-- 权限管理系统数据库迁移
-- 版本: V21
-- 描述: 创建权限管理核心表 (按PRD V10.2.1定义)
-- 创建时间: 2026-03-04
-- H2兼容版本

-- 1. 角色表（sys_role）
CREATE TABLE sys_role (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    role_code VARCHAR(50) NOT NULL UNIQUE,
    role_name VARCHAR(100) NOT NULL,
    role_level VARCHAR(20) NOT NULL,
    data_scope VARCHAR(20) NOT NULL,
    description VARCHAR(500),
    status VARCHAR(20) DEFAULT 'ENABLED',
    created_by BIGINT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 2. 权限表（sys_permission）
CREATE TABLE sys_permission (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    permission_code VARCHAR(100) NOT NULL UNIQUE,
    permission_name VARCHAR(100) NOT NULL,
    module_code VARCHAR(50) NOT NULL,
    resource_code VARCHAR(50),
    operation_code VARCHAR(50),
    data_scope VARCHAR(20),
    description VARCHAR(500),
    sort_order INT DEFAULT 0,
    status VARCHAR(20) DEFAULT 'ENABLED',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 3. 用户角色关联表（sys_user_role）
CREATE TABLE sys_user_role (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    user_id BIGINT NOT NULL,
    role_id BIGINT NOT NULL,
    department_id BIGINT,
    created_by BIGINT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (user_id, role_id, department_id)
);

-- 4. 角色权限关联表（sys_role_permission）
CREATE TABLE sys_role_permission (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    role_id BIGINT NOT NULL,
    permission_id BIGINT NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (role_id, permission_id)
);

-- 5. 部门表（sys_department）
CREATE TABLE sys_department (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    dept_name VARCHAR(100) NOT NULL,
    parent_id BIGINT,
    dept_code VARCHAR(50),
    leader_id BIGINT,
    sort_order INT DEFAULT 0,
    status VARCHAR(20) DEFAULT 'ENABLED',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 6. 审批流程配置表（sys_approval_flow）
CREATE TABLE sys_approval_flow (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    flow_code VARCHAR(50) NOT NULL UNIQUE,
    flow_name VARCHAR(100) NOT NULL,
    trigger_event VARCHAR(100) NOT NULL,
    conditions VARCHAR(1000),
    nodes VARCHAR(2000) NOT NULL,
    timeout_hours INT DEFAULT 24,
    timeout_action VARCHAR(20) DEFAULT 'ESCALATE',
    status VARCHAR(20) DEFAULT 'ENABLED',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 7. 审批记录表（sys_approval_record）
CREATE TABLE sys_approval_record (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    flow_id BIGINT NOT NULL,
    biz_type VARCHAR(50) NOT NULL,
    biz_id BIGINT NOT NULL,
    current_node INT NOT NULL,
    applicant_id BIGINT NOT NULL,
    status VARCHAR(20) DEFAULT 'PENDING',
    current_approver_id BIGINT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 8. 审批历史表（sys_approval_history）
CREATE TABLE sys_approval_history (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    record_id BIGINT NOT NULL,
    node_index INT NOT NULL,
    approver_id BIGINT NOT NULL,
    action VARCHAR(20) NOT NULL,
    comment VARCHAR(1000),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 9. 权限审计日志表（sys_permission_audit）
CREATE TABLE sys_permission_audit (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    operator_id BIGINT NOT NULL,
    operation_type VARCHAR(50) NOT NULL,
    target_type VARCHAR(20) NOT NULL,
    target_id BIGINT NOT NULL,
    change_detail VARCHAR(1000),
    ip_address VARCHAR(50),
    reason VARCHAR(500),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 10. 数据敏感字段配置表（sys_sensitive_field）
CREATE TABLE sys_sensitive_field (
    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    table_name VARCHAR(50) NOT NULL,
    field_name VARCHAR(50) NOT NULL,
    field_type VARCHAR(20) NOT NULL,
    mask_type VARCHAR(20) NOT NULL,
    mask_pattern VARCHAR(50),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- 创建索引
CREATE INDEX idx_role_code ON sys_role(role_code);
CREATE INDEX idx_role_level ON sys_role(role_level);
CREATE INDEX idx_role_status ON sys_role(status);

CREATE INDEX idx_permission_code ON sys_permission(permission_code);
CREATE INDEX idx_permission_module ON sys_permission(module_code);
CREATE INDEX idx_permission_status ON sys_permission(status);

CREATE INDEX idx_user_role_user ON sys_user_role(user_id);
CREATE INDEX idx_user_role_role ON sys_user_role(role_id);

CREATE INDEX idx_role_permission_role ON sys_role_permission(role_id);
CREATE INDEX idx_role_permission_perm ON sys_role_permission(permission_id);

CREATE INDEX idx_department_parent ON sys_department(parent_id);
CREATE INDEX idx_department_code ON sys_department(dept_code);

CREATE INDEX idx_approval_flow_code ON sys_approval_flow(flow_code);
CREATE INDEX idx_approval_flow_trigger ON sys_approval_flow(trigger_event);

CREATE INDEX idx_approval_record_flow ON sys_approval_record(flow_id);
CREATE INDEX idx_approval_record_biz ON sys_approval_record(biz_type, biz_id);
CREATE INDEX idx_approval_record_applicant ON sys_approval_record(applicant_id);
CREATE INDEX idx_approval_record_status ON sys_approval_record(status);

CREATE INDEX idx_approval_history_record ON sys_approval_history(record_id);
CREATE INDEX idx_approval_history_approver ON sys_approval_history(approver_id);

CREATE INDEX idx_permission_audit_operator ON sys_permission_audit(operator_id);
CREATE INDEX idx_permission_audit_target ON sys_permission_audit(target_type, target_id);
CREATE INDEX idx_permission_audit_created ON sys_permission_audit(created_at);
