feat: harden content asset access

supabase/migrations/202606290021_content_asset_access_security.sql

@@ -0,0 +1,43 @@
+create table if not exists public.content_asset_access_events (
+  id uuid primary key default gen_random_uuid(),
+  tenant_id uuid not null references public.tenants(id) on delete cascade,
+  asset_id uuid references public.content_assets(id) on delete set null,
+  user_id uuid references public.platform_users(id) on delete set null,
+  actor_role text not null default 'anonymous'
+    check (actor_role in ('anonymous', 'student', 'tenant_admin', 'tenant_content_editor', 'system')),
+  access_type text not null
+    check (access_type in ('download', 'preview', 'admin_download', 'admin_preview', 'upload_sign', 'upload_confirm')),
+  visibility text,
+  asset_type text,
+  storage_provider text,
+  disposition text check (disposition is null or disposition in ('attachment', 'inline')),
+  expires_in_sec integer check (expires_in_sec is null or expires_in_sec > 0),
+  signature_mode text,
+  result text not null check (result in ('granted', 'denied')),
+  deny_code text,
+  ip_address text,
+  user_agent text,
+  metadata jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now()
+);
+
+comment on table public.content_asset_access_events is
+  '短期资源签名与资源访问授权事件。用于租户隔离审计、资料下载追踪、异常 CDN/私有资源排查。';
+
+create index if not exists idx_asset_access_events_asset
+  on public.content_asset_access_events(tenant_id, asset_id, created_at desc);
+
+create index if not exists idx_asset_access_events_user
+  on public.content_asset_access_events(tenant_id, user_id, created_at desc)
+  where user_id is not null;
+
+create index if not exists idx_asset_access_events_type
+  on public.content_asset_access_events(tenant_id, access_type, result, created_at desc);
+
+alter table public.content_asset_access_events enable row level security;
+
+drop policy if exists tenant_isolation on public.content_asset_access_events;
+create policy tenant_isolation on public.content_asset_access_events
+  for all
+  using (tenant_id = app.current_tenant_id() or app.is_platform_admin())
+  with check (tenant_id = app.current_tenant_id() or app.is_platform_admin());