YG_FT/backend/app/db/sql/002_governance.sql

-- A. 平台基础与企业治理：权限 / 角色 / 租户 / 审批 / 审计 / 留存
-- 沿用 001 的约定：时间戳存 TEXT，布尔用 INTEGER，列表用 TEXT(JSON)

CREATE TABLE IF NOT EXISTS permissions (
    code        TEXT PRIMARY KEY,
    name        TEXT NOT NULL,
    group_name  TEXT NOT NULL,
    create_time TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS roles (
    id           TEXT PRIMARY KEY,
    name         TEXT NOT NULL UNIQUE,
    display_name TEXT NOT NULL,
    permissions  TEXT NOT NULL,
    create_time  TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS role_permissions (
    role_id     TEXT NOT NULL,
    permission  TEXT NOT NULL,
    PRIMARY KEY (role_id, permission)
);

CREATE TABLE IF NOT EXISTS user_permission_overrides (
    user_id     TEXT NOT NULL,
    permission  TEXT NOT NULL,
    granted     INTEGER NOT NULL,
    PRIMARY KEY (user_id, permission)
);

CREATE TABLE IF NOT EXISTS tenants (
    id            TEXT PRIMARY KEY,
    name          TEXT NOT NULL UNIQUE,
    code          TEXT NOT NULL UNIQUE,
    status        TEXT NOT NULL,
    owner_user_id TEXT,
    create_time   TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS tenant_users (
    tenant_id TEXT NOT NULL,
    user_id   TEXT NOT NULL,
    role      TEXT NOT NULL,
    PRIMARY KEY (tenant_id, user_id)
);

CREATE TABLE IF NOT EXISTS resource_acl (
    resource_type  TEXT NOT NULL,
    resource_id    TEXT NOT NULL,
    principal_type TEXT NOT NULL,
    principal_id   TEXT NOT NULL,
    permission     TEXT NOT NULL,
    granted        INTEGER NOT NULL,
    PRIMARY KEY (resource_type, resource_id, principal_type, principal_id, permission)
);

CREATE TABLE IF NOT EXISTS approval_templates (
    id          TEXT PRIMARY KEY,
    name        TEXT NOT NULL,
    steps       TEXT NOT NULL,
    create_time TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS approval_instances (
    id            TEXT PRIMARY KEY,
    template_id   TEXT,
    resource_type TEXT NOT NULL,
    resource_id   TEXT NOT NULL,
    applicant_id  TEXT NOT NULL,
    status        TEXT NOT NULL,
    current_step  INTEGER NOT NULL DEFAULT 0,
    create_time   TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS approval_steps (
    instance_id TEXT NOT NULL,
    step_index  INTEGER NOT NULL,
    approver_id TEXT,
    status      TEXT NOT NULL,
    comment     TEXT,
    time        TEXT,
    PRIMARY KEY (instance_id, step_index)
);

CREATE TABLE IF NOT EXISTS audit_logs (
    id          TEXT PRIMARY KEY,
    tenant_id   TEXT,
    project_id  TEXT,
    actor_id    TEXT,
    action      TEXT NOT NULL,
    target_type TEXT,
    target_id   TEXT,
    detail      TEXT,
    client_ip   TEXT,
    time        TEXT NOT NULL
);

CREATE TABLE IF NOT EXISTS retention_policies (
    id             TEXT PRIMARY KEY,
    name           TEXT NOT NULL,
    resource_type  TEXT NOT NULL,
    retention_days INTEGER NOT NULL,
    create_time    TEXT NOT NULL
);

-- ===================== 种子数据 =====================
INSERT INTO permissions (code, name, group_name, create_time) VALUES
    ('dashboard',       '仪表盘',   '概览', '2026-01-01T00:00:00Z'),
    ('fine-tune',       '模型微调', '模型', '2026-01-01T00:00:00Z'),
    ('model-eval',      '模型评估', '模型', '2026-01-01T00:00:00Z'),
    ('model-inference', '模型推理', '模型', '2026-01-01T00:00:00Z'),
    ('model-manage',    '模型管理', '模型', '2026-01-01T00:00:00Z'),
    ('dataset',         '数据集',   '数据', '2026-01-01T00:00:00Z'),
    ('data-process',    '数据处理', '数据', '2026-01-01T00:00:00Z'),
    ('data-convert',    '数据转换', '数据', '2026-01-01T00:00:00Z'),
    ('compute',         '算力管理', '算力', '2026-01-01T00:00:00Z'),
    ('hardware',        '硬件监控', '算力', '2026-01-01T00:00:00Z'),
    ('logs',            '日志查看', '运维', '2026-01-01T00:00:00Z'),
    ('user-settings',   '用户设置', '运维', '2026-01-01T00:00:00Z')
ON CONFLICT (code) DO NOTHING;

INSERT INTO roles (id, name, display_name, permissions, create_time) VALUES
    ('role_admin',   'admin',   '管理员', '["dashboard","fine-tune","model-eval","model-inference","model-manage","dataset","data-process","data-convert","compute","hardware","logs","user-settings"]', '2026-01-01T00:00:00Z'),
    ('role_operator','operator','操作员', '["dashboard","fine-tune","model-eval","model-inference","model-manage","dataset","data-process","data-convert","compute","hardware","logs"]', '2026-01-01T00:00:00Z'),
    ('role_viewer',  'viewer',  '访客',   '["dashboard"]', '2026-01-01T00:00:00Z')
ON CONFLICT (name) DO NOTHING;