暂存提交

2026-07-31 13:52:35 +08:00
parent 11e740706d
commit bc3c18a6e9
35 changed files with 421 additions and 121 deletions
@@ -18,15 +18,15 @@
 | `common-audit/` | 审计注解、切面、脱敏与日志/HTTP 发送 | `BusinessAuditAspect.java`、`SensitiveDataSanitizer.java`、`HttpAuditSink.java` |
 | `common-event-contract/` | 跨区域事件信封、类型、标识、哈希与校验 | `EventEnvelope.java`、`EventTypes.java`、`EventEnvelopeValidator.java` |
 | `gateway/` | 路由、CORS、入口安全、访问域隔离 | `config/`、`filter/`、`src/main/resources/application*.yml` |
-| `auth/` | 登录、令牌、注册、账号与密码 | `controller/`、`service/`、`src/main/resources/db/` |
-| `iam/` | 租户、成员、企业资料、RBAC 与授权快照 | `controller/`、`service/`、`README-IAM.md` |
+| `auth/` | 登录、令牌、注册、账号与密码 | `InternalAccountController.java`、`AccountManagementService.java`、`src/main/resources/db/` |
+| `iam/` | 租户、商户成员、平台内部用户、企业资料、RBAC 与授权快照 | `ProfileResourceController.java`、`PlatformInternalUserService.java`、`RbacController.java` |
 | `order/` | 订单主数据、状态编排、快照与 Outbox | `controller/`、`OrderApplicationService.java`、`README-ORDER.md` |
 | `firstleg/` | 履约任务、操作分配与分配历史 | `PlatformFulfillmentAssignmentController.java`、`FulfillmentTaskService.java` |
 | `warehouse/` | 仓库、地址、服务能力与往来单位 | `controller/`、`WarehouseApplicationService.java`、`PartnerQueryService.java` |
 | `file/` | 企业资质文件本地存储、预览与鉴权 | `controller/`、`LocalQualificationStorage.java`；元数据表结构尚未接入 |
 | `print/` | 打印中心边界 | 当前为应用、健康检查和 `print/src/main/resources/db/print.sql` 骨架 |
 | `audit-service/` | 审计事件接收与持久化 | `AuditIngestController.java`、`AuditIngestService.java`；当前接收接口未实现内部令牌保护 |
-| `integration-service/` | OCR、Amazon 等第三方适配 | `provider/`、`IntegrationProperties.java` |
+| `integration-service/` | 重量 OCR、百度 OCR、Amazon 等第三方适配 | `controller/WeightOcrController.java`、`service/ocr/`、`provider/ocr/`、`IntegrationProperties.java` |
 | `event-bridge-service/` | 跨区域事件接收、校验与 Inbox 幂等 | `EventBridgeController.java`、`EventInboxService.java` |

 ## 配置、数据库与验证入口
@@ -66,6 +66,7 @@ pipeline {
        booleanParam(name: 'SERVICE_AUDIT', defaultValue: false, description: '审计服务（audit-service）')
        choice(name: 'ENVIRONMENT', choices: ['test', 'staging', 'production'], description: '部署环境')
        booleanParam(name: 'DEPLOY', defaultValue: false, description: '构建成功后是否部署')
+        booleanParam(name: 'INITIALIZE_TEST_DATABASE', defaultValue: false, description: '仅 test：幂等初始化 IAM、订单、仓库与往来单位表结构及仓库样例数据')
        booleanParam(name: 'SKIP_TESTS', defaultValue: false, description: '是否跳过测试；生产构建不建议勾选')
        string(name: 'IMAGE_REPOSITORY', defaultValue: '8.163.30.128:10082/java-project/baiyue-firstleg', description: '预发布/生产镜像仓库地址；test 环境自动使用本机镜像，无需修改')
        string(name: 'DOCKER_BASE_IMAGE', defaultValue: 'docker.m.daocloud.io/library/eclipse-temurin:17-jre-alpine', description: 'Java 17 基础镜像；默认使用国内镜像代理')
@@ -194,6 +195,17 @@ pipeline {
            }
        }

+        stage('测试数据库初始化（可选）') {
+            when {
+                allOf {
+                    expression { params.ENVIRONMENT == 'test' && params.INITIALIZE_TEST_DATABASE }
+                }
+            }
+            steps {
+                sh 'sh deploy/scripts/initialize-test-databases.sh'
+            }
+        }
+
        stage('部署') {
            when {
                allOf {
@@ -13,7 +13,7 @@
 | 登录、注册、刷新、退出、改密 API | `controller/AuthController.java`（`/api/auth`） |
 | 内部账号管理 API | `controller/InternalAccountController.java`（`/internal/auth/accounts`） |
 | 认证与令牌编排 | `service/AuthService.java`、`TokenSessionStore.java` |
-| 账号状态、密码重置 | `service/AccountManagementService.java` |
+| 账号创建、显示名同步、状态和密码重置 | `service/AccountManagementService.java`；平台账号使用 `default_app_code=PLATFORM`、`tenant_id=0` |
 | 商户注册协作 | `service/MerchantRegistrationService.java` |
 | IAM 调用与授权快照 | `client/IamAuthorizationClient.java`、`IamOnboardingClient.java`、`AuthorizationSnapshot.java` |
 | 账号与 Refresh Token 持久化 | `entity/`、`mapper/`、`repository/` |
@@ -26,4 +26,5 @@
 - 密码必须安全散列；不得记录密码、Token、密钥或完整敏感 Claim。
 - 修改 Token Claim、会话 Redis Key、过期或撤销逻辑时同步检查 `common-security/`、`gateway/` 和 IAM 授权快照。
 - 注册流程跨 Auth/IAM，失败补偿和幂等必须成对检查；不要跨库写 IAM 表。
+- 内部账号创建允许相同账号 ID 与相同归属幂等重试；不同身份占用同一 ID 必须冲突。内部接口只接收 IAM 的服务令牌，不直接暴露给前端。
 - 从父目录运行 `mvn -pl auth -am test`，认证接口变更再运行相关 `scripts/` 回归。
@@ -6,6 +6,7 @@ import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import jakarta.annotation.PostConstruct;
+import jakarta.annotation.Resource;
 import jakarta.validation.Valid;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.*;
@@ -17,13 +18,14 @@ import java.security.MessageDigest;
@RestController
@RequestMapping("/internal/auth/accounts")
 public class InternalAccountController {
-    private final AccountManagementService service;
+    @Resource
+    private AccountManagementService service;
+
    private final String configuredToken;
    private byte[] tokenBytes;

-    public InternalAccountController(AccountManagementService service,
+    public InternalAccountController(
            @Value("${baiyue.security.internal-service-token}") String configuredToken) {
-        this.service = service;
        this.configuredToken = configuredToken;
    }

@@ -44,6 +46,11 @@ public class InternalAccountController {
                                    @PathVariable Long id, @Valid @RequestBody UpdateAccountStatusRequest request) {
        verify(token); service.updateStatus(id, request); return ApiResponse.success(null);
    }
+    @PutMapping("/{id}/profile")
+    public ApiResponse<Void> profile(@RequestHeader(value="X-Internal-Service-Token", required=false) String token,
+                                     @PathVariable Long id, @Valid @RequestBody UpdateAccountProfileRequest request) {
+        verify(token); service.updateProfile(id, request); return ApiResponse.success(null);
+    }
    @PutMapping("/{id}/password")
    public ApiResponse<Void> reset(@RequestHeader(value="X-Internal-Service-Token", required=false) String token,
                                   @PathVariable Long id, @Valid @RequestBody ResetPasswordRequest request) {
@@ -17,7 +17,10 @@ public final class AccountManagementDtos {
                                       @NotBlank @Size(min = 8, max = 64)
                                       @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String password,
                                       @NotBlank String displayName, @NotNull Long tenantId,
-                                       @NotNull Long membershipId) { }
+                                       @NotNull Long membershipId,
+                                       @Pattern(regexp = "MERCHANT|PLATFORM", message = "应用端只能是 MERCHANT 或 PLATFORM")
+                                       String appCode) { }
+    public record UpdateAccountProfileRequest(@NotBlank @Size(max = 64) String displayName) { }
    public record UpdateAccountStatusRequest(@NotBlank String status) { }
    public record ResetPasswordRequest(@NotBlank @Size(min = 8, max = 64)
                                       @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String newPassword) { }
@@ -11,6 +11,9 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import com.baiyue.common.audit.BusinessAudit;

+import java.util.Locale;
+import java.util.Objects;
+
 /** 账号生命周期管理，所有密码只以 BCrypt 摘要写入数据库。 */
@Service
 public class AccountManagementService {
@@ -35,7 +38,15 @@ public class AccountManagementService {
    @BusinessAudit(event = "ACCOUNT_CREATE", resourceType = "ACCOUNT",
        resourceId = "#request.accountId", description = "创建认证账号")
