa.String(64), nullable=True),
+        sa.Column("rule_version", sa.String(64), nullable=True),
+        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+    )
+    op.create_index("ix_clue_status", "clue", ["status"])
+    op.create_index("ix_clue_scenario", "clue", ["scenario_code"])
+    op.create_index("ix_clue_assignee", "clue", ["assignee"])
+
+    op.create_table(
+        "clue_status_history",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("from_status", sa.String(16), nullable=True),
+        sa.Column("to_status", sa.String(16), nullable=False),
+        sa.Column("actor", sa.String(64), nullable=False),
+        sa.Column("note", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
+    )
+    op.create_index("ix_csh_clue", "clue_status_history", ["clue_id"])
+
+    op.create_table(
+        "working_paper",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("content", sa.Text(), nullable=False, server_default=""),
+        sa.Column("conclusion", sa.String(32), nullable=True),
+        sa.Column("author", sa.String(64), nullable=False),
+        sa.Column("snapshot", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
+    )
+    op.create_index("ix_wp_clue", "working_paper", ["clue_id"])
+
+    op.create_table(
+        "audit_log",
+        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
+        sa.Column("seq", sa.BigInteger(), sa.Identity(always=False), nullable=False),
+        sa.Column("actor", sa.String(64), nullable=False),
+        sa.Column("role", sa.String(32), nullable=True),
+        sa.Column("action", sa.String(64), nullable=False),
+        sa.Column("target_type", sa.String(64), nullable=True),
+        sa.Column("target_id", sa.String(128), nullable=True),
+        sa.Column("detail", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("prev_hash", sa.String(64), nullable=True),
+        sa.Column("entry_hash", sa.String(64), nullable=False),
+    )
+    op.create_index("ix_audit_actor", "audit_log", ["actor"])
+    op.create_index("ix_audit_action", "audit_log", ["action"])
+    op.create_index("ix_audit_seq", "audit_log", ["seq"], unique=True)
+
+    # R19：禁止物理删除线索与审计日志（数据库级触发器兜底）
+    op.execute(
+        """
+        CREATE OR REPLACE FUNCTION forbid_delete() RETURNS trigger AS $$
+        BEGIN
+            RAISE EXCEPTION '禁止删除：% 表受 R19 不可删除约束保护', TG_TABLE_NAME;
+        END;
+        $$ LANGUAGE plpgsql;
+        """
+    )
+    op.execute(
+        "CREATE TRIGGER trg_clue_no_delete BEFORE DELETE ON clue "
+        "FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
+    )
+    op.execute(
+        "CREATE TRIGGER trg_audit_no_delete BEFORE DELETE ON audit_log "
+        "FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
+    )
+    # 审计日志禁止更新（仅追加）
+    op.execute(
+        """
+        CREATE OR REPLACE FUNCTION forbid_update() RETURNS trigger AS $$
+        BEGIN
+            RAISE EXCEPTION '禁止更新：% 表为仅追加日志', TG_TABLE_NAME;
+        END;
+        $$ LANGUAGE plpgsql;
+        """
+    )
+    op.execute(
+        "CREATE TRIGGER trg_audit_no_update BEFORE UPDATE ON audit_log "
+        "FOR EACH ROW EXECUTE FUNCTION forbid_update();"
+    )
+
+
+def downgrade() -> None:
+    op.execute("DROP TRIGGER IF EXISTS trg_audit_no_update ON audit_log;")
+    op.execute("DROP TRIGGER IF EXISTS trg_audit_no_delete ON audit_log;")
+    op.execute("DROP TRIGGER IF EXISTS trg_clue_no_delete ON clue;")
+    op.drop_table("audit_log")
+    op.drop_table("working_paper")
+    op.drop_table("clue_status_history")
+    op.drop_table("clue")
+    clue_status.drop(op.get_bind(), checkfirst=True)
+    confidence_tier.drop(op.get_bind(), checkfirst=True)
+    op.execute("DROP FUNCTION IF EXISTS forbid_update();")
+    op.execute("DROP FUNCTION IF EXISTS forbid_delete();")