暂存提交

iam/src/main/resources/openapi/iam-v1.yaml

@@ -18,6 +18,25 @@ tags:
     description: Platform and merchant role-permission management / 平台端与商户端角色权限管理
 paths:
   /api/platform/v1/iam/tenants:
+    get:
+      tags: [Platform Tenant / 平台租户]
+      summary: List enterprise tenants / 查询企业客户列表
+      description: Returns paged merchant tenants. Requires `platform:customer:list`. / 分页查询商户企业客户，需要 `platform:customer:list` 权限。
+      parameters:
+        - {name: page, in: query, required: false, schema: {type: integer, minimum: 1, default: 1}}
+        - {name: size, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 200, default: 20}}
+        - {name: keyword, in: query, required: false, schema: {type: string}, description: 企业编码、名称、信用代码或联系人关键字}
+        - {name: status, in: query, required: false, schema: {type: string, enum: [PROFILE_REQUIRED, PENDING, ACTIVE, REJECTED, DISABLED]}}
+      responses:
+        '200':
+          description: 企业客户分页查询成功
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/TenantPageApiResponse'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '401': {$ref: '#/components/responses/Unauthorized'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '422': {$ref: '#/components/responses/UnprocessableEntity'}
     post:
       tags: [Platform Tenant / 平台租户]
       summary: Register enterprise tenant / 创建企业租户
@@ -32,6 +51,32 @@ paths:
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /api/platform/v1/iam/authorization/permissions:
+    get:
+      tags: [IAM Resources / IAM 资源]
+      summary: Get current effective permissions / 查询当前用户有效权限
+      description: Returns the current active platform membership's permission codes. It only requires a valid PLATFORM JWT and does not require `platform:role:list`. / 返回当前有效平台成员权限编码；只要求有效 PLATFORM JWT，不依赖 `platform:role:list`。
+      responses:
+        '200':
+          description: 当前平台成员权限查询成功
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/PermissionCodesApiResponse'}
+        '401': {$ref: '#/components/responses/Unauthorized'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+  /api/merchant/v1/iam/authorization/permissions:
+    get:
+      tags: [IAM Resources / IAM 资源]
+      summary: Get current effective permissions / 查询当前用户有效权限
+      description: Returns the current active merchant membership's permission codes. / 返回当前有效商户成员权限编码。
+      responses:
+        '200':
+          description: 当前商户成员权限查询成功
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/PermissionCodesApiResponse'}
+        '401': {$ref: '#/components/responses/Unauthorized'}
+        '403': {$ref: '#/components/responses/Forbidden'}
   /api/platform/v1/iam/reviews:
     get:
       tags: [Platform Tenant / 平台租户]
@@ -79,7 +124,11 @@ paths:
       tags: [IAM Resources / IAM 资源]
       summary: 查询平台内部用户
       responses:
-        '200': {$ref: '#/components/responses/Success'}
+        '200':
+          description: 平台内部用户查询成功，公开主键为 membershipId 并回显 roleIds
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/InternalUserListApiResponse'}
         '403': {$ref: '#/components/responses/Forbidden'}
     post:
       tags: [IAM Resources / IAM 资源]
@@ -326,6 +375,7 @@ components:
     Forbidden: {description: Permission or tenant scope rejected / 权限或租户范围不匹配, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     NotFound: {description: Resource not found / 资源不存在, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
     Conflict: {description: Resource conflict / 资源冲突, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
+    UnprocessableEntity: {description: 参数校验失败, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
   schemas:
     ApiResponse:
       type: object
@@ -337,6 +387,48 @@ components:
         requestId: {type: string}
         traceId: {type: string}
         timestamp: {type: string, format: date-time}
+    PermissionCodesApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data:
+              type: array
+              uniqueItems: true
+              items: {type: string}
+    TenantPageApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data:
+              type: object
+              required: [records, page, size, total, pages]
+              properties:
+                records: {type: array, items: {$ref: '#/components/schemas/TenantResponse'}}
+                page: {type: integer, format: int64, minimum: 1}
+                size: {type: integer, format: int64, minimum: 1}
+                total: {type: integer, format: int64, minimum: 0}
+                pages: {type: integer, format: int64, minimum: 0}
+    InternalUserListApiResponse:
+      allOf:
+        - {$ref: '#/components/schemas/ApiResponse'}
+        - type: object
+          properties:
+            data: {type: array, items: {$ref: '#/components/schemas/InternalUserResponse'}}
+    TenantResponse:
+      type: object
+      required: [id, tenantCode, tenantName, status]
+      properties:
+        id: {type: integer, format: int64}
+        tenantCode: {type: string}
+        tenantName: {type: string}
+        status: {type: string, enum: [PROFILE_REQUIRED, PENDING, ACTIVE, REJECTED, DISABLED]}
+        legalName: {type: string}
+        unifiedSocialCreditCode: {type: string}
+        contactName: {type: string}
+        contactPhone: {type: string}
+        contactEmail: {type: string, format: email}
     RegisterRequest:
       type: object
       required: [tenantName, legalName, unifiedSocialCreditCode, contactName, contactPhone]