优化

iam/src/main/resources/db/iam.sql

@@ -12,6 +12,7 @@ CREATE TABLE IF NOT EXISTS iam_tenant (
   tenant_type VARCHAR(20) NOT NULL DEFAULT 'MERCHANT' COMMENT '租户类型',
   status VARCHAR(20) NOT NULL DEFAULT 'PROFILE_REQUIRED' COMMENT '租户状态：PROFILE_REQUIRED、PENDING、ACTIVE、REJECTED、DISABLED',
   legal_name VARCHAR(128) NULL COMMENT '企业法定名称',
+  legal_representative VARCHAR(64) NULL COMMENT '法定代表人',
   unified_social_credit_code VARCHAR(32) NULL COMMENT '统一社会信用代码',
   contact_name VARCHAR(64) NULL COMMENT '企业联系人',
   contact_phone VARCHAR(32) NULL COMMENT '联系电话',

iam/src/main/resources/db/phase1-admin-rbac.sql

@@ -79,7 +79,6 @@ VALUES
   (5104000, 0, 'PLATFORM', 'MENU', 0, 'platform:audit', '审计管理', '/audit', NULL, 50, 'ACTIVE', 0),
 -- Platform: level-two menus.
   (5100010, 0, 'PLATFORM', 'MENU', 5100000, 'platform:customer:list', '企业客户', '/customers/list', NULL, 10, 'ACTIVE', 0),
-  (5100020, 0, 'PLATFORM', 'MENU', 5100000, 'platform:customer:review', '企业审核', '/customers/reviews', NULL, 20, 'ACTIVE', 0),
   (5101010, 0, 'PLATFORM', 'MENU', 5101000, 'platform:user:list', '内部用户', '/system/users', NULL, 10, 'ACTIVE', 0),
   (5101020, 0, 'PLATFORM', 'MENU', 5101000, 'platform:role:list', '角色管理', '/system/roles', NULL, 20, 'ACTIVE', 0),
   (5101030, 0, 'PLATFORM', 'MENU', 5101000, 'platform:permission:list', '菜单按钮', '/system/permissions', NULL, 30, 'ACTIVE', 0),
@@ -91,6 +90,7 @@ VALUES
   (5103040, 0, 'PLATFORM', 'MENU', 5103000, 'platform:download:list', '下载中心', '/downloads', NULL, 40, 'ACTIVE', 0),
   (5104010, 0, 'PLATFORM', 'MENU', 5104000, 'platform:audit:list', '操作日志', '/audit/logs', NULL, 10, 'ACTIVE', 0),
 -- Platform: buttons.
+  (5100020, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:review', '客户审核', NULL, NULL, 50, 'ACTIVE', 0),
   (5100021, 0, 'PLATFORM', 'BUTTON', 5100020, 'platform:customer:approve', '审核通过', NULL, NULL, 10, 'ACTIVE', 0),
   (5100022, 0, 'PLATFORM', 'BUTTON', 5100020, 'platform:customer:reject', '审核驳回', NULL, NULL, 20, 'ACTIVE', 0),
   (5100015, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:export', '导出企业客户', NULL, NULL, 40, 'ACTIVE', 0),

iam/src/main/resources/db/phase1-onboarding.sql

@@ -25,6 +25,7 @@ DELIMITER ;
 CALL phase1_iam_add_column('iam_tenant', 'approved_at', "DATETIME(3) NULL COMMENT 'Approval time'");
 CALL phase1_iam_add_column('iam_tenant', 'approved_by', "BIGINT NULL COMMENT 'Reviewer ID'");
 CALL phase1_iam_add_column('iam_tenant', 'reject_reason', "VARCHAR(500) NULL COMMENT 'Rejection reason'");
+CALL phase1_iam_add_column('iam_tenant', 'legal_representative', "VARCHAR(64) NULL COMMENT '法定代表人' AFTER legal_name");
 CALL phase1_iam_add_column('iam_tenant_qualification', 'review_comment', "VARCHAR(500) NULL COMMENT 'Review comment'");
 CALL phase1_iam_add_column('iam_membership', 'created_by', "BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Creator ID'");
 CALL phase1_iam_add_column('iam_membership', 'updated_by', "BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Updater ID'");
@@ -55,11 +56,17 @@ ON DUPLICATE KEY UPDATE
   permission_name=VALUES(permission_name), route_path=VALUES(route_path),
   parent_id=VALUES(parent_id), sort_no=VALUES(sort_no), status='ACTIVE', deleted=0;
 
-INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000100, id, 0
-FROM iam_permission
-WHERE app_code='MERCHANT' AND tenant_id=0
-  AND permission_type IN ('MENU','BUTTON') AND status='ACTIVE' AND deleted=0;
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT owner_role.id, permission.id, 0
+FROM iam_role owner_role
+JOIN iam_permission permission
+  ON permission.app_code='MERCHANT' AND permission.tenant_id=0
+ AND permission.permission_type IN ('MENU','BUTTON')
+ AND permission.status='ACTIVE' AND permission.deleted=0
+WHERE owner_role.tenant_id=0 AND owner_role.app_code='MERCHANT'
+  AND owner_role.role_code='MERCHANT_OWNER'
+  AND owner_role.status='ACTIVE' AND owner_role.deleted=0
+ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);
 
