feat(saas): implement marketplace and tenant onboarding

2026-07-29 13:58:59 +08:00
parent 76606029e2
commit 6db200a2fc
145 changed files with 16862 additions and 94529 deletions
--- a/Tiku.Api/Controllers/CatalogController.cs
+++ b/Tiku.Api/Controllers/CatalogController.cs
@@ -146,6 +146,7 @@ public sealed class CatalogController(
    }

    [HttpGet("question-collections")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询可用题集")]
    [ProducesResponseType<CatalogList<QuestionCollectionCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -159,6 +160,7 @@ public sealed class CatalogController(
    }

    [HttpGet("question-collections/questions")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询题集内题目")]
    [ProducesResponseType<CatalogList<CollectionQuestionCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status400BadRequest)]
@@ -173,6 +175,7 @@ public sealed class CatalogController(
    }

    [HttpGet("practice-blueprints")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询练习蓝图")]
    [ProducesResponseType<CatalogList<PracticeBlueprintCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -186,6 +189,7 @@ public sealed class CatalogController(
    }

    [HttpGet("question-banks")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询题库列表")]
    [ProducesResponseType<CatalogList<QuestionBankCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -199,6 +203,7 @@ public sealed class CatalogController(
    }

    [HttpGet("questions")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询已发布题目")]
    [EndpointDescription("支持按题库、科目、分类、模块节点、内容入口、内容节点、题集或题目 ID 列表筛选。")]
    [ProducesResponseType<CatalogList<QuestionCatalogItem>>(StatusCodes.Status200OK)]
@@ -213,6 +218,7 @@ public sealed class CatalogController(
    }

    [HttpGet("questions/{questionId:guid}")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询题目详情")]
    [ProducesResponseType<QuestionCatalogItem>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -227,6 +233,7 @@ public sealed class CatalogController(
    }

    [HttpGet("questions/{questionId:guid}/versions")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询题目版本")]
    [ProducesResponseType<CatalogList<QuestionVersionCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -241,6 +248,7 @@ public sealed class CatalogController(
    }

    [HttpGet("vocabulary-units")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("查询词汇单元")]
    [ProducesResponseType<CatalogList<VocabularyUnitCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -254,6 +262,7 @@ public sealed class CatalogController(
    }

    [HttpGet("vocabulary-words")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("查询词汇单词")]
    [ProducesResponseType<CatalogList<VocabularyWordCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -267,6 +276,7 @@ public sealed class CatalogController(
    }

    [HttpGet("handbook-subjects")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询知识手册科目")]
    [ProducesResponseType<CatalogList<HandbookSubjectCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -280,6 +290,7 @@ public sealed class CatalogController(
    }

    [HttpGet("handbook-chapters")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询知识手册章节")]
    [ProducesResponseType<CatalogList<HandbookChapterCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -293,6 +304,7 @@ public sealed class CatalogController(
    }

    [HttpGet("handbook-entries")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询知识手册条目")]
    [ProducesResponseType<CatalogList<HandbookEntryCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -345,6 +357,7 @@ public sealed class CatalogController(
    }

    [HttpGet("video-explanations")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
    [EndpointSummary("查询视频讲解")]
    [ProducesResponseType<CatalogList<VideoExplanationCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -358,6 +371,7 @@ public sealed class CatalogController(
    }

    [HttpGet("question-videos")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
    [EndpointSummary("查询题目关联视频")]
    [ProducesResponseType<CatalogList<QuestionVideoCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -371,6 +385,7 @@ public sealed class CatalogController(
    }

    [HttpGet("banners")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("查询首页横幅")]
    [ProducesResponseType<CatalogList<BannerCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -384,6 +399,7 @@ public sealed class CatalogController(
    }

    [HttpGet("faqs")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("查询常见问题")]
    [ProducesResponseType<CatalogList<FaqCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -397,6 +413,7 @@ public sealed class CatalogController(
    }

    [HttpGet("announcements")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("查询公告")]
    [ProducesResponseType<CatalogList<AnnouncementCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -410,6 +427,7 @@ public sealed class CatalogController(
    }

    [HttpGet("exam-dates")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("查询考试日期")]
    [ProducesResponseType<CatalogList<ExamDateCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -423,6 +441,7 @@ public sealed class CatalogController(
    }

    [HttpGet("products")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
    [EndpointSummary("查询可购买产品")]
    [ProducesResponseType<CatalogList<ProductCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
@@ -436,6 +455,7 @@ public sealed class CatalogController(
    }

    [HttpGet("svip-plans")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
    [EndpointSummary("查询 SVIP 套餐")]
    [ProducesResponseType<CatalogList<SvipPlanCatalogItem>>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
--- a/Tiku.Api/Controllers/CommerceController.cs
+++ b/Tiku.Api/Controllers/CommerceController.cs
@@ -13,6 +13,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
 [Produces("application/json")]
 [Route("api/commerce")]
 public sealed class CommerceController(
--- a/Tiku.Api/Controllers/CommissionController.cs
+++ b/Tiku.Api/Controllers/CommissionController.cs
@@ -8,6 +8,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = BackendPermissions.TenantCommissionManage)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.ReferralCommission)]
 [Produces("application/json")]
 [Route("api/commission")]
 public sealed class CommissionController(
--- a/Tiku.Api/Controllers/CrmController.cs
+++ b/Tiku.Api/Controllers/CrmController.cs
@@ -8,6 +8,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = BackendPermissions.TenantCrmManage)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Crm)]
 [Produces("application/json")]
 [Route("api/crm")]
 public sealed class CrmController(
--- a/Tiku.Api/Controllers/LearningController.cs
+++ b/Tiku.Api/Controllers/LearningController.cs
@@ -8,6 +8,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
 [Produces("application/json")]
 [Route("api/learning")]
 public sealed class LearningController(
--- a/Tiku.Api/Controllers/PlatformAdminController.cs
+++ b/Tiku.Api/Controllers/PlatformAdminController.cs
@@ -37,8 +37,8 @@ public sealed class PlatformAdminController(
    [HttpPost("tenants")]
    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
    [EndpointSummary("创建平台租户")]
-    [ProducesResponseType<PlatformTenantItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformTenantItem>> CreateTenant(
+    [ProducesResponseType<PlatformTenantProvisioningResult>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformTenantProvisioningResult>> CreateTenant(
        CreatePlatformTenantDto request,
        CancellationToken cancellationToken)
    {
@@ -78,55 +78,6 @@ public sealed class PlatformAdminController(
        return Ok(await platformAdminService.UpsertTenantBillingProfileAsync(ResolveActor(), request.ToCommand(), cancellationToken));
    }

-    [HttpGet("plans")]
-    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
-    [EndpointSummary("查询平台 SaaS 套餐")]
-    [ProducesResponseType<PlatformPlanList>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformPlanList>> Plans(
-        [FromQuery] PlatformAdminQueryDto query,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await platformAdminService.GetPlansAsync(ResolveActor(), query.ToQuery(), cancellationToken));
-    }
-
-    [HttpPut("plans/{planCode}/modules")]
-    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
-    [EndpointSummary("替换 SaaS 套餐模块权益")]
-    [ProducesResponseType<PlatformPlanModuleEntitlements>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformPlanModuleEntitlements>> ReplacePlanModules(
-        string planCode,
-        ReplacePlatformPlanModulesDto request,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await platformAdminService.ReplacePlanModulesAsync(
-            ResolveActor(), request.ToCommand(planCode), cancellationToken));
-    }
-
-    [HttpPost("subscriptions")]
-    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
-    [EndpointSummary("创建或调整租户订阅")]
-    [ProducesResponseType<PlatformTenantSubscriptionItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformTenantSubscriptionItem>> UpsertSubscription(
-        UpsertPlatformSubscriptionDto request,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await platformAdminService.UpsertSubscriptionAsync(ResolveActor(), request.ToCommand(), cancellationToken));
-    }
-
-    [HttpPut("tenants/{tenantId:guid}/module-overrides/{moduleCode}")]
-    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
-    [EndpointSummary("设置租户模块覆盖")]
-    [ProducesResponseType<PlatformTenantModuleOverrideItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformTenantModuleOverrideItem>> UpsertTenantModuleOverride(
-        Guid tenantId,
-        string moduleCode,
-        UpsertPlatformTenantModuleOverrideDto request,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await platformAdminService.UpsertTenantModuleOverrideAsync(
-            ResolveActor(), request.ToCommand(tenantId, moduleCode), cancellationToken));
-    }
-
    [HttpGet("domains")]
    [Authorize(Policy = BackendPermissions.PlatformTenantManage)]
    [EndpointSummary("查询租户域名状态")]
@@ -215,70 +166,70 @@ public sealed class PlatformAdminController(
        return Ok(await platformAdminService.UpdateAuditAlertStatusAsync(ResolveActor(), request.ToCommand(), cancellationToken));
    }

-    [HttpGet("dunning-notification-channels")]
+    [HttpGet("saas/dunning/channels")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("查询平台催缴通知渠道")]
-    [ProducesResponseType<PlatformDunningChannelList>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningChannelList>> DunningChannels(
+    [ProducesResponseType<PlatformBillingDunningChannelList>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningChannelList>> BillingDunningChannels(
        [FromQuery] PlatformAdminQueryDto query,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.GetDunningChannelsAsync(ResolveActor(), query.ToQuery(), cancellationToken));
+        return Ok(await platformAdminService.GetBillingDunningChannelsAsync(ResolveActor(), query.ToQuery(), cancellationToken));
    }

