暂存提交

iam/src/main/resources/db/iam.sql

@@ -158,6 +158,7 @@ CREATE TABLE IF NOT EXISTS iam_permission (
   http_method VARCHAR(16) NULL COMMENT 'API权限对应的HTTP方法',
   sort_no INT NOT NULL DEFAULT 0 COMMENT '同级显示顺序',
   status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' COMMENT '权限状态',
+  built_in TINYINT NOT NULL DEFAULT 0 COMMENT '是否为系统预置权限；预置权限不可通过管理接口修改',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
   deleted TINYINT NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',

iam/src/main/resources/db/phase1-admin-rbac.sql

@@ -121,6 +121,26 @@ ON DUPLICATE KEY UPDATE
   permission_name = VALUES(permission_name), route_path = VALUES(route_path),
   http_method = NULL, sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
 
+-- 平台代客创建、编辑草稿权限；可重复执行并纳入已有平台管理员和订单运营角色授权。
+INSERT INTO iam_permission
+  (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, deleted)
+VALUES
+  (5102019, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:create', '平台代客创建订单', NULL, NULL, 90, 'ACTIVE', 0),
+  (5102024, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:edit', '平台编辑订单草稿', NULL, NULL, 100, 'ACTIVE', 0),
+  (5102025, 0, 'PLATFORM', 'BUTTON', 5102010, 'platform:order:submit', '平台代客提交订单', NULL, NULL, 110, 'ACTIVE', 0)
+ON DUPLICATE KEY UPDATE
+  permission_name = VALUES(permission_name), parent_id = VALUES(parent_id), status = 'ACTIVE', deleted = 0;
+
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT 4000001, id, 0 FROM iam_permission
+WHERE id IN (5102019, 5102024, 5102025)
+ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
+
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT 4000003, id, 0 FROM iam_permission
+WHERE id IN (5102019, 5102024, 5102025)
+ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
+
 -- Merchant: level-one menus, level-two menus and buttons.
 INSERT INTO iam_permission
   (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, deleted)

iam/src/main/resources/db/phase1-platform-master-data-and-permission-management.sql

@@ -0,0 +1,52 @@
+-- 权限资源维护与平台主数据权限迁移。
+-- 在 phase1-admin-rbac.sql、rbac-role-management-v2.sql 之后执行，可重复执行。
+USE baiyue_iam;
+
+-- 兼容不支持 ADD COLUMN IF NOT EXISTS 的 MySQL 版本，通过元数据判断后执行。
+SET @iam_permission_built_in_sql = IF(
+  EXISTS(SELECT 1 FROM information_schema.columns
+         WHERE table_schema = DATABASE() AND table_name = 'iam_permission' AND column_name = 'built_in'),
+  'SELECT 1',
+  "ALTER TABLE iam_permission ADD COLUMN built_in TINYINT NOT NULL DEFAULT 0 COMMENT '是否为系统预置权限；预置资源不可通过管理接口修改' AFTER status"
+);
+PREPARE iam_permission_built_in_stmt FROM @iam_permission_built_in_sql;
+EXECUTE iam_permission_built_in_stmt;
+DEALLOCATE PREPARE iam_permission_built_in_stmt;
+
+-- 一期固定编号范围内的资源均为种子资源，运行期生成的雪花编号不作预置标记。
+UPDATE iam_permission
+SET built_in = 1
+WHERE id BETWEEN 5000000 AND 5399999 AND built_in = 0;
+
+INSERT INTO iam_permission
+  (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name,
+   sort_no, status, built_in, deleted)
+VALUES
+  (5100012, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:edit', '编辑企业客户', 20, 'ACTIVE', 1, 0),
+  (5100013, 0, 'PLATFORM', 'BUTTON', 5100010, 'platform:customer:status', '启停企业客户', 30, 'ACTIVE', 1, 0),
+  (5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 1, 0),
+  (5101032, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:edit', '编辑权限资源', 20, 'ACTIVE', 1, 0),
+  (5101033, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:status', '启停权限资源', 30, 'ACTIVE', 1, 0),
+  (5101034, 0, 'PLATFORM', 'BUTTON', 5101030, 'platform:permission:delete', '删除权限资源', 40, 'ACTIVE', 1, 0),
+  (5103021, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:create', '新增快递公司', 10, 'ACTIVE', 1, 0),
+  (5103022, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:edit', '编辑快递公司', 20, 'ACTIVE', 1, 0),
+  (5103023, 0, 'PLATFORM', 'BUTTON', 5103020, 'platform:express:status', '启停快递公司', 30, 'ACTIVE', 1, 0),
+  (5103031, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:create', '新增往来单位', 10, 'ACTIVE', 1, 0),
+  (5103032, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:edit', '编辑往来单位', 20, 'ACTIVE', 1, 0),
+  (5103033, 0, 'PLATFORM', 'BUTTON', 5103030, 'platform:counterparty:status', '启停往来单位', 30, 'ACTIVE', 1, 0)
+ON DUPLICATE KEY UPDATE
+  permission_name = VALUES(permission_name), sort_no = VALUES(sort_no), status = 'ACTIVE',
+  built_in = 1, deleted = 0;
+
+-- 新增平台操作权限默认只授予系统管理员。
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
+SELECT 4000001, id, 0
+FROM iam_permission
+WHERE tenant_id = 0 AND app_code = 'PLATFORM'
+  AND permission_code IN (
+    'platform:customer:edit', 'platform:customer:status', 'platform:user:grant-role',
+    'platform:permission:edit', 'platform:permission:status', 'platform:permission:delete',
+    'platform:express:list', 'platform:express:create', 'platform:express:edit', 'platform:express:status',
+    'platform:counterparty:list', 'platform:counterparty:create', 'platform:counterparty:edit', 'platform:counterparty:status'
+  )
+ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);

