diff --git a/app_audit/init.py b/app_audit/init.py index 5a87cbc..8a1d556 100644 --- a/app_audit/init.py +++ b/app_audit/init.py @@ -1,8 +1,11 @@ """ app_audit/init.py - 审计模块加载入口。 -独立审计模块:建 sd_audit_logs 表 + owner.audit 角色(审计独立性, +独立审计模块:提供审计日志读写服务(append-only)+ owner.audit 角色(审计独立性, owner.superuser 也无权访问审计日志)。宿主应用调用 load_app_audit() 即可。 + +铁律:运行期不做任何 schema / 数据初始化。sd_audit_logs 表建表在部署期 +scripts/create_tables.py,owner.audit 角色数据在 init/data.json(build.sh → import_init.py 导入)。 """ MODULE_NAME = "app_audit" @@ -10,35 +13,5 @@ MODULE_VERSION = "1.0.0" def load_app_audit(): - """注册审计模块的建表 + owner.audit 角色到启动流程。""" - from ahserver.configuredServer import add_startup - - async def _init_audit(app): - from sqlor.dbpools import DBPools - from appPublic.log import debug - from ahserver.serverenv import ServerEnv - try: - db = DBPools() - dbname = ServerEnv().get_module_dbname('app_audit') - async with db.sqlorContext(dbname) as sor: - # 审计日志表(append-only,全局) - await sor.sqlExe( - "CREATE TABLE IF NOT EXISTS sd_audit_logs (" - "id varchar(32) NOT NULL, user_id varchar(32), username varchar(100)," - "action varchar(50) NOT NULL, target varchar(200), detail text," - "result varchar(10), client_ip varchar(64)," - "created_at datetime NOT NULL DEFAULT CURRENT_TIMESTAMP," - "PRIMARY KEY (id), KEY idx_user (user_id), KEY idx_action (action)," - "KEY idx_created (created_at)" - ") ENGINE=InnoDB DEFAULT CHARSET=utf8mb4", {}) - debug("app_audit: sd_audit_logs table ready") - # owner.audit 角色(审计独立角色) - await sor.sqlExe( - "INSERT IGNORE INTO role (id, orgtypeid, name) " - "VALUES ('owner.audit', 'owner', 'audit')", {}) - debug("app_audit: owner.audit role ready") - except Exception as e: - debug("app_audit init: " + str(e)) - - add_startup(_init_audit) + """审计模块加载入口。表/角色初始化已迁到部署期,此处无需启动时建表/插数据。""" return True diff --git a/build.sh b/build.sh index d17c59a..e28b99f 100755 --- a/build.sh +++ b/build.sh @@ -1,6 +1,7 @@ #!/bin/bash # app_audit module build script -# 链接 wwwroot 到宿主应用(Sage 或 pipeline)。审计表由 load_app_audit() 启动时自动建。 +# 链接 wwwroot 到宿主应用(Sage 或 pipeline)。 +# 审计表在宿主部署期由 create_tables.py 建,owner.audit 角色由 import_init.py 从 init/data.json 导入。 set -e diff --git a/init/data.json b/init/data.json new file mode 100644 index 0000000..05aebd8 --- /dev/null +++ b/init/data.json @@ -0,0 +1,9 @@ +{ + "roles": [ + { + "id": "owner.audit", + "orgtypeid": "owner", + "name": "audit" + } + ] +}