1

iam/src/main/resources/db/notification-center.sql

@@ -85,3 +85,10 @@ INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, creat
 SELECT 0, r.id, p.id, CURRENT_TIMESTAMP(3)
 FROM iam_permission p JOIN iam_role r ON r.tenant_id=0 AND r.app_code='PLATFORM' AND r.status='ACTIVE'
 WHERE p.tenant_id=0 AND p.permission_code LIKE 'platform:notification%' AND r.role_code='PLATFORM_ADMIN';
+
+-- All active platform employee roles can receive and read their own inbox messages.
+INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
+SELECT 0, r.id, p.id, CURRENT_TIMESTAMP(3)
+FROM iam_permission p JOIN iam_role r ON r.tenant_id=0 AND r.app_code='PLATFORM' AND r.status='ACTIVE'
+WHERE p.tenant_id=0
+  AND p.permission_code IN ('platform:notification:view','platform:notification:read','platform:notification:read-all');

iam/src/main/resources/openapi/notification-v1.yaml

@@ -145,7 +145,7 @@ components:
         tenantId: {type: integer, format: int64, minimum: 0}
         templateCode: {type: string, maxLength: 64}
         recipientType: {type: string, enum: [USER, MEMBERSHIP, TENANT_ROLE, TENANT_ALL, PLATFORM_ROLE]}
-        recipientIds: {type: array, minItems: 1, maxItems: 1000, items: {type: integer, format: int64}, description: Required for USER or MEMBERSHIP; forbidden for role/all recipient types.}
+        recipientIds: {type: array, minItems: 1, maxItems: 1000, items: {type: integer, format: int64}, description: Required for USER or MEMBERSHIP; forbidden for role/all recipient types. For a specified enterprise member, pass the user's ID and use USER; membership IDs are reserved for explicit membership-level calls.}
         roleCode: {type: string, minLength: 1, maxLength: 64, description: Required for TENANT_ROLE or PLATFORM_ROLE; forbidden otherwise.}
         variables: {type: object, maxProperties: 32, additionalProperties: {type: string, maxLength: 2000}}
         scheduledAt: {type: string, format: date-time, nullable: true}