Merge branch 'main' into dev

# Conflicts:
#	docs/backstage/IM-Kafka接入方案.md
#	docs/backstage/IM-Kafka接入范围识别.md
#	server/api/admin/imconfiginternal/im_config.go
#	server/api/admin/imuser/im_user.go
#	server/internal/consts/im_kafka.go
#	server/internal/controller/admin/sys/im_user.go
#	server/internal/controller/internalapi/imconfig/im_config.go
#	server/internal/library/imadmin/client.go
#	server/internal/library/imadmin/client_test.go
#	server/internal/library/imadmin/internal.go
#	server/internal/library/imkafka/command.go
#	server/internal/library/imtenant/db.go
#	server/internal/library/imtenant/db_test.go
#	server/internal/library/queue/kafkamq.go
#	server/internal/library/queue/queue.go
#	server/internal/logic/admin/member.go
#	server/internal/logic/sys/im_dead_letter.go
#	server/internal/logic/sys/im_group.go
#	server/internal/logic/sys/im_invite.go
#	server/internal/logic/sys/im_kafka_audit.go
#	server/internal/logic/sys/im_kafka_command.go
#	server/internal/logic/sys/im_tenant.go
#	server/internal/logic/sys/im_user.go
#	server/internal/model/input/sysin/im_group.go
#	server/internal/model/input/sysin/im_invite.go
#	server/internal/model/input/sysin/im_user.go
#	server/internal/queues/im_admin_command_result.go
#	server/internal/queues/im_audit_event.go
#	server/internal/queues/im_dead_letter.go
#	server/internal/service/sys.go
#	server/manifest/config/config.example.yaml
#	server/storage/data/generate/im_group_menu.sql
#	server/storage/data/generate/im_user_menu.sql
#	server/storage/data/im_registration_invite_hotgo.sql
#	web/src/views/im/registrationInvite/BatchViewModal.vue
#	web/src/views/im/registrationInvite/index.vue
#	web/src/views/im/registrationInvite/model.ts
#	web/src/views/imDeadLetter/index.vue
#	web/src/views/imDeadLetter/model.ts
#	web/src/views/imGroup/governance.vue
#	web/src/views/imGroup/members.vue
#	web/src/views/imKafkaAudit/model.ts
#	web/src/views/imKafkaAudit/view.vue
#	web/src/views/imKafkaCommand/index.vue
#	web/src/views/imKafkaCommand/model.ts
#	web/src/views/imKafkaCommand/view.vue
#	web/src/views/imUser/ResetPasswordModal.vue
#	web/src/views/imUser/governance.vue
#	web/src/views/imUser/index.vue
#	web/src/views/imUser/model.ts
#	web/src/views/imUser/view.vue

server/internal/cmd/http.go

@@ -11,6 +11,7 @@ import (
 	"github.com/gogf/gf/v2/net/ghttp"
 	"github.com/gogf/gf/v2/os/gcmd"
 	"github.com/gogf/gf/v2/util/gmode"
+	"hotgo/internal/controller/health"
 	"hotgo/internal/library/addons"
 	"hotgo/internal/library/casbin"
 	"hotgo/internal/library/hggen"
@@ -33,6 +34,7 @@ var (
 
 			// 请求响应结束后回调
 			s.BindHookHandler("/*any", ghttp.HookAfterOutput, service.Hook().AfterOutput)
+			s.BindHandler("/healthz", health.Serve)
 
