暂存

migrations/000204_add_audit_investigation_indexes.down.sql

@@ -0,0 +1,19 @@
+-- 回滚统一审计跨视角查询索引，并恢复 request 与 parent 的原始精确查询索引。
+DROP INDEX idx_audit_resource_key_event;
+DROP INDEX idx_audit_resource_id_event;
+
+DROP INDEX idx_audit_event_parent;
+CREATE INDEX idx_audit_event_parent
+    ON tb_audit_event (parent_event_id)
+    WHERE parent_event_id <> '';
+
+DROP INDEX idx_audit_event_request;
+CREATE INDEX idx_audit_event_request
+    ON tb_audit_event (request_id)
+    WHERE request_id <> '';
+
+DROP INDEX idx_audit_event_source_occurred;
+DROP INDEX idx_audit_event_category_occurred;
+DROP INDEX idx_audit_event_risk_occurred;
+DROP INDEX idx_audit_event_result_occurred;
+DROP INDEX idx_audit_event_action_occurred;

migrations/000204_add_audit_investigation_indexes.up.sql

@@ -0,0 +1,32 @@
+-- 为统一审计跨视角查询补充受控 B-tree 索引，不增加 JSONB 搜索、缓存或分区。
+CREATE INDEX idx_audit_event_action_occurred
+    ON tb_audit_event (action_code, occurred_at DESC, id DESC);
+
+CREATE INDEX idx_audit_event_result_occurred
+    ON tb_audit_event (result, occurred_at DESC, id DESC);
+
+CREATE INDEX idx_audit_event_risk_occurred
+    ON tb_audit_event (risk_level, occurred_at DESC, id DESC);
+
+CREATE INDEX idx_audit_event_category_occurred
+    ON tb_audit_event (category, occurred_at DESC, id DESC);
+
+CREATE INDEX idx_audit_event_source_occurred
+    ON tb_audit_event (source, occurred_at DESC, id DESC);
+
+DROP INDEX idx_audit_event_request;
+CREATE INDEX idx_audit_event_request
+    ON tb_audit_event (request_id, occurred_at DESC, id DESC)
+    WHERE request_id <> '';
+
+DROP INDEX idx_audit_event_parent;
+CREATE INDEX idx_audit_event_parent
+    ON tb_audit_event (parent_event_id, occurred_at DESC, id DESC)
+    WHERE parent_event_id <> '';
+
+CREATE INDEX idx_audit_resource_id_event
+    ON tb_audit_event_resource (resource_type, resource_id, audit_event_id)
+    WHERE resource_id IS NOT NULL;
+
+CREATE INDEX idx_audit_resource_key_event
+    ON tb_audit_event_resource (resource_type, resource_key, audit_event_id);

migrations/000205_create_log_archive_run.down.sql

@@ -0,0 +1,11 @@
+LOCK TABLE tb_log_archive_run IN ACCESS EXCLUSIVE MODE;
+
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM tb_log_archive_run LIMIT 1) THEN
+        RAISE EXCEPTION 'tb_log_archive_run 已存在归档运行事实，禁止回滚迁移';
+    END IF;
+END;
+$$;
+
+DROP TABLE tb_log_archive_run;

migrations/000205_create_log_archive_run.up.sql

@@ -0,0 +1,53 @@
+CREATE TABLE tb_log_archive_run (
+    id bigserial PRIMARY KEY,
+    source varchar(32) NOT NULL,
+    archive_date date NOT NULL,
+    instance_id varchar(100) NOT NULL,
+    schema_version varchar(32) NOT NULL,
+    revision integer NOT NULL DEFAULT 1,
+    status varchar(16) NOT NULL,
+    is_final boolean NOT NULL DEFAULT false,
+    range_start timestamptz NOT NULL,
+    range_end timestamptz NOT NULL,
+    object_key varchar(500) NOT NULL DEFAULT '',
+    manifest_key varchar(500) NOT NULL DEFAULT '',
+    event_count bigint NOT NULL DEFAULT 0,
+    resource_count bigint NOT NULL DEFAULT 0,
+    record_count bigint NOT NULL DEFAULT 0,
+    uncompressed_bytes bigint NOT NULL DEFAULT 0,
+    compressed_bytes bigint NOT NULL DEFAULT 0,
+    sha256 varchar(64) NOT NULL DEFAULT '',
+    attempt_count integer NOT NULL DEFAULT 0,
+    error_summary varchar(500) NOT NULL DEFAULT '',
+    generated_at timestamptz,
+    completed_at timestamptz,
+    cleanup_started_at timestamptz,
+    cleaned_at timestamptz,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    updated_at timestamptz NOT NULL DEFAULT NOW(),
+    CONSTRAINT uq_log_archive_run UNIQUE (source, archive_date, instance_id, schema_version),
+    CONSTRAINT ck_log_archive_run_status CHECK (status IN ('pending', 'running', 'success', 'failed')),
+    CONSTRAINT ck_log_archive_run_revision CHECK (revision > 0),
+    CONSTRAINT ck_log_archive_run_range CHECK (range_end > range_start),
+    CONSTRAINT ck_log_archive_run_counts CHECK (
+        event_count >= 0 AND resource_count >= 0 AND record_count >= 0
+        AND uncompressed_bytes >= 0 AND compressed_bytes >= 0 AND attempt_count >= 0
+    )
+);
+
+CREATE INDEX idx_log_archive_run_date_status
+    ON tb_log_archive_run (archive_date, status, source);
+
+COMMENT ON TABLE tb_log_archive_run IS '日志冷归档运行账本，不保存日志正文';
+COMMENT ON COLUMN tb_log_archive_run.source IS '归档数据源稳定编码';
+COMMENT ON COLUMN tb_log_archive_run.archive_date IS 'Asia/Shanghai 归档自然日';
+COMMENT ON COLUMN tb_log_archive_run.instance_id IS '归档任务实例标识';
+COMMENT ON COLUMN tb_log_archive_run.schema_version IS '归档 JSONL 结构版本';
+COMMENT ON COLUMN tb_log_archive_run.revision IS '同一归档日不可变对象版本';
+COMMENT ON COLUMN tb_log_archive_run.status IS '归档状态：pending、running、success 或 failed';
+COMMENT ON COLUMN tb_log_archive_run.is_final IS '是否已按数据库当前内容形成月度最终版本';
+COMMENT ON COLUMN tb_log_archive_run.object_key IS 'JSONL gzip 对象 Key';
+COMMENT ON COLUMN tb_log_archive_run.manifest_key IS '归档 manifest 对象 Key';
+COMMENT ON COLUMN tb_log_archive_run.sha256 IS 'gzip 对象内容 SHA-256';
+COMMENT ON COLUMN tb_log_archive_run.cleanup_started_at IS '月度物理清理已通过门禁并开始执行的时间';
+COMMENT ON COLUMN tb_log_archive_run.cleaned_at IS '后续月度在线数据清理完成时间';