259 lines
15 KiB
SQL
259 lines
15 KiB
SQL
-- =============================================================
|
||
-- 统一认证中心（UAC）表结构 数据库：go-platform
|
||
-- 路径：api.yunzer.cn/auth
|
||
--
|
||
-- 设计要点：
|
||
-- 1. yz_auth_identity 为「自然人」层，密码上提到这一层；
|
||
-- 2. yz_auth_tenant_user 为「身份-企业」绑定，一人可在多家企业任职；
|
||
-- 3. 密码列存 PHC 格式（$argon2id$...），盐内联，无需独立 salt 列；
|
||
-- 历史数据为 salt$sha256（legacy），首次登录时自动升级；
|
||
-- 4. 会话/刷新令牌/授权码均存哈希，明文不下发到数据库；
|
||
-- 5. 本脚本只建表不写数据，数据迁移由 scripts/migrate_auth.go 完成。
|
||
-- =============================================================
|
||
|
||
SET NAMES utf8mb4;
|
||
|
||
-- ---------------- 1. 统一身份（自然人） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_identity` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT COMMENT '身份ID',
|
||
`union_id` VARCHAR(32) NOT NULL COMMENT '全局唯一标识（32位随机串）',
|
||
`mobile` VARCHAR(20) DEFAULT NULL COMMENT '手机号，全局唯一',
|
||
`email` VARCHAR(128) DEFAULT NULL COMMENT '邮箱，全局唯一',
|
||
`password_algo` VARCHAR(16) NOT NULL DEFAULT 'argon2id' COMMENT 'argon2id/legacy',
|
||
`password_hash` VARCHAR(255) DEFAULT NULL COMMENT 'PHC格式，含盐与参数',
|
||
`password_ver` INT NOT NULL DEFAULT 1 COMMENT '密码版本，改密时+1用于踢下线',
|
||
`nickname` VARCHAR(64) DEFAULT NULL,
|
||
`avatar` VARCHAR(500) DEFAULT NULL,
|
||
`mfa_enabled` TINYINT NOT NULL DEFAULT 0 COMMENT '是否开启二次验证',
|
||
`mfa_secret` VARCHAR(128) DEFAULT NULL COMMENT 'TOTP密钥（加密存储）',
|
||
`status` TINYINT NOT NULL DEFAULT 1 COMMENT '1启用/0禁用/2锁定',
|
||
`fail_count` INT NOT NULL DEFAULT 0 COMMENT '连续失败次数',
|
||
`locked_until` DATETIME DEFAULT NULL COMMENT '锁定截止时间',
|
||
`last_login_at` DATETIME DEFAULT NULL,
|
||
`last_login_ip` VARCHAR(45) DEFAULT NULL,
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
`update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
|
||
`delete_time` DATETIME DEFAULT NULL,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_union_id` (`union_id`),
|
||
UNIQUE KEY `uk_mobile` (`mobile`),
|
||
UNIQUE KEY `uk_email` (`email`),
|
||
KEY `idx_status` (`status`),
|
||
KEY `idx_create_time` (`create_time`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-身份表';
|
||
|
||
-- ---------------- 2. 身份-企业绑定（一人多企） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_tenant_user` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`tid` BIGINT UNSIGNED NOT NULL COMMENT '租户ID',
|
||
`identity_id` BIGINT UNSIGNED NOT NULL COMMENT '身份ID',
|
||
`account` VARCHAR(64) DEFAULT NULL COMMENT '企业内账号，可空（用手机号登录）',
|
||
`name` VARCHAR(64) DEFAULT NULL COMMENT '在该企业的姓名',
|
||
`phone` VARCHAR(20) DEFAULT NULL,
|
||
`email` VARCHAR(128) DEFAULT NULL,
|
||
`group_id` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '角色ID（cid=2的租户角色）',
|
||
`org_id` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '部门ID',
|
||
`is_default` TINYINT NOT NULL DEFAULT 0 COMMENT '是否默认企业',
|
||
`status` TINYINT NOT NULL DEFAULT 1 COMMENT '1启用/0禁用',
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
`update_time` DATETIME DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
|
||
`delete_time` DATETIME DEFAULT NULL,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_tid_identity` (`tid`, `identity_id`),
|
||
KEY `idx_identity` (`identity_id`),
|
||
KEY `idx_tid_account` (`tid`, `account`),
|
||
