USE baiyue_iam;

CREATE TABLE IF NOT EXISTS iam_security_subject_version (
  auth_user_id BIGINT NOT NULL COMMENT '认证账号ID',
  permission_version BIGINT NOT NULL DEFAULT 0 COMMENT '权限版本，身份或授权变化时单调递增',
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
  PRIMARY KEY (auth_user_id)
) ENGINE=InnoDB COMMENT='安全主体权限版本';

CREATE TABLE IF NOT EXISTS iam_security_tenant_version (
  tenant_id BIGINT NOT NULL COMMENT '客户ID',
  status_version BIGINT NOT NULL DEFAULT 0 COMMENT '客户状态单调版本',
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
  PRIMARY KEY (tenant_id)
) ENGINE=InnoDB COMMENT='客户状态事件版本';

CREATE TABLE IF NOT EXISTS iam_security_event_outbox (
  event_id VARCHAR(64) NOT NULL COMMENT '全局事件ID，消费者幂等键',
  event_type VARCHAR(64) NOT NULL COMMENT '安全事件类型',
  aggregate_type VARCHAR(32) NOT NULL COMMENT 'USER、TENANT或AUTHORIZATION',
  aggregate_id VARCHAR(64) NOT NULL COMMENT '聚合标识',
  payload_json JSON NOT NULL COMMENT '标准跨区事件信封，不含密码、令牌和权限全集',
  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT '发送状态：PENDING、SENDING、SENT、DEAD',
  attempt_count INT NOT NULL DEFAULT 0 COMMENT '发送尝试次数',
  next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '下次重试时间',
  lease_owner VARCHAR(128) NULL COMMENT '租约持有者',
  lease_until DATETIME(3) NULL COMMENT '租约到期时间',
  last_error VARCHAR(1000) NULL COMMENT '最近一次错误',
  sent_at DATETIME(3) NULL COMMENT '发送成功时间',
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
  PRIMARY KEY (event_id),
  KEY idx_security_outbox_publish (status,next_retry_at,lease_until,created_at),
  KEY idx_security_outbox_aggregate (aggregate_type,aggregate_id,created_at)
) ENGINE=InnoDB COMMENT='IAM可靠安全事件本地发送箱';