-    [HttpPut("dunning-notification-channels")]
+    [HttpPut("saas/dunning/channels")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("创建或更新平台催缴通知渠道")]
-    [ProducesResponseType<PlatformDunningChannelItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningChannelItem>> UpsertDunningChannel(
-        UpsertPlatformDunningChannelDto request,
+    [ProducesResponseType<PlatformBillingDunningChannelItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningChannelItem>> UpsertBillingDunningChannel(
+        UpsertPlatformBillingDunningChannelDto request,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.UpsertDunningChannelAsync(ResolveActor(), request.ToCommand(), cancellationToken));
+        return Ok(await platformAdminService.UpsertBillingDunningChannelAsync(ResolveActor(), request.ToCommand(), cancellationToken));
    }

-    [HttpPost("dunning-notification-channels/disable")]
+    [HttpPost("saas/dunning/channels/disable")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("禁用平台催缴通知渠道")]
-    [ProducesResponseType<PlatformDunningChannelItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningChannelItem>> DisableDunningChannel(
-        DisablePlatformDunningChannelDto request,
+    [ProducesResponseType<PlatformBillingDunningChannelItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningChannelItem>> DisableBillingDunningChannel(
+        DisablePlatformBillingDunningChannelDto request,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.DisableDunningChannelAsync(ResolveActor(), request.ToCommand(), cancellationToken));
+        return Ok(await platformAdminService.DisableBillingDunningChannelAsync(ResolveActor(), request.ToCommand(), cancellationToken));
    }

-    [HttpGet("dunning-notification-events")]
+    [HttpGet("saas/dunning/events")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("查询平台催缴通知事件")]
-    [ProducesResponseType<PlatformDunningEventList>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningEventList>> DunningEvents(
+    [ProducesResponseType<PlatformBillingDunningEventList>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningEventList>> BillingDunningEvents(
        [FromQuery] PlatformAdminQueryDto query,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.GetDunningEventsAsync(ResolveActor(), query.ToQuery(), cancellationToken));
+        return Ok(await platformAdminService.GetBillingDunningEventsAsync(ResolveActor(), query.ToQuery(), cancellationToken));
    }

-    [HttpGet("dunning-notification-events/detail")]
+    [HttpGet("saas/dunning/events/detail")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("查询平台催缴通知事件详情")]
-    [ProducesResponseType<PlatformDunningEventItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningEventItem>> DunningEventDetail(
+    [ProducesResponseType<PlatformBillingDunningEventItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningEventItem>> BillingDunningEventDetail(
        [FromQuery] Guid eventId,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.GetDunningEventDetailAsync(ResolveActor(), eventId, cancellationToken));
+        return Ok(await platformAdminService.GetBillingDunningEventDetailAsync(ResolveActor(), eventId, cancellationToken));
    }

-    [HttpPost("dunning-notification-events/retry")]
+    [HttpPost("saas/dunning/events/retry")]
    [Authorize(Policy = BackendPermissions.PlatformBillingNotification)]
    [EndpointSummary("重新标记平台催缴通知事件待发送")]
-    [ProducesResponseType<PlatformDunningEventItem>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<PlatformDunningEventItem>> RetryDunningEvent(
-        RetryPlatformDunningEventDto request,
+    [ProducesResponseType<PlatformBillingDunningEventItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PlatformBillingDunningEventItem>> RetryBillingDunningEvent(
+        RetryPlatformBillingDunningEventDto request,
        CancellationToken cancellationToken)
    {
-        return Ok(await platformAdminService.RetryDunningEventAsync(ResolveActor(), request.ToCommand(), cancellationToken));
+        return Ok(await platformAdminService.RetryBillingDunningEventAsync(ResolveActor(), request.ToCommand(), cancellationToken));
    }

