mirror of
https://github.com/langgenius/dify.git
synced 2026-09-02 14:25:35 +08:00
69 lines
2.6 KiB
SQL
69 lines
2.6 KiB
SQL
-- Knowledge Platform schema migration
|
|
-- Migration id: 0032_capability_source_sync_policies
|
|
-- Dialect: postgres
|
|
-- Allows durable source sync policies to retain either a Capability grant or legacy ACL snapshot.
|
|
|
|
ALTER TABLE "source_sync_policies"
|
|
ADD COLUMN IF NOT EXISTS "capability_grant_id" UUID,
|
|
ALTER COLUMN "requested_by_subject_id" DROP NOT NULL,
|
|
ALTER COLUMN "access_channel" DROP NOT NULL,
|
|
ALTER COLUMN "permission_snapshot_id" DROP NOT NULL,
|
|
ALTER COLUMN "permission_snapshot_revision" DROP NOT NULL,
|
|
ALTER COLUMN "required_permission_scope" DROP NOT NULL;
|
|
|
|
ALTER TABLE "source_sync_policies"
|
|
DROP CONSTRAINT IF EXISTS "source_sync_policies_channel_ck",
|
|
DROP CONSTRAINT IF EXISTS "source_sync_policies_revision_ck",
|
|
DROP CONSTRAINT IF EXISTS "source_sync_policies_authorization_binding_ck";
|
|
|
|
ALTER TABLE "source_sync_policies"
|
|
ADD CONSTRAINT "source_sync_policies_channel_ck" CHECK (
|
|
"access_channel" IS NULL
|
|
OR "access_channel" IN ('interactive', 'service_api', 'mcp', 'agent')
|
|
),
|
|
ADD CONSTRAINT "source_sync_policies_revision_ck" CHECK (
|
|
"revision" >= 1 AND "expected_source_version" >= 1
|
|
AND ("capability_grant_id" IS NOT NULL OR "permission_snapshot_revision" >= 1)
|
|
),
|
|
ADD CONSTRAINT "source_sync_policies_authorization_binding_ck" CHECK (
|
|
(
|
|
"capability_grant_id" IS NOT NULL
|
|
AND "requested_by_subject_id" IS NULL
|
|
AND "access_channel" IS NULL
|
|
AND "permission_snapshot_id" IS NULL
|
|
AND "permission_snapshot_revision" IS NULL
|
|
AND "required_permission_scope" IS NULL
|
|
)
|
|
OR (
|
|
"capability_grant_id" IS NULL
|
|
AND "requested_by_subject_id" IS NOT NULL
|
|
AND "access_channel" IN ('interactive', 'service_api', 'mcp', 'agent')
|
|
AND "permission_snapshot_id" IS NOT NULL
|
|
AND "permission_snapshot_revision" >= 1
|
|
AND "required_permission_scope" IS NOT NULL
|
|
AND jsonb_typeof("required_permission_scope") = 'array'
|
|
)
|
|
);
|
|
|
|
DO $kfs_0032_source_sync_policy_capability_fk$
|
|
BEGIN
|
|
IF NOT EXISTS (
|
|
SELECT 1
|
|
FROM pg_constraint
|
|
WHERE conname = 'source_sync_policies_capability_grant_fk'
|
|
AND conrelid = 'source_sync_policies'::regclass
|
|
) THEN
|
|
ALTER TABLE "source_sync_policies"
|
|
ADD CONSTRAINT "source_sync_policies_capability_grant_fk"
|
|
FOREIGN KEY ("tenant_id", "knowledge_space_id", "capability_grant_id")
|
|
REFERENCES "capability_grants" ("tenant_id", "knowledge_space_id", "grant_id")
|
|
ON DELETE RESTRICT;
|
|
END IF;
|
|
END
|
|
$kfs_0032_source_sync_policy_capability_fk$;
|
|
|
|
CREATE INDEX IF NOT EXISTS "source_sync_policies_capability_grant_idx"
|
|
ON "source_sync_policies" (
|
|
"tenant_id", "knowledge_space_id", "capability_grant_id"
|
|
);
|