fix: polish channel groups and add production deployment

2026-07-07 11:16:08 +08:00
parent b5132d7f4e
commit 72f2c010ce
44 changed files with 1265 additions and 489 deletions
@@ -0,0 +1,75 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { writeFileSync } from 'node:fs';
+import { PrismaPg } from '../../api/node_modules/@prisma/adapter-pg/dist/index.js';
+import { PrismaClient } from '../../api/node_modules/@prisma/client/index.js';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) {
+  throw new Error('DATABASE_URL is required');
+}
+
+const prisma = new PrismaClient({ adapter: new PrismaPg(databaseUrl) });
+const username = process.env.PROD_ADMIN_USERNAME || 'prod_admin';
+const email = process.env.PROD_ADMIN_EMAIL || 'admin@example.com';
+const password = process.env.PROD_ADMIN_PASSWORD || randomBytes(18).toString('base64url');
+const credentialFile = process.env.PROD_ADMIN_CREDENTIAL_FILE;
+
+function hashPassword(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+async function main() {
+  const role = await prisma.role.upsert({
+    where: { code: 'platform_admin' },
+    update: { name: '平台管理员', scope: 'platform' },
+    create: { code: 'platform_admin', name: '平台管理员', scope: 'platform' },
+  });
+  const user = await prisma.user.upsert({
+    where: { username },
+    update: {
+      email,
+      displayName: '生产平台管理员',
+      passwordHash: hashPassword(password),
+      status: 'active',
+      failedLoginCount: 0,
+      lockedUntil: null,
+      deletedAt: null,
+      tenantId: null,
+    },
+    create: {
+      username,
+      email,
+      displayName: '生产平台管理员',
+      passwordHash: hashPassword(password),
+      status: 'active',
+    },
+  });
+  await prisma.userRole.upsert({
+    where: { userId_roleId: { userId: user.id, roleId: role.id } },
+    update: {},
+    create: { userId: user.id, roleId: role.id },
+  });
+
+  const message = [
+    'CMPP production admin account',
+    `username=${username}`,
+    `email=${email}`,
+    `password=${password}`,
+    `generatedAt=${new Date().toISOString()}`,
+    '',
+  ].join('\n');
+  if (credentialFile) {
+    writeFileSync(credentialFile, message, { mode: 0o600 });
+  }
+  console.log(`Production admin is ready: ${email}`);
+  if (!credentialFile) {
+    console.log(`Temporary password: ${password}`);
+  }
+}
+
+main()
+  .finally(() => prisma.$disconnect())
+  .catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });