feat: complete phase 02 RBAC and data scope recovery

2026-09-10 10:58:43 +08:00
parent b46b48eb33
commit 5b51d5b3f1
115 changed files with 3608 additions and 1135 deletions
@@ -0,0 +1,37 @@
+# Danyang Match Platform - Environment Variables Example
+# Copy this file to application-dev.yml and fill in real values.
+
+# Database
+DB_HOST=localhost
+DB_PORT=5432
+DB_NAME=danyang_match
+DB_USER=postgres
+DB_PASSWORD=replace-with-local-password
+
+# Redis
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=
+
+# MinIO (Object Storage)
+MINIO_ENDPOINT=http://localhost:9000
+MINIO_ACCESS_KEY=replace-with-local-access-key
+MINIO_SECRET_KEY=replace-with-local-secret-key
+MINIO_BUCKET_PUBLIC=public
+MINIO_BUCKET_PRIVATE=private
+
+# WeChat Mini Program
+WECHAT_APP_ID=your-wechat-app-id
+WECHAT_APP_SECRET=your-wechat-app-secret
+
+# Encryption (AES-256 key, 64 hex chars)
+ENCRYPTION_KEY=replace-with-64-hex-character-key
+
+# JWT Secrets (use strong random values in production)
+JWT_ACCESS_SECRET=replace-with-strong-access-secret
+JWT_REFRESH_SECRET=replace-with-strong-refresh-secret
+
+# Real-name Verification Provider (mock for dev)
+VERIFICATION_PROVIDER=mock
+VERIFICATION_API_URL=
+VERIFICATION_API_KEY=
@@ -0,0 +1,78 @@
+spring:
+  datasource:
+    url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:danyang_match}
+    username: ${DB_USER:postgres}
+    password: ${DB_PASSWORD}
+
+  data:
+    redis:
+      host: ${REDIS_HOST:localhost}
+      port: ${REDIS_PORT:6379}
+      password: ${REDIS_PASSWORD:}
+
+wechat:
+  app-id: ${WECHAT_APP_ID:}
+  app-secret: ${WECHAT_APP_SECRET:}
+
+encryption:
+  key: ${ENCRYPTION_KEY}
+
+jwt:
+  access-token-secret: ${JWT_ACCESS_SECRET}
+  access-token-expiration-ms: 7200000
+  refresh-token-secret: ${JWT_REFRESH_SECRET}
+  refresh-token-expiration-ms: 1209600000
+
+object-storage:
+  endpoint: ${MINIO_ENDPOINT:http://localhost:9000}
+  access-key: ${MINIO_ACCESS_KEY}
+  secret-key: ${MINIO_SECRET_KEY}
+  bucket-public: ${MINIO_BUCKET_PUBLIC:public}
+  bucket-private: ${MINIO_BUCKET_PRIVATE:private}
+  region: us-east-1
+  signature-version: s3v4
+
+verification:
+  provider: mock
+  api-url: ${VERIFICATION_API_URL:}
+  api-key: ${VERIFICATION_API_KEY:}
+
+match:
+  rule-version: 1
+  default-daily-limit: 6
+  default-score-threshold: 60
+  default-cooldown-days: 180
+
+activity:
+  default-need-review: true
+  default-mutual-max-selection: 3
+  default-mutual-deadline-hours: 48
+
+rate-limit:
+  enabled: true
+  window-seconds: 60
+  max-requests-per-window: 100
+
+features:
+  # V1.0
+  activity-enabled: true
+  matchmaker-enabled: true
+  chat-image-enabled: false
+  appeal-enabled: false
+  # V1.1
+  counseling-enabled: true
+  premarital-enabled: true
+  content-enabled: true
+  service-location-enabled: true
+  local-eligibility-enabled: true
+  referral-enabled: true
+  mutual-consent-enabled: true
+  service-program-enabled: true
+  liveness-enabled: false
+  liveness-provider: none
+  local-evidence-upload-enabled: true
+  local-evidence-max-files: 5
+  local-evidence-max-file-size-mb: 10
+  local-evidence-allowed-types: jpg,png,pdf
+  counseling-attachments-private: true
+  counseling-attachments-bucket: counseling-attachments
@@ -0,0 +1,12 @@
+-- V028: Phase 02 服务站运营人员数据范围
+-- 组织关系不授予数据权限；只有显式站点分配或预约任务分配可访问。
+CREATE TABLE service_location_operators (
+    service_location_id UUID NOT NULL REFERENCES service_locations(id),
+    operator_id UUID NOT NULL REFERENCES operators(id),
+    created_by UUID REFERENCES operators(id),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (service_location_id, operator_id)
+);
+
+CREATE INDEX idx_service_location_operators_operator
+    ON service_location_operators(operator_id, service_location_id);
@@ -0,0 +1,14 @@
+-- V1.1 Phase 02: complete the service-station permission contract from the customer baseline.
+INSERT INTO permissions (id, code, name, module, description) VALUES
+('20000000-0000-0000-0000-000000000800', 'activity.checkin', '活动签到', 'activity', '执行活动扫码或人工签到并查看签到统计'),
+('20000000-0000-0000-0000-000000000801', 'service.assisted_registration', '现场协助登记', 'service', '在服务站现场协助用户完成服务登记');
+
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT '00000000-0000-0000-0000-000000000010', id
+FROM permissions
+WHERE code IN ('activity.checkin', 'service.assisted_registration');
+
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT '00000000-0000-0000-0000-000000000002', id
+FROM permissions
+WHERE code IN ('activity.checkin', 'service.assisted_registration');