platforms/backend/api/internal/initdb/platform.go

package initdb

import (
	"errors"
	"os"

	"git.apinb.com/heqiapp/platforms/backend/api/internal/logic/common"
	"git.apinb.com/heqiapp/platforms/backend/api/internal/models"
	"golang.org/x/crypto/bcrypt"
	"gorm.io/gorm"
)

const (
	// PlatformRootUsername 是平台总后台的内置根账号名称。
	PlatformRootUsername = "root"
	// PlatformRootPassword 是仅用于首次启动的初始密码，首次登录后必须修改。
	PlatformRootPassword = "Heqi@Root2026"
	// PlatformRootRoleCode 表示根账号的平台角色。
	PlatformRootRoleCode = "root"
)

// InitPlatformAccess 幂等初始化 root 角色；菜单定义位于逻辑层静态数据中。
func InitPlatformAccess(database *gorm.DB) error {
	rootRole := models.PlatformRole{
		Entity:        models.Entity{Identity: models.NewIdentity(), Status: common.StatusEnable},
		RoleCode:      PlatformRootRoleCode,
		Name:          "系统管理员",
		LocationScope: "precise",
		IsSystem:      true,
	}
	return database.Where("role_code = ?", rootRole.RoleCode).FirstOrCreate(&rootRole).Error
}

// InitPlatformRoot 幂等创建平台总后台 root 账号。
func InitPlatformRoot(database *gorm.DB) error {
	var account models.PlatformAccount
	err := database.Where("username = ?", PlatformRootUsername).First(&account).Error
	if err == nil {
		return nil
	}
	if !errors.Is(err, gorm.ErrRecordNotFound) {
		return err
	}

	passwordHash, err := bcrypt.GenerateFromPassword([]byte(platformRootPassword()), bcrypt.DefaultCost)
	if err != nil {
		return err
	}

	account = models.PlatformAccount{
		Entity:           models.Entity{Identity: models.NewIdentity(), Status: common.StatusEnable},
		Username:         PlatformRootUsername,
		DisplayName:      "平台根管理员",
		PasswordHash:     string(passwordHash),
		PlatformRoleCode: PlatformRootRoleCode,
		Phone:            "",
	}
	return database.Create(&account).Error
}

// platformRootPassword 优先读取部署环境传入的 root 初始密码。
func platformRootPassword() string {
	if password := os.Getenv("HEQI_PLATFORM_ROOT_PASSWORD"); common.IsValidAccountPassword(password) {
		return password
	}
	return PlatformRootPassword
}