feat: add authenticated remote MCP access and complete business workflows
This commit is contained in:
陈煜 committed
1 parent
f40f4da781
commit
027a8c1b6a
35 files changed
+4430
-183
No files matched your search
@@ -0,0 +1,85 @@
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentPolicy` (
|
||||
`userId` CHAR(36) NOT NULL,
|
||||
`mode` VARCHAR(16) NOT NULL DEFAULT 'draft',
|
||||
|
||||
PRIMARY KEY (`userId`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentClient` (
|
||||
`id` CHAR(36) NOT NULL,
|
||||
`metadata` JSON NOT NULL,
|
||||
`createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
|
||||
|
||||
PRIMARY KEY (`id`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentAuthorization` (
|
||||
`id` CHAR(36) NOT NULL,
|
||||
`userId` CHAR(36) NULL,
|
||||
`clientId` CHAR(36) NOT NULL,
|
||||
`parameters` JSON NOT NULL,
|
||||
`codeDigest` CHAR(64) NULL,
|
||||
`expiresAt` DATETIME(3) NOT NULL,
|
||||
`status` VARCHAR(16) NOT NULL DEFAULT 'pending',
|
||||
|
||||
UNIQUE INDEX `AgentAuthorization_codeDigest_key`(`codeDigest`),
|
||||
PRIMARY KEY (`id`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentGrant` (
|
||||
`id` CHAR(36) NOT NULL,
|
||||
`userId` CHAR(36) NOT NULL,
|
||||
`clientId` CHAR(36) NULL,
|
||||
`name` VARCHAR(100) NOT NULL,
|
||||
`scopes` JSON NOT NULL,
|
||||
`resource` VARCHAR(500) NOT NULL,
|
||||
`accessDigest` CHAR(64) NOT NULL,
|
||||
`refreshDigest` CHAR(64) NULL,
|
||||
`expiresAt` DATETIME(3) NOT NULL,
|
||||
`refreshExpiresAt` DATETIME(3) NULL,
|
||||
`revokedAt` DATETIME(3) NULL,
|
||||
`sessionId` CHAR(64) NOT NULL,
|
||||
`createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
|
||||
|
||||
UNIQUE INDEX `AgentGrant_accessDigest_key`(`accessDigest`),
|
||||
UNIQUE INDEX `AgentGrant_refreshDigest_key`(`refreshDigest`),
|
||||
INDEX `AgentGrant_userId_createdAt_idx`(`userId`, `createdAt`),
|
||||
PRIMARY KEY (`id`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentOperation` (
|
||||
`id` CHAR(36) NOT NULL,
|
||||
`userId` CHAR(36) NOT NULL,
|
||||
`grantId` CHAR(36) NOT NULL,
|
||||
`key` VARCHAR(128) NOT NULL,
|
||||
`hash` CHAR(64) NOT NULL,
|
||||
`tool` VARCHAR(100) NOT NULL,
|
||||
`parameters` JSON NOT NULL,
|
||||
`snapshot` CHAR(64) NOT NULL,
|
||||
`status` VARCHAR(16) NOT NULL DEFAULT 'pending',
|
||||
`expiresAt` DATETIME(3) NOT NULL,
|
||||
`result` JSON NULL,
|
||||
`createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
|
||||
`completedAt` DATETIME(3) NULL,
|
||||
|
||||
INDEX `AgentOperation_userId_createdAt_idx`(`userId`, `createdAt`),
|
||||
UNIQUE INDEX `AgentOperation_userId_key_key`(`userId`, `key`),
|
||||
PRIMARY KEY (`id`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE `AgentPolicy` ADD CONSTRAINT `AgentPolicy_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `User`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE `AgentAuthorization` ADD CONSTRAINT `AgentAuthorization_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `User`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE `AgentGrant` ADD CONSTRAINT `AgentGrant_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `User`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE `AgentOperation` ADD CONSTRAINT `AgentOperation_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `User`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