    private PlatformAdminActor ResolveActor()
--- a/Tiku.Api/Controllers/PlatformBillingCallbackController.cs
+++ b/Tiku.Api/Controllers/PlatformBillingCallbackController.cs
@@ -0,0 +1,45 @@
+using System.Text;
+using System.Text.Json;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.PlatformBilling;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/platform-billing/callbacks")]
+public sealed class PlatformBillingCallbackController(
+    IPlatformBillingNotificationService notificationService) : ControllerBase
+{
+    [AllowAnonymous]
+    [HttpPost("{provider}")]
+    public async Task<IActionResult> Notify(string provider, CancellationToken cancellationToken)
+    {
+        Request.EnableBuffering();
+        using var reader = new StreamReader(Request.Body, Encoding.UTF8, leaveOpen: true);
+        var rawBody = await reader.ReadToEndAsync(cancellationToken);
+        Request.Body.Position = 0;
+        JsonElement body;
+        try
+        {
+            body = string.IsNullOrWhiteSpace(rawBody)
+                ? JsonDocument.Parse("{}").RootElement.Clone()
+                : JsonDocument.Parse(rawBody).RootElement.Clone();
+        }
+        catch (JsonException)
+        {
+            body = JsonDocument.Parse("{}").RootElement.Clone();
+        }
+        var normalizedProvider = provider.Trim().ToLowerInvariant().Replace('-', '_');
+        await notificationService.ProcessAsync(new PlatformBillingNotification(
+            normalizedProvider,
+            Request.Headers.ToDictionary(value => value.Key, value => value.Value.ToString(), StringComparer.OrdinalIgnoreCase),
+            rawBody,
+            body), cancellationToken);
+        if (normalizedProvider is "alipay" or "ali_pay")
+        {
+            return Content("success", "text/plain", Encoding.UTF8);
+        }
+        return Ok(new { code = "SUCCESS", message = "成功" });
+    }
+}
--- a/Tiku.Api/Controllers/PlatformSaasController.cs
+++ b/Tiku.Api/Controllers/PlatformSaasController.cs
@@ -0,0 +1,98 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Api.Contracts;
+using Tiku.Application.PlatformBilling;
+using Tiku.Application.Security;
+using Tiku.Domain.Platform;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/platform-admin/saas")]
+[Authorize(Policy = TikuPolicies.PlatformBackofficeBootstrap)]
+public sealed class PlatformSaasController(
+    ISaasCatalogAdminService catalogService,
+    IPlatformBillingAdminService billingService,
+    ICurrentUser currentUser) : ControllerBase
+{
+    [HttpGet("catalog")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasCatalogSnapshot> Catalog(CancellationToken cancellationToken) =>
+        catalogService.GetCatalogAsync(Actor(), cancellationToken);
+
+    [HttpPut("features")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasFeature> UpsertFeature(UpsertSaasFeatureDto request, CancellationToken cancellationToken) =>
+        catalogService.UpsertFeatureAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    [HttpPut("feature-limits")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasFeatureLimitDefinition> UpsertFeatureLimit(
+        UpsertSaasFeatureLimitDto request,
+        CancellationToken cancellationToken) =>
+        catalogService.UpsertLimitDefinitionAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    [HttpPut("offerings")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasOffering> UpsertOffering(UpsertSaasOfferingDto request, CancellationToken cancellationToken) =>
+        catalogService.UpsertOfferingAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    [HttpPut("offering-versions")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasOfferingVersionItem> UpsertVersion(UpsertSaasOfferingVersionDto request, CancellationToken cancellationToken) =>
+        catalogService.UpsertDraftVersionAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    [HttpPost("offering-versions/{versionId:guid}/publish")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasOfferingVersionItem> PublishVersion(Guid versionId, CancellationToken cancellationToken) =>
+        catalogService.PublishVersionAsync(Actor(), versionId, cancellationToken);
+
+    [HttpPost("offering-versions/{versionId:guid}/clone")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasOfferingVersionItem> CloneVersion(Guid versionId, CancellationToken cancellationToken) =>
+        catalogService.CloneVersionAsync(Actor(), versionId, cancellationToken);
+
+    [HttpPost("offering-versions/{versionId:guid}/retire")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasCatalogManage)]
+    public Task<SaasOfferingVersionItem> RetireVersion(Guid versionId, CancellationToken cancellationToken) =>
+        catalogService.RetireVersionAsync(Actor(), versionId, cancellationToken);
+
+    [HttpGet("orders")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<IReadOnlyCollection<PlatformBillingOrder>> Orders(Guid? tenantId, string? status, int limit = 100, CancellationToken cancellationToken = default) =>
+        billingService.GetOrdersAsync(Actor(), new PlatformBillingAdminQuery(tenantId, status, limit), cancellationToken);
+
+    [HttpGet("payments")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<IReadOnlyCollection<PlatformBillingPayment>> Payments(Guid? tenantId, string? status, int limit = 100, CancellationToken cancellationToken = default) =>
+        billingService.GetPaymentsAsync(Actor(), new PlatformBillingAdminQuery(tenantId, status, limit), cancellationToken);
+
+    [HttpGet("refunds")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<IReadOnlyCollection<PlatformBillingRefund>> Refunds(Guid? tenantId, string? status, int limit = 100, CancellationToken cancellationToken = default) =>
+        billingService.GetRefundsAsync(Actor(), new PlatformBillingAdminQuery(tenantId, status, limit), cancellationToken);
+
+    [HttpGet("invoices")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<IReadOnlyCollection<PlatformBillingInvoice>> Invoices(Guid? tenantId, string? status, int limit = 100, CancellationToken cancellationToken = default) =>
+        billingService.GetInvoicesAsync(Actor(), new PlatformBillingAdminQuery(tenantId, status, limit), cancellationToken);
+
+    [HttpGet("subscriptions")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<IReadOnlyCollection<TenantSaasSubscription>> Subscriptions(Guid? tenantId, string? status, int limit = 100, CancellationToken cancellationToken = default) =>
+        billingService.GetSubscriptionsAsync(Actor(), new PlatformBillingAdminQuery(tenantId, status, limit), cancellationToken);
+
+    [HttpPost("payments/manual/confirm")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<PlatformBillingPayment> ConfirmManualPayment(ConfirmManualPlatformPaymentDto request, CancellationToken cancellationToken) =>
+        billingService.ConfirmManualPaymentAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    [HttpPut("tenant-feature-overrides")]
+    [Authorize(Policy = BackendPermissions.PlatformSaasBillingManage)]
+    public Task<TenantFeatureOverride> UpsertFeatureOverride(UpsertTenantFeatureOverrideDto request, CancellationToken cancellationToken) =>
+        billingService.UpsertFeatureOverrideAsync(Actor(), request.ToCommand(), cancellationToken);
+
+    private SaasCatalogActor Actor() => currentUser.UserId is { } userId
+        ? new SaasCatalogActor(userId)
+        : throw new PlatformBillingException("Platform actor was not resolved.", "platform_access_denied");
+}
--- a/Tiku.Api/Controllers/PointsController.cs
+++ b/Tiku.Api/Controllers/PointsController.cs
@@ -8,6 +8,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
 [Produces("application/json")]
 [Route("api/points")]
 public sealed class PointsController(
--- a/Tiku.Api/Controllers/ProfileController.cs
+++ b/Tiku.Api/Controllers/ProfileController.cs
@@ -108,6 +108,7 @@ public sealed class ProfileController(
    }

