feat: 商户 qqflow 流程管理员账号脚本（scrm_service/智和诚/威马/五菱新事业）

与 wl-scrm 侧 qqflow_tenant_account 绑定脚本成对使用，幂等可重复执行。

Co-Authored-By: Claude <noreply@anthropic.com>

sql/20261027_qqflow_create_scrm_service_account.sql

@@ -0,0 +1,129 @@
+-- =====================================================================
+-- 为 wl-scrm 后端创建 qqflow 专用服务账号
+--
+-- 执行库：qqflow 审批引擎库（qqflowengine）
+-- 用途：wl-scrm 后端内部调用 qqflow（发起/撤回审批、同步进度、
+--       审批人配置页「同步选中」创建审批人账号/绑定企微）
+--
+-- 为什么需要 super_admin：
+--   · POST /system/user（创建审批人账号）要求 super_admin 或 dept_manager；
+--   · PUT /system/user/{id}/wecom（给已有账号补绑企微）仅允许 super_admin；
+--   · 只授 flow_manager 时，「同步选中」会报「权限不足，无法访问」。
+--
+-- 账号约定：
+--   username = scrm_service
+--   password = 自定义强密码（与 wl-scrm 外置配置 qqflow.service.password 一致）
+--
+-- qqflow 密码使用 BCrypt 存储，先生成哈希再替换下面的占位符：
+--   htpasswd -bnBC 10 "" '你的密码' | tr -d ':\n'
+--
+-- 注意：
+--   · 本脚本创建的是高权限服务账号，密码只放 wl-scrm 服务端外置配置，
+--     不要提交仓库、不要发到群里；
+--   · 脚本幂等：重复执行会重置该账号密码并补齐 super_admin 角色；
+--   · 如果 username 已被无关账号占用，第 0 步会先查出来，切勿直接覆盖。
+-- =====================================================================
+
+-- 执行前确认当前库：必须是 qqflowengine。
+-- 如果在 wlscrmcenter 或测试库执行，生产 qqflow 里不会出现这个账号。
+SELECT DATABASE() AS current_database;
+
+SET @service_username = 'scrm_service';
+-- 替换为 htpasswd 生成的 BCrypt 哈希（60 位，$2a$/$2b$/$2y$ 开头）
+SET @service_password_hash = '<替换为 BCrypt 哈希>';
+SET @super_admin_role_code = 'super_admin';
+
+-- 0) 执行前检查：用户名是否已被占用
+--    有结果时先确认是不是本次要重置的账号；如果是别人在用的账号，请换一个 username。
+SELECT id, username, real_name, employee_type, status
+FROM sys_user
+WHERE username COLLATE utf8mb4_general_ci = @service_username COLLATE utf8mb4_general_ci;
+
+-- 1) 校验 super_admin 角色存在且启用
+--    生产当前应有 id=1 的 super_admin；若没有，请先确认 qqflow 角色模型，不要继续。
+SELECT id, role_code, role_name, role_scope, status
+FROM sys_role
+WHERE role_code COLLATE utf8mb4_general_ci = @super_admin_role_code COLLATE utf8mb4_general_ci;
+
+-- 2.1) 更新已有账号（仅限本脚本管理的账号）
+--       只有 real_name 或 employee_type 对得上才更新，避免误改同名但无关的账号
+UPDATE sys_user
+SET password = @service_password_hash,
+    real_name = 'SCRM 服务账号',
+    employee_type = @super_admin_role_code,
+    status = 0,
+    wecom_user_id = NULL,
+    wecom_remind_enabled = 0,
+    update_time = NOW()
+WHERE username COLLATE utf8mb4_general_ci = @service_username COLLATE utf8mb4_general_ci
+  AND (real_name = 'SCRM 服务账号' OR employee_type = @super_admin_role_code);
+
+-- 2.2) 不存在则创建
+--      若 username 已被无关账号占用，这里不会插入；第 0 步/第 4 步会显示