KEY `idx_tid_status` (`tid`, `status`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-身份企业绑定';
|
||
|
||
-- ---------------- 3. 接入应用（OIDC Client） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_client` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`client_id` VARCHAR(64) NOT NULL,
|
||
`client_secret` VARCHAR(128) DEFAULT NULL COMMENT '机密客户端才有，存哈希',
|
||
`app_code` VARCHAR(32) NOT NULL COMMENT 'crm/oa/uniapp/website...',
|
||
`name` VARCHAR(128) NOT NULL,
|
||
`app_type` TINYINT NOT NULL DEFAULT 1 COMMENT '1Web后端 2SPA 3原生APP 4小程序',
|
||
`redirect_uris` TEXT COMMENT 'JSON数组，精确匹配白名单',
|
||
`post_logout_uris` TEXT COMMENT '登出后允许回跳的地址',
|
||
`backchannel_logout_uri` VARCHAR(500) DEFAULT NULL COMMENT '单点登出回调（服务端通知）',
|
||
`grant_types` VARCHAR(255) NOT NULL DEFAULT 'authorization_code,refresh_token',
|
||
`scope` VARCHAR(255) DEFAULT 'openid,profile,tenant',
|
||
`access_ttl` INT NOT NULL DEFAULT 1800 COMMENT '访问令牌有效期（秒）',
|
||
`refresh_ttl` INT NOT NULL DEFAULT 2592000 COMMENT '刷新令牌有效期（秒）',
|
||
`realm` VARCHAR(16) NOT NULL DEFAULT 'tenant' COMMENT 'tenant/platform',
|
||
`status` TINYINT NOT NULL DEFAULT 1,
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
`update_time` DATETIME DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_client_id` (`client_id`),
|
||
UNIQUE KEY `uk_app_code` (`app_code`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-接入应用';
|
||
|
||
-- ---------------- 4. 登录会话（1号1机 / 强制下线） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_session` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`sid` VARCHAR(64) NOT NULL COMMENT '会话ID，写入JWT的sid',
|
||
`identity_id` BIGINT UNSIGNED NOT NULL,
|
||
`tid` BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '当前所选企业',
|
||
`client_id` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`device_id` VARCHAR(64) DEFAULT NULL,
|
||
`device_name` VARCHAR(128) DEFAULT NULL,
|
||
`ip` VARCHAR(45) DEFAULT NULL,
|
||
`user_agent` VARCHAR(500) DEFAULT NULL,
|
||
`login_type` VARCHAR(20) NOT NULL DEFAULT 'password',
|
||
`amr` VARCHAR(64) DEFAULT NULL COMMENT 'pwd/sms/otp/wx/dingtalk/feishu/qq/github/google',
|
||
`login_at` DATETIME NOT NULL,
|
||
`last_access_at` DATETIME NOT NULL,
|
||
`expires_at` DATETIME NOT NULL,
|
||
`revoked` TINYINT NOT NULL DEFAULT 0,
|
||
`revoke_reason` VARCHAR(64) DEFAULT NULL COMMENT 'logout/kicked/admin/expired',
|
||
`revoke_at` DATETIME DEFAULT NULL,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_sid` (`sid`),
|
||
KEY `idx_identity_status` (`identity_id`, `revoked`),
|
||
KEY `idx_tid` (`tid`),
|
||
KEY `idx_expires` (`expires_at`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-登录会话';
|
||
|
||
-- ---------------- 5. 刷新令牌（轮换 + 重放检测） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_refresh_token` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`token_hash` VARCHAR(128) NOT NULL COMMENT '不透明串的哈希，明文不下发落库',
|
||
`identity_id` BIGINT UNSIGNED NOT NULL,
|
||
`tid` BIGINT UNSIGNED NOT NULL DEFAULT 0,
|
||
`client_id` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`sid` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`family_id` VARCHAR(64) NOT NULL COMMENT '轮换家族，检测到重放则整族吊销',
|
||
`rotated_from` VARCHAR(128) DEFAULT NULL,
|
||
`used` TINYINT NOT NULL DEFAULT 0,
|
||
`revoked` TINYINT NOT NULL DEFAULT 0,
