USE baiyue_iam;

CREATE TABLE IF NOT EXISTS iam_security_subject_version (
  auth_user_id BIGINT NOT NULL COMMENT '认证账号ID',
  permission_version BIGINT NOT NULL DEFAULT 0 COMMENT '权限版本，角色或权限变化时单调递增',
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (auth_user_id)
) ENGINE=InnoDB COMMENT='安全主体权限版本';

CREATE TABLE IF NOT EXISTS iam_security_event_outbox (
  event_id VARCHAR(64) NOT NULL COMMENT '全局事件ID，消费者幂等键', event_type VARCHAR(64) NOT NULL,
  aggregate_type VARCHAR(32) NOT NULL COMMENT 'USER、ACCOUNT、AUTHORIZATION', aggregate_id VARCHAR(64) NOT NULL,
  payload_json JSON NOT NULL COMMENT '不含密码、令牌和权限全集的安全事件',
  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT 'PENDING、SENDING、SENT、DEAD',
  attempt_count INT NOT NULL DEFAULT 0, next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  lease_owner VARCHAR(128) NULL, lease_until DATETIME(3) NULL, last_error VARCHAR(1000) NULL,
  sent_at DATETIME(3) NULL, created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (event_id), KEY idx_security_outbox_publish (status, next_retry_at, lease_until, created_at),
  KEY idx_security_outbox_aggregate (aggregate_type, aggregate_id, created_at)
) ENGINE=InnoDB COMMENT='IAM可靠安全事件本地发送箱';