优化

iam/src/main/resources/application-dev.yml

@@ -1,6 +0,0 @@
-spring:
-  datasource:
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: ${IAM_DB_URL:jdbc:mysql://127.0.0.1:3306/baiyue_iam?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&rewriteBatchedStatements=true}
-    username: ${IAM_DB_USERNAME:root}
-    password: ${IAM_DB_PASSWORD:123456}

iam/src/main/resources/application-test.yml

@@ -1,15 +0,0 @@
-spring:
-  cloud:
-    nacos:
-      config:
-        namespace: ${NACOS_NAMESPACE:test}
-        group: ${NACOS_GROUP:BAIYUE}
-        encode: UTF-8
-      discovery:
-        namespace: ${NACOS_NAMESPACE:test}
-        group: ${NACOS_GROUP:BAIYUE}
-  datasource:
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: ${IAM_TEST_DB_URL:jdbc:mysql://${TEST_DB_HOST:8.163.30.128}:${TEST_DB_PORT:3306}/baiyue_iam?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&useSSL=false&allowPublicKeyRetrieval=true&rewriteBatchedStatements=true}
-    username: ${IAM_TEST_DB_USERNAME:${TEST_DB_USERNAME:root}}
-    password: ${IAM_TEST_DB_PASSWORD:${TEST_DB_PASSWORD}}

iam/src/main/resources/application.yml

@@ -2,29 +2,28 @@ server:
   port: ${IAM_PORT:9201}
 spring:
   profiles:
-    active: ${SPRING_PROFILES_ACTIVE:dev}
+    active: ${SPRING_PROFILES_ACTIVE:test}
   application:
     name: iam-service
   config:
     import:
-      - optional:nacos:baiyue-common.yml?group=BAIYUE&refreshEnabled=true
-      - optional:nacos:${spring.application.name}.yml?group=BAIYUE&refreshEnabled=true
+      - nacos:baiyue-common.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
+      - nacos:${spring.application.name}.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
   cloud:
     nacos:
-      server-addr: ${NACOS_SERVER_ADDR:127.0.0.1:8848}
-      username: ${NACOS_USERNAME:nacos}
-      password: ${NACOS_PASSWORD:nacos}
+      server-addr: ${NACOS_SERVER_ADDR}
+      username: ${NACOS_USERNAME}
+      password: ${NACOS_PASSWORD}
       discovery:
         enabled: ${NACOS_DISCOVERY_ENABLED:true}
         register-enabled: ${NACOS_REGISTER_ENABLED:true}
         group: ${NACOS_GROUP:BAIYUE}
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
       config:
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
         encode: UTF-8
 baiyue:
   security-event:
-    event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}
   customer-dimension-initialization:
     fixed-delay-ms: ${CUSTOMER_DIMENSION_INITIALIZATION_FIXED_DELAY_MS:5000}
     max-attempts: ${CUSTOMER_DIMENSION_INITIALIZATION_MAX_ATTEMPTS:12}
@@ -36,6 +35,5 @@ baiyue:
     auth:
       url: ${AUTH_SERVICE_URL:}
   security:
-    jwt-secret: ${JWT_SECRET:change-me-to-at-least-32-bytes-long-before-start}
-    internal-service-token: ${INTERNAL_SERVICE_TOKEN:change-me-to-an-internal-token-at-least-32-bytes-long}
+    internal-service-token: ${INTERNAL_SERVICE_TOKEN}
 management.endpoints.web.exposure.include: health,info,prometheus

