6d5a711d2c
功能修复： 1. 患者创建空名称验证：后端添加 name.trim().is_empty() 检查 2. 仪表盘统计容错：单个查询失败返回零值而非 500 3. FHIR 路由修复：从 /fhir 移到 /api/v1/fhir 保持一致 4. 冻结模块后端中间件：新增 frozen_module_middleware 拦截冻结路径 5. 积分端点权限码：health.health-data.list → health.points.list 6. 角色权限迁移：护士补充 devices.list，运营补充 points.list/manage 7. 测试结果文档：R01-R05 角色测试 + T00/T10 结果归档 Clippy 全 workspace 清零（14→0 errors）： - erp-core: 修复 empty doc line、collapsible if、redundant closure 等 9 处 - erp-health: 修复 too_many_arguments、unused var、unnecessary parens 等 58 处 - erp-ai: 修复 dead_code、unused import 等 11 处 - erp-plugin: 修复 too_many_arguments、wildcard pattern 等 11 处 - erp-server-migration: 修复 enum_variant_names 5 处 - erp-auth/config/workflow/message: 各 1-3 处 工程改进： - lint-staged 配置迁移到 .lintstagedrc.js（函数式避免文件列表传给 clippy） - cargo fmt 统一格式化
83 lines
2.9 KiB
Rust
83 lines
2.9 KiB
Rust
use sea_orm_migration::prelude::*;
|
||
|
||
#[derive(DeriveMigrationName)]
|
||
pub struct Migration;
|
||
|
||
#[async_trait::async_trait]
|
||
impl MigrationTrait for Migration {
|
||
async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
|
||
let conn = manager.get_connection();
|
||
|
||
// 替换所有表的 RLS 策略：移除空字符串绕过条件
|
||
// 原策略允许 current_setting(...) = '' 时通过（绕过 RLS），现在要求变量已设置且匹配
|
||
conn.execute_unprepared(
|
||
r#"
|
||
DO $$
|
||
DECLARE
|
||
tbl TEXT;
|
||
BEGIN
|
||
FOR tbl IN
|
||
SELECT c.table_name FROM information_schema.columns c
|
||
JOIN information_schema.tables t
|
||
ON c.table_name = t.table_name AND c.table_schema = t.table_schema
|
||
WHERE c.column_name = 'tenant_id'
|
||
AND c.table_schema = 'public'
|
||
AND t.table_type = 'BASE TABLE'
|
||
ORDER BY c.table_name
|
||
LOOP
|
||
EXECUTE format('DROP POLICY IF EXISTS tenant_isolation ON %I', tbl);
|
||
EXECUTE format(
|
||
'CREATE POLICY tenant_isolation ON %I USING (
|
||
current_setting(''app.current_tenant_id'', true) != ''''
|
||
AND tenant_id = current_setting(''app.current_tenant_id'', true)::uuid
|
||
)',
|
||
tbl
|
||
);
|
||
END LOOP;
|
||
END;
|
||
$$;
|
||
"#,
|
||
)
|
||
.await?;
|
||
|
||
Ok(())
|
||
}
|
||
|
||
async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
|
||
let conn = manager.get_connection();
|
||
|
||
// 回滚：恢复允许空字符串绕过的原策略
|
||
conn.execute_unprepared(
|
||
r#"
|
||
DO $$
|
||
DECLARE
|
||
tbl TEXT;
|
||
BEGIN
|
||
FOR tbl IN
|
||
SELECT c.table_name FROM information_schema.columns c
|
||
JOIN information_schema.tables t
|
||
ON c.table_name = t.table_name AND c.table_schema = t.table_schema
|
||
WHERE c.column_name = 'tenant_id'
|
||
AND c.table_schema = 'public'
|
||
AND t.table_type = 'BASE TABLE'
|
||
ORDER BY c.table_name
|
||
LOOP
|
||
EXECUTE format('DROP POLICY IF EXISTS tenant_isolation ON %I', tbl);
|
||
EXECUTE format(
|
||
'CREATE POLICY tenant_isolation ON %I USING (
|
||
current_setting(''app.current_tenant_id'', true) = ''''
|
||
OR tenant_id = current_setting(''app.current_tenant_id'', true)::uuid
|
||
)',
|
||
tbl
|
||
);
|
||
END LOOP;
|
||
END;
|
||
$$;
|
||
"#,
|
||
)
|
||
.await?;
|
||
|
||
Ok(())
|
||
}
|
||
}
|