优化

lastleg-service/src/main/resources/db/lastleg.sql

@@ -1624,3 +1624,42 @@ CREATE TABLE IF NOT EXISTS ll_local_looseboard_operation (
   UNIQUE KEY uk_ll_local_looseboard_operation_key(customer_id,order_id,idempotency_key),
   KEY idx_ll_local_looseboard_operation_order(customer_id,order_id,created_at)
 ) ENGINE=InnoDB COMMENT='本土散板订单幂等操作账';
+
+CREATE TABLE IF NOT EXISTS ll_security_event_inbox (
+  event_id VARCHAR(64) NOT NULL COMMENT '跨区安全事件ID',
+  event_type VARCHAR(96) NOT NULL COMMENT 'IAM安全事件类型',
+  payload_hash CHAR(64) NOT NULL COMMENT '规范化载荷SHA-256哈希',
+  payload_json JSON NOT NULL COMMENT '冻结事件载荷JSON',
+  status VARCHAR(16) NOT NULL COMMENT '消费状态：RECEIVED或PROCESSED',
+  result VARCHAR(32) NULL COMMENT '处理结果：APPLIED、STALE、DUPLICATE或DUPLICATE_VERSION',
+  received_at DATETIME(3) NOT NULL COMMENT '接收时间',
+  processed_at DATETIME(3) NULL COMMENT '处理完成时间',
+  PRIMARY KEY (event_id),
+  KEY idx_security_inbox_type_time (event_type,received_at)
+) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者收件箱';
+
+CREATE TABLE IF NOT EXISTS ll_security_projection (
+  aggregate_type VARCHAR(32) NOT NULL COMMENT '聚合类型：USER、TENANT或AUTHORIZATION',
+  aggregate_id VARCHAR(64) NOT NULL COMMENT '用户或客户聚合ID',
+  tenant_id BIGINT NOT NULL COMMENT '平台0或客户ID',
+  security_status VARCHAR(24) NULL COMMENT '当前安全状态：ACTIVE或DISABLED',
+  permission_version BIGINT NULL COMMENT '当前单调权限版本',
+  aggregate_version BIGINT NOT NULL COMMENT '事件聚合单调版本',
+  payload_hash CHAR(64) NOT NULL COMMENT '当前版本载荷哈希',
+  last_event_id VARCHAR(64) NOT NULL COMMENT '最后应用的事件ID',
+  changed_at DATETIME(3) NOT NULL COMMENT '国内IAM事实发生时间',
+  updated_at DATETIME(3) NOT NULL COMMENT '投影更新时间',
+  PRIMARY KEY (aggregate_type,aggregate_id),
+  KEY idx_security_projection_tenant (tenant_id),
+  KEY idx_security_projection_permission (aggregate_id,permission_version)
+) ENGINE=InnoDB COMMENT='海外IAM安全状态与权限版本投影';
+
+-- 开发基线固定管理员；后续真实 IAM 事件从 aggregate_version=1 单调覆盖该 version=0 投影。
+INSERT IGNORE INTO ll_security_projection (
+  aggregate_type,aggregate_id,tenant_id,security_status,permission_version,aggregate_version,
+  payload_hash,last_event_id,changed_at,updated_at
+) VALUES
+  ('USER','1000001',0,'ACTIVE',0,0,SHA2('lastleg-baseline:platform_admin:USER:0',256),
+   'baseline-platform-admin-user-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000'),
+  ('AUTHORIZATION','1000001',0,NULL,0,0,SHA2('lastleg-baseline:platform_admin:AUTHORIZATION:0',256),
+   'baseline-platform-admin-authorization-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000');