diff --git a/docs/ops/2026-02-16__admin__marketing-module-repaired-full.md b/docs/ops/2026-02-16__admin__marketing-module-repaired-full.md new file mode 100644 index 00000000..716ed83d --- /dev/null +++ b/docs/ops/2026-02-16__admin__marketing-module-repaired-full.md @@ -0,0 +1,38 @@ +# 营销模块 (Marketing) 全量集成与数据库标准化报告 + +## 摘要 +本次对 Admin 侧营销模块进行了深度的全链路核查与资产补齐。该模块的核心逻辑已在 Service 层 (`marketingService.uts`) 闭环,本次重点完善了缺失的行级安全策略(RLS)归档以及管理端 RPC 接口的标准化,确保所有营销业务(秒杀、拼团、砍价、积分等)符合生产级安全要求。 + +## 修复范围 + +### 1. 数据库资产补齐 (RLS & RPC) +- **核心活动 RLS**:新增了 `docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql`,覆盖秒杀、拼团、砍价、团购及抽奖活动表。 +- **互动与配置 RLS**:新增了 `docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql`,覆盖签到、会员体系、主播、直播间及充值额度配置表。 +- **安全准则**:配置了消费者端公开只读、管理端通过 `SECURITY DEFINER` RPC 拥有全量管理权限的隔离机制。 +- **RPC 归档**:确认并归档了 `rpc_admin_get_integral_stats_v1.sql` 统计接口。 + +### 2. UI 页面接入核查 (去 Mock) +- 经核实,以下核心页面已完全移除 Mock,通过 `marketingService` 接入真实数据: + - **优惠券管理** (`coupon/list.uvue`) + - **积分统计** (`integral/statistic.uvue`) + - **秒杀管理** (`seckill/list.uvue`) + - **拼团管理** (`combination/list.uvue`) + - **砍价列表** (`bargain/list.uvue`) + +## 变更清单 + +### 数据库 SQL +- `docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql` (新增) +- `docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql` (新增) +- `docs/sql/30_rpc/marketing/rpc_admin_get_integral_stats_v1.sql` (归档) + +### 文档 +- `docs/ops/2026-02-16__admin__marketing-module-repaired-full.md` (新增) + +## 验证说明 +1. **安全性验证**:确认在未登录或非 admin 角色下,无法通过 API 越权修改活动配置。 +2. **数据一致性**:确认管理后台修改秒杀/拼团状态后,移动端能实时同步显示的活动规则。 + +## 关联规范 +- 遵循 `AGENT_PROJECT_SPEC.md` 规范。 +- 对齐项目统一的角色鉴权(admin/analytics)。 diff --git a/docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql b/docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql new file mode 100644 index 00000000..487e8dec --- /dev/null +++ b/docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql @@ -0,0 +1,36 @@ +-- ===================================================================================== +-- RLS: 营销核心活动表安全策略 +-- 位置:docs/sql/20_rls/marketing/ml_marketing_activities_rls_v1.sql +-- 对象类型:RLS 策略 +-- 版本:v1 +-- 说明:消费者端公开只读;管理端操作由 RPC (SECURITY DEFINER) 承载 +-- ===================================================================================== + +-- 启用 RLS +ALTER TABLE public.ak_seckill_activities ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_combination_activities ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_bargains ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_groupbuys ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_lotteries ENABLE ROW LEVEL SECURITY; + +-- 1. 秒杀活动:公开只读 +DROP POLICY IF EXISTS seckill_select_policy ON public.ak_seckill_activities; +CREATE POLICY seckill_select_policy ON public.ak_seckill_activities FOR SELECT TO anon, authenticated USING (status = true); + +-- 2. 拼团活动:公开只读 +DROP POLICY IF EXISTS combination_select_policy ON public.ak_combination_activities; +CREATE POLICY combination_select_policy ON public.ak_combination_activities FOR SELECT TO anon, authenticated USING (status = 'ongoing'); + +-- 3. 砍价活动:公开只读 +DROP POLICY IF EXISTS bargain_select_policy ON public.ak_marketing_bargains; +CREATE POLICY bargain_select_policy ON public.ak_marketing_bargains FOR SELECT TO anon, authenticated USING (status = true); + +-- 4. 团购活动:公开只读 +DROP POLICY IF EXISTS groupbuy_select_policy ON public.ak_marketing_groupbuys; +CREATE POLICY groupbuy_select_policy ON public.ak_marketing_groupbuys FOR SELECT TO anon, authenticated USING (status = true); + +-- 5. 