@@ -0,0 +1,15 @@
|
||||
-- CreateTable
|
||||
CREATE TABLE `AgentCall` (
|
||||
`id` CHAR(36) NOT NULL,
|
||||
`userId` CHAR(36) NOT NULL,
|
||||
`grantId` CHAR(36) NOT NULL,
|
||||
`tool` VARCHAR(100) NOT NULL,
|
||||
`status` VARCHAR(16) NOT NULL,
|
||||
`createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
|
||||
|
||||
INDEX `AgentCall_userId_createdAt_idx`(`userId`, `createdAt`),
|
||||
PRIMARY KEY (`id`)
|
||||
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE `AgentCall` ADD CONSTRAINT `AgentCall_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `User`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
@@ -0,0 +1,50 @@
|
||||
ALTER TABLE `AgentPolicy` COMMENT '用户的 Agent 写入策略';
|
||||
ALTER TABLE `AgentPolicy` MODIFY `userId` CHAR(36) NOT NULL COMMENT '所属用户标识，用于数据隔离';
|
||||
ALTER TABLE `AgentPolicy` MODIFY `mode` VARCHAR(16) NOT NULL DEFAULT 'draft' COMMENT '写入策略：readonly 只读、draft 草稿、direct 普通直接写入';
|
||||
ALTER TABLE `AgentClient` COMMENT 'OAuth 动态注册客户端元数据';
|
||||
ALTER TABLE `AgentClient` MODIFY `id` CHAR(36) NOT NULL COMMENT '唯一标识';
|
||||
ALTER TABLE `AgentClient` MODIFY `metadata` JSON NOT NULL COMMENT '公开客户端注册元数据，不保存用户凭据';
|
||||
ALTER TABLE `AgentClient` MODIFY `createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间，UTC';
|
||||
ALTER TABLE `AgentAuthorization` COMMENT '短期 OAuth 授权请求及一次性授权码摘要';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `id` CHAR(36) NOT NULL COMMENT '唯一标识';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `userId` CHAR(36) NULL COMMENT '所属用户标识，用于数据隔离';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `clientId` CHAR(36) NOT NULL COMMENT 'OAuth 客户端标识；个人令牌为空';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `parameters` JSON NOT NULL COMMENT '具体操作参数；禁止保存密码及令牌';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `codeDigest` CHAR(64) NULL COMMENT '一次性授权码 SHA-256 摘要';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `expiresAt` DATETIME(3) NOT NULL COMMENT '到期时间，UTC';
|
||||
ALTER TABLE `AgentAuthorization` MODIFY `status` VARCHAR(16) NOT NULL DEFAULT 'pending' COMMENT '当前处理状态';
|
||||
ALTER TABLE `AgentGrant` COMMENT '用户授权连接、令牌摘要及资源权限';
|
||||
ALTER TABLE `AgentGrant` MODIFY `id` CHAR(36) NOT NULL COMMENT '唯一标识';
|
||||
ALTER TABLE `AgentGrant` MODIFY `userId` CHAR(36) NOT NULL COMMENT '所属用户标识，用于数据隔离';
|
||||
ALTER TABLE `AgentGrant` MODIFY `clientId` CHAR(36) NULL COMMENT 'OAuth 客户端标识；个人令牌为空';
|
||||
ALTER TABLE `AgentGrant` MODIFY `name` VARCHAR(100) NOT NULL COMMENT '用户可见连接名称';
|
||||
ALTER TABLE `AgentGrant` MODIFY `scopes` JSON NOT NULL COMMENT '权限列表：read、draft、write、sensitive';
|
||||
ALTER TABLE `AgentGrant` MODIFY `resource` VARCHAR(500) NOT NULL COMMENT '令牌适用的规范 MCP 资源地址';
|
||||
ALTER TABLE `AgentGrant` MODIFY `accessDigest` CHAR(64) NOT NULL COMMENT '访问令牌 SHA-256 摘要；完整值仅颁发时返回';
|
||||
ALTER TABLE `AgentGrant` MODIFY `refreshDigest` CHAR(64) NULL COMMENT '刷新令牌 SHA-256 摘要，使用后轮换';
|
||||
ALTER TABLE `AgentGrant` MODIFY `expiresAt` DATETIME(3) NOT NULL COMMENT '到期时间，UTC';
|
||||
ALTER TABLE `AgentGrant` MODIFY `refreshExpiresAt` DATETIME(3) NULL COMMENT '刷新授权到期时间，UTC';