|
||
`expires_at` DATETIME NOT NULL,
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_token_hash` (`token_hash`),
|
||
KEY `idx_family` (`family_id`),
|
||
KEY `idx_identity` (`identity_id`),
|
||
KEY `idx_expires` (`expires_at`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-刷新令牌';
|
||
|
||
-- ---------------- 6. 授权码（一次性，60秒） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_code` (
|
||
`code_hash` VARCHAR(128) NOT NULL COMMENT '授权码哈希',
|
||
`client_id` VARCHAR(64) NOT NULL,
|
||
`identity_id` BIGINT UNSIGNED NOT NULL,
|
||
`tid` BIGINT UNSIGNED NOT NULL DEFAULT 0,
|
||
`redirect_uri` VARCHAR(500) NOT NULL,
|
||
`code_challenge` VARCHAR(128) NOT NULL COMMENT 'PKCE',
|
||
`code_challenge_method` VARCHAR(10) NOT NULL DEFAULT 'S256',
|
||
`scope` VARCHAR(255) DEFAULT NULL,
|
||
`nonce` VARCHAR(128) DEFAULT NULL COMMENT 'OIDC nonce，进ID Token',
|
||
`used` TINYINT NOT NULL DEFAULT 0,
|
||
`expires_at` DATETIME NOT NULL,
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`code_hash`),
|
||
KEY `idx_expires` (`expires_at`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-授权码';
|
||
|
||
-- ---------------- 7. 令牌吊销表（登出/踢下线） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_token_blacklist` (
|
||
`jti` VARCHAR(64) NOT NULL COMMENT 'JWT ID',
|
||
`identity_id` BIGINT UNSIGNED NOT NULL DEFAULT 0,
|
||
`sid` VARCHAR(64) DEFAULT NULL,
|
||
`reason` VARCHAR(64) DEFAULT NULL,
|
||
`expires_at` DATETIME NOT NULL COMMENT '原token过期时间，到期后可清理',
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`jti`),
|
||
KEY `idx_expires` (`expires_at`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-令牌吊销表';
|
||
|
||
-- ---------------- 8. 第三方身份绑定 ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_identity_third` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`identity_id` BIGINT UNSIGNED NOT NULL,
|
||
`provider` VARCHAR(32) NOT NULL COMMENT 'wechat/dingtalk/feishu/qq/github/google',
|
||
`open_id` VARCHAR(128) NOT NULL COMMENT '该平台内的唯一ID',
|
||
`union_id` VARCHAR(128) DEFAULT NULL COMMENT '跨平台唯一ID（微信/钉钉有）',
|
||
`nickname` VARCHAR(128) DEFAULT NULL,
|
||
`avatar` VARCHAR(500) DEFAULT NULL,
|
||
`raw` TEXT COMMENT '原始用户信息JSON',
|
||
`bind_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_provider_open` (`provider`, `open_id`),
|
||
KEY `idx_identity` (`identity_id`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-第三方绑定';
|
||
|
||
-- ---------------- 9. 租户自带身份源（企业微信/钉钉/飞书/OIDC） ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_tenant_idp` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`tid` BIGINT UNSIGNED NOT NULL,
|
||
`provider` VARCHAR(32) NOT NULL COMMENT 'dingtalk/feishu/wework/oidc/saml',
|
||
`name` VARCHAR(128) DEFAULT NULL COMMENT '显示名称',
|
||
`app_id` VARCHAR(128) DEFAULT NULL,
|
||
`app_secret` VARCHAR(512) DEFAULT NULL COMMENT '加密存储',
|
||
`issuer` VARCHAR(500) DEFAULT NULL COMMENT 'OIDC/SAML issuer',
|
||
`auth_url` VARCHAR(500) DEFAULT NULL,
|
||
`token_url` VARCHAR(500) DEFAULT NULL,
|
||
`userinfo_url` VARCHAR(500) DEFAULT NULL,
|
||
`jwks_url` VARCHAR(500) DEFAULT NULL,
|
||
`scopes` VARCHAR(255) DEFAULT NULL,
|
||
`attr_map` TEXT COMMENT 'JSON：字段映射（手机/姓名/部门）',
|
||
`proxy_url` VARCHAR(500) DEFAULT NULL COMMENT 'GitHub/Google等需要代理时填写',
|
||