    public AccountSummary create(CreateAccountRequest request) {
-        if (repository.existsByUsername(request.username()) || repository.findById(request.accountId()) != null) {
+        String appCode = request.appCode() == null ? "MERCHANT"
+                : request.appCode().trim().toUpperCase(Locale.ROOT);
+        validateScope(appCode, request.tenantId());
+        AuthAccount existing = repository.findById(request.accountId());
+        if (existing != null) {
+            if (sameIdentity(existing, request, appCode)) return summary(existing);
+            throw new BizException(ResultCode.CONFLICT, "认证账号标识已被其他成员使用");
+        }
+        if (repository.existsByUsername(request.username())) {
            throw new BizException(ResultCode.CONFLICT, "登录账号已存在");
        }
        AuthAccount account = new AuthAccount();
@@ -49,7 +60,7 @@ public class AccountManagementService {
        account.setDefaultTenantId(request.tenantId());
        account.setOperatorTenantId(request.tenantId());
        account.setDefaultMembershipId(request.membershipId());
-        account.setDefaultAppCode("MERCHANT");
+        account.setDefaultAppCode(appCode);
        account.setDeleted(0);
        repository.insert(account);
        return summary(account);
@@ -66,6 +77,16 @@ public class AccountManagementService {
        bumpVersion(account);
    }

+    @Transactional
+    @BusinessAudit(event = "ACCOUNT_PROFILE_CHANGE", resourceType = "ACCOUNT", resourceId = "#accountId",
+            description = "同步账号显示名称", captureAfter = false)
+    public void updateProfile(Long accountId, UpdateAccountProfileRequest request) {
+        AuthAccount account = required(accountId);
+        if (Objects.equals(account.getDisplayName(), request.displayName())) return;
+        account.setDisplayName(request.displayName());
+        bumpVersion(account);
+    }
+
    @Transactional
    @BusinessAudit(event = "PASSWORD_RESET", resourceType = "ACCOUNT", resourceId = "#accountId", description = "管理员重置密码", captureAfter = false)
    public void resetPassword(Long accountId, ResetPasswordRequest request) {
@@ -108,4 +129,23 @@ public class AccountManagementService {
    private AccountSummary summary(AuthAccount a) {
        return new AccountSummary(a.getId(), a.getUsername(), a.getDisplayName(), a.getAccountStatus());
    }
+
+    private void validateScope(String appCode, Long tenantId) {
+        if (!"MERCHANT".equals(appCode) && !"PLATFORM".equals(appCode)) {
+            throw new BizException(ResultCode.BAD_REQUEST, "应用端只能是 MERCHANT 或 PLATFORM");
+        }
+        if (("PLATFORM".equals(appCode) && tenantId != 0L)
+                || ("MERCHANT".equals(appCode) && tenantId <= 0L)) {
+            throw new BizException(ResultCode.BAD_REQUEST, "账号应用端与租户范围不匹配");
+        }
+    }
+
+    private boolean sameIdentity(AuthAccount account, CreateAccountRequest request, String appCode) {
+        return Objects.equals(account.getUsername(), request.username())
+                && Objects.equals(account.getDefaultTenantId(), request.tenantId())
+                && Objects.equals(account.getOperatorTenantId(), request.tenantId())
+                && Objects.equals(account.getDefaultMembershipId(), request.membershipId())
+                && Objects.equals(account.getDefaultAppCode(), appCode)
+                && !Integer.valueOf(1).equals(account.getDeleted());
+    }
 }
@@ -1,6 +1,8 @@
 package com.baiyue.auth.service;

 import com.baiyue.auth.dto.AccountManagementDtos.ChangePasswordRequest;
+import com.baiyue.auth.dto.AccountManagementDtos.CreateAccountRequest;
+import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountProfileRequest;
 import com.baiyue.auth.dto.AccountManagementDtos.UpdateAccountStatusRequest;
 import com.baiyue.auth.entity.AuthAccount;
 import com.baiyue.auth.repository.AuthAccountRepository;
@@ -49,4 +51,41 @@ class AccountManagementServiceTest {
        assertEquals("DISABLED", account.getAccountStatus());
        verify(sessions).revokeAll(10L);
    }
+
+    @Test void 创建平台账号保存平台应用域且密码仅保存摘要() {
+        when(repository.findById(20L)).thenReturn(null);
+        when(repository.existsByUsername("platform.user")).thenReturn(false);
+
+        var result = service.create(new CreateAccountRequest(20L, "platform.user", "Password1",
+                "平台用户", 0L, 30L, "PLATFORM"));
+
+        assertEquals("platform.user", result.username());
+        var captor = org.mockito.ArgumentCaptor.forClass(AuthAccount.class);
+        verify(repository).insert(captor.capture());
+        assertEquals("PLATFORM", captor.getValue().getDefaultAppCode());
+        assertTrue(encoder.matches("Password1", captor.getValue().getPasswordHash()));
+        assertNotEquals("Password1", captor.getValue().getPasswordHash());
+    }
+
+    @Test void 相同账号标识和归属重试时幂等返回() {
+        account.setUsername("platform.user"); account.setDisplayName("平台用户");
+        account.setDefaultTenantId(0L); account.setOperatorTenantId(0L);
+        account.setDefaultMembershipId(30L); account.setDefaultAppCode("PLATFORM"); account.setDeleted(0);
+
+        var result = service.create(new CreateAccountRequest(10L, "platform.user", "Password1",
+                "平台用户", 0L, 30L, "PLATFORM"));
+
+        assertEquals(10L, result.accountId());
+        verify(repository, never()).insert(any());
+    }
+
+    @Test void 同步显示名撤销已有会话() {
+        account.setDisplayName("旧名称");
+
+        service.updateProfile(10L, new UpdateAccountProfileRequest("新名称"));
+
+        assertEquals("新名称", account.getDisplayName());
+        verify(repository).save(account);
+        verify(sessions).revokeAll(10L);
+    }
 }
@@ -77,6 +77,8 @@ Content-Type: application/json
 | PUT | `/api/merchant/v1/iam/tenant/profile` | 更新当前租户资料 |
 | GET | `/api/merchant/v1/iam/tenant/qualifications` | 返回当前租户资质列表 |

+IAM 的商户资质接口只读。旧的 `POST /api/merchant/v1/iam/tenant/qualifications` 已移除，上传必须使用 File 服务的 multipart 接口，避免数据库出现没有真实文件支撑的 URL。
+
 个人资料与修改密码：

 | 方法 | 路径 | 说明 |
@@ -142,6 +144,8 @@ Content-Type: application/json
 | GET | `/api/merchant/v1/files/qualifications/{fileName}` | 商户下载自己的资质 |
 | GET | `/api/platform/v1/files/qualifications/{tenantId}/{fileName}` | 平台查看指定租户资质 |

+历史 `/phase1-seed/...` 路径不符合 File 服务契约，不能直接改成不存在的 UUID。处理步骤见 `docs/企业资质文件迁移说明.md`。
+
 上传采用 `multipart/form-data`：`file` 必填，`certificateNo` 可选。只接受文件内容真实为 JPG/PNG 的图片，最大 5MB。上传成功 `data`：

 ```json
@@ -10,7 +10,7 @@ import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
-import lombok.RequiredArgsConstructor;
+import jakarta.annotation.Resource;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -25,10 +25,12 @@ import org.springframework.web.bind.annotation.RestController;
@Tag(name = "事件桥内部接口", description = "跨区域事件的幂等接收与能力状态")
@RestController
@RequestMapping("/internal/event-bridge")
-@RequiredArgsConstructor
 public class EventBridgeController {
-    private final EventInboxService eventInboxService;
-    private final InternalServiceTokenGuard internalServiceTokenGuard;
+    @Resource
+    private EventInboxService eventInboxService;
+
+    @Resource
+    private InternalServiceTokenGuard internalServiceTokenGuard;

    @Value("${baiyue.region:CN}")
    private String region;
@@ -2,6 +2,8 @@

 ## 职责边界

+- File 服务是企业资质文件的唯一公开上传入口。必须先持久化并验证真实文件，再调用 IAM 内部接口登记元数据；禁止只生成或改写一个不存在文件的 URL。
+
 - 负责企业资质文件的上传、存储、读取和访问鉴权；当前实现只使用本地磁盘，文件内容不进入 Git。
