all-project/backend/script/sql/update/update_20261026_workflow_permission.sql

-- =============================================================================
-- 工作流管理类接口权限按钮（安全整改：流程定义/实例/全部待办接口原先仅校验登录）
-- 日期：2026-10-26
-- 挂载菜单：流程定义(11620)、流程实例(11621)、待办任务(11631)
-- 授权方式：给已拥有对应菜单的角色补授权，不改变现有可见范围
-- 执行后需要相关用户重新登录（或清理 Redis 中的登录缓存）权限才会生效
-- 执行：开发/生产库均可幂等执行
-- =============================================================================

INSERT INTO `sys_menu` (
  `menu_id`, `menu_name`, `parent_id`, `order_num`, `path`, `component`, `query_param`,
  `is_frame`, `is_cache`, `menu_type`, `visible`, `status`, `perms`, `icon`,
  `create_dept`, `create_by`, `create_time`, `remark`
)
SELECT t.menu_id, t.menu_name, t.parent_id, t.order_num, '#', '', NULL,
       1, 0, 'F', '0', '0', t.perms, '#', 103, 1, NOW(), t.remark
FROM (
  SELECT 2026102620000000101 AS menu_id, '流程定义查询' AS menu_name, 11620 AS parent_id, 1 AS order_num,
         'workflow:definition:list' AS perms, '流程定义列表/详情/设计器读取' AS remark
  UNION ALL
  SELECT 2026102620000000102, '流程定义维护', 11620, 2,
         'workflow:definition:edit', '流程定义新增/修改/发布/导入/删除/设计器保存'
  UNION ALL
  SELECT 2026102620000000103, '流程实例管理', 11621, 1,
         'workflow:instance:manage', '全部实例查询/作废/挂起/变量/删除他人实例/撤销他人流程'
  UNION ALL
  SELECT 2026102620000000104, '全部待办管理', 11631, 1,
         'workflow:task:manage', '全部待办/已办查询与修改办理人'
) t
WHERE NOT EXISTS (SELECT 1 FROM `sys_menu` m WHERE m.menu_id = t.menu_id);

INSERT INTO `sys_role_menu` (`role_id`, `menu_id`)
SELECT DISTINCT rm.role_id, m.menu_id
FROM `sys_role_menu` rm
JOIN (
  SELECT 11620 AS parent_id, 2026102620000000101 AS menu_id UNION ALL
  SELECT 11620, 2026102620000000102 UNION ALL
  SELECT 11621, 2026102620000000103 UNION ALL
  SELECT 11631, 2026102620000000104
) m ON rm.menu_id = m.parent_id
WHERE NOT EXISTS (
  SELECT 1 FROM `sys_role_menu` x WHERE x.role_id = rm.role_id AND x.menu_id = m.menu_id
);

-- 核对：哪些角色拿到了工作流管理权限（应只有管理员类角色）
SELECT r.role_id, r.role_key, r.role_name, m.perms
FROM sys_role_menu rm
JOIN sys_role r ON r.role_id = rm.role_id
JOIN sys_menu m ON m.menu_id = rm.menu_id
WHERE m.menu_id BETWEEN 2026102620000000101 AND 2026102620000000104
ORDER BY r.role_id, m.perms;