优化

iam/src/main/java/com/baiyue/iam/mapper/AuthorizationQueryMapper.java

@@ -19,6 +19,10 @@ public interface AuthorizationQueryMapper {
           AND u.status = 'ACTIVE' AND u.deleted = 0
           AND m.id = #{membershipId} AND m.tenant_id = #{tenantId}
           AND m.status = 'ACTIVE' AND m.deleted = 0
+          AND (m.tenant_id = 0 OR EXISTS (
+              SELECT 1 FROM iam_tenant t WHERE t.id = m.tenant_id AND t.deleted = 0
+                AND t.status IN ('ACTIVE', 'PROFILE_REQUIRED', 'PENDING', 'REJECTED')
+          ))
         """)
     int countActiveIdentity(@Param("userId") long userId,
                             @Param("tenantId") long tenantId,

iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java

@@ -165,7 +165,7 @@ public class PlatformUserManagementService {
             members.save(membership);
             if (scopeChanged) members.replaceRoles(oldTenantId, membershipId, List.of());
             members.replaceRoles(newTenantId, membershipId, roleIds);
-            if ((rolesChanged || warehouseChanged) && !profileChanged && !scopeChanged) {
+            if ((rolesChanged || warehouseChanged) && !scopeChanged) {
                 call(() -> authClient.revokeSessions(internalToken,
                         new AuthAccountClient.RevokeAccountSessionsRequest(Set.of(user.getAuthUserId()))));
             }

iam/src/main/java/com/baiyue/iam/service/TenantService.java

@@ -423,10 +423,30 @@ public class TenantService {
         }
         tenant.setStatus(request.status());
         repository.saveTenant(tenant);
+        revokeMerchantSessions(tenantId);
         securityEvents.tenantStatus(tenantId, request.status());
         return response(tenant);
     }
 
+    private void revokeMerchantSessions(long tenantId) {
+        List<Long> accounts = memberRepository.findByTenant(tenantId).stream()
+                .map(member -> memberRepository.findUser(member.getUserId()))
+                .filter(java.util.Objects::nonNull).map(IamUser::getAuthUserId)
+                .filter(java.util.Objects::nonNull).distinct().toList();
+        for (int start = 0; start < accounts.size(); start += 200) {
+            Set<Long> batch = Set.copyOf(accounts.subList(start, Math.min(start + 200, accounts.size())));
+            try {
+                ApiResponse<Void> result = authClient.revokeSessions(internalToken,
+                        new AuthAccountClient.RevokeAccountSessionsRequest(batch));
+                if (result == null || !result.successful()) {
+                    throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "客户会话撤销失败，请重试");
+                }
+            } catch (FeignException exception) {
+                throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "客户会话撤销失败，请重试");
+            }
+        }
+    }
+
     @Transactional
     @BusinessAudit(event = "PLATFORM_TENANT_SUBMIT_REVIEW", resourceType = "TENANT", resourceId = "#tenantId",
         description = "平台提交企业客户审核")