 			// 注册全局中间件
 			s.BindMiddleware("/*any", []ghttp.HandlerFunc{

server/internal/consts/im_content_audit.go

@@ -0,0 +1,84 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+const (
+	ImMessageContentText   = "text"
+	ImMessageContentImage  = "image"
+	ImMessageContentVideo  = "video"
+	ImMessageContentAudio  = "audio"
+	ImMessageContentVoice  = "voice"
+	ImMessageContentFile   = "file"
+	ImMessageContentCard   = "card"
+	ImMessageContentSystem = "system"
+
+	ImMessageStatusNormal   = "normal"
+	ImMessageStatusDeleted  = "deleted"
+	ImMessageStatusRecalled = "recalled"
+	ImMessageStatusBlocked  = "blocked"
+	ImMessageStatusHidden   = "hidden"
+)
+
+var ImMessageContentTypeOptions = []*model.Option{
+	dict.GenInfoOption(ImMessageContentText, "文本"),
+	dict.GenPrimaryOption(ImMessageContentImage, "图片"),
+	dict.GenPrimaryOption(ImMessageContentVideo, "视频"),
+	dict.GenPrimaryOption(ImMessageContentAudio, "语音"),
+	dict.GenPrimaryOption(ImMessageContentVoice, "语音"),
+	dict.GenDefaultOption(ImMessageContentFile, "文件"),
+	dict.GenDefaultOption(ImMessageContentCard, "名片"),
+	dict.GenWarningOption(ImMessageContentSystem, "系统"),
+}
+
+var ImMessageStatusOptions = []*model.Option{
+	dict.GenSuccessOption(ImMessageStatusNormal, "正常"),
+	dict.GenErrorOption(ImMessageStatusDeleted, "后台删除"),
+	dict.GenWarningOption(ImMessageStatusRecalled, "用户撤回"),
+	dict.GenErrorOption(ImMessageStatusBlocked, "风控拦截"),
+	dict.GenWarningOption(ImMessageStatusHidden, "已隐藏"),
+}
+
+var ImLoginTypeOptions = []*model.Option{
+	dict.GenPrimaryOption("password", "密码"),
+	dict.GenPrimaryOption("sms_code", "短信验证码"),
+	dict.GenInfoOption("sso", "单点登录"),
+	dict.GenInfoOption("qr_code", "二维码"),
+	dict.GenDefaultOption("token_refresh", "令牌刷新"),
+}
+
+var ImLoginEventTypeOptions = []*model.Option{
+	dict.GenSuccessOption("login", "登录"),
+	dict.GenInfoOption("refresh", "刷新会话"),
+	dict.GenDefaultOption("logout", "主动退出"),
+	dict.GenWarningOption("kicked", "被踢下线"),
+	dict.GenWarningOption("session_expired", "会话过期"),
+}
+
+var ImClientPlatformOptions = []*model.Option{
+	dict.GenPrimaryOption("ios", "iOS"),
+	dict.GenSuccessOption("android", "Android"),
+	dict.GenInfoOption("web", "Web"),
+	dict.GenDefaultOption("desktop", "桌面端"),
+	dict.GenDefaultOption("unknown", "未知"),
+}
+
+var ImLoginFailureTypeOptions = []*model.Option{
+	dict.GenErrorOption("password_error", "密码错误"),
+	dict.GenErrorOption("code_error", "验证码错误"),
+	dict.GenWarningOption("account_not_found", "账号不存在"),
+	dict.GenErrorOption("account_disabled", "账号已禁用"),
+	dict.GenWarningOption("rate_limited", "访问频率受限"),
+	dict.GenErrorOption("risk_blocked", "风控拦截"),
+}
+
+func init() {
+	dict.RegisterEnums("ImMessageContentTypeOptions", "IM消息内容类型选项", ImMessageContentTypeOptions)
+	dict.RegisterEnums("ImMessageStatusOptions", "IM消息状态选项", ImMessageStatusOptions)
+	dict.RegisterEnums("ImLoginTypeOptions", "IM登录方式选项", ImLoginTypeOptions)
+	dict.RegisterEnums("ImLoginEventTypeOptions", "IM登录事件选项", ImLoginEventTypeOptions)
+	dict.RegisterEnums("ImClientPlatformOptions", "IM客户端平台选项", ImClientPlatformOptions)
+	dict.RegisterEnums("ImLoginFailureTypeOptions", "IM登录失败类型选项", ImLoginFailureTypeOptions)
+}

server/internal/consts/im_external_config.go

@@ -0,0 +1,35 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImExternalServiceOptions", "IM外部服务选项", ImExternalServiceOptions)
+	dict.RegisterEnums("ImExternalConfigStatusOptions", "IM外部配置状态选项", ImExternalConfigStatusOptions)
+}
+
+const (
+	ImExternalServiceSms        = "sms"
+	ImExternalServicePush       = "push"
+	ImExternalServiceTurn       = "turn"
+	ImExternalServiceStorage    = "storage"
+	ImExternalServiceModeration = "moderation"
+
+	ImExternalConfigStatusConfigured   = "configured"
+	ImExternalConfigStatusUnconfigured = "unconfigured"
+)
+
+var ImExternalServiceOptions = []*model.Option{
+	dict.GenSuccessOption(ImExternalServiceSms, "SMS"),
+	dict.GenPrimaryOption(ImExternalServicePush, "Push"),
+	dict.GenInfoOption(ImExternalServiceTurn, "TURN/STUN"),
+	dict.GenWarningOption(ImExternalServiceStorage, "对象存储"),
+	dict.GenDefaultOption(ImExternalServiceModeration, "审核插件"),
+}
+
+var ImExternalConfigStatusOptions = []*model.Option{
+	dict.GenSuccessOption(ImExternalConfigStatusConfigured, "已配置"),
+	dict.GenWarningOption(ImExternalConfigStatusUnconfigured, "未配置"),
+}