 - `src/main/resources/db/file.sql` 是文件元数据、下载令牌和下载日志的目标表结构，当前代码尚未接入 Entity、Mapper 或 Repository，不能据此判断元数据持久化已实现。
 - 企业资质审核状态和元数据归 `iam/`；本模块通过 IAM 客户端校验访问权限，不跨库读取 IAM 数据。
@@ -2,6 +2,8 @@

 ## 职责边界

+- 商户侧资质公开接口在 IAM 中只提供查询；真实文件上传统一由 File 服务的 multipart 接口完成，IAM 仅接受 File 服务携带内部令牌提交的资质元数据。
+
 - 负责租户、用户、成员关系、企业资料与审核、角色、权限、数据范围、个人资料和授权快照。
 - 账号凭据与 Token 属于 `auth/`；资质文件内容属于 `file/`。IAM 只维护业务元数据和跨服务协作。

@@ -12,7 +14,8 @@
 | 商户个人与企业资料 | `controller/MerchantTenantController.java` | `PersonalProfileService.java`、`TenantService.java` |
 | 商户成员增改、启停、重置密码 | `MerchantTenantController.java` | `MemberService.java`，账号协作看 `client/AuthAccountClient.java` |
 | 平台创建企业与入驻审核 | `controller/PlatformTenantController.java` | `MerchantOnboardingService.java`、`TenantService.java` |
-| 平台内部用户、企业地址与资质元数据 | `controller/ProfileResourceController.java` | `ProfileResourceService.java`、`ProfileResourceRepository.java` |
+| 平台内部用户 | `controller/ProfileResourceController.java` | `PlatformInternalUserService.java`；账号创建、显示名、启停和重置密码经 `AuthAccountClient` 编排 |
+| 企业地址与资质元数据 | `controller/ProfileResourceController.java` | `ProfileResourceService.java`、`ProfileResourceRepository.java` |
 | 角色、权限、成员角色、角色授权 | `controller/RbacController.java` | `RbacService.java`、`RbacRepository.java` |
 | Auth/Order 内部授权与资格查询 | `InternalAuthorizationController.java`、`InternalTenantController.java` | `AuthorizationSnapshotService.java`、`TenantGuard.java` |
 | DTO | `src/main/java/com/baiyue/iam/dto/` | 按 Authorization、Member、Onboarding、Profile、Rbac、Tenant 分类 |
@@ -26,5 +29,6 @@
 - `tenant_id` 是商户数据隔离核心；平台端与商户端访问域、角色和权限不可混用。
 - 按钮隐藏不能代替后端 permission code / permissionIds 校验；权限快照变化需同步检查 Auth 与 Gateway Claim 消费。
 - 成员账号操作跨 IAM/Auth，保持幂等与补偿；资质上传跨 IAM/File，IAM 不保存文件内容。
+- 平台内部用户的公开主键是 `membershipId`；列表必须回显 `roleIds`，密码只允许通过 DTO 转交 Auth，禁止进入 IAM 实体、日志或审计快照。
 - SQL 增量保持可重复部署顺序，修改 Entity 时同步检查 Mapper、Repository、DTO 与种子数据。
 - 从父目录运行 `mvn -pl iam -am test`，再按影响执行一期认证/IAM API 回归。
@@ -14,14 +14,22 @@ public interface AuthAccountClient {
                                                              @PathVariable Long id);
    @PutMapping("/{id}/status") ApiResponse<Void> status(@RequestHeader("X-Internal-Service-Token") String token,
                                                         @PathVariable Long id, @RequestBody StatusRequest request);
+    @PutMapping("/{id}/profile") ApiResponse<Void> profile(@RequestHeader("X-Internal-Service-Token") String token,
+                                                            @PathVariable Long id, @RequestBody ProfileRequest request);
    @PutMapping("/{id}/password") ApiResponse<Void> reset(@RequestHeader("X-Internal-Service-Token") String token,
                                                          @PathVariable Long id, @RequestBody PasswordRequest request);
    @DeleteMapping("/{id}/compensation") ApiResponse<Void> compensate(@RequestHeader("X-Internal-Service-Token") String token,
                                                                       @PathVariable Long id);

    record CreateAccountRequest(Long accountId, String username, String password, String displayName,
-                                Long tenantId, Long membershipId) { }
+                                Long tenantId, Long membershipId, String appCode) {
+        public CreateAccountRequest(Long accountId, String username, String password, String displayName,
+                                    Long tenantId, Long membershipId) {
+            this(accountId, username, password, displayName, tenantId, membershipId, "MERCHANT");
+        }
+    }
    record AccountSummary(Long accountId, String username, String displayName, String status) { }
    record StatusRequest(String status) { }
+    record ProfileRequest(String displayName) { }
    record PasswordRequest(String newPassword) { }
 }
@@ -54,6 +54,7 @@ public class MerchantTenantController {
    }

    @GetMapping("/tenant/profile")
+    @PreAuthorize("hasAuthority('merchant:profile:view')")
    @Operation(summary = "Get current enterprise profile / 查询当前企业资料", description = "Tenant ID is taken only from the authenticated merchant JWT. / 租户 ID 仅从已认证商户 JWT 获取。")
    @ApiResponses({@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Profile returned / 查询成功"), @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Tenant not found / 企业不存在")})
    public ApiResponse<TenantResponse> profile(@AuthenticationPrincipal AuthenticatedUser user) {
@@ -1,6 +1,7 @@
 package com.baiyue.iam.controller;

 import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.iam.dto.TenantDtos.RegisterRequest;
 import com.baiyue.iam.dto.TenantDtos.ReviewRequest;
@@ -13,9 +14,12 @@ import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import jakarta.annotation.Resource;
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
 import jakarta.validation.Valid;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;

 import java.util.List;
@@ -25,11 +29,30 @@ import java.util.List;
 */
@RestController
@RequestMapping("/api/platform/v1/iam")
+@Validated
@Tag(name = "Platform tenant administration / 平台企业管理", description = "Enterprise registration review and tenant activation for platform operators. / 平台运营人员进行企业注册审核和租户启用。")
 public class PlatformTenantController {
    @Resource
    private TenantService service;

+    @GetMapping("/tenants")
+    @PreAuthorize("hasAuthority('platform:customer:list')")
+    @Operation(summary = "List enterprise tenants / 查询企业列表", description = "Returns paged merchant enterprise tenants for platform operators. / 平台端分页查询商户企业，支持企业名称、统一社会信用代码、联系人和状态筛选。")
+    @ApiResponses({
+        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Tenant list returned / 企业列表查询成功"),
+        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid paging parameters / 分页参数无效"),
+        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform scope required / 需要平台端权限")
+    })
+    public ApiResponse<PageResult<TenantResponse>> page(
+            @RequestParam(defaultValue = "1") @Min(1) long page,
+            @RequestParam(defaultValue = "20") @Min(1) @Max(200) long size,
+            @RequestParam(required = false) String keyword,
+            @RequestParam(required = false) String status,
+            @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        return ApiResponse.success(service.pageMerchants(page, size, keyword, status));
+    }
+
    @PostMapping("/tenants")
    @PreAuthorize("hasAuthority('platform:customer:create')")
    @Operation(summary = "Register enterprise tenant / 提交企业注册", description = "Create a pending merchant tenant and its registration review ticket. Platform token required. / 创建待审核商户租户及注册审核单，需要平台端令牌。")
@@ -3,12 +3,11 @@ package com.baiyue.iam.controller;
 import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.iam.dto.ProfileDtos.AddressRequest;
-import com.baiyue.iam.dto.ProfileDtos.CreateUserRequest;
-import com.baiyue.iam.dto.ProfileDtos.QualificationRequest;
+import com.baiyue.iam.dto.PlatformInternalUserDtos.*;
 import com.baiyue.iam.entity.IamTenantAddress;
 import com.baiyue.iam.entity.IamTenantQualification;
-import com.baiyue.iam.entity.IamUser;
 import com.baiyue.iam.service.ProfileResourceService;
+import com.baiyue.iam.service.PlatformInternalUserService;
 import com.baiyue.iam.service.TenantGuard;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
@@ -29,23 +28,57 @@ import java.util.List;
 public class ProfileResourceController {
    @Resource
    private ProfileResourceService service;