|
||||
ALTER TABLE `AgentGrant` MODIFY `revokedAt` DATETIME(3) NULL COMMENT '撤销时间，UTC；空表示未撤销';
|
||||
ALTER TABLE `AgentGrant` MODIFY `sessionId` CHAR(64) NOT NULL COMMENT '本连接的独立业务授权会话标识，不作为 MCP 凭证';
|
||||
ALTER TABLE `AgentGrant` MODIFY `createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间，UTC';
|
||||
ALTER TABLE `AgentOperation` COMMENT 'Agent 写入草稿、幂等记录及提交结果';
|
||||
ALTER TABLE `AgentOperation` MODIFY `id` CHAR(36) NOT NULL COMMENT '唯一标识';
|
||||
ALTER TABLE `AgentOperation` MODIFY `userId` CHAR(36) NOT NULL COMMENT '所属用户标识，用于数据隔离';
|
||||
ALTER TABLE `AgentOperation` MODIFY `grantId` CHAR(36) NOT NULL COMMENT '发起操作的授权连接标识';
|
||||
ALTER TABLE `AgentOperation` MODIFY `key` VARCHAR(128) NOT NULL COMMENT '同用户唯一的客户端幂等键';
|
||||
ALTER TABLE `AgentOperation` MODIFY `hash` CHAR(64) NOT NULL COMMENT '工具和参数的规范摘要；拒绝同键不同参数';
|
||||
ALTER TABLE `AgentOperation` MODIFY `tool` VARCHAR(100) NOT NULL COMMENT '业务工具名称';
|
||||
ALTER TABLE `AgentOperation` MODIFY `parameters` JSON NOT NULL COMMENT '具体操作参数；禁止保存密码及令牌';
|
||||
ALTER TABLE `AgentOperation` MODIFY `snapshot` CHAR(64) NOT NULL COMMENT '确认前的账目版本摘要，防止覆盖并发修改';
|
||||
ALTER TABLE `AgentOperation` MODIFY `status` VARCHAR(16) NOT NULL DEFAULT 'pending' COMMENT '当前处理状态';
|
||||
ALTER TABLE `AgentOperation` MODIFY `expiresAt` DATETIME(3) NOT NULL COMMENT '到期时间，UTC';
|
||||
ALTER TABLE `AgentOperation` MODIFY `result` JSON NULL COMMENT '结构化操作结果或最近提交失败原因';
|
||||
ALTER TABLE `AgentOperation` MODIFY `createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间，UTC';
|
||||
ALTER TABLE `AgentOperation` MODIFY `completedAt` DATETIME(3) NULL COMMENT '完成或取消时间，UTC';
|
||||
ALTER TABLE `AgentCall` COMMENT 'MCP 调用审计，不保存参数、密码、令牌或财务内容';
|
||||
ALTER TABLE `AgentCall` MODIFY `id` CHAR(36) NOT NULL COMMENT '审计标识';
|
||||
ALTER TABLE `AgentCall` MODIFY `userId` CHAR(36) NOT NULL COMMENT '所属用户标识，用于数据隔离';
|
||||
ALTER TABLE `AgentCall` MODIFY `grantId` CHAR(36) NOT NULL COMMENT '调用所属连接标识';
|
||||
ALTER TABLE `AgentCall` MODIFY `tool` VARCHAR(100) NOT NULL COMMENT '调用的工具名称';
|
||||
ALTER TABLE `AgentCall` MODIFY `status` VARCHAR(16) NOT NULL COMMENT '结果状态：success 或 error';
|
||||
ALTER TABLE `AgentCall` MODIFY `createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '调用完成时间，UTC';
|
||||
@@ -42,6 +42,133 @@ model User {
|
||||
icons Icon[]
|
||||
transfers Transfer[]
|
||||
schedules Schedule[]
|
||||
agentGrants AgentGrant[]
|
||||
agentOperations AgentOperation[]
|
||||
agentAuthorizations AgentAuthorization[]
|
||||
agentPolicy AgentPolicy?
|
||||
agentCalls AgentCall[]
|
||||
}
|
||||
|
||||
/// MCP 调用审计，不保存工具参数、令牌、密码或财务内容
|
||||
model AgentCall {
|
||||
/// 审计记录标识
|
||||
id String @id @default(uuid()) @db.Char(36)
|
||||
/// 可信认证上下文中的用户标识
|
||||
userId String @db.Char(36)
|
||||
/// 所属用户；注销后级联清理
|
||||
user User @relation(fields:[userId],references:[id],onDelete:Cascade)
|
||||
/// 发起调用的连接标识
|
||||
grantId String @db.Char(36)
|
||||
/// 工具名称
|
||||
tool String @db.VarChar(100)
|
||||
/// 结果状态 success 或 error
|
||||
status String @db.VarChar(16)
|
||||
/// 调用完成时间，UTC
|
||||
createdAt DateTime @default(now())
|
||||
@@index([userId,createdAt])
|
||||
}
|
||||
|
||||
/// 用户的 Agent 写入策略
|
