feat(phase3): 收口父子单与全链路验收

iam/src/main/java/com/baiyue/iam/repository/RbacRepository.java

@@ -64,6 +64,16 @@ public class RbacRepository {
             .eq(IamRolePermission::getPermissionId, permissionId)) > 0;
     }
 
+    public Set<Long> findRoleIdsByPermission(long tenantId, Long permissionId) {
+        List<IamRolePermission> rows = rolePermissionMapper.selectList(
+            new LambdaQueryWrapper<IamRolePermission>()
+                .eq(IamRolePermission::getTenantId, tenantId)
+                .eq(IamRolePermission::getPermissionId, permissionId));
+        Set<Long> result = new LinkedHashSet<>();
+        rows.forEach(row -> result.add(row.getRoleId()));
+        return result;
+    }
+
     public void deletePermission(IamPermission permission) { permissionMapper.deleteById(permission.getId()); }
 
     public List<IamRole> findRoles(long tenantId, String appCode) {

iam/src/main/java/com/baiyue/iam/service/MemberService.java

@@ -133,6 +133,10 @@ public class MemberService {
         membership.setMemberType(request.memberType()); membership.setMemberNo(request.memberNo());
         repository.saveUser(user); repository.save(membership);
         repository.replaceRoles(tenantId, membershipId, request.roleIds());
+        if (!new HashSet<>(currentRoleIds).equals(new HashSet<>(request.roleIds()))) {
+            call(() -> authClient.revokeSessions(internalToken,
+                    new AuthAccountClient.RevokeAccountSessionsRequest(Set.of(user.getAuthUserId()))));
+        }
         return response(tenantId, membership);
     }
 

iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java

@@ -93,6 +93,8 @@ public class PlatformInternalUserService {
         IamUser user = requiredUser(membership.getUserId());
         AuthAccountClient.AccountSummary oldAccount = account(user.getAuthUserId());
         boolean displayNameChanged = !Objects.equals(user.getDisplayName(), request.displayName());
+        List<Long> oldRoleIds = repository.findRoleIds(PLATFORM_TENANT_ID, membershipId);
+        boolean rolesChanged = !new java.util.HashSet<>(oldRoleIds).equals(new java.util.HashSet<>(roleIds));
         if (displayNameChanged) {
             call(() -> authClient.profile(internalToken, user.getAuthUserId(),
                     new AuthAccountClient.ProfileRequest(request.displayName())));
@@ -105,6 +107,7 @@ public class PlatformInternalUserService {
             repository.saveUser(user);
             repository.save(membership);
             repository.replaceRoles(PLATFORM_TENANT_ID, membershipId, roleIds);
+            if (rolesChanged && !displayNameChanged) revokeSessions(user.getAuthUserId());
         } catch (RuntimeException localFailure) {
             if (displayNameChanged) compensateProfile(user.getAuthUserId(), oldAccount.displayName(), localFailure);
             throw localFailure;
@@ -159,8 +162,12 @@ public class PlatformInternalUserService {
         IamMembership membership = required(membershipId);
         List<Long> roleIds = normalizeRoles(request.roleIds());
         validateRoles(roleIds);
-        repository.replaceRoles(PLATFORM_TENANT_ID, membershipId, roleIds);
         IamUser user = requiredUser(membership.getUserId());
+        List<Long> currentRoleIds = repository.findRoleIds(PLATFORM_TENANT_ID, membershipId);
+        repository.replaceRoles(PLATFORM_TENANT_ID, membershipId, roleIds);
+        if (!new java.util.HashSet<>(currentRoleIds).equals(new java.util.HashSet<>(roleIds))) {
+            revokeSessions(user.getAuthUserId());
+        }
         AuthAccountClient.AccountSummary authAccount = account(user.getAuthUserId());
         return response(membership, user, authAccount.username(), roleIds);
     }
@@ -283,6 +290,11 @@ public class PlatformInternalUserService {
         return data(call(() -> authClient.summary(internalToken, authUserId)));
     }
 
+    private void revokeSessions(Long authUserId) {
+        call(() -> authClient.revokeSessions(internalToken,
+                new AuthAccountClient.RevokeAccountSessionsRequest(java.util.Set.of(authUserId))));
+    }
+
     private void compensateCreate(long authUserId, RuntimeException localFailure) {
         try {
             call(() -> authClient.compensate(internalToken, authUserId));

iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java

@@ -131,6 +131,7 @@ public class PlatformUserManagementService {
         AuthAccountClient.AccountSummary oldAccount = account(user.getAuthUserId());
         boolean profileChanged = !Objects.equals(user.getDisplayName(), request.displayName().trim());
         boolean scopeChanged = oldTenantId != newTenantId;
+        boolean rolesChanged = !new java.util.HashSet<>(oldRoleIds).equals(new java.util.HashSet<>(roleIds));
 
         if (profileChanged) call(() -> authClient.profile(internalToken, user.getAuthUserId(),
                 new AuthAccountClient.ProfileRequest(request.displayName().trim())));
@@ -149,6 +150,10 @@ public class PlatformUserManagementService {
             members.save(membership);
             if (scopeChanged) members.replaceRoles(oldTenantId, membershipId, List.of());
             members.replaceRoles(newTenantId, membershipId, roleIds);
+            if (rolesChanged && !profileChanged && !scopeChanged) {
+                call(() -> authClient.revokeSessions(internalToken,
+                        new AuthAccountClient.RevokeAccountSessionsRequest(Set.of(user.getAuthUserId()))));
+            }
         } catch (RuntimeException localFailure) {
             compensateUpdate(user.getAuthUserId(), membershipId, oldTenantId, oldAccount,
                     profileChanged, scopeChanged, localFailure);

iam/src/main/java/com/baiyue/iam/service/RbacService.java

@@ -167,11 +167,17 @@ public class RbacService {
 
     @BusinessAudit(event = "PERMISSION_STATUS_CHANGE", resourceType = "PERMISSION", resourceId = "#permissionId",
         description = "启停权限资源", captureBefore = true, captureAfter = true)
+    @Transactional
     public IamPermission changePermissionStatus(long tenantId, String appCode, Long permissionId,
                                                 ChangePermissionStatusRequest request) {
         IamPermission permission = requireMutablePermission(tenantId, appCode, permissionId);
         permission.setStatus(request.status());
         repository.updatePermission(permission);
+        Set<Long> affectedAccounts = new LinkedHashSet<>();
+        for (Long roleId : repository.findRoleIdsByPermission(tenantId, permissionId)) {
+            affectedAccounts.addAll(repository.findAssignedAuthUserIds(tenantId, roleId));
+        }
+        revokeSessions(List.copyOf(affectedAccounts));
         return permission;
     }