`status` TINYINT NOT NULL DEFAULT 1,
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
`update_time` DATETIME DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`id`),
|
||
UNIQUE KEY `uk_tid_provider` (`tid`, `provider`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-租户身份源';
|
||
|
||
-- ---------------- 10. 租户登录策略 ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_tenant_auth_config` (
|
||
`tid` BIGINT UNSIGNED NOT NULL COMMENT '租户ID',
|
||
`verify_type` VARCHAR(20) NOT NULL DEFAULT 'captcha' COMMENT 'none/captcha/sms/email/geetest',
|
||
`open_verify` TINYINT NOT NULL DEFAULT 1 COMMENT '是否开启登录二次验证',
|
||
`pwd_min_len` INT NOT NULL DEFAULT 8,
|
||
`pwd_complexity` TINYINT NOT NULL DEFAULT 0 COMMENT '0不限制 1字母+数字 2大小写+数字+符号',
|
||
`session_ttl` INT NOT NULL DEFAULT 7200 COMMENT '会话有效期（秒）',
|
||
`max_session` INT NOT NULL DEFAULT 1 COMMENT '同账号最大同时在线数（默认1号1机）',
|
||
`kick_strategy` TINYINT NOT NULL DEFAULT 1 COMMENT '1踢掉旧会话 2拒绝新登录',
|
||
`mfa_required` TINYINT NOT NULL DEFAULT 0,
|
||
`ip_whitelist` TEXT COMMENT 'JSON数组，为空表示不限制',
|
||
`allow_third` VARCHAR(255) DEFAULT NULL COMMENT '允许的第三方登录，逗号分隔，空表示全部',
|
||
`update_time` DATETIME DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`tid`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-租户登录策略';
|
||
|
||
-- ---------------- 11. 统一登录日志 ----------------
|
||
CREATE TABLE IF NOT EXISTS `yz_auth_login_log` (
|
||
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
|
||
`tid` BIGINT UNSIGNED DEFAULT NULL,
|
||
`identity_id` BIGINT UNSIGNED DEFAULT NULL,
|
||
`account` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`user_name` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`tenant_name` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`client_id` VARCHAR(64) NOT NULL DEFAULT '',
|
||
`login_type` VARCHAR(20) NOT NULL DEFAULT 'password' COMMENT 'password/sms/otp/third',
|
||
`amr` VARCHAR(64) DEFAULT NULL,
|
||
`status` TINYINT NOT NULL DEFAULT 1 COMMENT '1成功/0失败',
|
||
`message` VARCHAR(255) NOT NULL DEFAULT '',
|
||
`ip` VARCHAR(45) NOT NULL DEFAULT '',
|
||
`user_agent` VARCHAR(500) NOT NULL DEFAULT '',
|
||
`create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||
PRIMARY KEY (`id`),
|
||
KEY `idx_tid` (`tid`),
|
||
KEY `idx_identity` (`identity_id`),
|
||
KEY `idx_account` (`account`),
|
||
KEY `idx_create_time` (`create_time`)
|
||
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='统一认证-登录日志';
|
||
|
||
-- =============================================================
|
||
-- 内置接入应用（后续由 platform 端「应用注册」页面维护）
|
||
-- client_secret 为占位值，正式启用前必须在管理端重新生成
|
||
-- =============================================================
|
||
INSERT INTO `yz_auth_client`
|
||
(`client_id`, `app_code`, `name`, `app_type`, `grant_types`, `scope`, `access_ttl`, `refresh_ttl`, `realm`)
|
||
VALUES
|
||
('yz-backend', 'backend', '租户管理后台', 2, 'authorization_code,refresh_token', 'openid,profile,tenant', 1800, 2592000, 'tenant'),
|
||
('yz-uniapp', 'uniapp', '移动端APP', 3, 'authorization_code,refresh_token', 'openid,profile,tenant', 1800, 2592000, 'tenant'),
|
||
('yz-website', 'website', '企业官网', 2, 'authorization_code,refresh_token', 'openid,profile,tenant', 1800, 2592000, 'tenant')
|
||
ON DUPLICATE KEY UPDATE `name` = VALUES(`name`);
|