ruoyi-vue-pro/docs/education/migration/04-module-reuse-map.md

Module Reuse Map

Phase 0 static assessment generated on 2026-07-29. No build, test, application startup, PostgreSQL connection, or Flyway migration was executed during this assessment.

Education must call public APIs, framework extension points, or events. It must not depend on another module's internal ServiceImpl, Mapper, or DO.

Tenant resolution, identity, and student context

• Target owner: System + Member + framework tenant support with an Education context adapter
• Public/framework capability to reuse: System TenantCommonApi/TenantApiImpl, TenantContextHolder, TenantSecurityWebFilter, Member/System authentication and UserTypeEnum, framework tenant injection and tenant-ignore only for explicitly authorized platform operations.
• Education-owned gap: Verified: EducationTenantController accepts caller-supplied hostname or tenantName under @PermitAll and does not enforce the source resolver's production Origin/Referer/request-host binding. Verified: TenantSecurityWebFilter already rejects authenticated LoginUser/request-tenant mismatches and requires a tenant on non-ignored URLs. Verified: EducationContextController checks login presence and tenant validity but not LoginUser.userType. Verified: hostname documentation says no port while implementation preserves legal ports and tests expect port preservation. Inference: arbitrary tenant discovery, admin-principal acceptance, and port inconsistency are P0/P1 trust-boundary risks until policy is fixed.
• Allowed external-module change: System/framework tenant and security boundaries remain authoritative; Education should only adapt them. A generic tenant lookup contract and possibly Member-only context policy require explicit decisions.

Student core learning loop

• Target owner: Education
• Public/framework capability to reuse: Education provider/adapter boundary, Member/System identity, database uniqueness and transactions, framework locks/idempotency only as supplements—not replacements—for atomic database claims.
• Education-owned gap: Verified: commit ce02f8a contains committed access/core controllers, safe projections, and focused tests, while native provider/catalog and additional core-loop work are dirty; these statuses must be separated. Verified: native and Scalar providers disagree on malformed/absent options; QuestionCatalogService and SessionResponseAssembler can emit apparently valid empty options. Verified: submit idempotency performs check-then-insert rather than atomic initial reservation. Inference: core-loop completion and concurrency guarantees are not established.
• Allowed external-module change: Education owns education-domain state and orchestration; Member/System context is reused. Paid/private access remains blocked on an entitlement decision.

Education catalog and question content

• Target owner: Education
• Public/framework capability to reuse: Education Provider boundary, explicit CatalogScopeQuery, framework tenant context, Infra File public API for future assets.
• Education-owned gap: Verified: current native reads intentionally run inside TenantUtils.executeIgnore and apply explicit scope predicates; this is a controlled manual-isolation boundary, not proof of a current leak. Verified: V4020 uses ordinary single-column foreign keys, so tenant-owned/public graph consistency is not enforced. Inference: every mapper needs audit and content admission needs composite constraints or equivalent enforcement.
• Allowed external-module change: Education owns domain reads; Infra File may later provide asset transport. No provider expansion should occur before provider authority and graph-integrity rules are decided.

Auth, student profile, and extended learning

• Target owner: Member + System + Education, with Infra composition
• Public/framework capability to reuse: Member/System auth and profile primitives, System/Infra notifications, Member points/levels where semantics match, Education-specific projections and authorization.
• Education-owned gap: Verified source inventory shows these are distinct required Phase 0 domains, not merely generic context or secondary engagement. Target ownership and compatibility are not established. Inference: the definition-of-done is unsupported until each endpoint/state family is classified.
• Allowed external-module change: Member/System own authentication and generic membership; Education owns education-specific profile/progress projections. System/Infra may own notifications, while product owners must decide points, badges, feedback, exams, and vocabulary ownership.

Tenant education operations, appearance, integrations, secrets, and codes

• Target owner: Education + System + Member + Mall/Pay + Infra
• Public/framework capability to reuse: System Tenant/RBAC/DataPermission/AdminUserApi, Member relationships, Mall/Pay/Member APIs, Infra secret/file/message/audit facilities.
• Education-owned gap: Verified: classes/supervision were only part of the source tenant-admin surface. Appearance/theme lifecycle, domains/payment/auth integrations, secret rotation, and codes/coupons are separate migration/security surfaces with no verified target equivalent. Inference: collapsing them into one row would hide authorization and secret-handling decisions.
• Allowed external-module change: System RBAC/DataPermission and tenant configuration are reused; Mall/Pay/Member own commercial primitives; Infra owns secrets/messaging/files where applicable; Education owns only domain relationships and configuration extensions.

Platform administration and governance

• Target owner: System + Pay + Mall + Infra + CRM with Education extensions
• Public/framework capability to reuse: System RBAC/DataPermission/AdminUserApi, authorized tenant-ignore mechanisms, Pay/Mall/Infra/CRM public APIs, audit/logging.
• Education-owned gap: Verified source surface is broader than one aggregated platform-admin row. Target seams exist, but object-level ownership, data scopes, and cross-tenant operation policy remain incomplete.
• Allowed external-module change: System, Pay, Mall, Infra, CRM, and Education-specific extension permissions; Education must not duplicate platform ledgers or generic administration.

Commercialization and growth

• Target owner: Mall + Pay + Member + CRM with Education binding
• Public/framework capability to reuse: Mall/Pay DTO APIs, Member identity/entitlement/points, CRM services, Infra Job/MQ/audit.
• Education-owned gap: Verified target Pay/Mall APIs expose core seams, but scoped entitlement issuance/revocation, activation codes, reconciliation, commissions, dunning, and referral semantics are not proven. One prior evidence path was malformed; corrected source location is /Users/tiku1/code/tiku-backend/apps/api/src/nest/commerce-reconciliation.module.ts.
• Allowed external-module change: Mall Trade/Product, Pay, Member entitlement/points, CRM, Infra jobs/events/audit; Education owns product-to-education bindings and fulfillment orchestration only.

Background processing, assets, and operational platform

• Target owner: Infra platform plus owning domain modules
• Public/framework capability to reuse: Public Infra File APIs and framework tenant context; generic locks, logging, tracing, and scheduling remain platform capabilities when exposed through public contracts.
• Education-owned delivered scope: EDU-011 owns tenant import asset metadata and import jobs, including the five states PREVIEW, PENDING, PROCESSING, COMPLETED, and FAILED; lease/heartbeat/expired-lease recovery; bounded attempts; and duplicate safety. V4130 is the only delivered EDU-011 migration. Scanner absence defaults to fail-closed UNAVAILABLE; CSV/XLSX preview is metadata-only when no parser is available; execution requires both a clean scan and executable parsed content.
• Deferred scope: The export boundary currently defines request redaction only—answers and private fields are excluded—but generates no export file or export job. Production scanner integration, full parser availability, retention automation, dead-letter/operator tooling, partial-row reporting, and legacy asset migration remain deferred.
• Allowed external-module change: Education may call public Infra APIs only. It must not depend on Infra DOs, mappers, ServiceImpl classes, or implementation packages, and it does not move Education job state into Infra.

Secondary learning, media, AI, and engagement

• Target owner: Education plus AI/Infra/Member/System
• Public/framework capability to reuse: AI services, Infra File/notifications, Member points/levels, Education authorization/projections.
• Education-owned gap: Verified legacy capabilities exist, but target equivalence and priority are not established. These cannot remain an undifferentiated P3 bucket if Phase 0 must give every capability a disposition.
• Allowed external-module change: AI, Infra File/messaging, Member growth primitives, System notifications, and Education extensions.