+    @Resource
+    private PlatformInternalUserService internalUserService;

    @GetMapping("/api/platform/v1/iam/internal-users")
+    @PreAuthorize("hasAuthority('platform:user:list')")
    @Operation(summary = "List platform internal users / 查询平台内部用户", description = "Platform scope is required. / 需要平台端权限域。")
    @ApiResponses({@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "User list returned / 查询成功"), @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform scope required / 需要平台端权限域")})
-    public ApiResponse<List<IamUser>> internalUsers(@AuthenticationPrincipal AuthenticatedUser user) {
+    public ApiResponse<List<InternalUserResponse>> internalUsers(@AuthenticationPrincipal AuthenticatedUser user) {
        TenantGuard.tenant(user, "PLATFORM");
-        return ApiResponse.success(service.internalUsers());
+        return ApiResponse.success(internalUserService.list());
    }

    @PostMapping("/api/platform/v1/iam/internal-users")
    @PreAuthorize("hasAuthority('platform:user:create')")
    @Operation(summary = "Create platform internal user / 新增平台内部用户", description = "Create an IAM profile linked to an auth-service account. / 创建关联统一认证账号的 IAM 用户资料。")
    @ApiResponses({@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "User created / 创建成功"), @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid user profile / 用户资料不合法")})
-    public ApiResponse<IamUser> addUser(@Valid @RequestBody CreateUserRequest request,
-                                        @AuthenticationPrincipal AuthenticatedUser user) {
+    public ApiResponse<InternalUserResponse> addUser(@Valid @RequestBody CreateInternalUserRequest request,
+                                                     @AuthenticationPrincipal AuthenticatedUser user) {
        TenantGuard.tenant(user, "PLATFORM");
-        return ApiResponse.success(service.addUser(request));
+        return ApiResponse.success(internalUserService.create(request));
+    }
+
+    @PutMapping("/api/platform/v1/iam/internal-users/{membershipId:\\d+}")
+    @PreAuthorize("hasAuthority('platform:user:edit')")
+    @Operation(summary = "编辑平台内部用户")
+    public ApiResponse<InternalUserResponse> updateInternalUser(
+            @PathVariable Long membershipId, @Valid @RequestBody UpdateInternalUserRequest request,
+            @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        return ApiResponse.success(internalUserService.update(membershipId, request));
+    }
+
+    @PutMapping("/api/platform/v1/iam/internal-users/{membershipId:\\d+}/status")
+    @PreAuthorize("hasAuthority('platform:user:status')")
+    @Operation(summary = "启用或停用平台内部用户")
+    public ApiResponse<InternalUserResponse> changeInternalUserStatus(
+            @PathVariable Long membershipId, @Valid @RequestBody ChangeInternalUserStatusRequest request,
+            @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        return ApiResponse.success(internalUserService.changeStatus(membershipId, request, user.membershipId()));
+    }
+
+    @PutMapping("/api/platform/v1/iam/internal-users/{membershipId:\\d+}/password")
+    @PreAuthorize("hasAuthority('platform:user:reset-password')")
+    @Operation(summary = "重置平台内部用户密码")
+    public ApiResponse<Void> resetInternalUserPassword(
+            @PathVariable Long membershipId, @Valid @RequestBody ResetInternalUserPasswordRequest request,
+            @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        internalUserService.resetPassword(membershipId, request);
+        return ApiResponse.success(null);
    }

    @GetMapping("/api/merchant/v1/iam/tenant/addresses")
@@ -79,12 +112,4 @@ public class ProfileResourceController {
        return ApiResponse.success(service.qualifications(tenantId));
    }

-    @PostMapping("/api/merchant/v1/iam/tenant/qualifications")
-    @PreAuthorize("hasAuthority('merchant:qualification:upload')")
-    @Operation(summary = "Submit enterprise qualification / 提交企业资质", description = "Create a pending qualification record; document content is stored externally. / 创建待审核资质记录，文件内容由外部对象存储保存。")
-    @ApiResponses({@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Qualification submitted / 提交成功"), @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid qualification / 资质信息不合法")})
-    public ApiResponse<IamTenantQualification> addQualification(@Valid @RequestBody QualificationRequest request,
-                                                                @AuthenticationPrincipal AuthenticatedUser user) {
-        return ApiResponse.success(service.addQualification(TenantGuard.tenant(user, "MERCHANT"), request));
-    }
 }
@@ -2,18 +2,12 @@ package com.baiyue.iam.dto;

 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;

-import java.time.LocalDate;
-
 /** 用户档案、地址和资质的数据契约。 */
 public final class ProfileDtos {
    private ProfileDtos() { }

-    public record CreateUserRequest(@NotNull Long authUserId, @NotBlank String userType,
-                                    @NotBlank String displayName, String phone, String email) { }
-
    public record PersonalProfileResponse(Long userId, Long authUserId, String username,
                                          String displayName, String phone, String email) { }

@@ -25,6 +19,4 @@ public final class ProfileDtos {
                                 String city, String district, @NotBlank String detail,
                                 String postalCode, Boolean isDefault) { }

-    public record QualificationRequest(@NotBlank String qualificationType, String certificateNo,
-                                       @NotBlank String documentUrl, LocalDate validFrom, LocalDate validTo) { }
 }
@@ -27,13 +27,11 @@ public class ProfileResourceRepository {
        this.qualificationMapper = qualificationMapper;
    }

-    public void insertUser(IamUser user) { userMapper.insert(user); }
    public IamUser findUserByAuthId(Long authUserId) { return userMapper.selectOne(new LambdaQueryWrapper<IamUser>().eq(IamUser::getAuthUserId, authUserId).last("LIMIT 1")); }
    public void saveUser(IamUser user) { userMapper.updateById(user); }
    public void insertAddress(IamTenantAddress address) { addressMapper.insert(address); }
    public void insertQualification(IamTenantQualification qualification) { qualificationMapper.insert(qualification); }
    public void saveQualification(IamTenantQualification qualification) { qualificationMapper.updateById(qualification); }
-    public List<IamUser> findInternalUsers() { return userMapper.selectList(new LambdaQueryWrapper<IamUser>().eq(IamUser::getUserType, "INTERNAL")); }
    public List<IamTenantAddress> findAddresses(long tenantId) { return addressMapper.selectList(new LambdaQueryWrapper<IamTenantAddress>().eq(IamTenantAddress::getTenantId, tenantId)); }
    public List<IamTenantQualification> findQualifications(long tenantId) { return qualificationMapper.selectList(new LambdaQueryWrapper<IamTenantQualification>().eq(IamTenantQualification::getTenantId, tenantId)); }
    public long countApprovedQualifications(long tenantId) {
@@ -1,11 +1,14 @@
 package com.baiyue.iam.repository;

+import com.baiyue.common.core.api.PageResult;
 import com.baiyue.iam.entity.IamTenant;
 import com.baiyue.iam.entity.IamTenantReview;
 import com.baiyue.iam.mapper.IamTenantMapper;
 import com.baiyue.iam.mapper.IamTenantReviewMapper;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import org.springframework.stereotype.Repository;
+import org.springframework.util.StringUtils;

 import java.util.List;

@@ -45,4 +48,21 @@ public class TenantRepository {
            .eq(IamTenantReview::getStatus, "PENDING")
            .orderByAsc(IamTenantReview::getId));
    }
+
+    public PageResult<IamTenant> pageMerchants(long page, long size, String keyword, String status) {
+        LambdaQueryWrapper<IamTenant> wrapper = new LambdaQueryWrapper<IamTenant>()
+            .eq(IamTenant::getTenantType, "MERCHANT")
+            .eq(StringUtils.hasText(status), IamTenant::getStatus, status)
+            .orderByDesc(IamTenant::getCreatedAt);
+        if (StringUtils.hasText(keyword)) {
+            wrapper.and(condition -> condition
+                .like(IamTenant::getTenantCode, keyword)
+                .or().like(IamTenant::getTenantName, keyword)
+                .or().like(IamTenant::getLegalName, keyword)
+                .or().like(IamTenant::getUnifiedSocialCreditCode, keyword)
+                .or().like(IamTenant::getContactName, keyword)
+                .or().like(IamTenant::getContactPhone, keyword));
+        }
+        return PageResult.from(tenantMapper.selectPage(new Page<>(page, size), wrapper));
+    }
 }
@@ -6,13 +6,10 @@ import com.baiyue.common.core.exception.BizException;
 import com.baiyue.iam.dto.OnboardingDtos.QualificationSubmissionRequest;
 import com.baiyue.iam.dto.OnboardingDtos.QualificationSubmissionResponse;
 import com.baiyue.iam.dto.ProfileDtos.AddressRequest;
-import com.baiyue.iam.dto.ProfileDtos.CreateUserRequest;
-import com.baiyue.iam.dto.ProfileDtos.QualificationRequest;
 import com.baiyue.iam.entity.IamTenant;
 import com.baiyue.iam.entity.IamTenantAddress;
 import com.baiyue.iam.entity.IamTenantQualification;
 import com.baiyue.iam.entity.IamTenantReview;
-import com.baiyue.iam.entity.IamUser;
 import com.baiyue.iam.repository.ProfileResourceRepository;
 import com.baiyue.iam.repository.TenantRepository;
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
@@ -29,16 +26,6 @@ public class ProfileResourceService {
    @Resource private ProfileResourceRepository repository;
    @Resource private TenantRepository tenantRepository;

-    @BusinessAudit(event = "INTERNAL_USER_CREATE", resourceType = "IAM_USER",
-        resourceId = "#q.authUserId", description = "新增平台内部用户")
-    public IamUser addUser(CreateUserRequest q) {
-        IamUser u = new IamUser();
-        u.setId(IdWorker.getId()); u.setAuthUserId(q.authUserId()); u.setUserType(q.userType());
-        u.setDisplayName(q.displayName()); u.setPhone(q.phone()); u.setEmail(q.email()); u.setStatus("ACTIVE");
-        repository.insertUser(u); return u;
-    }
-
-    public List<IamUser> internalUsers() { return repository.findInternalUsers(); }
    public List<IamTenantAddress> addresses(long tenant) { return repository.findAddresses(tenant); }

    @BusinessAudit(event = "TENANT_ADDRESS_CREATE", resourceType = "TENANT_ADDRESS",
@@ -54,11 +41,6 @@ public class ProfileResourceService {

    public List<IamTenantQualification> qualifications(long tenant) { return repository.findQualifications(tenant); }

-    public IamTenantQualification addQualification(long tenant, QualificationRequest q) {
-        throw new BizException(ResultCode.CONFLICT,
-                "Upload the business license through the qualification file API");
-    }
-
    @Transactional
    @BusinessAudit(event = "TENANT_QUALIFICATION_SUBMIT", resourceType = "TENANT_QUALIFICATION",
        resourceId = "#request.tenantId", description = "提交企业资质", captureAfter = false)
@@ -2,6 +2,7 @@ package com.baiyue.iam.service;
 import jakarta.annotation.Resource;

 import com.baiyue.common.audit.BusinessAudit;
+import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.iam.entity.IamTenant;
@@ -72,6 +73,12 @@ public class TenantService {
        return repository.findPendingReviews();
    }

+    public PageResult<TenantResponse> pageMerchants(long page, long size, String keyword, String status) {
+        PageResult<IamTenant> source = repository.pageMerchants(page, size, keyword, status);
+        return new PageResult<>(source.records().stream().map(this::response).toList(),
+            source.page(), source.size(), source.total(), source.pages());
+    }
+
    @BusinessAudit(
        event = "TENANT_REVIEW",
        resourceType = "TENANT_REVIEW",
@@ -1,5 +1,6 @@
 SET NAMES utf8mb4;
 -- IAM 服务独占数据库：负责租户、成员、双端角色、菜单/页面/按钮/API权限和数据范围。
+
 CREATE DATABASE IF NOT EXISTS baiyue_iam
  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
 USE baiyue_iam;
@@ -61,11 +61,5 @@ FROM iam_permission
 WHERE app_code='MERCHANT' AND tenant_id=0
  AND permission_type IN ('MENU','BUTTON') AND status='ACTIVE' AND deleted=0;

-- Keep the phase-one demo merchant eligible for existing order acceptance tests.
-INSERT INTO iam_tenant_qualification (
-  id, tenant_id, qualification_type, certificate_no, document_url, status, deleted
-) VALUES (
-  7000101, 10001, 'BUSINESS_LICENSE', '91310000PHASE10001',
-  '/phase1-seed/demo-business-license.jpg', 'APPROVED', 0
-)
-ON DUPLICATE KEY UPDATE status='APPROVED', deleted=0;
+-- 不再写入伪造的资质 URL。资质必须先由 File 服务保存真实图片，再由 IAM 记录文件地址和审核结果。
+-- 已部署环境中的 /phase1-seed/ 历史记录按 docs/企业资质文件迁移说明.md 处理，本脚本不得将其改成不存在的 UUID。
@@ -12,6 +12,9 @@ VALUES
  (5101025, 0, 'PLATFORM', 'BUTTON', 5101020, 'platform:role:delete', '删除角色', 50, 'ACTIVE', 0),
  (5101040, 0, 'PLATFORM', 'MENU', 5101000, 'platform:member:list', '平台成员', 40, 'ACTIVE', 0),
  (5101041, 0, 'PLATFORM', 'BUTTON', 5101040, 'platform:member:grant-role', '分配成员角色', 10, 'ACTIVE', 0),
+  (5101012, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:edit', '编辑用户', 20, 'ACTIVE', 0),
+  (5101013, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:status', '启停用户', 30, 'ACTIVE', 0),
+  (5101014, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:reset-password', '重置密码', 40, 'ACTIVE', 0),
  (5200033, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
  (5200034, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
  (5200035, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0),
@@ -28,7 +31,8 @@ INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000001, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'PLATFORM'
  AND permission_code IN ('platform:role:edit', 'platform:role:status', 'platform:role:delete',
-                          'platform:member:list', 'platform:member:grant-role', 'platform:customer:create')
+                          'platform:member:list', 'platform:member:grant-role', 'platform:customer:create',
+                          'platform:user:edit', 'platform:user:status', 'platform:user:reset-password')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);

 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
@@ -77,24 +77,73 @@ paths:
  /api/platform/v1/iam/internal-users:
    get:
      tags: [IAM Resources / IAM 资源]
-      summary: List platform internal users / 查询平台内部用户
+      summary: 查询平台内部用户
      responses:
        '200': {$ref: '#/components/responses/Success'}
        '403': {$ref: '#/components/responses/Forbidden'}
    post:
      tags: [IAM Resources / IAM 资源]
-      summary: Create platform internal user / 新增平台内部用户
-      description: Create an IAM profile linked to an existing authentication account. / 创建关联已有认证账号的 IAM 用户资料。
+      summary: 新增平台内部用户
+      description: 创建完整的 Auth/IAM 平台账号，也兼容通过 authUserId 关联已有账号。
      requestBody:
        required: true
        content:
          application/json:
-            schema: {$ref: '#/components/schemas/CreateIamUserRequest'}
+            schema: {$ref: '#/components/schemas/CreateInternalUserRequest'}
      responses:
        '200': {$ref: '#/components/responses/Success'}
        '400': {$ref: '#/components/responses/BadRequest'}
        '403': {$ref: '#/components/responses/Forbidden'}
        '409': {$ref: '#/components/responses/Conflict'}
+  /api/platform/v1/iam/internal-users/{membershipId}:
+    parameters:
+      - {$ref: '#/components/parameters/MembershipId'}
+    put:
+      tags: [IAM Resources / IAM 资源]
+      summary: 编辑平台内部用户
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/UpdateInternalUserRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
+  /api/platform/v1/iam/internal-users/{membershipId}/status:
+    parameters:
+      - {$ref: '#/components/parameters/MembershipId'}
+    put:
+      tags: [IAM Resources / IAM 资源]
+      summary: 启用或停用平台内部用户
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ChangeInternalUserStatusRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+  /api/platform/v1/iam/internal-users/{membershipId}/password:
+    parameters:
+      - {$ref: '#/components/parameters/MembershipId'}
+    put:
+      tags: [IAM Resources / IAM 资源]
+      summary: 重置平台内部用户密码
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ResetInternalUserPasswordRequest'}
+      responses:
+        '200': {$ref: '#/components/responses/Success'}
+        '400': {$ref: '#/components/responses/BadRequest'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
  /api/merchant/v1/iam/tenant/profile:
    get:
      tags: [Merchant Tenant / 商户企业]
@@ -165,18 +214,6 @@ paths:
      responses:
        '200': {$ref: '#/components/responses/Success'}
        '403': {$ref: '#/components/responses/Forbidden'}
-    post:
-      tags: [IAM Resources / IAM 资源]
-      summary: Add tenant qualification / 新增企业资质
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: {$ref: '#/components/schemas/QualificationRequest'}
-      responses:
-        '200': {$ref: '#/components/responses/Success'}
-        '400': {$ref: '#/components/responses/BadRequest'}
-        '403': {$ref: '#/components/responses/Forbidden'}
  /api/{app}/v1/iam/roles:
    parameters:
      - {$ref: '#/components/parameters/App'}
@@ -276,6 +313,12 @@ components:
      description: Application domain / 应用域
      schema: {type: string, enum: [platform, merchant]}
      example: platform
+    MembershipId:
+      name: membershipId
+      in: path
+      required: true
+      description: Platform membership ID / 平台成员关系 ID
+      schema: {type: integer, format: int64}
  responses:
    Success: {description: Operation succeeded / 操作成功, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
    BadRequest: {description: Invalid request / 请求参数错误, content: {application/json: {schema: {$ref: '#/components/schemas/ApiResponse'}}}}
@@ -317,15 +360,53 @@ components:
      type: object
      properties:
        comment: {type: string, description: Review comment or rejection reason / 审核意见或驳回原因}
-    CreateIamUserRequest:
+    CreateInternalUserRequest:
      type: object
-      required: [authUserId, userType, displayName]
+      required: [displayName]
      properties:
+        authUserId: {type: integer, format: int64, description: 兼容旧接口；填写后关联已有认证账号}
+        userType: {type: string, enum: [INTERNAL, PLATFORM], description: 兼容旧接口，可省略}
+        username: {type: string, minLength: 4, maxLength: 64}
+        password: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
+        displayName: {type: string, maxLength: 64}
+        phone: {type: string, maxLength: 32}
+        email: {type: string, format: email, maxLength: 128}
+        memberNo: {type: string, maxLength: 64}
+        roleIds: {type: array, items: {type: integer, format: int64}}
+    UpdateInternalUserRequest:
+      type: object
+      required: [displayName, memberNo, roleIds]
+      properties:
+        displayName: {type: string, maxLength: 64}
+        phone: {type: string, maxLength: 32}
+        email: {type: string, format: email, maxLength: 128}
+        memberNo: {type: string, maxLength: 64}
+        roleIds: {type: array, items: {type: integer, format: int64}}
+    ChangeInternalUserStatusRequest:
+      type: object
+      required: [status]
+      properties:
+        status: {type: string, enum: [ACTIVE, DISABLED]}
+    ResetInternalUserPasswordRequest:
+      type: object
+      required: [newPassword]
+      properties:
+        newPassword: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
+    InternalUserResponse:
+      type: object
+      required: [membershipId, userId, authUserId, username, displayName, memberType, status, roleIds]
+      properties:
+        membershipId: {type: integer, format: int64}
+        userId: {type: integer, format: int64}
        authUserId: {type: integer, format: int64}
-        userType: {type: string, enum: [PLATFORM, ENTERPRISE]}
+        username: {type: string}
        displayName: {type: string}
        phone: {type: string}
        email: {type: string, format: email}
+        memberType: {type: string, enum: [EMPLOYEE]}
+        memberNo: {type: string}
+        status: {type: string, enum: [ACTIVE, DISABLED]}
+        roleIds: {type: array, items: {type: integer, format: int64}}
    CreateMemberRequest:
      type: object
      required: [username, password, displayName, memberType]
@@ -350,15 +431,6 @@ components:
        detail: {type: string}
        postalCode: {type: string}
        isDefault: {type: boolean}
-    QualificationRequest:
-      type: object
-      required: [qualificationType, documentUrl]
-      properties:
-        qualificationType: {type: string, example: BUSINESS_LICENSE}
-        certificateNo: {type: string}
-        documentUrl: {type: string, format: uri}
-        validFrom: {type: string, format: date}
-        validTo: {type: string, format: date}
    CreateRoleRequest:
      type: object
      required: [roleCode, roleName]
@@ -12,12 +12,17 @@
 | 应用与配置扫描 | `src/main/java/com/baiyue/integration/IntegrationServiceApplication.java` |
 | `baiyue.integration` 配置 | `config/IntegrationProperties.java` |
 | 内部供应商状态 API | `controller/IntegrationProviderController.java` |
+| 重量 OCR 内部 API | `controller/WeightOcrController.java` |
 | 能力状态模型与服务 | `dto/ProviderStatus.java`、`service/ProviderStatusService.java` |
 | 适配器抽象 | `provider/IntegrationProviderAdapter.java` |
-| 百度 OCR | `provider/BaiduOcrAdapter.java` |
+| 百度 OCR 状态与客户端 | `provider/BaiduOcrAdapter.java`、`provider/ocr/BaiduMeterClient.java` |
+| 重量 OCR 协议模型 | `dto/ocr/` |
+| 重量 OCR 批处理 | `service/ocr/WeightOcrBatchService.java` |
+| 图片裁剪与重量筛选 | `service/ocr/ImageCropper.java`、`service/ocr/WeightCandidateSelector.java` |
+| OCR 文件访问边界 | `service/ocr/WeightOcrStoragePolicy.java` |
 | Amazon | `provider/AmazonLogisticsAdapter.java` |
 | 内部服务令牌 | `security/InternalServiceTokenGuard.java` |
-| 配置测试 | `src/test/java/com/baiyue/integration/config/IntegrationPropertiesTest.java` |
+| 配置与 OCR 测试 | `src/test/java/com/baiyue/integration/config/IntegrationPropertiesTest.java`、`src/test/java/com/baiyue/integration/service/ocr/` |
 | 本地/Nacos 配置 | `src/main/resources/application.yml`、`../config/nacos/{local,cn}/integration-service.yml` |

 ## 修改与验证
@@ -25,4 +30,7 @@
 - 第三方密钥、Token、请求原文和客户敏感数据不得写入源码或日志；配置应支持按供应商独立关闭。
 - 适配器负责外部协议转换、超时、错误归一化和安全降级；业务编排留在调用方服务。
 - 启用真实调用前补齐超时、重试边界、限流、幂等和可观测性，并避免在测试中访问真实供应商。
+- OCR 目录批处理只能访问 `WEIGHT_OCR_INPUT_ROOT` 和 `WEIGHT_OCR_OUTPUT_ROOT` 内的路径，不得恢复任意服务器路径读取。
+- OCR 接口只允许内部服务令牌调用；图片大小、解码像素数、单批数量和并发批次限制不得绕过。
+- OCR 原始响应和第三方密钥不得写入应用日志，真实供应商调用必须保持默认关闭。
 - 从父目录运行 `mvn -pl integration-service -am test`。
@@ -9,8 +9,8 @@

 | 功能 | 入口 |
 |---|---|
-| 商户订单创建、编辑、列表、详情、提交、取消 | `controller/MerchantFirstLegOrderController.java` |
-| 平台订单列表、详情、审核、接单、开始、完成、取消 | `controller/PlatformFirstLegOrderController.java` |
+| 商户订单创建、编辑、列表、详情、提交、取消 | `controller/MerchantFirstLegOrderController.java`；列表校验 `merchant:order:list`，详情校验 `merchant:order:view` |
+| 平台订单列表、详情、审核、接单、开始、完成、取消 | `controller/PlatformFirstLegOrderController.java`；列表和详情校验 `platform:order:list` |
 | 内部备注与快递信息 | `PlatformFirstLegOrderController.java` |
 | 核心编排与状态机 | `service/OrderApplicationService.java`、`entity/OrderStatus.java` |
 | 企业下单资格 | `service/OrderEligibilityGuard.java`、`client/TenantEligibilityClient.java` |
@@ -20,11 +20,12 @@
 | 主单、货物、参与方、历史、备注、Outbox | `entity/`、`mapper/`、`repository/OrderRepository.java` |
 | 表结构与一期扩展 | `src/main/resources/db/order.sql`、`phase1-masterdata-extension.sql`、`phase1-order-extension.sql` |
 | 模块说明 | `README-ORDER.md` |
-| 状态与主数据测试 | `src/test/java/com/baiyue/order/service/` |
+| 状态、主数据与接口权限测试 | `src/test/java/com/baiyue/order/service/`、`src/test/java/com/baiyue/order/controller/` |

 ## 修改与验证

 - 所有商户查询和写入必须执行租户/访问范围校验；平台操作必须验证权限及合法状态迁移。
+- 查询接口同样必须校验权限码；沿用 IAM 已初始化的权限资源，新增权限码时同步补充 IAM 初始化脚本与角色授权。
 - 已提交订单中的仓库、往来单位等快照不能随主数据修改而变化。
 - 跨服务只通过 `client/` 或事件演进，不跨库查询 IAM/Warehouse；跨域通知优先使用 Outbox。
 - 新增状态或动作时同步修改 Controller、Service 状态机、历史记录、DTO、SQL、前端消费者和测试。
@@ -80,6 +80,7 @@ public class MerchantFirstLegOrderController {
        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Merchant scope required / 需要商户端权限")
    })
    @GetMapping
+    @PreAuthorize("hasAuthority('merchant:order:list')")
    public ApiResponse<PageResult<OrderEntity>> page(@AuthenticationPrincipal AuthenticatedUser user,
                                                      @Valid OrderRequests.QueryRequest query) {
        return ApiResponse.success(service.page(OrderScopeGuard.merchant(user), query));
@@ -92,6 +93,7 @@ public class MerchantFirstLegOrderController {
        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Order not found / 订单不存在")
    })
    @GetMapping("/{id}")
+    @PreAuthorize("hasAuthority('merchant:order:view')")
    public ApiResponse<OrderDetailResponse> detail(
        @AuthenticationPrincipal AuthenticatedUser user,
        @Parameter(description = "Order ID / 订单 ID", example = "190000000000000001", required = true) @PathVariable long id) {
@@ -47,6 +47,7 @@ public class PlatformFirstLegOrderController {
        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform scope required / 需要平台端权限")
    })
    @GetMapping
+    @PreAuthorize("hasAuthority('platform:order:list')")
    public ApiResponse<PageResult<OrderEntity>> page(
        @AuthenticationPrincipal AuthenticatedUser user,
        @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true) @RequestParam long tenantId,
@@ -61,6 +62,7 @@ public class PlatformFirstLegOrderController {
        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Order not found in target tenant / 目标租户下订单不存在")
    })
    @GetMapping("/{id}")
+    @PreAuthorize("hasAuthority('platform:order:list')")
    public ApiResponse<OrderDetailResponse> detail(
        @AuthenticationPrincipal AuthenticatedUser user,
        @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true) @RequestParam long tenantId,
@@ -6,6 +6,7 @@ import com.baiyue.order.dto.OrderDetailResponse;
 import com.baiyue.order.dto.OrderRequests;
 import com.baiyue.order.entity.*;
 import com.baiyue.order.repository.OrderRepository;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.Resource;
@@ -14,10 +15,8 @@ import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.StringUtils;

 import java.time.LocalDateTime;
-import java.time.format.DateTimeFormatter;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.ThreadLocalRandom;
 import java.util.stream.Collectors;

@Service
@@ -33,7 +32,8 @@ public class OrderApplicationService {
        validatePrototypeFields(request);
        var snapshots = masterDataGuard.validate(tenantId, request);
        OrderEntity order = new OrderEntity();
-        order.setTenantId(tenantId); order.setOrderNo(nextNo()); order.setStatus(OrderStatus.DRAFT);
+        long orderId = IdWorker.getId();
+        order.setId(orderId); order.setTenantId(tenantId); order.setOrderNo(nextNo(orderId)); order.setStatus(OrderStatus.DRAFT);
        apply(order, request, snapshots); order.setCreatedBy(userId); order.setUpdatedBy(userId);
        repository.insertOrder(order);
        saveChildren(tenantId, userId, order.getId(), request);
@@ -182,8 +182,9 @@ public class OrderApplicationService {
        order.setShipmentId(request.shipmentId()); order.setReferenceId(request.referenceId());
    }
    private String formatAddress(com.baiyue.order.client.WarehouseClient.Detail detail) {
-        if (detail.addresses() == null || detail.addresses().isEmpty()) return null;
-        var a = detail.addresses().get(0);
+        if (detail.addresses() == null) return null;
+        var a = detail.addresses().stream().filter(java.util.Objects::nonNull).findFirst().orElse(null);
+        if (a == null) return null;
        return java.util.stream.Stream.of(a.countryCode(), a.stateProvince(), a.city(), a.district(),
                a.addressLine1(), a.addressLine2(), a.postalCode())
            .filter(StringUtils::hasText).collect(Collectors.joining(" "));
@@ -191,7 +192,7 @@ public class OrderApplicationService {
    private String formatReceivingTime(com.baiyue.order.client.WarehouseClient.Detail detail) {
        if (detail.capabilities() == null) return null;
        return detail.capabilities().stream()
-            .filter(c -> "RECEIVING".equals(c.capabilityCode()) && Boolean.TRUE.equals(c.enabled()))
+            .filter(c -> c != null && "RECEIVING".equals(c.capabilityCode()) && Boolean.TRUE.equals(c.enabled()))
            .map(c -> c.cutoffTime() == null ? "支持收货" : "每日 " + c.cutoffTime() + " 前收货")
            .findFirst().orElse(null);
    }
@@ -241,8 +242,7 @@ public class OrderApplicationService {
        event.setPublishStatus("PENDING"); event.setRetryCount(0); event.setCreatedAt(LocalDateTime.now());
        repository.insertOutbox(event);
    }
-    private String nextNo() {
-        return "FL" + LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyyMMddHHmmss"))
-                + ThreadLocalRandom.current().nextInt(100, 1000);
+    private String nextNo(long orderId) {
+        return "FL" + orderId;
    }
 }
@@ -8,6 +8,9 @@ import com.baiyue.order.dto.OrderRequests;
 import feign.FeignException;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
+import org.springframework.util.StringUtils;
+
+import java.util.Objects;

@Service
 public class OrderMasterDataGuard {
@@ -23,10 +26,10 @@ public class OrderMasterDataGuard {
        try {
            var partner=loadPartner(tenantId,request.customerId());
            var receiving=loadWarehouse(tenantId,request.receivingWarehouseId(),"收货仓库");
-            if (receiving.addresses()==null || receiving.addresses().isEmpty())
+            if (receiving.addresses()==null || receiving.addresses().stream().noneMatch(Objects::nonNull))
