feat(security): complete capability messaging workflows

Tiku.Api/Configuration/DependencyInjection.cs

@@ -51,6 +51,9 @@ public static class DependencyInjection
                             !string.IsNullOrWhiteSpace(options.Username) &&
                             !string.IsNullOrWhiteSpace(options.Password)),
                 "Production RabbitMQ requires a valid Host, Username and Password.")
+            .Validate(
+                options => options.OutboxBacklogAlertCount > 0 && options.OutboxOldestMessageAlertSeconds > 0,
+                "RabbitMQ outbox alert thresholds must be positive.")
             .ValidateOnStart();
         builder.Services.AddSingleton(messaging);
         if (messaging.IsConfigured)

Tiku.Api/Contracts/PlatformAdminDtos.cs

@@ -140,6 +140,27 @@ public sealed class UpsertPlatformSubscriptionDto
         Metadata);
 }
 
+public sealed class ReplacePlatformPlanModulesDto
+{
+    [Required]
+    public IReadOnlyCollection<string> ModuleCodes { get; set; } = [];
+
+    public ReplacePlatformPlanModulesCommand ToCommand(string planCode) => new(planCode, ModuleCodes);
+}
+
+public sealed class UpsertPlatformTenantModuleOverrideDto
+{
+    public TenantModuleOverrideMode Mode { get; set; }
+    public DateTimeOffset? ExpiresAt { get; set; }
+
+    [Required]
+    [StringLength(1000, MinimumLength = 1)]
+    public string Reason { get; set; } = string.Empty;
+
+    public UpsertPlatformTenantModuleOverrideCommand ToCommand(Guid tenantId, string moduleCode) =>
+        new(tenantId, moduleCode, Mode, ExpiresAt, Reason);
+}
+
 public sealed class UpsertPlatformStaffDto
 {
     public Guid? UserId { get; set; }

Tiku.Api/Controllers/HealthController.cs

@@ -45,6 +45,16 @@ public sealed class HealthController(
         var outboxPending = database
             ? await dbContext.Set<OutboxMessage>().CountAsync(cancellationToken)
             : -1;
+        var outboxOldestSentTime = database
+            ? await dbContext.Set<OutboxMessage>()
+                .Select(message => (DateTime?)message.SentTime)
+                .MinAsync(cancellationToken)
+            : null;
+        var outboxOldestAgeSeconds = outboxOldestSentTime is null
+            ? 0
+            : Math.Max(0, (DateTimeOffset.UtcNow - new DateTimeOffset(outboxOldestSentTime.Value)).TotalSeconds);
+        var outboxAlert = outboxPending >= messagingOptions.OutboxBacklogAlertCount ||
+                          outboxOldestAgeSeconds >= messagingOptions.OutboxOldestMessageAlertSeconds;
         var ready = database && redis && rabbitMq;
         var response = new
         {
@@ -52,7 +62,14 @@ public sealed class HealthController(
             database,
             redis = new { configured = redisSecurityStore.IsConfigured, ready = redis },
             rabbitMq = new { configured = messagingOptions.IsConfigured, ready = rabbitMq },
-            outbox = new { pending = outboxPending },
+            outbox = new
+            {
+                pending = outboxPending,
+                oldestAgeSeconds = Math.Round(outboxOldestAgeSeconds, 1),
+                alert = outboxAlert,
+                backlogAlertCount = messagingOptions.OutboxBacklogAlertCount,
+                oldestMessageAlertSeconds = messagingOptions.OutboxOldestMessageAlertSeconds
+            },
             checkedAt = DateTimeOffset.UtcNow
         };
         return ready ? Ok(response) : StatusCode(StatusCodes.Status503ServiceUnavailable, response);

Tiku.Api/Controllers/PlatformAdminController.cs

@@ -89,6 +89,19 @@ public sealed class PlatformAdminController(
         return Ok(await platformAdminService.GetPlansAsync(ResolveActor(), query.ToQuery(), cancellationToken));
     }
 
+    [HttpPut("plans/{planCode}/modules")]
+    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
+    [EndpointSummary("替换 SaaS 套餐模块权益")]
+    [ProducesResponseType<PlatformPlanModuleEntitlements>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformPlanModuleEntitlements>> ReplacePlanModules(
+        string planCode,
+        ReplacePlatformPlanModulesDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await platformAdminService.ReplacePlanModulesAsync(
+            ResolveActor(), request.ToCommand(planCode), cancellationToken));
+    }
+
     [HttpPost("subscriptions")]
     [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
     [EndpointSummary("创建或调整租户订阅")]
@@ -100,6 +113,20 @@ public sealed class PlatformAdminController(
         return Ok(await platformAdminService.UpsertSubscriptionAsync(ResolveActor(), request.ToCommand(), cancellationToken));
     }
 
+    [HttpPut("tenants/{tenantId:guid}/module-overrides/{moduleCode}")]
+    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
+    [EndpointSummary("设置租户模块覆盖")]
+    [ProducesResponseType<PlatformTenantModuleOverrideItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformTenantModuleOverrideItem>> UpsertTenantModuleOverride(
+        Guid tenantId,
+        string moduleCode,
+        UpsertPlatformTenantModuleOverrideDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await platformAdminService.UpsertTenantModuleOverrideAsync(
+            ResolveActor(), request.ToCommand(tenantId, moduleCode), cancellationToken));
+    }
+
     [HttpGet("domains")]
     [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
     [EndpointSummary("查询租户域名状态")]

Tiku.Api/appsettings.json

@@ -72,7 +72,9 @@
     "Host": "",
     "VirtualHost": "/",
     "Username": "",
-    "Password": ""
+    "Password": "",
+    "OutboxBacklogAlertCount": 1000,
+    "OutboxOldestMessageAlertSeconds": 300
   },
   "BrowserAuth": {
     "AllowedOrigins": []