优化

iam/src/main/resources/db/phase1-platform-master-data-and-permission-management.sql

@@ -36,6 +36,9 @@ VALUES
   (5100012, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:edit', '编辑企业客户', 20, 'ACTIVE', 1, 0),
   (5100013, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:status', '启停企业客户', 30, 'ACTIVE', 1, 0),
   (5100015, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:export', '导出企业客户', 40, 'ACTIVE', 1, 0),
+  (5100016, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:reset-password', '重置客户管理员密码', 50, 'ACTIVE', 1, 0),
+  (5100017, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:delete', '归档企业客户', 60, 'ACTIVE', 1, 0),
+  (5100018, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:impersonate', '跳转客户登录', 70, 'ACTIVE', 1, 0),
   (5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 1, 0),
   (5101032, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:edit', '编辑权限资源', 20, 'ACTIVE', 1, 0),
   (5101033, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:status', '启停权限资源', 30, 'ACTIVE', 1, 0),
@@ -58,7 +61,8 @@ SELECT 4000001, id, 0
 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'PLATFORM'
   AND permission_code IN (
-    'platform:customer:edit', 'platform:customer:status', 'platform:user:grant-role',
+    'platform:customer:edit', 'platform:customer:status', 'platform:customer:reset-password',
+    'platform:customer:delete', 'platform:customer:impersonate', 'platform:user:grant-role',
     'platform:permission:edit', 'platform:permission:status', 'platform:permission:delete',
     'platform:express:list', 'platform:express:create', 'platform:express:edit', 'platform:express:status', 'platform:express:import',
     'platform:counterparty:list', 'platform:counterparty:create', 'platform:counterparty:edit', 'platform:counterparty:status',

iam/src/main/resources/db/rbac-role-management-v2.sql

@@ -7,6 +7,9 @@ INSERT INTO iam_permission
    permission_name, sort_no, status, deleted)
 VALUES
   (5100011, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:create', '新增企业客户', 10, 'ACTIVE', 0),
+  (5100016, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:reset-password', '重置客户管理员密码', 50, 'ACTIVE', 0),
+  (5100017, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:delete', '归档企业客户', 60, 'ACTIVE', 0),
+  (5100018, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:impersonate', '跳转客户登录', 70, 'ACTIVE', 0),
   (5101023, 0, 'PLATFORM', 'BUTTON', 5101020, 'platform:role:edit', '编辑角色', 30, 'ACTIVE', 0),
   (5101024, 0, 'PLATFORM', 'BUTTON', 5101020, 'platform:role:status', '启停角色', 40, 'ACTIVE', 0),
   (5101025, 0, 'PLATFORM', 'BUTTON', 5101020, 'platform:role:delete', '删除角色', 50, 'ACTIVE', 0),

iam/src/main/resources/openapi/iam-v1.yaml

@@ -183,6 +183,63 @@ paths:
         '403': {$ref: '#/components/responses/Forbidden'}
         '404': {$ref: '#/components/responses/NotFound'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /api/platform/v1/iam/tenants/{tenantId}/owner/password:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    put:
+      tags: [Platform Tenant / 平台租户]
+      summary: 重置客户企业管理员密码
+      description: 仅重置指定客户 OWNER 的认证密码；密码不写入审计快照并撤销该账号现有会话。
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ResetCustomerOwnerPasswordRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
+  /api/platform/v1/iam/tenants/{tenantId}/archive:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    post:
+      tags: [Platform Tenant / 平台租户]
+      summary: 逻辑归档客户
+      description: 仅停用客户及其认证账号，保留业务历史数据；重复归档幂等返回当前客户。
+      security: [{bearerAuth: []}]
+      responses:
+        '200': {$ref: '#/components/responses/TenantSuccess'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
+  /api/platform/v1/iam/tenants/{tenantId}/impersonation:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    post:
+      tags: [Platform Tenant / 平台租户]
+      summary: 创建客户代登录授权码
+      description: 创建 60 秒有效、只能兑换一次且不包含刷新令牌的客户 OWNER 代登录授权码。
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/CustomerImpersonationRequest'}
+      responses:
+        '200':
+          description: 授权码创建成功
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/CustomerImpersonationApiResponse'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
   /api/merchant/v1/iam/authorization/permissions:
     get:
       tags: [IAM Resources / IAM 资源]
@@ -770,6 +827,7 @@ components:
     Forbidden: {description: Permission, customer scope or platform technical scope rejected / 权限、客户范围或平台技术作用域不匹配, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     NotFound: {description: Resource not found / 资源不存在, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     Conflict: {description: Resource conflict / 资源冲突, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
+    ServiceUnavailable: {description: Authentication service unavailable / 认证服务不可用, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     UnprocessableEntity: {description: 参数校验失败, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
   schemas:
     ApiResponse:
@@ -1022,6 +1080,29 @@ components:
       required: [status]
       properties:
         status: {type: string, enum: [ACTIVE, DISABLED]}
+    ResetCustomerOwnerPasswordRequest:
+      type: object
+      required: [newPassword]
+      properties:
+        newPassword: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
+        forceChangePassword: {type: boolean, default: true}
+    CustomerImpersonationRequest:
+      type: object
+      required: [reason]
+      properties:
+        reason: {type: string, minLength: 5, maxLength: 500}
+    CustomerImpersonationApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data:
+              type: object
+              required: [code, ticketId, expiresIn]
+              properties:
+                code: {type: string, writeOnly: true}
+                ticketId: {type: string, format: uuid}
+                expiresIn: {type: integer, example: 60}
     ReviewRequest:
       type: object
       properties: