feat: integrate ZYT admin with IAM Hub

2026-09-08 13:26:41 +08:00
parent cf3fbdc5ef
commit a5f4c4472d
856 changed files with 3585 additions and 2371 deletions
@@ -0,0 +1,48 @@
+-- IAM Hub employee SSO identity, local session revocation and idempotent audit.
+-- The production table prefix in this repository is zyt_.
+
+SET @schema_name := DATABASE();
+
+SET @sql := IF(
+  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_subject') = 0,
+  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_subject` varchar(128) NULL DEFAULT NULL COMMENT ''IAM Hub OIDC subject'' AFTER `work_wechat_userid`',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @sql := IF(
+  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_managed') = 0,
+  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_managed` tinyint unsigned NOT NULL DEFAULT 0 COMMENT ''IAM Hub managed account'' AFTER `iam_subject`',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @sql := IF(
+  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_revoked_at') = 0,
+  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_revoked_at` int unsigned NOT NULL DEFAULT 0 COMMENT ''last IAM revocation timestamp'' AFTER `iam_managed`',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @sql := IF(
+  (SELECT COUNT(*) FROM information_schema.STATISTICS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND INDEX_NAME='uk_admin_iam_subject') = 0,
+  'CREATE UNIQUE INDEX `uk_admin_iam_subject` ON `zyt_admin` (`iam_subject`)',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+CREATE TABLE IF NOT EXISTS `zyt_iam_revocation_event` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `event_id` varchar(64) NOT NULL,
+  `iam_subject` varchar(128) NOT NULL,
+  `admin_id` int unsigned NOT NULL DEFAULT 0,
+  `status` varchar(32) NOT NULL,
+  `reason` varchar(500) NOT NULL DEFAULT '',
+  `payload` longtext NOT NULL,
+  `create_time` int unsigned NOT NULL DEFAULT 0,
+  `update_time` int unsigned NOT NULL DEFAULT 0,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uk_iam_revocation_event_id` (`event_id`),
+  KEY `idx_iam_revocation_subject` (`iam_subject`),
+  KEY `idx_iam_revocation_admin` (`admin_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='IAM Hub revocation delivery audit';