fix: project overseas authorization outside jwt

lastleg-service/src/main/resources/application.yml

@@ -82,7 +82,7 @@ baiyue:
   security:
     internal-service-token: ${INTERNAL_SERVICE_TOKEN:}
     jwt-mode: jwks
-    session-mode: claims
+    session-mode: gateway
     issuer: ${JWT_ISSUER:auth-service}
     audience: ${JWT_AUDIENCE:lastleg-api}
     jwk-set-uri: ${JWT_JWK_SET_URI:http://127.0.0.1:9100/api/auth/.well-known/jwks.json}

lastleg-service/src/main/resources/db/lastleg.sql

@@ -1871,6 +1871,8 @@ CREATE TABLE IF NOT EXISTS ll_security_projection (
   tenant_id BIGINT NOT NULL COMMENT '平台0或客户ID',
   security_status VARCHAR(24) NULL COMMENT '当前安全状态：ACTIVE或DISABLED',
   permission_version BIGINT NULL COMMENT '当前单调权限版本',
+  roles_json JSON NOT NULL COMMENT 'IAM投影的当前角色快照',
+  authorities_json JSON NOT NULL COMMENT 'IAM投影的当前海外权限快照',
   aggregate_version BIGINT NOT NULL COMMENT '事件聚合单调版本',
   payload_hash CHAR(64) NOT NULL COMMENT '当前版本载荷哈希',
   last_event_id VARCHAR(64) NOT NULL COMMENT '最后应用的事件ID',
@@ -1883,12 +1885,12 @@ CREATE TABLE IF NOT EXISTS ll_security_projection (
 
 -- 开发基线固定管理员；后续真实 IAM 事件从 aggregate_version=1 单调覆盖该 version=0 投影。
 INSERT IGNORE INTO ll_security_projection (
-  aggregate_type,aggregate_id,tenant_id,security_status,permission_version,aggregate_version,
+  aggregate_type,aggregate_id,tenant_id,security_status,permission_version,roles_json,authorities_json,aggregate_version,
   payload_hash,last_event_id,changed_at,updated_at
 ) VALUES
-  ('USER','1000001',0,'ACTIVE',0,0,SHA2('lastleg-baseline:platform_admin:USER:0',256),
+  ('USER','1000001',0,'ACTIVE',0,JSON_ARRAY(),JSON_ARRAY(),0,SHA2('lastleg-baseline:platform_admin:USER:0',256),
    'baseline-platform-admin-user-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000'),
-  ('AUTHORIZATION','1000001',0,NULL,0,0,SHA2('lastleg-baseline:platform_admin:AUTHORIZATION:0',256),
+  ('AUTHORIZATION','1000001',0,NULL,0,JSON_ARRAY(),JSON_ARRAY(),0,SHA2('lastleg-baseline:platform_admin:AUTHORIZATION:0',256),
    'baseline-platform-admin-authorization-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000');