+--      该账号的原状态，此时不要继续，换一个 username 后重跑。
+INSERT INTO sys_user
+    (username, password, real_name, dept_id, employee_type, status, wecom_remind_enabled)
+SELECT @service_username, @service_password_hash, 'SCRM 服务账号', NULL,
+       @super_admin_role_code, 0, 0
+FROM DUAL
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @service_username COLLATE utf8mb4_general_ci
+);
+
+-- 3) 绑定 super_admin 角色（接口鉴权使用）
+--    只取「本脚本管理的账号」：如果 username 被无关账号占用，这里取不到 id，
+--    不会给无关账号误绑 super_admin；校验结果会显示该账号仍是原 employee_type。
+SET @service_user_id = (
+    SELECT id FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @service_username COLLATE utf8mb4_general_ci
+      AND (real_name = 'SCRM 服务账号' OR employee_type = @super_admin_role_code)
+    LIMIT 1
+);
+SET @super_admin_role_id = (
+    SELECT id FROM sys_role
+    WHERE role_code COLLATE utf8mb4_general_ci = @super_admin_role_code COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+INSERT INTO sys_user_role (user_id, role_id)
+SELECT @service_user_id, @super_admin_role_id
+WHERE @service_user_id IS NOT NULL
+  AND @super_admin_role_id IS NOT NULL
+  AND NOT EXISTS (
+      SELECT 1 FROM sys_user_role
+      WHERE user_id = @service_user_id
+        AND role_id = @super_admin_role_id
+  );
+
+-- 4) 校验：应返回 1 行：
+--    employee_type=super_admin、role_code=super_admin、
+--    pwd_len=60、pwd_prefix=$2a$/$2b$/$2y$（不是 60 位说明哈希没替换/复制错）
+SELECT u.id            AS user_id,
+       u.username,
+       u.employee_type,
+       u.status        AS user_status,
+       CHAR_LENGTH(u.password) AS pwd_len,
+       LEFT(u.password, 4)     AS pwd_prefix,
+       r.id            AS role_id,
+       r.role_code,
+       r.role_name,
+       r.status        AS role_status
+FROM sys_user u
+LEFT JOIN sys_user_role ur ON ur.user_id = u.id
+LEFT JOIN sys_role r ON r.id = ur.role_id
+WHERE u.username COLLATE utf8mb4_general_ci = @service_username COLLATE utf8mb4_general_ci;
+
+-- =====================================================================
+-- 执行后还需要在 wl-scrm 生产外置配置（config/application-prod.properties
+-- 或环境变量）中配置，并重启 wl-scrm：
+--
+--   qqflow.service.username=scrm_service
+--   qqflow.service.password=<与上面的明文密码一致>
+--
+-- 如果之前用过其它服务账号，清掉 wl-scrm Redis 中的旧 token（JWT 角色是
+-- 登录时写入的，缓存 23 小时；改密码/改角色后必须清）：
+--
+--   redis-cli DEL "TOKEN:QQFLOW:SERVICE:default:scrm_service"
+--   redis-cli DEL "TOKEN:QQFLOW:SERVICE:default:<旧账号>"
+-- =====================================================================