||||
model AgentPolicy {
|
||||
/// 所属用户标识，用于数据隔离
|
||||
userId String @id @db.Char(36)
|
||||
user User @relation(fields:[userId],references:[id],onDelete:Cascade)
|
||||
/// 写入策略：readonly 只读、draft 草稿、direct 普通直接写入
|
||||
mode String @default("draft") @db.VarChar(16)
|
||||
}
|
||||
|
||||
/// OAuth 动态注册客户端元数据
|
||||
model AgentClient {
|
||||
/// 唯一标识
|
||||
id String @id @db.Char(36)
|
||||
/// 公开客户端注册元数据，不保存用户凭据
|
||||
metadata Json
|
||||
/// 创建时间，UTC
|
||||
createdAt DateTime @default(now())
|
||||
}
|
||||
|
||||
/// 短期 OAuth 授权请求及一次性授权码摘要
|
||||
model AgentAuthorization {
|
||||
/// 唯一标识
|
||||
id String @id @default(uuid()) @db.Char(36)
|
||||
/// 所属用户标识，用于数据隔离
|
||||
userId String? @db.Char(36)
|
||||
user User? @relation(fields:[userId],references:[id],onDelete:Cascade)
|
||||
/// OAuth 客户端标识；个人令牌为空
|
||||
clientId String @db.Char(36)
|
||||
/// 具体操作参数；禁止保存密码及令牌
|
||||
parameters Json
|
||||
/// 一次性授权码 SHA-256 摘要
|
||||
codeDigest String? @unique @db.Char(64)
|
||||
/// 到期时间，UTC
|
||||
expiresAt DateTime
|
||||
/// 当前处理状态
|
||||
status String @default("pending") @db.VarChar(16)
|
||||
}
|
||||
|
||||
/// 用户授权连接、令牌摘要及资源权限
|
||||
model AgentGrant {
|
||||
/// 唯一标识
|
||||
id String @id @default(uuid()) @db.Char(36)
|
||||
/// 所属用户标识，用于数据隔离
|
||||
userId String @db.Char(36)
|
||||
user User @relation(fields:[userId],references:[id],onDelete:Cascade)
|
||||
/// OAuth 客户端标识；个人令牌为空
|
||||
clientId String? @db.Char(36)
|
||||
/// 用户可见连接名称
|
||||
name String @db.VarChar(100)
|
||||
/// 权限列表：read、draft、write、sensitive
|
||||
scopes Json
|
||||
/// 令牌适用的规范 MCP 资源地址
|
||||
resource String @db.VarChar(500)
|
||||
/// 访问令牌 SHA-256 摘要；完整值仅颁发时返回
|
||||
accessDigest String @unique @db.Char(64)
|
||||
/// 刷新令牌 SHA-256 摘要，使用后轮换
|
||||
refreshDigest String? @unique @db.Char(64)
|
||||
/// 到期时间，UTC
|
||||
expiresAt DateTime
|
||||
/// 刷新授权到期时间，UTC
|
||||
refreshExpiresAt DateTime?
|
||||
/// 撤销时间，UTC；空表示未撤销
|
||||
revokedAt DateTime?
|
||||
/// 本连接的独立业务授权会话标识，不作为 MCP 凭证
|
||||
sessionId String @db.Char(64)
|
||||
/// 创建时间，UTC
|
||||
createdAt DateTime @default(now())
|
||||
@@index([userId,createdAt])
|
||||
}
|
||||
|
||||
/// Agent 写入草稿、幂等记录及提交结果
|
||||
model AgentOperation {
|
||||
/// 唯一标识
|
||||
id String @id @default(uuid()) @db.Char(36)
|
||||
/// 所属用户标识，用于数据隔离
|
||||
userId String @db.Char(36)
|
||||
user User @relation(fields:[userId],references:[id],onDelete:Cascade)
|
||||
/// 发起操作的授权连接标识
|
||||
grantId String @db.Char(36)
|
||||
/// 同用户唯一的客户端幂等键
|
||||
key String @db.VarChar(128)
|
||||
/// 工具和参数的规范摘要；拒绝同键不同参数
|
||||
hash String @db.Char(64)
|
||||
/// 业务工具名称
|
||||
tool String @db.VarChar(100)
|
||||
/// 具体操作参数；禁止保存密码及令牌
|
||||
parameters Json
|
||||
/// 确认前的账目版本摘要，防止覆盖并发修改
|
||||
snapshot String @db.Char(64)
|
||||
/// 当前处理状态
|
||||
status String @default("pending") @db.VarChar(16)
|
||||
/// 到期时间，UTC
|
||||
expiresAt DateTime
|
||||
/// 结构化操作结果或最近提交失败原因
|
||||
result Json?
|
||||
/// 创建时间，UTC
|
||||
createdAt DateTime @default(now())
|
||||
/// 完成或取消时间，UTC
|
||||
completedAt DateTime?
|
||||
@@unique([userId,key])
|
||||
@@index([userId,createdAt])
|
||||
}
|
||||
/// 登录会话与隐藏项目查看授权
|
||||
model Session {
|
||||
|
||||
Reference in new issue
Block a user