    [HttpPost("check-in")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
    [EndpointSummary("每日签到")]
    [ProducesResponseType<CheckInResult>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CheckInResult>> CheckIn(CancellationToken cancellationToken)
@@ -116,6 +117,7 @@ public sealed class ProfileController(
    }

    [HttpGet("score-events")]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
    [EndpointSummary("查询积分流水")]
    [ProducesResponseType<ProfileScoreEventList>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ProfileScoreEventList>> ScoreEvents(
--- a/Tiku.Api/Controllers/QuestionVideosController.cs
+++ b/Tiku.Api/Controllers/QuestionVideosController.cs
@@ -9,6 +9,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
 [Produces("application/json")]
 [Route("api/questions/videos")]
 public sealed class QuestionVideosController(
--- a/Tiku.Api/Controllers/ReferralController.cs
+++ b/Tiku.Api/Controllers/ReferralController.cs
@@ -11,6 +11,7 @@ using Tiku.Infrastructure.Persistence;
 namespace Tiku.Api.Controllers;

 [ApiController]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.ReferralCommission)]
 [Produces("application/json")]
 [Route("api/referral")]
 public sealed class ReferralController(
--- a/Tiku.Api/Controllers/ScorelineController.cs
+++ b/Tiku.Api/Controllers/ScorelineController.cs
@@ -12,6 +12,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [AllowAnonymous]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
 [Produces("application/json")]
 [Route("api/scoreline")]
 public sealed class ScorelineController(
--- a/Tiku.Api/Controllers/TaxonomyController.cs
+++ b/Tiku.Api/Controllers/TaxonomyController.cs
@@ -15,6 +15,7 @@ public sealed class TaxonomyController(
    ITaxonomyService taxonomyService) : ControllerBase
 {
    [HttpGet]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Practice)]
    [EndpointSummary("查询租户分类节点")]
    public Task<IReadOnlyCollection<TaxonomyNodeItem>> List(CancellationToken cancellationToken)
    {
@@ -22,6 +23,7 @@ public sealed class TaxonomyController(
    }

