优化

iam/src/main/resources/openapi/iam-v1.yaml

@@ -183,6 +183,63 @@ paths:
         '403': {$ref: '#/components/responses/Forbidden'}
         '404': {$ref: '#/components/responses/NotFound'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /api/platform/v1/iam/tenants/{tenantId}/owner/password:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    put:
+      tags: [Platform Tenant / 平台租户]
+      summary: 重置客户企业管理员密码
+      description: 仅重置指定客户 OWNER 的认证密码；密码不写入审计快照并撤销该账号现有会话。
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ResetCustomerOwnerPasswordRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
+  /api/platform/v1/iam/tenants/{tenantId}/archive:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    post:
+      tags: [Platform Tenant / 平台租户]
+      summary: 逻辑归档客户
+      description: 仅停用客户及其认证账号，保留业务历史数据；重复归档幂等返回当前客户。
+      security: [{bearerAuth: []}]
+      responses:
+        '200': {$ref: '#/components/responses/TenantSuccess'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
+  /api/platform/v1/iam/tenants/{tenantId}/impersonation:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    post:
+      tags: [Platform Tenant / 平台租户]
+      summary: 创建客户代登录授权码
+      description: 创建 60 秒有效、只能兑换一次且不包含刷新令牌的客户 OWNER 代登录授权码。
+      security: [{bearerAuth: []}]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/CustomerImpersonationRequest'}
+      responses:
+        '200':
+          description: 授权码创建成功
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/CustomerImpersonationApiResponse'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
+        '503': {$ref: '#/components/responses/ServiceUnavailable'}
   /api/merchant/v1/iam/authorization/permissions:
     get:
       tags: [IAM Resources / IAM 资源]
@@ -770,6 +827,7 @@ components:
     Forbidden: {description: Permission, customer scope or platform technical scope rejected / 权限、客户范围或平台技术作用域不匹配, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     NotFound: {description: Resource not found / 资源不存在, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     Conflict: {description: Resource conflict / 资源冲突, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
+    ServiceUnavailable: {description: Authentication service unavailable / 认证服务不可用, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     UnprocessableEntity: {description: 参数校验失败, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
   schemas:
     ApiResponse:
@@ -1022,6 +1080,29 @@ components:
       required: [status]
       properties:
         status: {type: string, enum: [ACTIVE, DISABLED]}
+    ResetCustomerOwnerPasswordRequest:
+      type: object
+      required: [newPassword]
+      properties:
+        newPassword: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
+        forceChangePassword: {type: boolean, default: true}
+    CustomerImpersonationRequest:
+      type: object
+      required: [reason]
+      properties:
+        reason: {type: string, minLength: 5, maxLength: 500}
+    CustomerImpersonationApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data:
+              type: object
+              required: [code, ticketId, expiresIn]
+              properties:
+                code: {type: string, writeOnly: true}
+                ticketId: {type: string, format: uuid}
+                expiresIn: {type: integer, example: 60}
     ReviewRequest:
       type: object
       properties: