优化

deploy/docker-compose.overseas.yml

@@ -47,6 +47,8 @@ services:
       CORS_ALLOW_CREDENTIALS: ${CORS_ALLOW_CREDENTIALS:-false}
       AUTH_SESSION_VALIDATION_URL: ${AUTH_SESSION_VALIDATION_URL}
       PDA_SESSION_VALIDATION_TIMEOUT: ${PDA_SESSION_VALIDATION_TIMEOUT:-2s}
+      OVERSEAS_SECURITY_SERVICE_URL: ${OVERSEAS_SECURITY_SERVICE_URL:-http://overseas-security-service:9307}
+      OVERSEAS_SECURITY_VALIDATION_TIMEOUT: ${OVERSEAS_SECURITY_VALIDATION_TIMEOUT:-2s}
 
   lastleg-service:
     <<: *overseas-common
@@ -92,11 +94,25 @@ services:
       EVENT_BRIDGE_DB_USERNAME: ${EVENT_BRIDGE_OVERSEAS_DB_USERNAME}
       EVENT_BRIDGE_DB_PASSWORD: ${EVENT_BRIDGE_OVERSEAS_DB_PASSWORD}
       EVENT_CONSUMER_URL: ${EVENT_CONSUMER_URL:-http://lastleg-service:9303/internal/lastleg/events}
+      OVERSEAS_SECURITY_EVENT_CONSUMER_URL: ${OVERSEAS_SECURITY_EVENT_CONSUMER_URL:-http://overseas-security-service:9307/internal/overseas-security/v1/events}
     networks:
       firstleg-overseas-network:
       infra-network:
         aliases: [event-bridge-overseas]
 
+  overseas-security-service:
+    <<: *overseas-common
+    image: ${IMAGE_REPOSITORY}/overseas-security-service:${IMAGE_TAG}
+    container_name: firstleg-${DEPLOY_ENV:-test}-overseas-security
+    ports: ["${PUBLISHED_BIND_ADDRESS:-127.0.0.1}:${OVERSEAS_SECURITY_PORT:-9307}:9307"]
+    volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/overseas-security-service:/app/logs"]
+    environment:
+      <<: *overseas-environment
+      SERVER_PORT: 9307
+      OVERSEAS_SECURITY_DB_URL: ${OVERSEAS_SECURITY_DB_URL}
+      OVERSEAS_SECURITY_DB_USERNAME: ${OVERSEAS_SECURITY_DB_USERNAME}
+      OVERSEAS_SECURITY_DB_PASSWORD: ${OVERSEAS_SECURITY_DB_PASSWORD}
+
 networks:
   firstleg-overseas-network:
     name: firstleg-${DEPLOY_ENV:-test}-overseas-network

deploy/scripts/deploy-built-service.sh

@@ -67,7 +67,7 @@ env_file_value() {
 }
 
 case "$SERVICE" in
-  gateway-overseas|lastleg-service|warehouse-overseas-service)
+  gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service)
     COMPOSE_FILE="deploy/docker-compose.overseas.yml"
     PROJECT_NAME="firstleg-$DEPLOY_ENV-overseas"
     ;;
@@ -101,6 +101,15 @@ if [ "$SERVICE" = "gateway-overseas" ]; then
   fi
 fi
 
+if [ "$SERVICE" = "overseas-security-service" ]; then
+  for key in OVERSEAS_SECURITY_DB_URL OVERSEAS_SECURITY_DB_USERNAME OVERSEAS_SECURITY_DB_PASSWORD; do
+    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
+      echo "部署 overseas-security-service 时，环境文件必须包含非空 $key" >&2
+      exit 2
+    fi
+  done
+fi
+
 for file in "$ENV_FILE" "$COMPOSE_FILE"; do
   if [ ! -f "$file" ]; then
     echo "必需文件不存在: $file" >&2
@@ -118,7 +127,7 @@ if [ "$SERVICE" = "finance" ]; then
 fi
 
 case "$SERVICE" in
-  gateway-overseas|lastleg-service|warehouse-overseas-service)
+  gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service)
     for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
       if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
         echo "部署海外服务时，环境文件必须包含非空 $key" >&2

deploy/scripts/deploy-services.sh

@@ -39,7 +39,7 @@ env_file_value() {
 DEPLOY_REGION=CN
 for service in $SERVICES; do
   case "$service" in
-    gateway-overseas|lastleg-service|warehouse-overseas-service) DEPLOY_REGION=OVERSEAS ;;
+    gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service) DEPLOY_REGION=OVERSEAS ;;
     event-bridge-service)
       BRIDGE_REGION="${EVENT_BRIDGE_REGION_OVERRIDE:-}"
       if [ -z "$BRIDGE_REGION" ] && env_file_has_key REGION_CODE; then
@@ -60,7 +60,7 @@ done
 if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
   for service in $SERVICES; do
     case "$service" in
-      gateway-overseas|lastleg-service|warehouse-overseas-service|event-bridge-service) ;;
+      gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service|event-bridge-service) ;;
       *) echo "一次部署不得混合国内与海外服务: $SERVICE_CSV" >&2; exit 2 ;;
     esac
   done
@@ -80,6 +80,17 @@ if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
   done
 fi
 
