feat: add customer authentication and scoped RBAC

2026-07-16 13:58:28 +08:00
parent 6d6c9ce534
commit a1195fb97d
28 changed files with 1738 additions and 97 deletions
--- a/vehicle-data-platform/deploy/migrations/013_platform_identity_access.sql
+++ b/vehicle-data-platform/deploy/migrations/013_platform_identity_access.sql
@@ -0,0 +1,79 @@
+CREATE TABLE IF NOT EXISTS platform_user (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+    username VARCHAR(64) NOT NULL,
+    display_name VARCHAR(96) NOT NULL,
+    password_hash VARCHAR(255) NOT NULL,
+    user_type VARCHAR(24) NOT NULL,
+    status VARCHAR(24) NOT NULL DEFAULT 'enabled',
+    customer_ref VARCHAR(96) NOT NULL DEFAULT '',
+    tenant_ref VARCHAR(96) NOT NULL DEFAULT '',
+    auth_provider VARCHAR(32) NOT NULL DEFAULT 'local',
+    external_subject VARCHAR(128) NULL,
+    failed_login_count INT UNSIGNED NOT NULL DEFAULT 0,
+    locked_until DATETIME(3) NULL,
+    password_changed_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    last_login_at DATETIME(3) NULL,
+    created_by VARCHAR(96) NOT NULL DEFAULT 'system',
+    updated_by VARCHAR(96) NOT NULL DEFAULT 'system',
+    created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+    UNIQUE KEY uk_platform_user_username (username),
+    UNIQUE KEY uk_platform_user_external_identity (auth_provider, external_subject),
+    INDEX idx_platform_user_type_status (user_type, status),
+    CONSTRAINT chk_platform_user_type CHECK (user_type IN ('admin', 'customer')),
+    CONSTRAINT chk_platform_user_status CHECK (status IN ('enabled', 'disabled'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS platform_user_menu (
+    user_id BIGINT UNSIGNED NOT NULL,
+    menu_key VARCHAR(48) NOT NULL,
+    granted_by VARCHAR(96) NOT NULL,
+    granted_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    PRIMARY KEY (user_id, menu_key),
+    INDEX idx_platform_user_menu_key (menu_key, user_id),
+    CONSTRAINT fk_platform_user_menu_user FOREIGN KEY (user_id) REFERENCES platform_user(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS platform_user_vehicle (
+    user_id BIGINT UNSIGNED NOT NULL,
+    vin VARCHAR(64) NOT NULL,
+    valid_from DATETIME(3) NULL,
+    valid_to DATETIME(3) NULL,
+    source_system VARCHAR(32) NOT NULL DEFAULT 'manual',
+    external_ref VARCHAR(128) NOT NULL DEFAULT '',
+    granted_by VARCHAR(96) NOT NULL,
+    granted_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    PRIMARY KEY (user_id, vin),
+    INDEX idx_platform_user_vehicle_vin (vin, user_id),
+    CONSTRAINT fk_platform_user_vehicle_user FOREIGN KEY (user_id) REFERENCES platform_user(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS platform_user_session (
+    id CHAR(32) NOT NULL PRIMARY KEY,
+    user_id BIGINT UNSIGNED NOT NULL,
+    token_hash BINARY(32) NOT NULL,
+    issued_at DATETIME(3) NOT NULL,
+    expires_at DATETIME(3) NOT NULL,
+    last_seen_at DATETIME(3) NOT NULL,
+    revoked_at DATETIME(3) NULL,
+    remote_addr VARCHAR(96) NOT NULL DEFAULT '',
+    user_agent VARCHAR(255) NOT NULL DEFAULT '',
+    UNIQUE KEY uk_platform_session_token (token_hash),
+    INDEX idx_platform_session_user (user_id, expires_at),
+    INDEX idx_platform_session_expiry (expires_at, revoked_at),
+    CONSTRAINT fk_platform_session_user FOREIGN KEY (user_id) REFERENCES platform_user(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS platform_auth_audit (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+    actor VARCHAR(96) NOT NULL,
+    action VARCHAR(64) NOT NULL,
+    target_type VARCHAR(32) NOT NULL DEFAULT '',
+    target_id VARCHAR(96) NOT NULL DEFAULT '',
+    result VARCHAR(24) NOT NULL,
+    detail_json JSON NULL,
+    remote_addr VARCHAR(96) NOT NULL DEFAULT '',
+    created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    INDEX idx_platform_auth_audit_created (created_at, action),
+    INDEX idx_platform_auth_audit_target (target_type, target_id, created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;