freedakgmail
147 lines
6.4 KiB
Python
147 lines
6.4 KiB
Python
"""线索引擎与系统自审计表：clue / clue_status_history / working_paper / audit_log
|
|
|
|
Revision ID: 0002_clues_audit
|
|
Revises: 0001_init_datahub
|
|
Create Date: 2026-06
|
|
"""
|
|
from collections.abc import Sequence
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
from sqlalchemy.dialects import postgresql
|
|
|
|
revision: str = "0002_clues_audit"
|
|
down_revision: str | None = "0001_init_datahub"
|
|
branch_labels: str | Sequence[str] | None = None
|
|
depends_on: str | Sequence[str] | None = None
|
|
|
|
confidence_tier = postgresql.ENUM(
|
|
"high", "medium", "low", name="confidence_tier", create_type=False
|
|
)
|
|
clue_status = postgresql.ENUM(
|
|
"new", "assigned", "reviewing", "confirmed", "dismissed",
|
|
"rectifying", "transferred", "closed", name="clue_status", create_type=False,
|
|
)
|
|
|
|
|
|
def upgrade() -> None:
|
|
bind = op.get_bind()
|
|
confidence_tier.create(bind, checkfirst=True)
|
|
clue_status.create(bind, checkfirst=True)
|
|
|
|
op.create_table(
|
|
"clue",
|
|
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
|
sa.Column("title", sa.String(256), nullable=False),
|
|
sa.Column("risk_domain", sa.String(32), nullable=False),
|
|
sa.Column("scenario_code", sa.String(32), nullable=False),
|
|
sa.Column("confidence", confidence_tier, nullable=False),
|
|
sa.Column("score", sa.Float(), nullable=False, server_default="0"),
|
|
sa.Column("status", clue_status, nullable=False, server_default="new"),
|
|
sa.Column("rationale", sa.Text(), nullable=False, server_default=""),
|
|
sa.Column("evidence", postgresql.JSONB(), nullable=False, server_default="{}"),
|
|
sa.Column("subjects", postgresql.JSONB(), nullable=False, server_default="{}"),
|
|
sa.Column("amount_involved", sa.Float(), nullable=True),
|
|
sa.Column("assignee", sa.String(64), nullable=True),
|
|
sa.Column("feedback", sa.String(16), nullable=True),
|
|
sa.Column("model_version", sa.String(64), nullable=True),
|
|
sa.Column("rule_version", sa.String(64), nullable=True),
|
|
sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
|
)
|
|
op.create_index("ix_clue_status", "clue", ["status"])
|
|
op.create_index("ix_clue_scenario", "clue", ["scenario_code"])
|
|
op.create_index("ix_clue_assignee", "clue", ["assignee"])
|
|
|
|
op.create_table(
|
|
"clue_status_history",
|
|
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
|
sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("from_status", sa.String(16), nullable=True),
|
|
sa.Column("to_status", sa.String(16), nullable=False),
|
|
sa.Column("actor", sa.String(64), nullable=False),
|
|
sa.Column("note", sa.Text(), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
|
|
)
|
|
op.create_index("ix_csh_clue", "clue_status_history", ["clue_id"])
|
|
|
|
op.create_table(
|
|
"working_paper",
|
|
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
|
sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
|
|
sa.Column("content", sa.Text(), nullable=False, server_default=""),
|
|
sa.Column("conclusion", sa.String(32), nullable=True),
|
|
sa.Column("author", sa.String(64), nullable=False),
|
|
sa.Column("snapshot", postgresql.JSONB(), nullable=False, server_default="{}"),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
|
|
)
|
|
op.create_index("ix_wp_clue", "working_paper", ["clue_id"])
|
|
|
|
op.create_table(
|
|
"audit_log",
|
|
sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
|
|
sa.Column("seq", sa.BigInteger(), sa.Identity(always=False), nullable=False),
|
|
sa.Column("actor", sa.String(64), nullable=False),
|
|
sa.Column("role", sa.String(32), nullable=True),
|
|
sa.Column("action", sa.String(64), nullable=False),
|
|
sa.Column("target_type", sa.String(64), nullable=True),
|
|
sa.Column("target_id", sa.String(128), nullable=True),
|
|
sa.Column("detail", postgresql.JSONB(), nullable=False, server_default="{}"),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("prev_hash", sa.String(64), nullable=True),
|
|
sa.Column("entry_hash", sa.String(64), nullable=False),
|
|
)
|
|
op.create_index("ix_audit_actor", "audit_log", ["actor"])
|
|
op.create_index("ix_audit_action", "audit_log", ["action"])
|
|
op.create_index("ix_audit_seq", "audit_log", ["seq"], unique=True)
|
|
|
|
# R19：禁止物理删除线索与审计日志（数据库级触发器兜底）
|
|
op.execute(
|
|
"""
|
|
CREATE OR REPLACE FUNCTION forbid_delete() RETURNS trigger AS $$
|
|
BEGIN
|
|
RAISE EXCEPTION '禁止删除：% 表受 R19 不可删除约束保护', TG_TABLE_NAME;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
"""
|
|
)
|
|
op.execute(
|
|
"CREATE TRIGGER trg_clue_no_delete BEFORE DELETE ON clue "
|
|
"FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
|
|
)
|
|
op.execute(
|
|
"CREATE TRIGGER trg_audit_no_delete BEFORE DELETE ON audit_log "
|
|
"FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
|
|
)
|
|
# 审计日志禁止更新（仅追加）
|
|
op.execute(
|
|
"""
|
|
CREATE OR REPLACE FUNCTION forbid_update() RETURNS trigger AS $$
|
|
BEGIN
|
|
RAISE EXCEPTION '禁止更新：% 表为仅追加日志', TG_TABLE_NAME;
|
|
END;
|
|
$$ LANGUAGE plpgsql;
|
|
"""
|
|
)
|
|
op.execute(
|
|
"CREATE TRIGGER trg_audit_no_update BEFORE UPDATE ON audit_log "
|
|
"FOR EACH ROW EXECUTE FUNCTION forbid_update();"
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.execute("DROP TRIGGER IF EXISTS trg_audit_no_update ON audit_log;")
|
|
op.execute("DROP TRIGGER IF EXISTS trg_audit_no_delete ON audit_log;")
|
|
op.execute("DROP TRIGGER IF EXISTS trg_clue_no_delete ON clue;")
|
|
op.drop_table("audit_log")
|
|
op.drop_table("working_paper")
|
|
op.drop_table("clue_status_history")
|
|
op.drop_table("clue")
|
|
clue_status.drop(op.get_bind(), checkfirst=True)
|
|
confidence_tier.drop(op.get_bind(), checkfirst=True)
|
|
op.execute("DROP FUNCTION IF EXISTS forbid_update();")
|
|
op.execute("DROP FUNCTION IF EXISTS forbid_delete();")
|