sql/20261028_qqflow_create_zhc_wm_merchant_accounts.sql

@@ -0,0 +1,165 @@
+-- =====================================================================
+-- 为「四川智和诚」「湖北威马」商户创建 qqflow 流程管理员账号
+--
+-- 执行库：qqflow 审批引擎库（qqflowengine）
+-- 执行顺序：先执行本脚本，再在 wl-scrm 库执行
+--           wl-scrm-center/sql/20261028_wlscrm_bind_zhc_wm_qqflow_accounts.sql
+--
+-- 账号约定（两个脚本必须一致）：
+--   四川智和诚  username = zhc_flow，明文密码 = zhc123456
+--   湖北威马    username = wm_flow ，明文密码 = wm123456
+--
+-- qqflow 密码使用 BCrypt 存储，哈希由下列命令生成（勿替换成明文）：
+--   htpasswd -bnBC 10 "" 'zhc123456' | tr -d ':\n'
+--   htpasswd -bnBC 10 "" 'wm123456'  | tr -d ':\n'
+--
+-- 说明：
+--   · qqflow 前端菜单看 sys_user.employee_type，必须为 flow_manager；
+--   · qqflow 后端接口 @PreAuthorize 看 sys_user_role → sys_role.role_code，
+--     必须同时绑定 flow_manager 角色（本脚本会补齐）；
+--   · 脚本幂等：重复执行会重置账号密码并补齐角色，不会重复插入。
+-- =====================================================================
+
+-- 执行前确认当前库：必须是 qqflowengine。
+SELECT DATABASE() AS current_database;
+
+-- -------------------------------------------------------------------
+-- 0) 公共准备：确保 flow_manager 角色存在且启用
+-- -------------------------------------------------------------------
+INSERT INTO sys_role (role_code, role_name, role_scope, parent_id, dept_id, status)
+SELECT 'flow_manager', '流程管理员', 'tenant', 0, 0, 1
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_role
+    WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci
+);
+
+UPDATE sys_role
+SET status = 1
+WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci;
+
+SET @flow_manager_role_id = (
+    SELECT id FROM sys_role
+    WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+-- =====================================================================
+-- 1) 四川智和诚（tenancy_id = 119304923710091）
+-- =====================================================================
+SET @username = 'zhc_flow';
+SET @password_hash = '$2y$10$PffgaT28otYLtLyo5nftKOoQW8Rl9PekZKJDGVXnb9klH1LeoUcUa';
+SET @real_name = '四川智和诚流程管理员';
+
+-- 1.0 执行前检查：用户名是否已被占用
+--     有结果时先确认是不是本次要重置的账号；如果是别人在用的账号，请换一个 username。
+SELECT id, username, real_name, employee_type, status
+FROM sys_user
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci;
+
+-- 1.1 更新已有账号（仅限本脚本管理的账号）
+--     只有 real_name 或 employee_type 对得上才更新，避免误改同名但无关的账号
+UPDATE sys_user
+SET password = @password_hash,
+    real_name = @real_name,
+    employee_type = 'flow_manager',
+    status = 0,
+    update_time = NOW()
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+  AND (real_name = @real_name OR employee_type = 'flow_manager');
+
+-- 1.2 不存在则创建
+--     若 username 已被无关账号占用，这里会因唯一键失败而中断（第 1.0 步会先提示）
+INSERT INTO sys_user
+    (username, password, real_name, dept_id, employee_type, status, wecom_remind_enabled)
+SELECT @username, @password_hash, @real_name, 0, 'flow_manager', 0, 0
+FROM DUAL
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+);
+
+-- 1.3 绑定 flow_manager 角色（后端接口鉴权使用）
+SET @user_id = (
+    SELECT id FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+INSERT INTO sys_user_role (user_id, role_id)
+SELECT @user_id, @flow_manager_role_id
+WHERE @user_id IS NOT NULL
+  AND @flow_manager_role_id IS NOT NULL
+  AND NOT EXISTS (
+      SELECT 1 FROM sys_user_role
+      WHERE user_id = @user_id
+        AND role_id = @flow_manager_role_id
+  );
+
+-- =====================================================================
+-- 2) 湖北威马（tenancy_id = 119306205010001）
+-- =====================================================================
+SET @username = 'wm_flow';
+SET @password_hash = '$2y$10$9EIvGo/0AFwdrPzglk9OBuLXRzyfowiI4nzm8Gx1euh1ZDkN05vyq';
+SET @real_name = '湖北威马流程管理员';
+
+-- 2.0 执行前检查：用户名是否已被占用
+SELECT id, username, real_name, employee_type, status
+FROM sys_user
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci;
+
+-- 2.1 更新已有账号（仅限本脚本管理的账号）
+UPDATE sys_user
+SET password = @password_hash,
+    real_name = @real_name,
+    employee_type = 'flow_manager',
+    status = 0,
+    update_time = NOW()
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+  AND (real_name = @real_name OR employee_type = 'flow_manager');
+
+-- 2.2 不存在则创建
+INSERT INTO sys_user
+    (username, password, real_name, dept_id, employee_type, status, wecom_remind_enabled)
+SELECT @username, @password_hash, @real_name, 0, 'flow_manager', 0, 0
+FROM DUAL
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+);
+
+-- 2.3 绑定 flow_manager 角色
+SET @user_id = (
+    SELECT id FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+INSERT INTO sys_user_role (user_id, role_id)
+SELECT @user_id, @flow_manager_role_id
+WHERE @user_id IS NOT NULL
+  AND @flow_manager_role_id IS NOT NULL
+  AND NOT EXISTS (
+      SELECT 1 FROM sys_user_role
+      WHERE user_id = @user_id
+        AND role_id = @flow_manager_role_id
+  );
+
+-- =====================================================================
+-- 3) 校验：应返回 2 行，employee_type 均为 flow_manager，
+--    role_code 均为 flow_manager，pwd_len=60、pwd_prefix=$2y$
+-- =====================================================================
+SELECT u.id            AS user_id,
+       u.username,
+       u.employee_type,
+       u.status        AS user_status,
+       CHAR_LENGTH(u.password) AS pwd_len,
+       LEFT(u.password, 4)     AS pwd_prefix,
+       r.id            AS role_id,
+       r.role_code,
+       r.role_name,
+       r.status        AS role_status
+FROM sys_user u
+LEFT JOIN sys_user_role ur ON ur.user_id = u.id
+LEFT JOIN sys_role r ON r.id = ur.role_id
+WHERE u.username COLLATE utf8mb4_general_ci IN ('zhc_flow', 'wm_flow')
+ORDER BY u.username;