iam/src/main/resources/db/rbac-role-management-v2.sql

@@ -15,6 +15,7 @@ VALUES
   (5101012, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:edit', '编辑用户', 20, 'ACTIVE', 0),
   (5101013, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:status', '启停用户', 30, 'ACTIVE', 0),
   (5101014, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:reset-password', '重置密码', 40, 'ACTIVE', 0),
+  (5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 0),
   (5200033, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
   (5200034, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
   (5200035, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0),
@@ -32,7 +33,8 @@ SELECT 4000001, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'PLATFORM'
   AND permission_code IN ('platform:role:edit', 'platform:role:status', 'platform:role:delete',
                           'platform:member:list', 'platform:member:grant-role', 'platform:customer:create',
-                          'platform:user:edit', 'platform:user:status', 'platform:user:reset-password')
+                          'platform:user:edit', 'platform:user:status', 'platform:user:reset-password',
+                          'platform:user:grant-role')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)

iam/src/main/resources/openapi/iam-v1.yaml

@@ -20,8 +20,8 @@ paths:
   /api/platform/v1/iam/tenants:
     get:
       tags: [Platform Tenant / 平台租户]
-      summary: List enterprise tenants / 查询企业客户列表
-      description: Returns paged merchant tenants. Requires `platform:customer:list`. / 分页查询商户企业客户，需要 `platform:customer:list` 权限。
+      summary: 查询企业客户列表
+      description: 分页查询商户企业客户，需要 `platform:customer:list` 权限。
       parameters:
         - {name: page, in: query, required: false, schema: {type: integer, minimum: 1, default: 1}}
         - {name: size, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 200, default: 20}}
@@ -54,8 +54,8 @@ paths:
   /api/platform/v1/iam/authorization/permissions:
     get:
       tags: [IAM Resources / IAM 资源]
-      summary: Get current effective permissions / 查询当前用户有效权限
-      description: Returns the current active platform membership's permission codes. It only requires a valid PLATFORM JWT and does not require `platform:role:list`. / 返回当前有效平台成员权限编码；只要求有效 PLATFORM JWT，不依赖 `platform:role:list`。
+      summary: 查询当前用户有效权限
+      description: 返回当前有效平台成员权限编码；只要求有效 PLATFORM JWT，不依赖 `platform:role:list`。
       responses:
         '200':
           description: 当前平台成员权限查询成功
@@ -64,11 +64,51 @@ paths:
               schema: {$ref: '#/components/schemas/PermissionCodesApiResponse'}
         '401': {$ref: '#/components/responses/Unauthorized'}
         '403': {$ref: '#/components/responses/Forbidden'}
+  /api/platform/v1/iam/tenants/{tenantId}:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    get:
+      tags: [Platform Tenant / 平台租户]
+      summary: 查询企业客户档案
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+    put:
+      tags: [Platform Tenant / 平台租户]
+      summary: 编辑企业客户档案
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/UpdateTenantRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+  /api/platform/v1/iam/tenants/{tenantId}/status:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    put:
+      tags: [Platform Tenant / 平台租户]
+      summary: 启停企业客户
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ChangeTenantStatusRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
   /api/merchant/v1/iam/authorization/permissions:
     get:
       tags: [IAM Resources / IAM 资源]
-      summary: Get current effective permissions / 查询当前用户有效权限
-      description: Returns the current active merchant membership's permission codes. / 返回当前有效商户成员权限编码。
+      summary: 查询当前用户有效权限
+      description: 返回当前有效商户成员权限编码。
       responses:
         '200':
           description: 当前商户成员权限查询成功
@@ -193,6 +233,27 @@ paths:
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '404': {$ref: '#/components/responses/NotFound'}
+  /api/platform/v1/iam/internal-users/{membershipId}/roles:
+    parameters:
+      - {$ref: '#/components/parameters/MembershipId'}
+    put:
+      tags: [IAM 资源]
+      summary: 全量分配平台内部用户角色
+      description: 仅允许分配平台租户下已启用的平台端角色；空集合表示清空角色。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/AssignInternalUserRolesRequest'}
+      responses:
+        '200':
+          description: 角色分配成功并返回最新内部用户模型