    [HttpPost]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.PrivateQuestionBank)]
    [Authorize(Policy = BackendPermissions.TenantContentManage)]
    [EndpointSummary("创建租户分类节点")]
    public Task<TaxonomyNodeItem> Create(
--- a/Tiku.Api/Controllers/TenantBillingController.cs
+++ b/Tiku.Api/Controllers/TenantBillingController.cs
@@ -0,0 +1,72 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Api.Contracts;
+using Tiku.Application.PlatformBilling;
+using Tiku.Application.Security;
+using Tiku.Domain.Platform;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/tenant-billing")]
+[Authorize(Policy = BackendPermissions.TenantBillingManage)]
+public sealed class TenantBillingController(
+    ITenantBillingService billingService,
+    ICurrentAccessContext accessContext) : ControllerBase
+{
+    [HttpGet("catalog")]
+    public async Task<TenantBillingCatalog> Catalog(CancellationToken cancellationToken) =>
+        await billingService.GetCatalogAsync(await ActorAsync(cancellationToken), cancellationToken);
+
+    [HttpPost("quotes")]
+    public async Task<PlatformBillingQuoteView> Quote(CreatePlatformBillingQuoteDto request, CancellationToken cancellationToken) =>
+        await billingService.CreateQuoteAsync(await ActorAsync(cancellationToken), request.ToCommand(), cancellationToken);
+
+    [HttpPost("orders")]
+    public async Task<PlatformBillingOrderView> CreateOrder(CreatePlatformBillingOrderDto request, CancellationToken cancellationToken) =>
+        await billingService.CreateOrderAsync(await ActorAsync(cancellationToken), request.ToCommand(), cancellationToken);
+
+    [HttpPost("orders/{orderNo}/payments")]
+    public async Task<PlatformBillingPaymentView> CreatePayment(string orderNo, CreatePlatformBillingPaymentDto request, CancellationToken cancellationToken) =>
+        await billingService.CreatePaymentAsync(await ActorAsync(cancellationToken), request.ToCommand(orderNo), cancellationToken);
+
+    [HttpGet("orders")]
+    public async Task<IReadOnlyCollection<PlatformBillingOrderView>> Orders(int limit = 100, CancellationToken cancellationToken = default) =>
+        await billingService.GetOrdersAsync(await ActorAsync(cancellationToken), limit, cancellationToken);
+
+    [HttpGet("orders/{orderNo}")]
+    public async Task<PlatformBillingOrderView> Order(string orderNo, CancellationToken cancellationToken) =>
+        await billingService.GetOrderAsync(await ActorAsync(cancellationToken), orderNo, cancellationToken);
+
+    [HttpGet("subscription")]
+    public async Task<TenantSubscriptionView?> Subscription(CancellationToken cancellationToken) =>
+        await billingService.GetSubscriptionAsync(await ActorAsync(cancellationToken), cancellationToken);
+
+    [HttpPost("subscription/change")]
+    public async Task<PlatformBillingOrderView> Change(ChangeTenantSubscriptionDto request, CancellationToken cancellationToken) =>
+        await billingService.ChangeSubscriptionAsync(await ActorAsync(cancellationToken), request.ToCommand(), request.IdempotencyKey, cancellationToken);
+
+    [HttpPost("subscription/renew")]
+    public async Task<PlatformBillingOrderView> Renew(IdempotentTenantBillingDto request, CancellationToken cancellationToken) =>
+        await billingService.RenewSubscriptionAsync(await ActorAsync(cancellationToken), request.IdempotencyKey, cancellationToken);
+
+    [HttpPost("subscription/cancel")]
+    public async Task<TenantSubscriptionView> Cancel(CancellationToken cancellationToken) =>
+        await billingService.CancelSubscriptionAsync(await ActorAsync(cancellationToken), cancellationToken);
+
+    [HttpGet("usage")]
+    public async Task<IReadOnlyCollection<FeatureQuotaSnapshot>> Usage(CancellationToken cancellationToken) =>
+        await billingService.GetUsageAsync(await ActorAsync(cancellationToken), cancellationToken);
+
+    [HttpGet("invoices")]
+    public async Task<IReadOnlyCollection<PlatformBillingInvoice>> Invoices(int limit = 100, CancellationToken cancellationToken = default) =>
+        await billingService.GetInvoicesAsync(await ActorAsync(cancellationToken), limit, cancellationToken);
+
+    private async Task<TenantBillingActor> ActorAsync(CancellationToken cancellationToken)
+    {
+        var access = await accessContext.GetAsync(cancellationToken);
+        return access.UserId is { } userId && access.TenantId is { } tenantId && access.IsCurrentTenantMember
+            ? new TenantBillingActor(userId, tenantId)
+            : throw new PlatformBillingException("Tenant billing actor was not resolved.", "tenant_access_denied");
+    }
+}
--- a/Tiku.Api/Controllers/TenantCommerceController.cs
+++ b/Tiku.Api/Controllers/TenantCommerceController.cs
@@ -10,6 +10,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = BackendPermissions.TenantCommerceOperate)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.StudentStore)]
 [Produces("application/json")]
 [Route("api/tenant-commerce")]
 public sealed class TenantCommerceController(
--- a/Tiku.Api/Controllers/TenantContentController.cs
+++ b/Tiku.Api/Controllers/TenantContentController.cs
@@ -235,6 +235,20 @@ public sealed class TenantContentController(
            cancellationToken));
    }

+    [HttpDelete("assets/{assetId:guid}")]
+    [EndpointSummary("归档内容资产")]
+    [ProducesResponseType<ContentManagementResult<ContentAssetManagementItem>>(StatusCodes.Status200OK)]
+    [ProducesResponseType<ProblemDetails>(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult<ContentManagementResult<ContentAssetManagementItem>>> ArchiveAsset(
+        Guid assetId,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await assetManagementService.ArchiveAssetAsync(
+            ResolveActor(),
+            assetId,
+            cancellationToken));
+    }
+
    [HttpPost("assets/sign-download")]
    [EndpointSummary("签发管理侧资产下载地址")]
    [ProducesResponseType<AssetManagementSignedAccessResult>(StatusCodes.Status200OK)]
--- a/Tiku.Api/Controllers/TenantContentDirectController.cs
+++ b/Tiku.Api/Controllers/TenantContentDirectController.cs
@@ -12,7 +12,6 @@ using Tiku.Domain.Content;
 namespace Tiku.Api.Controllers;

