feat(phase3): 收口父子单与全链路验收

common-security/src/main/java/com/baiyue/common/security/AccessTokenSession.java

@@ -0,0 +1,15 @@
+package com.baiyue.common.security;
+
+import java.util.Set;
+
+/** Server-side access session and its current authorization snapshot. */
+public record AccessTokenSession(int version, Long userId, Set<String> roles,
+                                 Set<String> permissions) {
+    public AccessTokenSession {
+        if (version != 1 || userId == null || userId <= 0) {
+            throw new IllegalArgumentException("Invalid access token session");
+        }
+        roles = roles == null ? Set.of() : Set.copyOf(roles);
+        permissions = permissions == null ? Set.of() : Set.copyOf(permissions);
+    }
+}