server/internal/consts/im_file.go

@@ -0,0 +1,52 @@
+// Package consts
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImFileStatusOptions", "IM文件状态选项", ImFileStatusOptions)
+	dict.RegisterEnums("ImFilePurposeOptions", "IM文件用途选项", ImFilePurposeOptions)
+}
+
+const (
+	ImFileStatusUploading   = 0
+	ImFileStatusCompleted   = 1
+	ImFileStatusFailed      = 2
+	ImFileStatusDeleted     = 3
+	ImFileStatusQuarantined = -1
+
+	ImFilePurposeUnknown       = "unknown"
+	ImFilePurposeChat          = "chat"
+	ImFilePurposeUserAvatar    = "user_avatar"
+	ImFilePurposeGroupAvatar   = "group_avatar"
+	ImFilePurposeGroupFile     = "group_file"
+	ImFilePurposeAbuseEvidence = "abuse_evidence"
+	ImFilePurposeFeedback      = "feedback"
+	ImFilePurposeOrphan        = "orphan"
+)
+
+var ImFileStatusOptions = []*model.Option{
+	dict.GenWarningOption(ImFileStatusUploading, "上传中"),
+	dict.GenSuccessOption(ImFileStatusCompleted, "已完成"),
+	dict.GenErrorOption(ImFileStatusFailed, "失败"),
+	dict.GenDefaultOption(ImFileStatusDeleted, "已删除"),
+	dict.GenErrorOption(ImFileStatusQuarantined, "已隔离"),
+}
+
+var ImFilePurposeOptions = []*model.Option{
+	dict.GenDefaultOption(ImFilePurposeUnknown, "未知"),
+	dict.GenSuccessOption(ImFilePurposeChat, "聊天附件"),
+	dict.GenInfoOption(ImFilePurposeUserAvatar, "用户头像"),
+	dict.GenInfoOption(ImFilePurposeGroupAvatar, "群头像"),
+	dict.GenPrimaryOption(ImFilePurposeGroupFile, "群文件"),
+	dict.GenWarningOption(ImFilePurposeAbuseEvidence, "举报证据"),
+	dict.GenWarningOption(ImFilePurposeFeedback, "反馈附件"),
+	dict.GenDefaultOption(ImFilePurposeOrphan, "孤儿文件"),
+}

server/internal/consts/im_file_policy.go

@@ -0,0 +1,20 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImFilePolicySwitchOptions", "IM文件策略开关选项", ImFilePolicySwitchOptions)
+}
+
+const (
+	ImFilePolicySwitchOff = 0
+	ImFilePolicySwitchOn  = 1
+)
+
+var ImFilePolicySwitchOptions = []*model.Option{
+	dict.GenWarningOption(ImFilePolicySwitchOff, "关闭"),
+	dict.GenSuccessOption(ImFilePolicySwitchOn, "开启"),
+}

server/internal/consts/im_group.go

@@ -19,6 +19,8 @@ func init() {
 	dict.RegisterEnums("ImGroupMuteStatusOptions", "IM禁言状态选项", ImGroupMuteStatusOptions)
 	dict.RegisterEnums("ImGroupAnnouncementStatusOptions", "IM群公告状态选项", ImGroupAnnouncementStatusOptions)
 	dict.RegisterEnums("ImGroupOutboxStatusOptions", "IM群事件状态选项", ImGroupOutboxStatusOptions)
+	dict.RegisterEnums("ImGroupFileStatusOptions", "IM群文件状态选项", ImGroupFileStatusOptions)
+	dict.RegisterEnums("ImGroupFileTypeOptions", "IM群文件类型选项", ImGroupFileTypeOptions)
 }
 
 var ImGroupStateOptions = []*model.Option{
@@ -58,6 +60,14 @@ const (
 	ImGroupOutboxStatusPending   = "pending"
 	ImGroupOutboxStatusDelivered = "delivered"
 	ImGroupOutboxStatusFailed    = "failed"
+
+	ImGroupFileStatusActive  = "active"
+	ImGroupFileStatusDeleted = "deleted"
+
+	ImGroupFileTypeFile  = "file"
+	ImGroupFileTypeImage = "image"
+	ImGroupFileTypeVideo = "video"
+	ImGroupFileTypeAudio = "audio"
 )
 
 var ImGroupStatusOptions = []*model.Option{
@@ -103,3 +113,15 @@ var ImGroupOutboxStatusOptions = []*model.Option{
 	dict.GenSuccessOption(ImGroupOutboxStatusDelivered, "已投递"),
 	dict.GenErrorOption(ImGroupOutboxStatusFailed, "投递失败"),
 }
+
+var ImGroupFileStatusOptions = []*model.Option{
+	dict.GenSuccessOption(ImGroupFileStatusActive, "正常"),
+	dict.GenDefaultOption(ImGroupFileStatusDeleted, "已删除"),
+}
+
+var ImGroupFileTypeOptions = []*model.Option{
+	dict.GenDefaultOption(ImGroupFileTypeFile, "文件"),
+	dict.GenInfoOption(ImGroupFileTypeImage, "图片"),
+	dict.GenPrimaryOption(ImGroupFileTypeVideo, "视频"),
+	dict.GenWarningOption(ImGroupFileTypeAudio, "音频"),
+}

