优化

iam/src/main/resources/openapi/iam-v1.yaml

@@ -869,6 +869,37 @@ paths:
         '400': {$ref: '#/components/responses/BadRequest'}
         '403': {$ref: '#/components/responses/Forbidden'}
         '409': {$ref: '#/components/responses/Conflict'}
+  /internal/iam/authorization-snapshot:
+    post:
+      tags: [IAM Resources / IAM 资源]
+      summary: Read a consistent authoritative authorization snapshot
+      description: Internal service credential required; no public Gateway route. Identity, permissions, warehouse bindings and monotonic subject/customer versions are read by one MVCC SELECT statement, without cross-statement snapshot mixing. Auth fingerprints this state for login, refresh and every Access validation.
+      security: []
+      parameters:
+        - {$ref: '#/components/parameters/InternalServiceToken'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [userId, tenantId, membershipId, appCode]
+              properties:
+                userId: {type: integer, format: int64}
+                tenantId: {type: integer, format: int64}
+                membershipId: {type: integer, format: int64}
+                appCode: {type: string, enum: [PLATFORM, MERCHANT]}
+      responses:
+        '200':
+          description: Consistent snapshot or business error
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - {$ref: '#/components/schemas/ApiResponse'}
+                  - type: object
+                    properties:
+                      data: {$ref: '#/components/schemas/AuthorizationSnapshot'}
   /internal/iam/merchant-registrations/{authUserId}:
     get:
       tags: [IAM Resources / IAM 资源]
@@ -1747,3 +1778,18 @@ components:
       properties:
         roleId: {type: integer, format: int64}
         permissionIds: {type: array, items: {type: integer, format: int64}}
+    AuthorizationSnapshot:
+      type: object
+      required: [userId, tenantId, membershipId, appCode, clientType, roles, permissions, permissionVersion, tenantVersion]
+      properties:
+        userId: {type: integer, format: int64}
+        tenantId: {type: integer, format: int64}
+        membershipId: {type: integer, format: int64}
+        appCode: {type: string, enum: [PLATFORM, MERCHANT]}
+        clientType: {type: string}
+        roles: {type: array, items: {type: string}}
+        permissions: {type: array, items: {type: string}}
+        permissionVersion: {type: integer, format: int64, description: Persistent subject security epoch}
+        tenantVersion: {type: integer, format: int64, description: Persistent customer status epoch}
+        overseasWarehouseId: {type: integer, format: int64, nullable: true}
+        domesticWarehouseId: {type: integer, format: int64, nullable: true}