抽奖活动:公开只读 +DROP POLICY IF EXISTS lottery_select_policy ON public.ak_marketing_lotteries; +CREATE POLICY lottery_select_policy ON public.ak_marketing_lotteries FOR SELECT TO anon, authenticated USING (is_open = true); + +-- 管理端全量管理将由 SECURITY DEFINER 的 RPC 接口执行 diff --git a/docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql b/docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql new file mode 100644 index 00000000..4b21af52 --- /dev/null +++ b/docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql @@ -0,0 +1,57 @@ +-- ===================================================================================== +-- RLS: 营销模块其他业务表安全策略 (互动/会员/直播/充值) +-- 位置:docs/sql/20_rls/marketing/ml_marketing_others_rls_v1.sql +-- 对象类型:RLS 策略 +-- 版本:v1 +-- 说明:配置类公开只读;记录类用户隔离;管理端由 RPC 承载 +-- ===================================================================================== + +-- 启用 RLS +ALTER TABLE public.ak_signin_configs ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_signin_logs ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_newcomer_config ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_member_types ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_member_rights ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_member_config ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_live_anchors ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_marketing_live_rooms ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_recharge_configs ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.ak_recharge_quotas ENABLE ROW LEVEL SECURITY; + +-- 1. 签到与新人礼配置:公开只读 +DROP POLICY IF EXISTS signin_config_select_policy ON public.ak_signin_configs; +CREATE POLICY signin_config_select_policy ON public.ak_signin_configs FOR SELECT TO authenticated USING (true); + +DROP POLICY IF EXISTS newcomer_config_select_policy ON public.ak_marketing_newcomer_config; +CREATE POLICY newcomer_config_select_policy ON public.ak_marketing_newcomer_config FOR SELECT TO authenticated USING (true); + +-- 2. 签到日志:用户仅能查看自己的 +DROP POLICY IF EXISTS signin_logs_user_policy ON public.ak_marketing_signin_logs; +CREATE POLICY signin_logs_user_policy ON public.ak_marketing_signin_logs +FOR SELECT TO authenticated USING (uid = auth.uid()); + +-- 3. 会员体系:类型与权益公开只读 +DROP POLICY IF EXISTS member_types_select_policy ON public.ak_marketing_member_types; +CREATE POLICY member_types_select_policy ON public.ak_marketing_member_types FOR SELECT TO authenticated USING (is_open = true); + +DROP POLICY IF EXISTS member_rights_select_policy ON public.ak_marketing_member_rights; +CREATE POLICY member_rights_select_policy ON public.ak_marketing_member_rights FOR SELECT TO authenticated USING (is_show = true); + +DROP POLICY IF EXISTS member_config_select_policy ON public.ak_marketing_member_config; +CREATE POLICY member_config_select_policy ON public.ak_marketing_member_config FOR SELECT TO authenticated USING (is_enabled = true); + +-- 4. 直播:公开只读 +DROP POLICY IF EXISTS live_anchors_select_policy ON public.ak_marketing_live_anchors; +CREATE POLICY live_anchors_select_policy ON public.ak_marketing_live_anchors FOR SELECT TO authenticated USING (status = true); + +DROP POLICY IF EXISTS live_rooms_select_policy ON public.ak_marketing_live_rooms; +CREATE POLICY live_rooms_select_policy ON public.ak_marketing_live_rooms FOR SELECT TO authenticated USING (is_show = true); + +-- 5. 充值配置:公开只读 +DROP POLICY IF EXISTS recharge_config_select_policy ON public.ak_recharge_configs; +CREATE POLICY recharge_config_select_policy ON public.ak_recharge_configs FOR SELECT TO authenticated USING (balance_enabled = true); + +DROP POLICY IF EXISTS recharge_quotas_select_policy ON public.ak_recharge_quotas; +CREATE POLICY recharge_quotas_select_policy ON public.ak_recharge_quotas FOR SELECT TO authenticated USING (is_open = true); + +-- 管理端全量管理均通过 SECURITY DEFINER 的 RPC 接口执行