feat(iam): 完整实现 iam 身份认证与权限服务

包含 jwt/jwks/audit/grpc、rbac、cache、redis/kafka 配置等完整实现

packages/shared-proto/proto/iam.proto

@@ -3,14 +3,33 @@ syntax = "proto3";
 package next_edu_cloud.iam.v1;
 
 // IamService 定义身份与访问管理契约
-// P2: REST 实现，P3 起转 gRPC
+// 双入口策略（president §2.16）：REST 供 gateway 透传 + admin-portal 直连，
+// gRPC 供 BFF 聚合调用。同一 Application Service 同时被两种 Controller 调用。
+// gRPC 端口 50052，P2 即启用（I1 裁决）。
 service IamService {
+  // 认证类
   rpc Register(RegisterRequest) returns (AuthResponse);
   rpc Login(LoginRequest) returns (AuthResponse);
   rpc RefreshToken(RefreshTokenRequest) returns (TokenPair);
+  rpc Logout(LogoutRequest) returns (LogoutResponse);
+
+  // 用户信息类
   rpc GetUserInfo(GetUserInfoRequest) returns (UserInfo);
+  rpc BatchGetUsers(BatchGetUsersRequest) returns (BatchGetUsersResponse);
+
+  // 权限与视口类
+  rpc GetEffectivePermissions(GetEffectivePermissionsRequest) returns (EffectivePermissionsResponse);
+  rpc GetEffectiveAccess(GetEffectiveAccessRequest) returns (EffectiveAccessResponse);
+  rpc GetEffectiveDataScope(GetEffectiveDataScopeRequest) returns (DataScopeResponse);
+  rpc GetViewports(GetViewportsRequest) returns (ViewportsResponse);
+
+  // 密钥与关系类
+  rpc GetPublicKey(GetPublicKeyRequest) returns (PublicKeyResponse);
+  rpc GetChildrenByParent(GetChildrenByParentRequest) returns (ChildrenResponse);
 }
 
+// ========== 认证类 ==========
+
 message RegisterRequest {
   string email = 1;
   string password = 2;
@@ -26,8 +45,13 @@ message RefreshTokenRequest {
   string refresh_token = 1;
 }
 
-message GetUserInfoRequest {
-  string user_id = 1;
+message LogoutRequest {
+  string refresh_token = 1;
+  string user_id = 2;
+}
+
+message LogoutResponse {
+  bool success = 1;
 }
 
 message AuthResponse {
@@ -41,10 +65,95 @@ message TokenPair {
   int32 expires_in = 3;
 }
 
+// ========== 用户信息类 ==========
+
+message GetUserInfoRequest {
+  string user_id = 1;
+}
+
+message BatchGetUsersRequest {
+  repeated string user_ids = 1;
+}
+
+message BatchGetUsersResponse {
+  repeated UserInfo users = 1;
+}
+
 message UserInfo {
   string id = 1;
   string email = 2;
   string name = 3;
   repeated string roles = 4;
   repeated string permissions = 5;
+  string data_scope = 6;
+  string status = 7;
+}
+
+// ========== 权限与视口类 ==========
+
+message GetEffectivePermissionsRequest {
+  string user_id = 1;
+}
+
+message EffectivePermissionsResponse {
+  repeated string permissions = 1;
+}
+
+message GetEffectiveAccessRequest {
+  string user_id = 1;
+  string permission = 2;
+}
+
+message EffectiveAccessResponse {
+  bool allowed = 1;
+  string data_scope = 2;
+}
+
+message GetEffectiveDataScopeRequest {
+  string user_id = 1;
+}
+
+message DataScopeResponse {
+  string data_scope = 1;
+}
+
+message GetViewportsRequest {
+  string user_id = 1;
+}
+
+message ViewportsResponse {
+  repeated ViewportItem viewports = 1;
+}
+
+message ViewportItem {
+  string key = 1;
+  string label = 2;
+  string route = 3;
+  string icon = 4;
+  string sort_order = 5;
+  string required_permission = 6;
+}
+
+// ========== 密钥与关系类 ==========
+
+message GetPublicKeyRequest {}
+
+message PublicKeyResponse {
+  string kid = 1;
+  string alg = 2;
+  string public_key_pem = 3;
+}
+
+message GetChildrenByParentRequest {
+  string parent_id = 1;
+}
+
+message ChildrenResponse {
+  repeated ChildInfo children = 1;
+}
+
+message ChildInfo {
+  string student_id = 1;
+  string name = 2;
+  string relation = 3;
 }