server/internal/consts/im_kafka.go

@@ -38,6 +38,7 @@ const (
 	ImAdminCommandGroupMemberUnmute  = "group.member.unmute"
 	ImAdminCommandGroupMemberRemove  = "group.member.remove"
 	ImAdminCommandGroupOwnerTransfer = "group.owner.transfer"
+	ImAdminCommandGroupDissolve      = "group.dissolve"
 	ImAdminCommandUserBan            = "user.ban"
 	ImAdminCommandUserUnban          = "user.unban"
 	ImAdminCommandUserFreeze         = "user.freeze"
@@ -46,6 +47,9 @@ const (
 	ImAdminCommandUserLogoutAll      = "user.logout_all"
 	ImAdminCommandUserCancel         = "user.account.cancel"
 	ImAdminCommandUserDelete         = "user.account.delete"
+	ImAdminCommandUserPasswordReset  = "user.password.reset"
+	ImAdminCommandMessageHide        = "message.hide"
+	ImAdminCommandMessageDelete      = "message.delete"
 	ImAdminCommandKafkaDeadReplay    = "kafka.dead_letter.replay"
 	ImAdminCommandKafkaDeadIgnore    = "kafka.dead_letter.ignore"
 	ImAdminCommandKafkaDeadResolve   = "kafka.dead_letter.resolve"

server/internal/consts/im_notification.go

@@ -0,0 +1,39 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImNotificationSceneOptions", "IM通知场景选项", ImNotificationSceneOptions)
+	dict.RegisterEnums("ImNotificationTemplateStatusOptions", "IM通知模板状态选项", ImNotificationTemplateStatusOptions)
+}
+
+const (
+	ImNotificationSceneAccountSecurity = "account_security"
+	ImNotificationSceneFriendRequest   = "friend_request"
+	ImNotificationSceneGroupEvent      = "group_event"
+	ImNotificationSceneFileEvent       = "file_event"
+	ImNotificationSceneMeetingReminder = "meeting_reminder"
+	ImNotificationSceneReportReminder  = "report_reminder"
+	ImNotificationSceneWorkOrder       = "work_order"
+
+	ImNotificationTemplateEnabled  = 1
+	ImNotificationTemplateDisabled = 0
+)
+
+var ImNotificationSceneOptions = []*model.Option{
+	dict.GenPrimaryOption(ImNotificationSceneAccountSecurity, "账号安全"),
+	dict.GenInfoOption(ImNotificationSceneFriendRequest, "好友申请"),
+	dict.GenInfoOption(ImNotificationSceneGroupEvent, "群事件"),
+	dict.GenDefaultOption(ImNotificationSceneFileEvent, "文件事件"),
+	dict.GenWarningOption(ImNotificationSceneMeetingReminder, "会议提醒"),
+	dict.GenWarningOption(ImNotificationSceneReportReminder, "日报月报提醒"),
+	dict.GenErrorOption(ImNotificationSceneWorkOrder, "工单处理"),
+}
+
+var ImNotificationTemplateStatusOptions = []*model.Option{
+	dict.GenSuccessOption(ImNotificationTemplateEnabled, "启用"),
+	dict.GenWarningOption(ImNotificationTemplateDisabled, "禁用"),
+}

server/internal/consts/im_org.go

@@ -0,0 +1,38 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImOrgDepartmentStateOptions", "IM组织部门状态选项", ImOrgDepartmentStateOptions)
+	dict.RegisterEnums("ImOrgEmploymentStateOptions", "IM组织成员在职状态选项", ImOrgEmploymentStateOptions)
+	dict.RegisterEnums("ImOrgContactableOptions", "IM组织成员可联系选项", ImOrgContactableOptions)
+}
+
+const (
+	ImOrgDepartmentStateActive   = "active"
+	ImOrgDepartmentStateDisabled = "disabled"
+
+	ImOrgEmploymentStateActive = "active"
+	ImOrgEmploymentStateLeft   = "left"
+
+	ImOrgContactableYes = 1
+	ImOrgContactableNo  = 0
+)
+
+var ImOrgDepartmentStateOptions = []*model.Option{
+	dict.GenSuccessOption(ImOrgDepartmentStateActive, "启用"),
+	dict.GenWarningOption(ImOrgDepartmentStateDisabled, "停用"),
+}
+
+var ImOrgEmploymentStateOptions = []*model.Option{
+	dict.GenSuccessOption(ImOrgEmploymentStateActive, "在职"),
+	dict.GenDefaultOption(ImOrgEmploymentStateLeft, "离职"),
+}
+
+var ImOrgContactableOptions = []*model.Option{
+	dict.GenSuccessOption(ImOrgContactableYes, "可联系"),
+	dict.GenWarningOption(ImOrgContactableNo, "不可联系"),
+}