+case " $SERVICES " in
+  *" overseas-security-service "*)
+    for key in OVERSEAS_SECURITY_DB_URL OVERSEAS_SECURITY_DB_USERNAME OVERSEAS_SECURITY_DB_PASSWORD; do
+      if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
+        echo "部署 overseas-security-service 时，环境文件必须包含非空 $key" >&2
+        exit 2
+      fi
+    done
+    ;;
+esac
+
 case " $SERVICES " in
   *" gateway-overseas "*)
     if ! env_file_has_key AUTH_SESSION_VALIDATION_URL || [ -z "$(env_file_value AUTH_SESSION_VALIDATION_URL)" ]; then

deploy/service-map.yml

@@ -8,6 +8,11 @@ services:
     jar: gateway-overseas/target/gateway-overseas-1.0.0-SNAPSHOT.jar
     port: 9300
     regions: [OVERSEAS]
+  overseas-security-service:
+    artifactId: overseas-security-service
+    jar: overseas-security-service/target/overseas-security-service-1.0.0-SNAPSHOT.jar
+    port: 9307
+    regions: [OVERSEAS]
   auth:
     artifactId: auth-service
     jar: auth/target/auth-service-1.0.0-SNAPSHOT.jar

deploy/sql/README.md

@@ -3,7 +3,7 @@
 ## 唯一数据库初始化与发布入口
 
 - 国内区域固定入口：`头程数据库统一增量-MySQL8.sql`。文件名保留历史兼容，内容维护为当前完整数据库基线和存量环境兼容升级，不再按日期拆分发布脚本。
-- 海外区域固定增量入口：`海外区域统一增量-MySQL8.sql`；空库先分别执行 `lastleg-service/src/main/resources/db/lastleg.sql` 与 `warehouse-overseas-service/src/main/resources/db/warehouse.sql` 基线，再执行该入口。固定入口同时升级 `baiyue_lastleg` 与 `baiyue_lastlag_warehouse`，当前包含海外主数据、业务、入仓库存与海外仓托盘兼容结构，后续继续追加到同一入口，不按日期拆分。
+- 海外区域固定增量入口：`海外区域统一增量-MySQL8.sql`；空库先分别执行 `lastleg-service/src/main/resources/db/lastleg.sql`、`warehouse-overseas-service/src/main/resources/db/warehouse.sql` 与 `overseas-security-service/src/main/resources/db/overseas-security.sql` 基线，再执行该入口。固定入口升级 `baiyue_lastleg`、`baiyue_lastlag_warehouse` 与 `baiyue_overseas_security`，后者保存 IAM 安全事件消费者 Inbox 和可恢复投影；Redis 只作可重建镜像。
 - 国内、海外 Compose 部署默认设置 `SPRING_SQL_INIT_MODE=never`，执行任一 SQL 均需用户单独授权。
 - 该脚本汇总一期、二期及已实现三期出仓能力的数据库基线、存量升级、IAM 权限资源和最终结构校验，适用于 MySQL 8.0。
 - 正式上线前的数据库变更直接维护该文件中的当前基线、存量兼容处理和最终校验，不再创建按日期拆分的发布 SQL；正式上线后的迁移策略在生产发布规范中另行冻结。

deploy/sql/海外区域统一增量-MySQL8.sql

@@ -919,4 +919,34 @@ END$$
 DELIMITER ;
 CALL assert_phase4_pda_operations_ready();
 DROP PROCEDURE assert_phase4_pda_operations_ready;
-SELECT 'PASS' AS migration_status, '海外仓报价、月度汇率、车辆、海外业务、入仓库存与海外仓托盘结构已就绪' AS message;
+
+CREATE DATABASE IF NOT EXISTS baiyue_overseas_security DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
+USE baiyue_overseas_security;
+CREATE TABLE IF NOT EXISTS overseas_security_event_inbox (
+  event_id VARCHAR(64) NOT NULL, event_type VARCHAR(96) NOT NULL, payload_hash CHAR(64) NOT NULL,
+  payload_json JSON NOT NULL, status VARCHAR(16) NOT NULL, result VARCHAR(32) NULL,
+  received_at DATETIME(3) NOT NULL, processed_at DATETIME(3) NULL,
+  PRIMARY KEY (event_id), KEY idx_security_inbox_type_time (event_type,received_at)
+) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者Inbox';
+CREATE TABLE IF NOT EXISTS overseas_security_projection (
+  aggregate_type VARCHAR(32) NOT NULL, aggregate_id VARCHAR(64) NOT NULL, tenant_id BIGINT NOT NULL,
+  security_status VARCHAR(24) NULL, permission_version BIGINT NULL, aggregate_version BIGINT NOT NULL,
+  payload_hash CHAR(64) NOT NULL, last_event_id VARCHAR(64) NOT NULL,
+  changed_at DATETIME(3) NOT NULL, updated_at DATETIME(3) NOT NULL,
+  PRIMARY KEY (aggregate_type,aggregate_id), KEY idx_security_projection_tenant (tenant_id),
+  KEY idx_security_projection_permission (aggregate_id,permission_version)
+) ENGINE=InnoDB COMMENT='海外IAM安全状态与权限版本投影';
+
+DROP PROCEDURE IF EXISTS assert_overseas_security_projection_ready;
+DELIMITER $$
+CREATE PROCEDURE assert_overseas_security_projection_ready()
+BEGIN
+  IF (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='baiyue_overseas_security'
+      AND table_name IN ('overseas_security_event_inbox','overseas_security_projection')) <> 2 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外IAM安全Inbox或投影表未完整部署';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_overseas_security_projection_ready();
+DROP PROCEDURE assert_overseas_security_projection_ready;
+SELECT 'PASS' AS migration_status, '海外仓业务、海外仓资源与IAM安全投影结构已就绪' AS message;