优化

iam/src/test/java/com/baiyue/iam/client/SecurityEventBridgeClientContractTest.java

@@ -0,0 +1,35 @@
+package com.baiyue.iam.client;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.cloud.openfeign.FeignClient;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class SecurityEventBridgeClientContractTest {
+    private static final Path REPOSITORY_ROOT = Path.of("..").toAbsolutePath().normalize();
+
+    @Test
+    void feignUsesTheExplicitOverseasBridgePropertyInsteadOfSameNameDiscovery() {
+        FeignClient annotation = SecurityEventBridgeClient.class.getAnnotation(FeignClient.class);
+
+        assertThat(annotation.name()).isEqualTo("event-bridge-service");
+        assertThat(annotation.url()).isEqualTo("${baiyue.security-event.event-bridge-url:}");
+    }
+
+    @Test
+    void cnIamConfigurationTargetsTheOverseasBridgeNetworkAlias() throws Exception {
+        String application = Files.readString(REPOSITORY_ROOT.resolve("iam/src/main/resources/application.yml"));
+        String nacos = Files.readString(REPOSITORY_ROOT.resolve("config/nacos/cn/iam-service.yml"));
+        String compose = Files.readString(REPOSITORY_ROOT.resolve("deploy/docker-compose.yml"));
+
+        assertThat(application).contains(
+            "event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}");
+        assertThat(nacos).contains(
+            "event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}");
+        assertThat(compose).contains(
+            "SECURITY_EVENT_BRIDGE_URL: ${SECURITY_EVENT_BRIDGE_URL:-http://event-bridge-overseas:9312}");
+    }
+}

iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java

@@ -14,6 +14,7 @@ import com.baiyue.iam.repository.MemberRepository;
 import com.baiyue.iam.repository.TenantRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 import jakarta.annotation.Resource;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.TestPropertySource;
@@ -135,6 +136,27 @@ class MemberServiceTest {
         verify(repository, never()).insert(any());
     }
 
+    @Test void createPublishesActiveUserAndInitialAuthorizationAfterRoleAssignment() {
+        IamRole role = activeMerchantRole(50L, 100L);
+        when(roleMapper.selectById(50L)).thenReturn(role);
+        when(auth.create(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
+        when(auth.summary(eq("internal-token"), anyLong())).thenAnswer(invocation -> ApiResponse.success(
+                new AuthAccountClient.AccountSummary(invocation.getArgument(1), "member02", "成员", "ACTIVE")));
+        when(repository.findRoleIds(eq(100L), anyLong())).thenReturn(List.of(50L));
+        CreateMemberRequest request = new CreateMemberRequest("member02", "Password1", "成员",
+                null, null, "EMPLOYEE", "M-002", List.of(50L));
+
+        service.create(100L, request, Set.of("merchant:member:create", "merchant:member:grant-role"));
+
+        ArgumentCaptor<AuthAccountClient.CreateAccountRequest> account =
+                ArgumentCaptor.forClass(AuthAccountClient.CreateAccountRequest.class);
+        verify(auth).create(eq("internal-token"), account.capture());
+        long authUserId = account.getValue().accountId();
+        verify(repository).replaceRoles(eq(100L), anyLong(), eq(List.of(50L)));
+        verify(securityEvents).userStatus(authUserId, 100L, "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(authUserId, 100L, "MERCHANT", "INITIAL_AUTHORIZATION");
+    }
+
     @Test void shouldHandleCase08() {
         IamRole role = activeMerchantRole(50L, 100L);
         when(roleMapper.selectById(50L)).thenReturn(role);

iam/src/test/java/com/baiyue/iam/service/MerchantOnboardingServiceTest.java

@@ -41,6 +41,7 @@ class MerchantOnboardingServiceTest {
     @MockBean private IamTenantReviewMapper reviews;
     @MockBean private CustomerDimensionRuleInitializationService dimensionRuleInitialization;
     @MockBean private OverseasStorageFeeInitializationService overseasStorageFeeInitialization;
+    @MockBean private SecurityEventOutboxService securityEvents;
     @Resource private MerchantOnboardingService service;
     @Test
     void clientRegistrationCreatesOwnerAndAssignsGlobalMerchantOwnerRole() {
@@ -67,6 +68,10 @@ class MerchantOnboardingServiceTest {
         verify(membershipRoles).insert(roleGrant.capture());
         verify(dimensionRuleInitialization).initialize(result.tenantId(), 9001L);
         verify(overseasStorageFeeInitialization).initialize(result.tenantId(), 9001L, "测试企业");
+        verify(securityEvents).tenantStatus(result.tenantId(), "PROFILE_REQUIRED");
+        verify(securityEvents).userStatus(9001L, result.tenantId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(9001L, result.tenantId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
 
