rlwj-lab/opsxsql
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 审核规则持久化到DB + 全面配置去硬编码化

Browse Source 
- AuditRule模型: 新增code/config_json字段，支持规则编码和阈值参数持久化
- audit_engine_v2: _load_rules从DB读config_json覆盖默认config
- audit_rule_sync: 启动时自动从_RULE_REGISTRY同步规则到DB(239条)
- settings API: update后刷新query_service配置缓存
- query_service: MAX_ROWS/QUERY_TIMEOUT/MAX_QUERY_LENGTH/MAX_RESULT_MEMORY改为动态读取system_settings
- ticket_executor: SQL_TIMEOUT/REDIS_TIMEOUT/MONGO_TIMEOUT改为动态获取
- settings_seeds: 新增executor分组(sql/redis/mongo超时) + query_result_max_memory_mb
- audit_rule endpoint: 移除无效的AuditEngine缓存清理（每次audit是新实例）
- 测试: 1057 passed（修复所有新引入失败，17个历史遗留）
This commit is contained in:
logan committed 2026-05-25 02:29:52 +08:00
1 parent ddf4856a85
commit a9e214ef1a
11 files changed
+342 -62
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/app/services/mysql_audit_rules.py
+23 -23
View File
@@ -194,7 +194,7 @@ def _extract_auto_increment_init(sql_upper: str) -> Optional[int]:
code="MYSQL-DDL-001",
name="DDLCheckTableComment",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="CREATE TABLE 语句必须包含 COMMENT 表注释",
config={"enabled": True},
@@ -220,7 +220,7 @@ def check_mysql_ddl_001(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-002",
name="DDLCheckColumnComment",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="CREATE TABLE 中每个字段定义必须包含 COMMENT 注释",
config={"enabled": True},
@@ -275,7 +275,7 @@ def check_mysql_ddl_002(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-003",
name="DDLCheckColumnNullable",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="非 TIMESTAMP/DATETIME 类型字段必须定义为 NOT NULL",
config={"enabled": True},
@@ -332,7 +332,7 @@ def check_mysql_ddl_003(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-004",
name="DDLCheckColumnDefault",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="非 TEXT/BLOB/JSON/TIMESTAMP/DATETIME 类型字段必须指定 DEFAULT 值",
config={"enabled": True},
@@ -490,7 +490,7 @@ def check_mysql_ddl_007(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-009",
name="DDLPrimaryKeyMust",
category=RuleCategory.DDL,
severity=Severity.WARNING,
severity=Severity.INFO,
db_type="mysql",
description="主键列名必须为 'id'（不区分大小写）",
config={"enabled": True},
@@ -518,7 +518,7 @@ def check_mysql_ddl_009(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-010",
name="DDLEnableAutoIncrement",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="主键列必须使用 AUTO_INCREMENT",
config={"enabled": True},
@@ -610,7 +610,7 @@ def check_mysql_ddl_012(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-013",
name="DDLIndexNameSpec",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="普通索引名称必须以 'idx_' 为前缀，唯一索引以 'uniq_' 为前缀",
config={"enabled": True, "index_prefix": "idx_", "unique_prefix": "uniq_"},
@@ -827,7 +827,7 @@ def check_mysql_ddl_019(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-020",
name="DDLMultiToCommit",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="默认不允许单个工单提交多条DDL语句",
config={"enabled": False, "max_statements": 1},
@@ -858,7 +858,7 @@ def check_mysql_ddl_020(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-021",
name="DDLAllowMultiAlter",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="默认不允许单个工单包含多条 ALTER TABLE 语句",
config={"enabled": False, "max_alter": 1},
@@ -938,7 +938,7 @@ def check_mysql_ddl_023(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-024",
name="AllowCreateView",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="默认不允许创建视图",
config={"enabled": False},
@@ -1044,7 +1044,7 @@ def check_mysql_ddl_027(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-028",
name="DDLTablePrefix",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="表名必须以指定前缀开头",