server/internal/consts/im_outbox.go

@@ -0,0 +1,38 @@
+// Package consts
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImOutboxSourceOptions", "IM Outbox来源选项", ImOutboxSourceOptions)
+	dict.RegisterEnums("ImOutboxStatusOptions", "IM Outbox状态选项", ImOutboxStatusOptions)
+}
+
+const (
+	ImOutboxSourceBusiness = "business"
+	ImOutboxSourceGroup    = "group"
+
+	ImOutboxStatusPending   = "pending"
+	ImOutboxStatusDelivered = "delivered"
+	ImOutboxStatusFailed    = "failed"
+	ImOutboxStatusDead      = "dead"
+)
+
+var ImOutboxSourceOptions = []*model.Option{
+	dict.GenPrimaryOption(ImOutboxSourceBusiness, "业务事件"),
+	dict.GenInfoOption(ImOutboxSourceGroup, "群事件"),
+}
+
+var ImOutboxStatusOptions = []*model.Option{
+	dict.GenWarningOption(ImOutboxStatusPending, "待投递"),
+	dict.GenSuccessOption(ImOutboxStatusDelivered, "已投递"),
+	dict.GenErrorOption(ImOutboxStatusFailed, "失败"),
+	dict.GenDefaultOption(ImOutboxStatusDead, "死信"),
+}