sql/20261030_qqflow_create_wlxsy_merchant_account.sql

@@ -0,0 +1,114 @@
+-- =====================================================================
+-- 为「五菱新事业」商户创建 qqflow 流程管理员账号
+--
+-- 执行库：qqflow 审批引擎库（qqflowengine）
+-- 执行顺序：先执行本脚本，再在 wl-scrm 库执行
+--           wl-scrm-center/sql/20261030_wlscrm_bind_wlxsy_qqflow_account.sql
+--
+-- 账号约定（两个脚本必须一致）：
+--   五菱新事业  username = wlxsy_flow，明文密码 = wlxsy123456
+--
+-- qqflow 密码使用 BCrypt 存储，哈希由下列命令生成（勿替换成明文）：
+--   htpasswd -bnBC 10 "" 'wlxsy123456' | tr -d ':\n'
+--
+-- 说明：
+--   · qqflow 前端菜单看 sys_user.employee_type，必须为 flow_manager；
+--   · qqflow 后端接口 @PreAuthorize 看 sys_user_role → sys_role.role_code，
+--     必须同时绑定 flow_manager 角色（本脚本会补齐）；
+--   · 脚本幂等：重复执行会重置账号密码并补齐角色，不会重复插入。
+-- =====================================================================
+
+-- 执行前确认当前库：必须是 qqflowengine。
+SELECT DATABASE() AS current_database;
+
+-- -------------------------------------------------------------------
+-- 0) 公共准备：确保 flow_manager 角色存在且启用
+-- -------------------------------------------------------------------
+INSERT INTO sys_role (role_code, role_name, role_scope, parent_id, dept_id, status)
+SELECT 'flow_manager', '流程管理员', 'tenant', 0, 0, 1
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_role
+    WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci
+);
+
+UPDATE sys_role
+SET status = 1
+WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci;
+
+SET @flow_manager_role_id = (
+    SELECT id FROM sys_role
+    WHERE role_code COLLATE utf8mb4_general_ci = 'flow_manager' COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+-- =====================================================================
+-- 1) 五菱新事业（tenancy_id = 118216101210041）
+-- =====================================================================
+SET @username = 'wlxsy_flow';
+SET @password_hash = '$2y$10$2IxmPKN7vqGy4tW32jxFYeMixOBZls4NEiAnz/WDfpUwoiezWp9n.';
+SET @real_name = '五菱新事业流程管理员';
+
+-- 1.0 执行前检查：用户名是否已被占用
+--     有结果时先确认是不是本次要重置的账号；如果是别人在用的账号，请换一个 username。
+SELECT id, username, real_name, employee_type, status
+FROM sys_user
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci;
+
+-- 1.1 更新已有账号（仅限本脚本管理的账号）
+--     只有 real_name 或 employee_type 对得上才更新，避免误改同名但无关的账号
+UPDATE sys_user
+SET password = @password_hash,
+    real_name = @real_name,
+    employee_type = 'flow_manager',
+    status = 0,
+    update_time = NOW()
+WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+  AND (real_name = @real_name OR employee_type = 'flow_manager');
+
+-- 1.2 不存在则创建
+--     若 username 已被无关账号占用，这里会因唯一键失败而中断（第 1.0 步会先提示）
+INSERT INTO sys_user
+    (username, password, real_name, dept_id, employee_type, status, wecom_remind_enabled)
+SELECT @username, @password_hash, @real_name, 0, 'flow_manager', 0, 0
+FROM DUAL
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+);
+
+-- 1.3 绑定 flow_manager 角色（后端接口鉴权使用）
+SET @user_id = (
+    SELECT id FROM sys_user
+    WHERE username COLLATE utf8mb4_general_ci = @username COLLATE utf8mb4_general_ci
+    LIMIT 1
+);
+
+INSERT INTO sys_user_role (user_id, role_id)
+SELECT @user_id, @flow_manager_role_id
+WHERE @user_id IS NOT NULL
+  AND @flow_manager_role_id IS NOT NULL
+  AND NOT EXISTS (
+      SELECT 1 FROM sys_user_role
+      WHERE user_id = @user_id
+        AND role_id = @flow_manager_role_id
+  );
+
+-- =====================================================================
+-- 2) 校验：应返回 1 行，employee_type 为 flow_manager，
+--    role_code 为 flow_manager，pwd_len=60、pwd_prefix=$2y$
+-- =====================================================================
+SELECT u.id            AS user_id,
+       u.username,
+       u.employee_type,
+       u.status        AS user_status,
+       CHAR_LENGTH(u.password) AS pwd_len,
+       LEFT(u.password, 4)     AS pwd_prefix,
+       r.id            AS role_id,
+       r.role_code,
+       r.role_name,
+       r.status        AS role_status
+FROM sys_user u
+LEFT JOIN sys_user_role ur ON ur.user_id = u.id
+LEFT JOIN sys_role r ON r.id = ur.role_id
+WHERE u.username COLLATE utf8mb4_general_ci = 'wlxsy_flow'
+ORDER BY u.username;