         assertEquals("PROFILE_REQUIRED", result.tenantStatus());
         assertEquals(result.tenantId(), tenant.getValue().getId());
@@ -194,3 +199,4 @@ class MerchantOnboardingServiceTest {
         verify(tenants, never()).deleteById((java.io.Serializable) any());
     }
 }
+

iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java

@@ -85,6 +85,39 @@ class PlatformInternalUserServiceTest {
         verify(repository).insertUser(any(IamUser.class));
         verify(repository).insert(any(IamMembership.class));
         verify(repository).replaceRoles(eq(0L), anyLong(), eq(List.of(40L)));
+        long authUserId = captor.getValue().accountId();
+        verify(securityEvents).userStatus(authUserId, 0L, "PLATFORM", "ACTIVE");
+        verify(securityEvents).permissionChanged(authUserId, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+    }
+
+    @Test
+    void linkingExistingAccountPublishesInitialProjectionOnlyForNewMembership() {
+        IamRole role = new IamRole();
+        role.setId(40L); role.setTenantId(0L); role.setAppCode("PLATFORM"); role.setStatus("ACTIVE");
+        when(roleMapper.selectById(40L)).thenReturn(role);
+        when(repository.findUserByAuthId(10L)).thenReturn(user);
+        when(repository.findByTenantAndAuthUser(0L, 10L)).thenReturn(null);
+        CreateInternalUserRequest request = new CreateInternalUserRequest(10L, null, "平台运营",
+                "13800138000", null, null, null, "PLATFORM-LINK", List.of(40L));
+
+        service.create(request);
+
+        verify(repository).replaceRoles(eq(0L), anyLong(), eq(List.of(40L)));
+        verify(securityEvents).userStatus(10L, 0L, "PLATFORM", "ACTIVE");
+        verify(securityEvents).permissionChanged(10L, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+        verify(auth, never()).create(anyString(), any());
+    }
+
+    @Test
+    void relinkingExistingMembershipDoesNotDuplicateInitialProjection() {
+        when(repository.findByTenantAndAuthUser(0L, 10L)).thenReturn(membership);
+        CreateInternalUserRequest request = new CreateInternalUserRequest(10L, null, "平台运营",
+                "13800138000", null, null, null, "PLATFORM-30", List.of());
+
+        service.create(request);
+
+        verifyNoInteractions(securityEvents);
+        verify(repository, never()).replaceRoles(anyLong(), anyLong(), anyList());
     }
 
     @Test

iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java

@@ -12,6 +12,7 @@ import com.baiyue.iam.mapper.IamRoleMapper;
 import com.baiyue.iam.repository.MemberRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 import jakarta.annotation.Resource;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.TestPropertySource;
@@ -20,6 +21,7 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
 import java.time.LocalDateTime;
 import java.util.List;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.*;
@@ -85,6 +87,30 @@ class PlatformUserManagementServiceTest {
         verify(auth, never()).create(anyString(), any());
     }
 
+    @Test
+    void createPublishesActualStatusAndInitialAuthorizationAfterRolesAreStored() {
+        AtomicReference<IamUser> createdUser = new AtomicReference<>();
+        doAnswer(invocation -> { createdUser.set(invocation.getArgument(0)); return null; })
+                .when(members).insertUser(any(IamUser.class));
+        when(members.findUser(anyLong())).thenAnswer(invocation -> createdUser.get());
+        when(members.findRoleIds(eq(0L), anyLong())).thenReturn(List.of(40001L));
+        when(auth.create(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
+        when(auth.summary(eq("internal-token"), anyLong())).thenAnswer(invocation -> ApiResponse.success(
+                new AuthAccountClient.AccountSummary(invocation.getArgument(1), "newuser", "新用户", "DISABLED")));
+        CreateUserRequest request = new CreateUserRequest("newuser", "新用户", "13900139000",
+                "new@example.com", 0L, List.of(40001L), "Password1", "DISABLED");
+
+        service.create(request);
+
+        ArgumentCaptor<AuthAccountClient.CreateAccountRequest> account =
+                ArgumentCaptor.forClass(AuthAccountClient.CreateAccountRequest.class);
+        verify(auth).create(eq("internal-token"), account.capture());
+        long authUserId = account.getValue().accountId();
+        verify(members).replaceRoles(eq(0L), anyLong(), eq(List.of(40001L)));
+        verify(securityEvents).userStatus(authUserId, 0L, "PLATFORM", "DISABLED");
+        verify(securityEvents).permissionChanged(authUserId, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+    }
+
     @Test
     void optionsContainOnlyPlatformTenantAndPlatformRoles() {
         UserOptions result = service.options();

iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxRelayTest.java

@@ -0,0 +1,91 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.EventPayloadCanonicalizer;
+import com.baiyue.common.event.EventPayloadHash;
+import com.baiyue.common.event.EventTypes;
+import com.baiyue.common.event.IamSecurityEventsV1;
+import com.baiyue.common.event.RegionCode;
+import com.baiyue.iam.client.SecurityEventBridgeClient;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.time.Instant;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class SecurityEventOutboxRelayTest {
+    @Mock private JdbcTemplate jdbc;
+    @Mock private SecurityEventBridgeClient client;
+    private final ObjectMapper objectMapper = new ObjectMapper().findAndRegisterModules();
+    private SecurityEventOutboxRelay relay;
+
+    @BeforeEach
+    void setUp() {
+        relay = new SecurityEventOutboxRelay();
+        ReflectionTestUtils.setField(relay, "jdbc", jdbc);
+        ReflectionTestUtils.setField(relay, "client", client);
+        ReflectionTestUtils.setField(relay, "objectMapper", objectMapper);
+        ReflectionTestUtils.setField(relay, "internalToken", "internal-token");
+        ReflectionTestUtils.setField(relay, "maxAttempts", 12);
+    }
+
+    @Test
+    void cnToOverseasEventIsSentOnlyAfterMatchingBridgeAcknowledgement() throws Exception {
+        EventEnvelope envelope = envelope(RegionCode.OVERSEAS);
+        when(jdbc.update(anyString(), any(Object[].class))).thenReturn(1);
+        when(jdbc.queryForObject(anyString(), eq(String.class), any(), any()))
+            .thenReturn(objectMapper.writeValueAsString(envelope));
+        when(client.receive(eq("internal-token"), any(EventEnvelope.class))).thenReturn(ApiResponse.success(
+            new SecurityEventBridgeClient.Acknowledgement(envelope.eventId(), "ACCEPTED", "2026-08-25T07:00:00Z")));
+
+        relay.deliver(envelope.eventId());
+
+        ArgumentCaptor<EventEnvelope> sent = ArgumentCaptor.forClass(EventEnvelope.class);
+        verify(client).receive(eq("internal-token"), sent.capture());
+        assertThat(sent.getValue().sourceRegion()).isEqualTo(RegionCode.CN);
+        assertThat(sent.getValue().targetRegion()).isEqualTo(RegionCode.OVERSEAS);
+        verify(jdbc).update(anyString(), any(), any(), eq(envelope.eventId()), anyString());
+    }
+
+    @Test
+    void nonOverseasTargetNeverReachesTheBridge() throws Exception {
+        EventEnvelope envelope = envelope(RegionCode.CN);
+        when(jdbc.update(anyString(), any(Object[].class))).thenReturn(1);
+        when(jdbc.queryForObject(anyString(), eq(String.class), any(), any()))
+            .thenReturn(objectMapper.writeValueAsString(envelope));
+        when(jdbc.queryForObject(anyString(), eq(Integer.class), eq(envelope.eventId()))).thenReturn(0);
+
+        relay.deliver(envelope.eventId());
+
+        verify(client, never()).receive(anyString(), any(EventEnvelope.class));
+        verify(jdbc).update(anyString(), eq("PENDING"), eq(1), any(), anyString(), any(),
+            eq(envelope.eventId()), anyString());
+    }
+
+    private EventEnvelope envelope(RegionCode target) {
+        var value = new IamSecurityEventsV1.PermissionVersionChanged(
+            101L, 0L, "PLATFORM", 3L, "contract", Instant.parse("2026-08-25T07:00:00Z"));
+        var payload = objectMapper.valueToTree(value);
+        return new EventEnvelope("00000000-0000-4000-8000-000000000081",
+            EventTypes.IAM_PERMISSION_VERSION_CHANGED, IamSecurityEventsV1.VERSION,
+            Instant.parse("2026-08-25T07:00:00Z"), RegionCode.CN, target, "0",
+            "AUTHORIZATION", "101", 3L, null, "trace-12345678", "correlation-12345678",
+            null, payload, EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(payload)));
+    }
+}

iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java

@@ -1,10 +1,13 @@
 package com.baiyue.iam.service;
 