server/internal/consts/im_policy.go

@@ -0,0 +1,118 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+const (
+	ImPolicyActionAllow     = "allow"
+	ImPolicyActionDeny      = "deny"
+	ImPolicyActionChallenge = "challenge"
+	ImPolicyActionAuditOnly = "audit_only"
+	ImSecurityActionBlock   = "block"
+
+	ImSensitiveMatchExact    = "exact"
+	ImSensitiveMatchContains = "contains"
+	ImSensitiveMatchRegex    = "regex"
+	ImSensitiveMatchPinyin   = "pinyin"
+
+	ImSensitiveActionReplace      = "replace"
+	ImSensitiveActionBlock        = "block"
+	ImSensitiveActionAuditOnly    = "audit_only"
+	ImSensitiveActionManualReview = "manual_review"
+
+	ImRiskLevelLow    = "low"
+	ImRiskLevelMedium = "medium"
+	ImRiskLevelHigh   = "high"
+
+	ImSecurityPublishDraft     = "draft"
+	ImSecurityPublishPublished = "published"
+	ImSecurityPublishArchived  = "archived"
+	ImSecurityPublishFailed    = "failed"
+
+	ImCurfewDateDaily   = "daily"
+	ImCurfewDateWeekday = "weekday"
+	ImCurfewDateWeekend = "weekend"
+	ImCurfewDateCustom  = "custom"
+
+	ImCurfewScopePrivate = "private_message"
+	ImCurfewScopeGroup   = "group_message"
+)
+
+var (
+	ImPolicyActionOptions = []*model.Option{
+		dict.GenSuccessOption(ImPolicyActionAllow, "放行"),
+		dict.GenErrorOption(ImPolicyActionDeny, "拦截"),
+		dict.GenWarningOption(ImPolicyActionChallenge, "二次验证"),
+		dict.GenInfoOption(ImPolicyActionAuditOnly, "仅审计"),
+	}
+	ImSecurityActionOptions = []*model.Option{
+		dict.GenSuccessOption(ImPolicyActionAllow, "放行"),
+		dict.GenWarningOption(ImPolicyActionChallenge, "二次验证"),
+		dict.GenErrorOption(ImSecurityActionBlock, "阻断"),
+		dict.GenInfoOption(ImPolicyActionAuditOnly, "仅审计"),
+	}
+	ImSensitiveMatchTypeOptions = []*model.Option{
+		dict.GenPrimaryOption(ImSensitiveMatchExact, "精确匹配"),
+		dict.GenDefaultOption(ImSensitiveMatchContains, "包含匹配"),
+		dict.GenWarningOption(ImSensitiveMatchRegex, "正则匹配"),
+		dict.GenInfoOption(ImSensitiveMatchPinyin, "拼音匹配"),
+	}
+	ImSensitiveActionOptions = []*model.Option{
+		dict.GenWarningOption(ImSensitiveActionReplace, "替换"),
+		dict.GenErrorOption(ImSensitiveActionBlock, "拦截"),
+		dict.GenInfoOption(ImSensitiveActionAuditOnly, "仅审计"),
+		dict.GenPrimaryOption(ImSensitiveActionManualReview, "人工审核"),
+	}
+	ImRiskLevelOptions = []*model.Option{
+		dict.GenSuccessOption(ImRiskLevelLow, "低风险"),
+		dict.GenWarningOption(ImRiskLevelMedium, "中风险"),
+		dict.GenErrorOption(ImRiskLevelHigh, "高风险"),
+	}
+	ImSecurityPublishStatusOptions = []*model.Option{
+		dict.GenWarningOption(ImSecurityPublishDraft, "草稿"),
+		dict.GenSuccessOption(ImSecurityPublishPublished, "已发布"),
+		dict.GenDefaultOption(ImSecurityPublishArchived, "已归档"),
+		dict.GenErrorOption(ImSecurityPublishFailed, "发布失败"),
+	}
+	ImCurfewDateTypeOptions = []*model.Option{
+		dict.GenDefaultOption(ImCurfewDateDaily, "每天"),
+		dict.GenPrimaryOption(ImCurfewDateWeekday, "工作日"),
+		dict.GenInfoOption(ImCurfewDateWeekend, "周末"),
+		dict.GenWarningOption(ImCurfewDateCustom, "自定义日期"),
+	}
+	ImCurfewScopeOptions = []*model.Option{
+		dict.GenErrorOption(ImCurfewScopePrivate, "单聊/私聊"),
+		dict.GenWarningOption(ImCurfewScopeGroup, "群聊"),
+	}
+	ImSensitiveSceneOptions = []*model.Option{
+		dict.GenPrimaryOption("private_message", "单聊消息"),
+		dict.GenPrimaryOption("group_message", "群聊消息"),
+		dict.GenInfoOption("user_profile", "用户资料"),
+		dict.GenInfoOption("group_profile", "群资料"),
+		dict.GenWarningOption("feedback", "用户反馈"),
+		dict.GenWarningOption("report", "举报内容"),
+	}
+	ImFriendEntryOptions = []*model.Option{
+		dict.GenDefaultOption("search", "用户搜索"),
+		dict.GenDefaultOption("profile_card", "个人名片"),
+		dict.GenDefaultOption("group_member", "群成员"),
+		dict.GenDefaultOption("qrcode", "二维码"),
+		dict.GenDefaultOption("invite_auto_add", "邀请注册自动添加"),
+		dict.GenDefaultOption("recommendation", "推荐联系人"),
+	}
+)
+
+func init() {
+	dict.RegisterEnums("ImPolicyActionOptions", "IM策略动作", ImPolicyActionOptions)
+	dict.RegisterEnums("ImSecurityActionOptions", "IM安全策略动作", ImSecurityActionOptions)
+	dict.RegisterEnums("ImSensitiveMatchTypeOptions", "IM敏感词匹配类型", ImSensitiveMatchTypeOptions)
+	dict.RegisterEnums("ImSensitiveActionOptions", "IM敏感词动作", ImSensitiveActionOptions)
+	dict.RegisterEnums("ImRiskLevelOptions", "IM风险等级", ImRiskLevelOptions)
+	dict.RegisterEnums("ImSecurityPublishStatusOptions", "IM安全策略发布状态", ImSecurityPublishStatusOptions)
+	dict.RegisterEnums("ImCurfewDateTypeOptions", "IM宵禁日期类型", ImCurfewDateTypeOptions)
+	dict.RegisterEnums("ImCurfewScopeOptions", "IM宵禁范围", ImCurfewScopeOptions)
+	dict.RegisterEnums("ImSensitiveSceneOptions", "IM敏感词场景", ImSensitiveSceneOptions)
+	dict.RegisterEnums("ImFriendEntryOptions", "IM好友入口", ImFriendEntryOptions)
+}