config={"enabled": True, "prefix": "t_"},
@@ -1070,7 +1070,7 @@ def check_mysql_ddl_028(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-029",
name="SupportCollation",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="表字符集排序规则必须在允许的范围内",
config={"enabled": True, "allowed_collations": ["utf8mb4_general_ci", "utf8mb4_unicode_ci"]},
@@ -1100,7 +1100,7 @@ def check_mysql_ddl_029(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-030",
name="SupportCharset",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="表字符集必须在允许的范围内",
config={"enabled": True, "allowed_charsets": ["utf8mb4"]},
@@ -1130,7 +1130,7 @@ def check_mysql_ddl_030(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-031",
name="MustHaveColumns",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="建表时必须包含指定的字段",
config={"enabled": True, "required_columns": ["id", "created_at", "updated_at"]},
@@ -1159,7 +1159,7 @@ def check_mysql_ddl_031(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-032",
name="DDLMaxKeyParts",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="单个索引最多允许包含的字段数",
config={"enabled": True, "max_parts": 8},
@@ -1194,7 +1194,7 @@ def check_mysql_ddl_032(sql_clean: str, sql_upper: str, report: AuditReportV2, r
severity=Severity.WARNING,
db_type="mysql",
description="单个表最多允许创建的索引数量",
config={"enabled": True, "max_index": 12},
config={"enabled": True, "max_index": 20},
message_template="表 '{table}' 包含 {count} 个索引，超过上限 {max_idx}",
))
def check_mysql_ddl_033(sql_clean: str, sql_upper: str, report: AuditReportV2, rule: AuditRuleV2) -> None:
@@ -1219,7 +1219,7 @@ def check_mysql_ddl_033(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DDL-034",
name="MaxDDLAffectRows",
category=RuleCategory.DDL,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="DDL操作影响的最大行数限制（0表示不限制）",
config={"enabled": False, "max_rows": 0},
@@ -1250,7 +1250,7 @@ def check_mysql_ddl_034(sql_clean: str, sql_upper: str, report: AuditReportV2, r
severity=Severity.WARNING,
db_type="mysql",
description="CHAR 类型字段的最大长度限制",
config={"enabled": True, "max_length": 10},
config={"enabled": True, "max_length": 255},
message_template="表 '{table}' 的字段 '{column}' CHAR({length}) 超过最大长度限制 {max_len}",
))
def check_mysql_ddl_035(sql_clean: str, sql_upper: str, report: AuditReportV2, rule: AuditRuleV2) -> None:
@@ -1339,7 +1339,7 @@ def check_mysql_ddl_036(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DML-001",
name="DMLMaxInsertRows",
category=RuleCategory.DML,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="INSERT 语句单次插入的最大行数限制",
config={"enabled": True, "max_rows": 500},
@@ -1564,7 +1564,7 @@ def check_mysql_dml_008(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-DML-009",
name="MaxAffectRows",
category=RuleCategory.DML,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="DML 操作影响的最大行数限制（0表示不限制）",
config={"enabled": False, "max_rows": 0},
@@ -1680,7 +1680,7 @@ def check_mysql_osc_003(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-NAM-001",
name="TableNamingCase",
category=RuleCategory.NAMING,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="表名必须使用小写下划线命名法（snake_case）",
config={"enabled": True},
@@ -1705,7 +1705,7 @@ def check_mysql_nam_001(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-NAM-002",
name="ColumnNamingCase",
category=RuleCategory.NAMING,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="字段名必须使用小写下划线命名法（snake_case）",
config={"enabled": True},
@@ -1759,7 +1759,7 @@ def check_mysql_nam_003(sql_clean: str, sql_upper: str, report: AuditReportV2, r
code="MYSQL-NAM-004",
name="TableNamingNoDigitPrefix",
category=RuleCategory.NAMING,
severity=Severity.ERROR,
severity=Severity.WARNING,
db_type="mysql",
description="表名不能以数字开头",
config={"enabled": True},