 -- 不再写入伪造的资质 URL。资质必须先由 File 服务保存真实图片，再由 IAM 记录文件地址和审核结果。
 -- 已部署环境中的 /phase1-seed/ 历史记录按 docs/企业资质文件迁移说明.md 处理，本脚本不得将其改成不存在的 UUID。

iam/src/main/resources/openapi/iam-v1.yaml

@@ -173,7 +173,7 @@ paths:
     post:
       tags: [Platform Tenant / 平台租户]
       summary: Approve enterprise registration / 审核通过企业注册
-      description: Approve a pending review and activate the tenant. / 通过待审核申请并激活企业租户。
+      description: Approve and activate the tenant. Client registrations keep the registration account as administrator. Only platform-created tenants without an owner receive a generated administrator and one-time credentials. / 审核通过并激活企业；客户端注册账号继续作为企业管理员，仅平台代建且没有所有者的企业自动创建管理员并返回一次性凭据。
       parameters:
         - {$ref: '#/components/parameters/Id'}
       requestBody:
@@ -182,7 +182,11 @@ paths:
           application/json:
             schema: {$ref: '#/components/schemas/ReviewRequest'}
       responses:
-        '200': {$ref: '#/components/responses/Success'}
+        '200':
+          description: 审核通过；data 返回开户结果及一次性初始凭据
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/TenantApprovalApiResponse'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '404': {$ref: '#/components/responses/NotFound'}
         '409': {$ref: '#/components/responses/Conflict'}
@@ -595,6 +599,41 @@ paths:
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /internal/exports/v1/CUSTOMER_LIST/batches:
+    post:
+      tags: [Internal Export Provider]
+      summary: 分批提供企业客户导出数据
+      description: 仅供 File Service 调用；按平台访问域、签名最大 ID 快照和游标只读查询商户客户。
+      security: []
+      parameters:
+        - name: X-Internal-Service-Token
+          in: header
+          required: true
+          schema: {type: string}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [taskId, tenantId, appCode, requestedBy, dispatchVersion, parameters, limit]
+              properties:
+                taskId: {type: string, pattern: '^\d+$'}
+                tenantId: {type: string, pattern: '^\d+$'}
+                appCode: {type: string, enum: [PLATFORM]}
+                requestedBy: {type: string, pattern: '^\d+$'}
+                dispatchVersion: {type: integer, minimum: 1}
+                parameters: {type: object}
+                cursor: {type: string, nullable: true}
+                snapshotToken: {type: string, nullable: true, maxLength: 512}
+                limit: {type: integer, minimum: 1, maximum: 500}
+      responses:
+        '200':
+          description: 统一响应；data 为 ExportBatchResponse，Long 值以字符串传输
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/ApiResponse'}
+        '403': {$ref: '#/components/responses/Forbidden'}
 components:
   securitySchemes:
     bearerAuth:
@@ -677,6 +716,20 @@ components:
                 size: {type: integer, format: int64, minimum: 1}
                 total: {type: integer, format: int64, minimum: 0}
                 pages: {type: integer, format: int64, minimum: 0}
+    TenantApprovalApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data: {$ref: '#/components/schemas/TenantApprovalResponse'}
+    TenantApprovalResponse:
+      type: object
+      required: [tenantId, administratorCreated]
+      properties:
+        tenantId: {type: string, pattern: '^\d+$', example: '190000000000000001'}
+        administratorCreated: {type: boolean, description: 本次审核是否新建企业管理员}
+        administratorUsername: {type: string, nullable: true, example: merchant_190000000000000001_k3mnpqrs}
+        temporaryPassword: {type: string, format: password, nullable: true, description: 一次性初始密码，仅新建管理员时返回}
     TenantApiResponse:
       allOf:
         - {$ref: '#/components/schemas/ApiResponse'}
@@ -704,6 +757,7 @@ components:
         tenantName: {type: string}
         status: {type: string, enum: [PROFILE_REQUIRED, PENDING, ACTIVE, REJECTED, DISABLED]}
         legalName: {type: string}
+        legalRepresentative: {type: string, maxLength: 64}
         unifiedSocialCreditCode: {type: string}
         contactName: {type: string}
         contactPhone: {type: string}
@@ -763,10 +817,11 @@ components:
         reviewComment: {type: string}
     RegisterRequest:
       type: object
-      required: [tenantName, legalName, unifiedSocialCreditCode, contactName, contactPhone, servicePackage]
+      required: [tenantName, legalName, legalRepresentative, unifiedSocialCreditCode, contactName, contactPhone, servicePackage]
       properties:
         tenantName: {type: string, example: 深圳虫虫出海科技有限公司}
-        legalName: {type: string, example: 张三}
+        legalName: {type: string, example: 深圳虫虫出海科技有限公司}
+        legalRepresentative: {type: string, maxLength: 64, example: 张三}
         unifiedSocialCreditCode: {type: string, pattern: '^[0-9A-Z]{18}$', example: 91440300MA5ABCDE12}
         contactName: {type: string, example: 李四}
         contactPhone: {type: string, example: '13800138000'}
@@ -783,19 +838,21 @@ components:
         internalRemark: {type: string, maxLength: 1000}
     UpdateProfileRequest:
       type: object
-      required: [tenantName, legalName, contactName, contactPhone, servicePackage]
+      required: [tenantName, legalName, legalRepresentative, contactName, contactPhone]
       properties:
         tenantName: {type: string}
         legalName: {type: string}
+        legalRepresentative: {type: string, maxLength: 64}
         contactName: {type: string}
         contactPhone: {type: string}
         contactEmail: {type: string, format: email}
     UpdateTenantRequest:
       type: object
-      required: [tenantName, legalName, contactName, contactPhone]
+      required: [tenantName, legalName, legalRepresentative, contactName, contactPhone]
       properties:
         tenantName: {type: string}
         legalName: {type: string}
+        legalRepresentative: {type: string, maxLength: 64}
         contactName: {type: string}
         contactPhone: {type: string}
         contactEmail: {type: string, format: email}