 [ApiController]
-[Authorize(Policy = BackendPermissions.TenantContentManage)]
 [Produces("application/json")]
 [Route("api/tenant-content")]
 public sealed class TenantContentDirectController(
@@ -22,7 +21,9 @@ public sealed class TenantContentDirectController(
    ITenantContext currentTenant) : ControllerBase
 {
    [HttpPost("questions")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantContentManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.PrivateQuestionBank)]
    [EndpointSummary("创建题目及首个版本")]
    [ProducesResponseType<ContentManagementResult<QuestionManagementItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<QuestionManagementItem>>> CreateQuestion(
@@ -33,7 +34,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPatch("questions")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantContentManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.PrivateQuestionBank)]
    [EndpointSummary("更新题目并可选择创建新版本")]
    [ProducesResponseType<ContentManagementResult<QuestionManagementItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<QuestionManagementItem>>> UpdateQuestion(
@@ -44,6 +47,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("vocabulary-units")]
+    [Authorize(Policy = BackendPermissions.TenantVocabularyManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("查询管理侧词汇单元")]
    [ProducesResponseType<CatalogList<VocabularyUnit>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<VocabularyUnit>>> GetVocabularyUnits(
@@ -54,6 +59,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("vocabulary-units")]
+    [Authorize(Policy = BackendPermissions.TenantVocabularyManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("新增或更新词汇单元")]
    [ProducesResponseType<ContentManagementResult<VocabularyUnit>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<VocabularyUnit>>> UpsertVocabularyUnit(
@@ -64,7 +71,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("vocabulary-words")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantVocabularyManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("查询管理侧词汇")]
    [ProducesResponseType<CatalogList<VocabularyWord>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<VocabularyWord>>> GetVocabularyWords(
@@ -75,7 +84,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("vocabulary-words")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantVocabularyManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Vocabulary)]
    [EndpointSummary("新增或更新词汇")]
    [ProducesResponseType<ContentManagementResult<VocabularyWord>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<VocabularyWord>>> UpsertVocabularyWord(
@@ -86,6 +97,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("handbook-subjects")]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询管理侧知识手册科目")]
    [ProducesResponseType<CatalogList<HandbookSubject>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<HandbookSubject>>> GetHandbookSubjects(
@@ -96,6 +109,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("handbook-subjects")]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("新增或更新知识手册科目")]
    [ProducesResponseType<ContentManagementResult<HandbookSubject>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<HandbookSubject>>> UpsertHandbookSubject(
@@ -106,7 +121,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("handbook-chapters")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询管理侧知识手册章节")]
    [ProducesResponseType<CatalogList<HandbookChapter>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<HandbookChapter>>> GetHandbookChapters(
@@ -117,7 +134,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("handbook-chapters")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("新增或更新知识手册章节")]
    [ProducesResponseType<ContentManagementResult<HandbookChapter>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<HandbookChapter>>> UpsertHandbookChapter(
@@ -128,7 +147,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("handbook-entries")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("查询管理侧知识手册条目")]
    [ProducesResponseType<CatalogList<HandbookEntry>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<HandbookEntry>>> GetHandbookEntries(
@@ -139,7 +160,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("handbook-entries")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantHandbookManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Handbook)]
    [EndpointSummary("新增或更新知识手册条目")]
    [ProducesResponseType<ContentManagementResult<HandbookEntry>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<HandbookEntry>>> UpsertHandbookEntry(
@@ -150,6 +173,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/schools")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询管理侧分数线院校")]
    [ProducesResponseType<CatalogList<School>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<School>>> GetSchools(
@@ -160,6 +185,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("scoreline/schools")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("新增或更新分数线院校")]
    [ProducesResponseType<ContentManagementResult<School>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<School>>> UpsertSchool(
@@ -170,6 +197,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/majors")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询管理侧分数线专业")]
    [ProducesResponseType<CatalogList<Major>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<Major>>> GetMajors(
@@ -180,6 +209,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("scoreline/majors")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("新增或更新分数线专业")]
    [ProducesResponseType<ContentManagementResult<Major>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<Major>>> UpsertMajor(
@@ -190,6 +221,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/fields")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询管理侧分数线字段")]
    [ProducesResponseType<CatalogList<ScorelineField>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<ScorelineField>>> GetScorelineFields(
@@ -200,6 +233,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("scoreline/fields")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("新增或更新动态分数线字段")]
    [ProducesResponseType<ContentManagementResult<ScorelineField>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<ScorelineField>>> UpsertScorelineField(
@@ -210,6 +245,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/records")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询管理侧分数线记录")]
    [ProducesResponseType<CatalogList<ScorelineRecord>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<ScorelineRecord>>> GetScorelineRecords(
@@ -220,6 +257,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("scoreline/records")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("新增或更新分数线记录")]
    [ProducesResponseType<ContentManagementResult<ScorelineRecord>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<ScorelineRecord>>> UpsertScorelineRecord(
@@ -230,6 +269,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/years")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询分数线年份")]
    [ProducesResponseType<CatalogList<int>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<int>>> GetScorelineYears(
@@ -240,6 +281,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("scoreline/trend")]
+    [Authorize(Policy = BackendPermissions.TenantScorelineManage)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Scoreline)]
    [EndpointSummary("查询分数线趋势摘要")]
    [ProducesResponseType<CatalogList<ScorelineTrendItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<ScorelineTrendItem>>> GetScorelineTrend(
@@ -250,7 +293,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("videos")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantVideoManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
    [EndpointSummary("查询租户视频解析")]
    [ProducesResponseType<CatalogList<VideoManagementItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<VideoManagementItem>>> GetVideos(
@@ -261,7 +306,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("videos")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantVideoManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
    [EndpointSummary("新增或更新视频解析")]
    [ProducesResponseType<ContentManagementResult<VideoManagementItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<VideoManagementItem>>> UpsertVideo(
@@ -272,7 +319,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPost("question-videos")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantVideoManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
    [EndpointSummary("绑定题目与解析视频")]
    [ProducesResponseType<ContentManagementResult<QuestionVideoManagementItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<QuestionVideoManagementItem>>> BindQuestionVideo(
@@ -283,7 +332,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("operations/{kind}")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantSiteContentManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("查询运营内容")]
    [ProducesResponseType<CatalogList<OperationContentItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<OperationContentItem>>> GetOperationContent(
@@ -295,7 +346,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPut("operations/{kind}")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantSiteContentManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.SiteContent)]
    [EndpointSummary("新增或更新运营内容")]
    [ProducesResponseType<ContentManagementResult<OperationContentItem>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentManagementResult<OperationContentItem>>> UpsertOperationContent(
@@ -307,7 +360,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPost("imports/preview/{importType}")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeatureFromRoute("importType")]
    [EndpointSummary("预览内容导入数据")]
    [ProducesResponseType<SimpleImportResult>(StatusCodes.Status200OK)]
    public async Task<ActionResult<SimpleImportResult>> PreviewImport(
@@ -319,7 +374,9 @@ public sealed class TenantContentDirectController(
    }

