feat: 数据源编辑加排除数据库+脱敏字段+审批流关联; 权限组Transfer改为选择实例

- EditInstanceDialog: 新增排除数据库(逗号分隔)、脱敏字段(动态表单+表/字段/规则)、审批流程关联
- Instance: workflow JSON字段改为workflow_id FK关联workflow_definitions表
- InstanceGroupPage: Transfer穿梭框从选数据库改为选实例(数据源)
- 后端instance API返回workflow_name, _get_workflow_names批量查询
- DB迁移: instances表添加workflow_id列
- 37个测试全部通过

backend/app/api/v1/endpoints/instance.py

@@ -19,7 +19,7 @@ from app.services.audit_log_service import AuditLogService
 router = APIRouter(prefix="/instances", tags=["数据源管理"])
 
 
-def _serialize_json_fields(instance: Instance) -> dict:
+def _serialize_json_fields(instance: Instance, workflow_name: str = None) -> dict:
     """将 Instance 的 JSON text 字段反序列化为 dict/list，返回 Response dict"""
     d = {
         "id": instance.id,
@@ -34,7 +34,8 @@ def _serialize_json_fields(instance: Instance) -> dict:
         "status": instance.status,
         "version": instance.version,
         "access_mode": instance.access_mode or "readwrite",
-        "workflow": json.loads(instance.workflow) if instance.workflow else None,
+        "workflow_id": instance.workflow_id,
+        "workflow_name": workflow_name,
         "excluded_databases": json.loads(instance.excluded_databases) if instance.excluded_databases else None,
         "mask_fields": json.loads(instance.mask_fields) if instance.mask_fields else None,
         "created_at": instance.created_at,
@@ -42,6 +43,16 @@ def _serialize_json_fields(instance: Instance) -> dict:
     return d
 
 
+async def _get_workflow_names(db: AsyncSession, instances: list) -> dict:
+    """批量获取 workflow_id -> name 映射"""
+    from app.models.workflow import WorkflowDefinition
+    wids = list({i.workflow_id for i in instances if i.workflow_id})
+    if not wids:
+        return {}
+    result = await db.execute(select(WorkflowDefinition).where(WorkflowDefinition.id.in_(wids)))
+    return {w.id: w.name for w in result.scalars().all()}
+
+
 @router.get("", response_model=List[InstanceResponse])
 async def list_instances(
     db_type: Optional[str] = None,
@@ -71,7 +82,8 @@ async def list_instances(
     
     result = await db.execute(stmt)
     instances = result.scalars().all()
-    return [_serialize_json_fields(i) for i in instances]
+    wnames = await _get_workflow_names(db, instances)
+    return [_serialize_json_fields(i, wnames.get(i.workflow_id)) for i in instances]
 
 
 @router.post("", response_model=InstanceResponse, status_code=201)
@@ -91,7 +103,7 @@ async def create_instance(
         env=data.env,
         description=data.description,
         access_mode=data.access_mode,
-        workflow=json.dumps([s.model_dump() for s in data.workflow], ensure_ascii=False) if data.workflow else None,
+        workflow_id=data.workflow_id,
         excluded_databases=json.dumps(data.excluded_databases, ensure_ascii=False) if data.excluded_databases else None,
         mask_fields=json.dumps([m.model_dump() for m in data.mask_fields], ensure_ascii=False) if data.mask_fields else None,
     )
@@ -104,7 +116,8 @@ async def create_instance(
     )
     await db.commit()
     await db.refresh(instance)
-    return _serialize_json_fields(instance)
+    wnames = await _get_workflow_names(db, [instance])
+    return _serialize_json_fields(instance, wnames.get(instance.workflow_id))
 
 
 @router.post("/test-connection", response_model=ConnectionTestResult)
@@ -133,7 +146,8 @@ async def get_instance(
         raise HTTPException(status_code=404, detail="数据源不存在")
     # P0: 检查访问权限
     await check_instance_access(current_user, instance, db)
-    return _serialize_json_fields(instance)
+    wnames = await _get_workflow_names(db, [instance])
+    return _serialize_json_fields(instance, wnames.get(instance.workflow_id))
 
 
 @router.put("/{instance_id}", response_model=InstanceResponse)
@@ -151,9 +165,9 @@ async def update_instance(
     update_data = data.model_dump(exclude_unset=True)
     if "password" in update_data:
         update_data["password"] = encrypt_password(update_data["password"])
-    # JSON fields
-    if "workflow" in update_data:
-        update_data["workflow"] = json.dumps([s if isinstance(s, dict) else s for s in update_data["workflow"]], ensure_ascii=False) if update_data["workflow"] else None
+    # workflow_id: 0 means clear
+    if "workflow_id" in update_data and update_data["workflow_id"] == 0:
+        update_data["workflow_id"] = None
     if "excluded_databases" in update_data:
         update_data["excluded_databases"] = json.dumps(update_data["excluded_databases"], ensure_ascii=False) if update_data["excluded_databases"] else None
     if "mask_fields" in update_data:
@@ -163,7 +177,8 @@ async def update_instance(
         setattr(instance, key, value)
     await db.commit()
     await db.refresh(instance)
-    return _serialize_json_fields(instance)
+    wnames = await _get_workflow_names(db, [instance])
+    return _serialize_json_fields(instance, wnames.get(instance.workflow_id))
 
 
 @router.delete("/{instance_id}")

backend/app/models/instance.py

@@ -22,7 +22,7 @@ class Instance(Base):
 
     # 新增字段
     access_mode = Column(String(20), default="readwrite")  # readwrite / read / write
-    workflow = Column(Text, nullable=True)  # JSON: [{stage, role, assignee}]
+    workflow_id = Column(Integer, ForeignKey("workflow_definitions.id", ondelete="SET NULL"), nullable=True)
     excluded_databases = Column(Text, nullable=True)  # JSON: ["sys", "information_schema", ...]
     mask_fields = Column(Text, nullable=True)  # JSON: [{table, field, rule}]
 
@@ -34,3 +34,4 @@ class Instance(Base):
 
     # 关系
     group = relationship("InstanceGroup", back_populates="instances")
+    workflow_def = relationship("WorkflowDefinition")

backend/app/schemas/instance.py

@@ -26,7 +26,7 @@ class InstanceCreate(BaseModel):
     env: Literal["production", "staging", "development"] = "development"
     description: Optional[str] = None
     access_mode: Literal["readwrite", "read", "write"] = "readwrite"
-    workflow: Optional[List[WorkflowStage]] = None
+    workflow_id: Optional[int] = Field(None, description="关联的审批流程ID")
     excluded_databases: Optional[List[str]] = None
     mask_fields: Optional[List[MaskFieldRule]] = None
 
@@ -41,7 +41,7 @@ class InstanceUpdate(BaseModel):
     env: Optional[Literal["production", "staging", "development"]] = None
     description: Optional[str] = None
     access_mode: Optional[Literal["readwrite", "read", "write"]] = None
-    workflow: Optional[List[WorkflowStage]] = None
+    workflow_id: Optional[int] = Field(default=None, description="关联的审批流程ID，设为0清除关联")
     excluded_databases: Optional[List[str]] = None
     mask_fields: Optional[List[MaskFieldRule]] = None
 
@@ -59,7 +59,8 @@ class InstanceResponse(BaseModel):
     status: str
     version: Optional[str] = None
     access_mode: str = "readwrite"
-    workflow: Optional[List[dict]] = None
+    workflow_id: Optional[int] = None
+    workflow_name: Optional[str] = None
     excluded_databases: Optional[List[str]] = None
     mask_fields: Optional[List[dict]] = None
     created_at: datetime