iam/src/main/resources/db/security-event-outbox.sql

@@ -1,35 +0,0 @@
-USE baiyue_iam;
-
-CREATE TABLE IF NOT EXISTS iam_security_subject_version (
-  auth_user_id BIGINT NOT NULL COMMENT '认证账号ID',
-  permission_version BIGINT NOT NULL DEFAULT 0 COMMENT '权限版本，身份或授权变化时单调递增',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  PRIMARY KEY (auth_user_id)
-) ENGINE=InnoDB COMMENT='安全主体权限版本';
-
-CREATE TABLE IF NOT EXISTS iam_security_tenant_version (
-  tenant_id BIGINT NOT NULL COMMENT '客户ID',
-  status_version BIGINT NOT NULL DEFAULT 0 COMMENT '客户状态单调版本',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  PRIMARY KEY (tenant_id)
-) ENGINE=InnoDB COMMENT='客户状态事件版本';
-
-CREATE TABLE IF NOT EXISTS iam_security_event_outbox (
-  event_id VARCHAR(64) NOT NULL COMMENT '全局事件ID，消费者幂等键',
-  event_type VARCHAR(64) NOT NULL COMMENT '安全事件类型',
-  aggregate_type VARCHAR(32) NOT NULL COMMENT 'USER、TENANT或AUTHORIZATION',
-  aggregate_id VARCHAR(64) NOT NULL COMMENT '聚合标识',
-  payload_json JSON NOT NULL COMMENT '标准跨区事件信封，不含密码、令牌和权限全集',
-  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT '发送状态：PENDING、SENDING、SENT、DEAD',
-  attempt_count INT NOT NULL DEFAULT 0 COMMENT '发送尝试次数',
-  next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '下次重试时间',
-  lease_owner VARCHAR(128) NULL COMMENT '租约持有者',
-  lease_until DATETIME(3) NULL COMMENT '租约到期时间',
-  last_error VARCHAR(1000) NULL COMMENT '最近一次错误',
-  sent_at DATETIME(3) NULL COMMENT '发送成功时间',
-  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  PRIMARY KEY (event_id),
-  KEY idx_security_outbox_publish (status,next_retry_at,lease_until,created_at),
-  KEY idx_security_outbox_aggregate (aggregate_type,aggregate_id,created_at)
-) ENGINE=InnoDB COMMENT='IAM可靠安全事件本地发送箱';

iam/src/main/resources/db/security-version.sql

@@ -0,0 +1,16 @@
+USE baiyue_iam;
+
+CREATE TABLE IF NOT EXISTS iam_security_subject_version (
+  auth_user_id BIGINT NOT NULL COMMENT '认证账号ID',
+  permission_version BIGINT NOT NULL DEFAULT 0 COMMENT '权限版本，身份或授权变化时单调递增',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
+  PRIMARY KEY (auth_user_id)
+) ENGINE=InnoDB COMMENT='安全主体权限版本';
+
+CREATE TABLE IF NOT EXISTS iam_security_tenant_version (
+  tenant_id BIGINT NOT NULL COMMENT '客户ID',
+  status_version BIGINT NOT NULL DEFAULT 0 COMMENT '客户状态单调版本',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
+  PRIMARY KEY (tenant_id)
+) ENGINE=InnoDB COMMENT='客户状态持久化版本';
+

iam/src/main/resources/openapi/iam-v1.yaml

@@ -869,6 +869,37 @@ paths:
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /internal/iam/authorization-snapshot:
+    post:
+      tags: [IAM Resources / IAM 资源]
+      summary: Read a consistent authoritative authorization snapshot
+      description: Internal service credential required; no public Gateway route. Identity, permissions, warehouse bindings and monotonic subject/customer versions are read by one MVCC SELECT statement, without cross-statement snapshot mixing. Auth fingerprints this state for login, refresh and every Access validation.
+      security: []
+      parameters:
+        - {$ref: '#/components/parameters/InternalServiceToken'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [userId, tenantId, membershipId, appCode]
+              properties:
+                userId: {type: integer, format: int64}
+                tenantId: {type: integer, format: int64}
+                membershipId: {type: integer, format: int64}
+                appCode: {type: string, enum: [PLATFORM, MERCHANT]}
+      responses:
+        '200':
+          description: Consistent snapshot or business error
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - {$ref: '#/components/schemas/ApiResponse'}
+                  - type: object
+                    properties:
+                      data: {$ref: '#/components/schemas/AuthorizationSnapshot'}
   /internal/iam/merchant-registrations/{authUserId}:
     get:
       tags: [IAM Resources / IAM 资源]
@@ -1747,3 +1778,18 @@ components:
       properties:
         roleId: {type: integer, format: int64}
         permissionIds: {type: array, items: {type: integer, format: int64}}
+    AuthorizationSnapshot:
+      type: object
+      required: [userId, tenantId, membershipId, appCode, clientType, roles, permissions, permissionVersion, tenantVersion]
+      properties:
+        userId: {type: integer, format: int64}
+        tenantId: {type: integer, format: int64}
+        membershipId: {type: integer, format: int64}
+        appCode: {type: string, enum: [PLATFORM, MERCHANT]}
+        clientType: {type: string}
+        roles: {type: array, items: {type: string}}
+        permissions: {type: array, items: {type: string}}
+        permissionVersion: {type: integer, format: int64, description: Persistent subject security epoch}
+        tenantVersion: {type: integer, format: int64, description: Persistent customer status epoch}
+        overseasWarehouseId: {type: integer, format: int64, nullable: true}
+        domesticWarehouseId: {type: integer, format: int64, nullable: true}