    [HttpPost("imports/{importType}")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
+    [Tiku.Api.Security.RequireSaasFeatureFromRoute("importType")]
    [EndpointSummary("执行或排队内容导入")]
    [ProducesResponseType<SimpleImportResult>(StatusCodes.Status200OK)]
    [ProducesResponseType<BackgroundJobItem>(StatusCodes.Status202Accepted)]
@@ -359,7 +416,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("imports/detail")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
    [EndpointSummary("查询内容导入任务详情")]
    [ProducesResponseType<ContentImportJobDetail>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ContentImportJobDetail>> GetImportDetail(
@@ -370,7 +428,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("imports/issues")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
    [EndpointSummary("查询内容导入问题明细")]
    [ProducesResponseType<CatalogList<ContentImportIssueModel>>(StatusCodes.Status200OK)]
    public async Task<ActionResult<CatalogList<ContentImportIssueModel>>> GetImportIssues(
@@ -381,7 +440,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpPost("imports/post-check")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
    [EndpointSummary("执行内容导入后完整性检查")]
    [ProducesResponseType<ImportPostCheckResult>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ImportPostCheckResult>> RunImportPostCheck(
@@ -392,7 +452,8 @@ public sealed class TenantContentDirectController(
    }

    [HttpGet("imports/post-check")]
-    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
+    [Authorize(Policy = BackendPermissions.TenantJobManage)]
+    [Authorize(Policy = TikuPolicies.TenantAllDataScope)]
    [EndpointSummary("查询内容导入后检查状态")]
    [ProducesResponseType<ImportPostCheckResult>(StatusCodes.Status200OK)]
    public async Task<ActionResult<ImportPostCheckResult>> GetImportPostCheck(
--- a/Tiku.Api/Controllers/TenantOnboardingController.cs
+++ b/Tiku.Api/Controllers/TenantOnboardingController.cs
@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.Security;
+using Tiku.Application.Tenancy;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/tenant-onboarding")]
+[Authorize(Policy = BackendPermissions.TenantSettingsManage)]
+public sealed class TenantOnboardingController(
+    ITenantOnboardingService onboardingService,
+    ICurrentAccessContext accessContext) : ControllerBase
+{
+    [HttpGet("status")]
+    public async Task<TenantOnboardingStatus> Status(CancellationToken cancellationToken)
+    {
+        var access = await accessContext.GetAsync(cancellationToken);
+        if (access.TenantId is not { } tenantId || !access.IsCurrentTenantMember)
+        {
+            throw new TenantExternalProviderException("Tenant onboarding access is denied.", "tenant_access_denied");
+        }
+        return await onboardingService.GetStatusAsync(tenantId, cancellationToken);
+    }
+}
--- a/Tiku.Api/Controllers/VideosController.cs
+++ b/Tiku.Api/Controllers/VideosController.cs
@@ -9,6 +9,7 @@ namespace Tiku.Api.Controllers;

 [ApiController]
 [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Tiku.Api.Security.RequireSaasFeature(SaasFeatureCatalog.Video)]
 [Produces("application/json")]
 [Route("api/videos")]
 public sealed class VideosController(