server/internal/consts/im_product_config.go

@@ -0,0 +1,52 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImAppPlatformOptions", "IM客户端平台选项", ImAppPlatformOptions)
+	dict.RegisterEnums("ImAppUpdateTypeOptions", "IM客户端更新类型选项", ImAppUpdateTypeOptions)
+	dict.RegisterEnums("ImAbuseTargetTypeOptions", "IM举报对象类型选项", ImAbuseTargetTypeOptions)
+	dict.RegisterEnums("ImAbuseReasonEnabledOptions", "IM举报原因启用状态", ImAbuseReasonEnabledOptions)
+}
+
+const (
+	ImAppPlatformIos     = "ios"
+	ImAppPlatformAndroid = "android"
+)
+
+const (
+	ImAppUpdateTypeNone        = "none"
+	ImAppUpdateTypeRecommended = "recommended"
+	ImAppUpdateTypeForce       = "force"
+)
+
+const (
+	ImAbuseTargetTypeUser    = "user"
+	ImAbuseTargetTypeGroup   = "group"
+	ImAbuseTargetTypeMessage = "message"
+)
+
+var ImAppPlatformOptions = []*model.Option{
+	dict.GenPrimaryOption(ImAppPlatformIos, "iOS"),
+	dict.GenSuccessOption(ImAppPlatformAndroid, "Android"),
+}
+
+var ImAppUpdateTypeOptions = []*model.Option{
+	dict.GenDefaultOption(ImAppUpdateTypeNone, "无需更新"),
+	dict.GenWarningOption(ImAppUpdateTypeRecommended, "建议更新"),
+	dict.GenErrorOption(ImAppUpdateTypeForce, "强制更新"),
+}
+
+var ImAbuseTargetTypeOptions = []*model.Option{
+	dict.GenPrimaryOption(ImAbuseTargetTypeUser, "用户"),
+	dict.GenSuccessOption(ImAbuseTargetTypeGroup, "群组"),
+	dict.GenWarningOption(ImAbuseTargetTypeMessage, "消息"),
+}
+
+var ImAbuseReasonEnabledOptions = []*model.Option{
+	dict.GenWarningOption(0, "禁用"),
+	dict.GenSuccessOption(1, "启用"),
+}

server/internal/consts/im_task_dashboard.go

@@ -0,0 +1,22 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImTaskDashboardStatusOptions", "IM任务看板状态选项", ImTaskDashboardStatusOptions)
+}
+
+const (
+	ImTaskDashboardStatusHealthy = "healthy"
+	ImTaskDashboardStatusWarning = "warning"
+	ImTaskDashboardStatusError   = "error"
+)
+
+var ImTaskDashboardStatusOptions = []*model.Option{
+	dict.GenSuccessOption(ImTaskDashboardStatusHealthy, "正常"),
+	dict.GenWarningOption(ImTaskDashboardStatusWarning, "待处理"),
+	dict.GenErrorOption(ImTaskDashboardStatusError, "异常"),
+}

server/internal/consts/im_user.go

@@ -12,6 +12,22 @@ import (
 
 func init() {
 	dict.RegisterEnums("ImUserStateOptions", "IM用户状态选项", ImUserStateOptions)
+	dict.RegisterEnums("ImUserListStateOptions", "IM用户列表状态选项", ImUserListStateOptions)
+	dict.RegisterEnums("ImUserRegisterTypeOptions", "IM用户注册方式选项", ImUserRegisterTypeOptions)
+}
+
+const (
+	ImUserRegisterTypeAdmin      = "admin"
+	ImUserRegisterTypeMobile     = "mobile"
+	ImUserRegisterTypeInviteCode = "invite_code"
+	ImLoginChannelApp            = "app"
+	ImLoginChannelWeb            = "web"
+)
+
+var ImUserRegisterTypeOptions = []*model.Option{
+	dict.GenPrimaryOption(ImUserRegisterTypeAdmin, "后台创建"),
+	dict.GenSuccessOption(ImUserRegisterTypeMobile, "手机号注册"),
+	dict.GenInfoOption(ImUserRegisterTypeInviteCode, "邀请码注册"),
 }
 
 const (
@@ -22,8 +38,14 @@ const (
 )
 
 var ImUserStateOptions = []*model.Option{
-	dict.GenSuccessOption(ImUserStateOk, "正常"),
-	dict.GenErrorOption(ImUserStateSuspended, "已停用"),
-	dict.GenDefaultOption(ImUserStateDeleted, "已删除"),
+	dict.GenSuccessOption(ImUserStateOk, "启用"),
+	dict.GenErrorOption(ImUserStateSuspended, "封禁"),
+	dict.GenDefaultOption(ImUserStateDeleted, "已注销"),
 	dict.GenWarningOption(ImUserStateUndefined, "未定义"),
 }
+
+var ImUserListStateOptions = []*model.Option{
+	dict.GenSuccessOption(ImUserStateOk, "启用"),
+	dict.GenErrorOption(ImUserStateSuspended, "封禁"),
+	dict.GenDefaultOption(ImUserStateDeleted, "已注销"),
+}

