forked from wangziqi/gongxue-base
50 lines
2.3 KiB
SQL
50 lines
2.3 KiB
SQL
create table if not exists public.tenant_role_templates (
|
||
id uuid primary key default gen_random_uuid(),
|
||
tenant_id uuid not null references public.tenants(id) on delete cascade,
|
||
code text not null,
|
||
name text not null,
|
||
description text,
|
||
base_role text not null default 'tenant_operator'
|
||
check (base_role in ('tenant_owner', 'tenant_admin', 'tenant_operator', 'teacher', 'sales', 'agent', 'student')),
|
||
status text not null default 'active' check (status in ('active', 'disabled', 'archived')),
|
||
permissions jsonb not null default '{}'::jsonb,
|
||
menu_permissions jsonb not null default '{}'::jsonb,
|
||
module_permissions jsonb not null default '{}'::jsonb,
|
||
field_permissions jsonb not null default '{}'::jsonb,
|
||
data_scope jsonb not null default '{}'::jsonb,
|
||
is_system boolean not null default false,
|
||
sort_order integer not null default 100,
|
||
created_by uuid references public.platform_users(id) on delete set null,
|
||
updated_by uuid references public.platform_users(id) on delete set null,
|
||
created_at timestamptz not null default now(),
|
||
updated_at timestamptz not null default now(),
|
||
unique (tenant_id, code)
|
||
);
|
||
|
||
comment on table public.tenant_role_templates is
|
||
'租户自定义角色模板。成员仍保留系统 base role，模板提供权限、菜单、模块、字段和数据范围配置。';
|
||
|
||
alter table public.tenant_memberships
|
||
add column if not exists role_template_id uuid references public.tenant_role_templates(id) on delete restrict;
|
||
|
||
create index if not exists idx_role_templates_tenant_status
|
||
on public.tenant_role_templates(tenant_id, status, sort_order);
|
||
|
||
create index if not exists idx_memberships_role_template
|
||
on public.tenant_memberships(role_template_id)
|
||
where role_template_id is not null;
|
||
|
||
alter table public.tenant_role_templates enable row level security;
|
||
|
||
drop policy if exists tenant_isolation on public.tenant_role_templates;
|
||
create policy tenant_isolation on public.tenant_role_templates
|
||
for all
|
||
using (tenant_id = app.current_tenant_id() or app.is_platform_admin())
|
||
with check (tenant_id = app.current_tenant_id() or app.is_platform_admin());
|
||
|
||
drop trigger if exists set_updated_at on public.tenant_role_templates;
|
||
create trigger set_updated_at
|
||
before update on public.tenant_role_templates
|
||
for each row
|
||
execute function app.touch_updated_at();
|