feat(appointment): integrate work calendar and stable cargo batches

iam/src/main/resources/db/appointment-work-permissions.sql

@@ -0,0 +1,45 @@
+USE baiyue_iam;
+
+-- Reject identity collisions before any permission or grant is changed.
+DROP PROCEDURE IF EXISTS check_appointment_work_permission_identity;
+DELIMITER $$
+CREATE PROCEDURE check_appointment_work_permission_identity()
+BEGIN
+  IF EXISTS(SELECT 1 FROM iam_permission WHERE
+      (id=5107283 AND permission_code<>'platform:appointment:manage-work')
+      OR (id=5102213 AND permission_code<>'platform:firstleg:terminal-drayage:direct-unload:confirm')
+      OR (permission_code='platform:appointment:manage-work' AND id<>5107283)
+      OR (permission_code='platform:firstleg:terminal-drayage:direct-unload:confirm' AND id<>5102213)) THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Appointment work permission identity conflict';
+  END IF;
+END$$
+DELIMITER ;
+CALL check_appointment_work_permission_identity();
+DROP PROCEDURE check_appointment_work_permission_identity;
+
+-- Two independent write capabilities; appointment/list remains read-only.
+INSERT INTO iam_permission
+  (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,deleted)
+VALUES
+  (5107283,0,'PLATFORM','BUTTON',5107280,'platform:appointment:manage-work','维护预约工作安排',NULL,'POST',743,'ACTIVE',1,0),
+  (5102213,0,'PLATFORM','BUTTON',5102200,'platform:firstleg:terminal-drayage:direct-unload:confirm','登记直送目的仓实际卸货',NULL,'POST',60,'ACTIVE',1,0)
+ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),parent_id=VALUES(parent_id),status='ACTIVE',deleted=0;
+
+INSERT IGNORE INTO iam_role_permission(tenant_id,role_id,permission_id,created_at)
+SELECT 0,r.id,p.id,CURRENT_TIMESTAMP(3)
+FROM iam_role r JOIN iam_permission p ON p.tenant_id=0 AND p.id IN (5107283,5102213)
+WHERE r.tenant_id=0 AND r.app_code='PLATFORM' AND r.role_code='PLATFORM_ADMIN' AND r.status='ACTIVE' AND r.deleted=0;
+
+DROP PROCEDURE IF EXISTS assert_appointment_work_permissions;
+DELIMITER $$
+CREATE PROCEDURE assert_appointment_work_permissions()
+BEGIN
+  IF (SELECT COUNT(*) FROM iam_permission WHERE tenant_id=0 AND app_code='PLATFORM' AND status='ACTIVE' AND deleted=0
+      AND ((id=5107283 AND permission_code='platform:appointment:manage-work' AND parent_id=5107280)
+        OR (id=5102213 AND permission_code='platform:firstleg:terminal-drayage:direct-unload:confirm' AND parent_id=5102200))) <> 2 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Appointment work permission identity conflict';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_appointment_work_permissions();
+DROP PROCEDURE assert_appointment_work_permissions;

iam/src/main/resources/openapi/iam-v1.yaml

@@ -17,6 +17,28 @@ tags:
   - name: RBAC
     description: Platform and merchant role-permission management / 平台端与商户端角色权限管理
 paths:
+  /internal/iam/platform-owners/{authUserId}:
+    get:
+      summary: Read active platform operator identity and authoritative display name
+      description: Internal service identity only. Auth subject ID is distinct from IAM profile and membership IDs. Requires active undeleted user, platform membership and PLATFORM role; no caller-supplied name fallback.
+      security: []
+      parameters:
+        - {$ref: '#/components/parameters/InternalServiceToken'}
+        - {name: authUserId, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    type: object
+                    required: [id, name]
+                    properties: {id: {type: string}, name: {type: string}}
+        '403': {description: Invalid internal service credential}
+        '404': {description: No eligible active platform operator}
   /api/merchant/v1/iam/profile:
     get:
       tags: [Merchant Tenant / 商户企业]