                throw new BizException(ResultCode.VALIDATION_FAILED,"收货仓库未配置地址");
            if (receiving.capabilities()==null || receiving.capabilities().stream().noneMatch(c ->
-                    "RECEIVING".equals(c.capabilityCode()) && Boolean.TRUE.equals(c.enabled())))
+                    c != null && "RECEIVING".equals(c.capabilityCode()) && Boolean.TRUE.equals(c.enabled())))
                throw new BizException(ResultCode.VALIDATION_FAILED,"仓库未启用收货能力");
            WarehouseClient.Detail destination=null;
            if (request.destinationWarehouseId()!=null) {
@@ -57,6 +60,7 @@ public class OrderMasterDataGuard {
        var value=response.data();
        if (!Long.valueOf(tenantId).equals(value.tenantId()) || !"ACTIVE".equals(value.status()))
            throw new BizException(ResultCode.FORBIDDEN,"往来单位不属于当前企业或已停用");
+        if (!StringUtils.hasText(value.partnerName())) throw unavailable("往来单位");
        return value;
    }
    private WarehouseClient.Detail loadWarehouse(long tenantId,long id,String name) {
@@ -66,6 +70,9 @@ public class OrderMasterDataGuard {
        var value=response.data();
        if (!Long.valueOf(tenantId).equals(value.warehouse().tenantId()) || !"ACTIVE".equals(value.warehouse().status()))
            throw new BizException(ResultCode.FORBIDDEN,name+"不属于当前企业或已停用");
+        if (!Long.valueOf(id).equals(value.warehouse().id()) || !StringUtils.hasText(value.warehouse().warehouseName())) {
+            throw unavailable(name);
+        }
        return value;
    }
    private BizException unavailable(String name) {
@@ -1,5 +1,6 @@
 SET NAMES utf8mb4;
 -- 订单服务独占数据库。其他服务只能通过 OpenAPI 或领域事件获取订单数据。
+
 CREATE DATABASE IF NOT EXISTS baiyue_order
  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
 USE baiyue_order;
@@ -1,12 +1,14 @@
 package com.baiyue.order.service;

 import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.order.client.PartnerClient;
 import com.baiyue.order.client.WarehouseClient;
 import com.baiyue.order.dto.OrderRequests;
 import org.junit.jupiter.api.Test;
 import java.math.BigDecimal;
+import java.util.Collections;
 import java.util.List;
 import static org.assertj.core.api.Assertions.*;
 import static org.mockito.Mockito.*;
@@ -32,6 +34,31 @@ class OrderMasterDataGuardTest {
        assertThatThrownBy(() -> new OrderMasterDataGuard(warehouses,partners,"token").validate(10002,request(7L,8L)))
            .isInstanceOf(BizException.class).hasMessageContaining("服务暂时不可用");
    }
+    @Test
+    void 主数据响应含空元素时返回受控业务错误而不是空指针异常() {
+        WarehouseClient warehouses=mock(WarehouseClient.class); PartnerClient partners=mock(PartnerClient.class);
+        var partner=new PartnerClient.Partner(7L,10001L,"服务端客户名","ACTIVE");
+        var wh=new WarehouseClient.Detail(new WarehouseClient.Warehouse(8L,10001L,"深圳仓","ACTIVE"),
+            Collections.singletonList(null), Collections.singletonList(null));
+        when(partners.active("token",10001,7)).thenReturn(ApiResponse.success(partner));
+        when(warehouses.active("token",10001,8)).thenReturn(ApiResponse.success(wh));
+
+        assertThatThrownBy(() -> new OrderMasterDataGuard(warehouses,partners,"token").validate(10001,request(7L,8L)))
+            .isInstanceOf(BizException.class)
+            .extracting(exception -> ((BizException) exception).getResultCode())
+            .isEqualTo(ResultCode.VALIDATION_FAILED);
+    }
+    @Test
+    void 缺失快照名称的主数据响应按服务不可用处理() {
+        WarehouseClient warehouses=mock(WarehouseClient.class); PartnerClient partners=mock(PartnerClient.class);
+        when(partners.active("token",10001,7)).thenReturn(ApiResponse.success(new PartnerClient.Partner(7L,10001L,null,"ACTIVE")));
+
+        assertThatThrownBy(() -> new OrderMasterDataGuard(warehouses,partners,"token").validate(10001,request(7L,8L)))
+            .isInstanceOf(BizException.class)
+            .extracting(exception -> ((BizException) exception).getResultCode())
+            .isEqualTo(ResultCode.SERVICE_UNAVAILABLE);
+        verifyNoInteractions(warehouses);
+    }
    private OrderRequests.SaveRequest request(Long partner,Long warehouse) {
        var party=new OrderRequests.Party("公司","联系人","13800138000",null,"CN",null,"深圳",null,"地址",null);
        var cargo=new OrderRequests.Cargo("货物",null,"CARTON",1,BigDecimal.ONE,BigDecimal.ONE,
@@ -5,6 +5,7 @@ import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.warehouse.entity.PartnerEntity;
 import com.baiyue.warehouse.service.PartnerQueryService;
+import jakarta.annotation.Resource;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.*;
 import java.nio.charset.StandardCharsets;
@@ -13,10 +14,14 @@ import java.security.MessageDigest;
@RestController
@RequestMapping("/internal/warehouse-partners")
 public class InternalPartnerController {
-    private final PartnerQueryService service; private final byte[] expected;
-    public InternalPartnerController(PartnerQueryService service,
+    @Resource
+    private PartnerQueryService service;
+
+    private final byte[] expected;
+
+    public InternalPartnerController(
            @Value("${baiyue.security.internal-service-token}") String token) {
-        this.service=service; this.expected=token.getBytes(StandardCharsets.UTF_8);
+        this.expected=token.getBytes(StandardCharsets.UTF_8);
    }
    @GetMapping("/{tenantId}/{id}/active")
    public ApiResponse<PartnerEntity> active(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,
@@ -5,6 +5,7 @@ import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.warehouse.dto.WarehouseDetailResponse;
 import com.baiyue.warehouse.service.WarehouseApplicationService;
+import jakarta.annotation.Resource;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.*;
 import java.nio.charset.StandardCharsets;
@@ -13,11 +14,14 @@ import java.security.MessageDigest;
@RestController
@RequestMapping("/internal/warehouses")
 public class InternalWarehouseController {
-    private final WarehouseApplicationService service;
+    @Resource
+    private WarehouseApplicationService service;
+
    private final byte[] expected;
-    public InternalWarehouseController(WarehouseApplicationService service,
+
+    public InternalWarehouseController(
            @Value("${baiyue.security.internal-service-token}") String token) {
-        this.service = service; this.expected = token.getBytes(StandardCharsets.UTF_8);
+        this.expected = token.getBytes(StandardCharsets.UTF_8);
    }
    @GetMapping("/{tenantId}/{id}/active")
    public ApiResponse<WarehouseDetailResponse> active(
@@ -4,6 +4,7 @@ import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.security.AuthenticatedUser;
 import com.baiyue.warehouse.entity.PartnerEntity;
 import com.baiyue.warehouse.service.PartnerQueryService;
+import jakarta.annotation.Resource;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import java.util.List;
@@ -11,8 +12,9 @@ import java.util.List;
@RestController
@RequestMapping("/api/merchant/v1/partners")
 public class MerchantPartnerController {
-    private final PartnerQueryService service;
-    public MerchantPartnerController(PartnerQueryService service) { this.service=service; }
+    @Resource
+    private PartnerQueryService service;
+
    @GetMapping("/candidates")
    public ApiResponse<List<PartnerEntity>> candidates(@AuthenticationPrincipal AuthenticatedUser user,
            @RequestParam(required=false) String keyword,@RequestParam(required=false) String type) {