 import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.IamSecurityEventsV1;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
@@ -43,4 +46,29 @@ class SecurityEventOutboxServiceTest {
         EventEnvelope envelope = objectMapper.readValue(String.valueOf(parameters.getValue()[4]), EventEnvelope.class);
         assertThat(envelope.requireValid().correlationId()).isNotBlank().isEqualTo(envelope.traceId());
     }
+
+    @ParameterizedTest
+    @CsvSource({
+        "ACTIVE,ACTIVE",
+        "PROFILE_REQUIRED,DISABLED",
+        "PENDING,DISABLED",
+        "REJECTED,DISABLED",
+        "DISABLED,DISABLED",
+        "ARCHIVED,DISABLED"
+    })
+    void tenantWorkflowStatusIsNormalizedToTheSecurityContract(String businessStatus,
+                                                                 String expectedSecurityStatus) throws Exception {
+        when(jdbc.queryForObject(anyString(), eq(Long.class), any())).thenReturn(3L);
+
+        service.tenantStatus(10001L, businessStatus);
+
+        ArgumentCaptor<Object[]> parameters = ArgumentCaptor.forClass(Object[].class);
+        verify(jdbc).update(eq("INSERT INTO iam_security_event_outbox(event_id,event_type,aggregate_type,aggregate_id,payload_json) "
+            + "VALUES (?,?,?,?,CAST(? AS JSON))"), parameters.capture());
+        EventEnvelope envelope = objectMapper.readValue(String.valueOf(parameters.getValue()[4]), EventEnvelope.class);
+        IamSecurityEventsV1.TenantStatusChanged payload = objectMapper.treeToValue(
+            envelope.payload(), IamSecurityEventsV1.TenantStatusChanged.class);
+        assertThat(payload.status()).isEqualTo(expectedSecurityStatus);
+        assertThat(envelope.aggregateVersion()).isEqualTo(3L);
+    }
 }

iam/src/test/java/com/baiyue/iam/service/TenantAdministratorProvisioningServiceTest.java

@@ -34,6 +34,7 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.when;
 
@@ -43,6 +44,7 @@ class TenantAdministratorProvisioningServiceTest {
     @MockBean private MemberRepository members;
     @MockBean private IamRoleMapper roles;
     @MockBean private AuthAccountClient auth;
+    @MockBean private SecurityEventOutboxService securityEvents;
     @Resource private TenantAdministratorProvisioningService service;
     private IamTenant tenant;
 
@@ -101,6 +103,9 @@ class TenantAdministratorProvisioningServiceTest {
         verify(members).insertUser(any(IamUser.class));
         verify(members).insert(any(IamMembership.class));
         verify(members).replaceRoles(eq(tenant.getId()), anyLong(), eq(List.of(4000100L)));
+        verify(securityEvents).userStatus(account.getValue().accountId(), tenant.getId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(account.getValue().accountId(), tenant.getId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
     }
 
     @Test
@@ -135,6 +140,7 @@ class TenantAdministratorProvisioningServiceTest {
         assertEquals(null, result.temporaryPassword());
         verify(auth, never()).create(anyString(), any());
         verify(members, never()).replaceRoles(anyLong(), anyLong(), any());
+        verifyNoInteractions(securityEvents);
     }
 
     @Test
@@ -153,6 +159,8 @@ class TenantAdministratorProvisioningServiceTest {
         assertFalse(result.created());
         verify(auth, never()).create(anyString(), any());
         verify(members).replaceRoles(tenant.getId(), owner.getId(), List.of(4000200L, 4000100L));
+        verify(securityEvents).permissionChanged(user.getAuthUserId(), tenant.getId(), "MERCHANT",
+                "MEMBER_ROLES_CHANGED");
     }
 
     @Test
@@ -190,6 +198,9 @@ class TenantAdministratorProvisioningServiceTest {
         verify(members, never()).insertUser(any());
         verify(members, never()).insert(any());
         verify(members, never()).replaceRoles(anyLong(), anyLong(), any());
+        verify(securityEvents).userStatus(user.getAuthUserId(), tenant.getId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(user.getAuthUserId(), tenant.getId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
     }
 
     @Test

iam/src/test/java/com/baiyue/iam/service/TenantServiceTest.java

@@ -320,6 +320,7 @@ class TenantServiceTest {
         verify(repository).insertTenant(argThat(tenant -> Long.valueOf(9001L).equals(tenant.getCreatedBy())
                 && Long.valueOf(9001L).equals(tenant.getUpdatedBy())));
         verify(dimensionRuleInitialization).initialize(created.tenant().id(), 9001L);
+        verify(securityEvents).tenantStatus(created.tenant().id(), "PROFILE_REQUIRED");
         verify(provisioning).provisionPlatformCreatedTenant(any(), eq(9001L));
         verify(repository, never()).insertReview(any());
     }
@@ -428,6 +429,7 @@ class TenantServiceTest {
         assertEquals("ACTIVE", tenant.getStatus());
         verify(repository).saveReview(review);
         verify(repository).saveTenant(tenant);
+        verify(securityEvents).tenantStatus(10001L, "ACTIVE");
     }
 
     @Test
@@ -527,3 +529,4 @@ class TenantServiceTest {
         return review;
     }
 }
+