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/InternalUserApiResponse'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
   /api/merchant/v1/iam/tenant/profile:
     get:
       tags: [Merchant Tenant / 商户企业]
@@ -341,6 +402,49 @@ paths:
         '200': {$ref: '#/components/responses/Success'}
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
+  /api/{app}/v1/iam/permissions/{permissionId}:
+    parameters:
+      - {$ref: '#/components/parameters/App'}
+      - {$ref: '#/components/parameters/PermissionId'}
+    put:
+      tags: [RBAC]
+      summary: 编辑自定义权限资源
+      description: 权限编码和类型不可变更，系统预置资源不可修改。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/UpdatePermissionRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '409': {$ref: '#/components/responses/Conflict'}
+    delete:
+      tags: [RBAC]
+      summary: 删除未绑定的自定义权限资源
+      description: 系统预置资源、存在子资源或已绑定角色的资源不可删除。
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '409': {$ref: '#/components/responses/Conflict'}
+  /api/{app}/v1/iam/permissions/{permissionId}/status:
+    parameters:
+      - {$ref: '#/components/parameters/App'}
+      - {$ref: '#/components/parameters/PermissionId'}
+    put:
+      tags: [RBAC]
+      summary: 启停自定义权限资源
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ChangePermissionStatusRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '409': {$ref: '#/components/responses/Conflict'}
 components:
   securitySchemes:
     bearerAuth:
@@ -366,7 +470,19 @@ components:
       name: membershipId
       in: path
       required: true
-      description: Platform membership ID / 平台成员关系 ID
+      description: 平台成员关系 ID
+      schema: {type: integer, format: int64}
+    TenantId:
+      name: tenantId
+      in: path
+      required: true
+      description: 企业客户租户 ID
+      schema: {type: integer, format: int64, minimum: 1}
+    PermissionId:
+      name: permissionId
+      in: path
+      required: true
+      description: 权限资源 ID
       schema: {type: integer, format: int64}
   responses:
     Success: {description: Operation succeeded / 操作成功, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
@@ -416,6 +532,12 @@ components:
         - type: object
           properties:
             data: {type: array, items: {$ref: '#/components/schemas/InternalUserResponse'}}
+    InternalUserApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data: {$ref: '#/components/schemas/InternalUserResponse'}
     TenantResponse:
       type: object
       required: [id, tenantCode, tenantName, status]
@@ -448,6 +570,20 @@ components:
         contactName: {type: string}
         contactPhone: {type: string}
         contactEmail: {type: string, format: email}
+    UpdateTenantRequest:
+      type: object
+      required: [tenantName, legalName, contactName, contactPhone]
+      properties:
+        tenantName: {type: string}
+        legalName: {type: string}
+        contactName: {type: string}
+        contactPhone: {type: string}
+        contactEmail: {type: string, format: email}
+    ChangeTenantStatusRequest:
+      type: object
+      required: [status]
+      properties:
+        status: {type: string, enum: [ACTIVE, DISABLED]}
     ReviewRequest:
       type: object
       properties:
@@ -484,6 +620,11 @@ components:
       required: [newPassword]
       properties:
         newPassword: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
+    AssignInternalUserRolesRequest:
+      type: object
+      required: [roleIds]
+      properties:
+        roleIds: {type: array, items: {type: integer, format: int64}}
     InternalUserResponse:
       type: object
       required: [membershipId, userId, authUserId, username, displayName, memberType, status, roleIds]
@@ -541,6 +682,20 @@ components:
         routePath: {type: string}
         httpMethod: {type: string, enum: [GET, POST, PUT, PATCH, DELETE]}
         sortNo: {type: integer, example: 10}
+    UpdatePermissionRequest:
+      type: object
+      required: [name]
+      properties:
+        name: {type: string}
+        parentId: {type: integer, format: int64}
+        routePath: {type: string}
+        httpMethod: {type: string, enum: [GET, POST, PUT, PATCH, DELETE]}
+        sortNo: {type: integer}
+    ChangePermissionStatusRequest:
+      type: object
+      required: [status]
+      properties:
+        status: {type: string, enum: [ACTIVE, DISABLED]}
     AssignRolesRequest:
       type: object
       required: [membershipId, roleIds]