feat: 新增 approval_staff 员工角色并收紧派单候选池为审批参与人（#45）

2026-10-31 05:02:42 +08:00
parent 2866abe1f5
commit 5018463005
5 changed files with 108 additions and 38 deletions
@@ -0,0 +1,59 @@
+-- 审批参与权限授予种子（可重复执行）
+-- 目标库：gxtyzx_core（server）
+-- 执行顺序：01-approval.sql -> 02-approval_menu.sql -> 03-approval_orgs_roles.sql -> 04-approval_role_grants.sql
+--
+-- 背景（#45）：审批动作的 @PreAuthorize 按 #14 动作矩阵要求 approval:instance:approve，
+-- 而报送人/被派单人是一般员工——参与审批的权限由角色授予承载，接口鉴权不放宽。
+--
+-- 授予矩阵：
+--   approval_staff（员工，本文件新建）与既有岗位角色
+--     dept_leader_*、dept_deputy_*、approval_archivist、approval_cashier、
+--     approval_typist、approval_issuer、approval_general_manager
+--       -> 页面 /approval、/approval/todo、/approval/instance
+--       -> approval:instance:list、submit、approve
+--   approval_archivist 额外 -> approval:instance:archive（收文员归档）
+--   assign、export 仍仅 superAdmin（02-approval_menu.sql 已授）
+--
+-- 成员分配（把 approval_staff 发给员工）由客户在后台完成，同 03 的约定。
+-- 按 tenant_id=10150 执行；换租户时改下面的 @tenant_id。
+
+SET @tenant_id := 10150;
+
+-- 1. 员工基础角色
+INSERT INTO sys_role (role_name, role_code, comments, sort_number, tenant_id, deleted)
+SELECT '员工', 'approval_staff', '审批种子：内部员工基础角色，提交/审批/确认自己的单据（#45）', 900, @tenant_id, 0
+FROM DUAL
+WHERE NOT EXISTS (
+  SELECT 1 FROM sys_role WHERE tenant_id = @tenant_id AND deleted = 0 AND role_code = 'approval_staff'
+);
+
+-- 2. 参与人角色：页面 + list/submit/approve
+INSERT INTO sys_role_menu (role_id, menu_id, tenant_id)
+SELECT r.role_id, m.menu_id, @tenant_id
+FROM sys_role r
+JOIN sys_menu m
+  ON m.tenant_id = @tenant_id AND m.deleted = 0
+ AND (m.path IN ('/approval', '/approval/todo', '/approval/instance')
+      OR m.authority IN ('approval:instance:list', 'approval:instance:submit', 'approval:instance:approve'))
+WHERE r.tenant_id = @tenant_id AND r.deleted = 0
+  AND (r.role_code = 'approval_staff'
+       OR LEFT(r.role_code, 12) = 'dept_leader_'
+       OR LEFT(r.role_code, 12) = 'dept_deputy_'
+       OR r.role_code IN ('approval_archivist', 'approval_cashier', 'approval_typist',
+                          'approval_issuer', 'approval_general_manager'))
+  AND NOT EXISTS (
+    SELECT 1 FROM sys_role_menu rm
+    WHERE rm.role_id = r.role_id AND rm.menu_id = m.menu_id AND rm.tenant_id = @tenant_id
+  );
+
+-- 3. 收文员追加归档权限
+INSERT INTO sys_role_menu (role_id, menu_id, tenant_id)
+SELECT r.role_id, m.menu_id, @tenant_id
+FROM sys_role r
+JOIN sys_menu m
+  ON m.tenant_id = @tenant_id AND m.deleted = 0 AND m.authority = 'approval:instance:archive'
+WHERE r.tenant_id = @tenant_id AND r.deleted = 0 AND r.role_code = 'approval_archivist'
+  AND NOT EXISTS (
+    SELECT 1 FROM sys_role_menu rm
+    WHERE rm.role_id = r.role_id AND rm.menu_id = m.menu_id AND rm.tenant_id = @tenant_id
+  );