refactor(api): 统一 HTTP 200 响应契约

auth/src/main/java/com/baiyue/auth/client/AuthorizationLoader.java

@@ -29,14 +29,25 @@ public class AuthorizationLoader {
             var response = client.load(internalToken, new AuthorizationSnapshotRequest(
                     account.getId(), account.getDefaultTenantId(), account.getDefaultMembershipId(),
                     account.getDefaultAppCode()));
-            if (response == null || !response.successful() || response.data() == null) {
+            if (response == null) {
+                throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
+            }
+            if (!response.successful()) {
+                ResultCode code = ResultCode.of(response.code());
+                if (code == ResultCode.BAD_REQUEST || code == ResultCode.FORBIDDEN || code == ResultCode.NOT_FOUND) {
+                    throw new BizException(ResultCode.FORBIDDEN, "账号没有有效的 IAM 身份或权限");
+                }
+                throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
+            }
+            if (response.data() == null) {
                 throw new BizException(ResultCode.FORBIDDEN, "账号没有有效的 IAM 身份或权限");
             }
             return response.data();
         } catch (FeignException exception) {
-            if (exception.status() == 400 || exception.status() == 403 || exception.status() == 404) {
-                throw new BizException(ResultCode.FORBIDDEN, "账号没有有效的 IAM 身份或权限");
-            }
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
+        } catch (BizException exception) {
+            throw exception;
+        } catch (RuntimeException exception) {
             throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
         }
     }

auth/src/main/java/com/baiyue/auth/controller/AuthController.java

@@ -55,10 +55,7 @@ public class AuthController {
     @SecurityRequirements
     @Operation(summary = "Login / 登录", description = "Validate credentials and issue access and refresh tokens. / 校验账号密码并签发访问令牌和刷新令牌。")
     @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Login succeeded / 登录成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid request / 请求参数错误"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "401", description = "Invalid username or password / 用户名或密码错误"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "429", description = "Account temporarily locked / 账号暂时锁定")
+        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Success or authentication business failure; inspect body code / 成功或认证业务失败，按响应体 code 判断"),
     })
     @PostMapping("/login")
     public ApiResponse<TokenResponse> login(@Valid @RequestBody LoginRequest request) {
@@ -68,8 +65,7 @@ public class AuthController {
     @SecurityRequirements
     @Operation(summary = "Refresh token / 刷新令牌", description = "Rotate a valid refresh token and issue a new token pair. / 轮换有效刷新令牌并签发新的令牌对。")
     @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Token refreshed / 刷新成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "401", description = "Refresh token invalid or expired / 刷新令牌无效或已过期")
+        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Success or refresh-token business failure; inspect body code / 成功或刷新令牌业务失败，按响应体 code 判断")
     })
     @PostMapping("/refresh")
     public ApiResponse<TokenResponse> refresh(@Valid @RequestBody RefreshRequest request) {

auth/src/main/java/com/baiyue/auth/service/MerchantRegistrationService.java

@@ -37,12 +37,24 @@ public class MerchantRegistrationService {
                     new IamOnboardingClient.OnboardingRequest(accountId, request.displayName(),
                             request.companyName(), request.legalPerson(), request.legalPhone(),
                             request.contactEmail(), request.countryCode(), request.address()));
-            if (response == null || !response.successful() || response.data() == null) {
+            if (response == null) {
+                throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM registration failed");
+            }
+            if (!response.successful()) {
+                ResultCode code = ResultCode.of(response.code());
+                String message = response.message() == null || response.message().isBlank()
+                        ? code.message() : response.message();
+                throw new BizException(code, message);
+            }
+            if (response.data() == null) {
                 throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM registration failed");
             }
             onboarding = response.data();
         } catch (FeignException exception) {
-            if (exception.status() == 409) throw new BizException(ResultCode.CONFLICT, "Enterprise already exists");
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM registration service is unavailable");
+        } catch (BizException exception) {
+            throw exception;
+        } catch (RuntimeException exception) {
             throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM registration service is unavailable");
         }