From 8d78f8563cf0762f2a68539b860d4baabead4ee6 Mon Sep 17 00:00:00 2001
From: zgw <13623675548@163.com>
Date: Fri, 28 Aug 2026 09:58:58 +0800
Subject: [PATCH] fix(shadow): allow SQL Server encryption metadata permissions

---
 .../shadow/startup/SqlServerPermissionProbe.java     | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/startup/SqlServerPermissionProbe.java b/ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/startup/SqlServerPermissionProbe.java
index e170eab..2387fee 100644
--- a/ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/startup/SqlServerPermissionProbe.java
+++ b/ruoyi-wcs-shadow/src/main/java/com/ruoyi/shadow/startup/SqlServerPermissionProbe.java
@@ -43,6 +43,10 @@ public class SqlServerPermissionProbe {
                     "db_ddladmin", "db_securityadmin", "db_accessadmin");
     private static final List<String> EVIDENCE_TABLE_PERMISSIONS =
             Arrays.asList("SELECT", "INSERT", "UPDATE", "DELETE");
+    private static final List<String> EVIDENCE_METADATA_PERMISSIONS =
+            Arrays.asList("CONNECT",
+                    "VIEW ANY COLUMN ENCRYPTION KEY DEFINITION",
+                    "VIEW ANY COLUMN MASTER KEY DEFINITION");
     private static final String DATABASE_ROLE_MEMBERSHIP_SQL =
             "SELECT role_principal.name AS role_name "
                     + "FROM sys.database_role_members rm "
@@ -253,7 +257,7 @@ public class SqlServerPermissionProbe {
                     "SELECT permission_name FROM fn_my_permissions(NULL, 'DATABASE')")) {
                 while (permissions.next()) {
                     String permission = permissions.getString("permission_name");
-                    if (!"CONNECT".equalsIgnoreCase(permission)) {
+                    if (!isAllowedEvidenceDatabasePermission(permission)) {
                         return PermissionCheckResult.rejected(
                                 "EVIDENCE_HAS_EFFECTIVE_" + reason(permission)
                                         + "_DATABASE_PERMISSION");
@@ -297,6 +301,12 @@ public class SqlServerPermissionProbe {
                 "EVIDENCE_DATABASE_VERIFIED");
     }
 
+    private static boolean isAllowedEvidenceDatabasePermission(
+            String permission) {
+        return permission != null && EVIDENCE_METADATA_PERMISSIONS.contains(
+                permission.trim().toUpperCase(Locale.ROOT));
+    }
+
     private static String sourcePermissionSql() {
         StringBuilder sql = new StringBuilder("SELECT ");
         Set<String> expressions = new LinkedHashSet<String>();