优化

iam/src/main/resources/db/phase1-onboarding.sql

@@ -25,6 +25,7 @@ DELIMITER ;
 CALL phase1_iam_add_column('iam_tenant', 'approved_at', "DATETIME(3) NULL COMMENT 'Approval time'");
 CALL phase1_iam_add_column('iam_tenant', 'approved_by', "BIGINT NULL COMMENT 'Reviewer ID'");
 CALL phase1_iam_add_column('iam_tenant', 'reject_reason', "VARCHAR(500) NULL COMMENT 'Rejection reason'");
+CALL phase1_iam_add_column('iam_tenant', 'legal_representative', "VARCHAR(64) NULL COMMENT '法定代表人' AFTER legal_name");
 CALL phase1_iam_add_column('iam_tenant_qualification', 'review_comment', "VARCHAR(500) NULL COMMENT 'Review comment'");
 CALL phase1_iam_add_column('iam_membership', 'created_by', "BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Creator ID'");
 CALL phase1_iam_add_column('iam_membership', 'updated_by', "BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT 'Updater ID'");
@@ -55,11 +56,17 @@ ON DUPLICATE KEY UPDATE
   permission_name=VALUES(permission_name), route_path=VALUES(route_path),
   parent_id=VALUES(parent_id), sort_no=VALUES(sort_no), status='ACTIVE', deleted=0;
 
-INSERT IGNORE INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000100, id, 0
-FROM iam_permission
-WHERE app_code='MERCHANT' AND tenant_id=0
-  AND permission_type IN ('MENU','BUTTON') AND status='ACTIVE' AND deleted=0;
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT owner_role.id, permission.id, 0
+FROM iam_role owner_role
+JOIN iam_permission permission
+  ON permission.app_code='MERCHANT' AND permission.tenant_id=0
+ AND permission.permission_type IN ('MENU','BUTTON')
+ AND permission.status='ACTIVE' AND permission.deleted=0
+WHERE owner_role.tenant_id=0 AND owner_role.app_code='MERCHANT'
+  AND owner_role.role_code='MERCHANT_OWNER'
+  AND owner_role.status='ACTIVE' AND owner_role.deleted=0
+ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);
 
 -- 不再写入伪造的资质 URL。资质必须先由 File 服务保存真实图片，再由 IAM 记录文件地址和审核结果。
 -- 已部署环境中的 /phase1-seed/ 历史记录按 docs/企业资质文件迁移说明.md 处理，本脚本不得将其改成不存在的 UUID。