server/internal/consts/im_workbench.go

@@ -0,0 +1,50 @@
+package consts
+
+import (
+	"hotgo/internal/library/dict"
+	"hotgo/internal/model"
+)
+
+func init() {
+	dict.RegisterEnums("ImWorkbenchAppEnabledOptions", "IM工作台模块启用状态", ImWorkbenchAppEnabledOptions)
+	dict.RegisterEnums("ImWorkbenchPermissionOptions", "IM工作台模块权限策略", ImWorkbenchPermissionOptions)
+	dict.RegisterEnums("ImWorkbenchRouteOptions", "IM工作台模块路由选项", ImWorkbenchRouteOptions)
+}
+
+const (
+	ImWorkbenchAppDisabled = 0
+	ImWorkbenchAppEnabled  = 1
+)
+
+const (
+	ImWorkbenchPermissionEnabled      = "enabled"
+	ImWorkbenchPermissionRoleRequired = "role_required"
+	ImWorkbenchPermissionDisabled     = "disabled"
+)
+
+const (
+	ImWorkbenchRouteOrganization     = "/organization"
+	ImWorkbenchRouteMeetings         = "/meetings"
+	ImWorkbenchRouteDailyReports     = "/reports/daily"
+	ImWorkbenchRouteMonthlyReports   = "/reports/monthly"
+	ImWorkbenchRouteExecutiveMailbox = "/executive-mailbox"
+)
+
+var ImWorkbenchAppEnabledOptions = []*model.Option{
+	dict.GenWarningOption(ImWorkbenchAppDisabled, "禁用"),
+	dict.GenSuccessOption(ImWorkbenchAppEnabled, "启用"),
+}
+
+var ImWorkbenchPermissionOptions = []*model.Option{
+	dict.GenSuccessOption(ImWorkbenchPermissionEnabled, "全部可见"),
+	dict.GenPrimaryOption(ImWorkbenchPermissionRoleRequired, "按角色权限"),
+	dict.GenWarningOption(ImWorkbenchPermissionDisabled, "不可见"),
+}
+
+var ImWorkbenchRouteOptions = []*model.Option{
+	dict.GenPrimaryOption(ImWorkbenchRouteOrganization, "组织架构"),
+	dict.GenPrimaryOption(ImWorkbenchRouteMeetings, "会议通知"),
+	dict.GenPrimaryOption(ImWorkbenchRouteDailyReports, "日报"),
+	dict.GenPrimaryOption(ImWorkbenchRouteMonthlyReports, "月报"),
+	dict.GenPrimaryOption(ImWorkbenchRouteExecutiveMailbox, "总经理信箱"),
+}

server/internal/controller/admin/sys/im_abuse_reason.go

@@ -0,0 +1,36 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imabusereason"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImAbuseReason = cImAbuseReason{}
+
+type cImAbuseReason struct{}
+
+func (c *cImAbuseReason) List(ctx context.Context, req *imabusereason.ListReq) (res *imabusereason.ListRes, err error) {
+	list, totalCount, err := service.SysImAbuseReason().List(ctx, &req.ImAbuseReasonListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImAbuseReasonModel{}
+	}
+	res = new(imabusereason.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImAbuseReason) Edit(ctx context.Context, req *imabusereason.EditReq) (res *imabusereason.EditRes, err error) {
+	err = service.SysImAbuseReason().Edit(ctx, &req.ImAbuseReasonEditInp)
+	return
+}
+
+func (c *cImAbuseReason) Delete(ctx context.Context, req *imabusereason.DeleteReq) (res *imabusereason.DeleteRes, err error) {
+	err = service.SysImAbuseReason().Delete(ctx, &req.ImAbuseReasonDeleteInp)
+	return
+}

server/internal/controller/admin/sys/im_app_release.go

@@ -0,0 +1,31 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imapprelease"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImAppRelease = cImAppRelease{}
+
+type cImAppRelease struct{}
+
+func (c *cImAppRelease) List(ctx context.Context, req *imapprelease.ListReq) (res *imapprelease.ListRes, err error) {
+	list, totalCount, err := service.SysImAppRelease().List(ctx, &req.ImAppReleaseListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImAppReleaseModel{}
+	}
+	res = new(imapprelease.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImAppRelease) Edit(ctx context.Context, req *imapprelease.EditReq) (res *imapprelease.EditRes, err error) {
+	err = service.SysImAppRelease().Edit(ctx, &req.ImAppReleaseEditInp)
+	return
+}

server/internal/controller/admin/sys/im_audit_log.go

@@ -31,6 +31,12 @@ func (c *cImAuditLog) List(ctx context.Context, req *imauditlog.ListReq) (res *i
 	return
 }
 
+// Export 导出IM审计日志列表
+func (c *cImAuditLog) Export(ctx context.Context, req *imauditlog.ExportReq) (res *imauditlog.ExportRes, err error) {
+	err = service.SysImAuditLog().Export(ctx, &req.ImAuditLogListInp)
+	return
+}
+
 // View 获取指定IM审计日志信息
 func (c *cImAuditLog) View(ctx context.Context, req *imauditlog.ViewReq) (res *imauditlog.ViewRes, err error) {
 	data, err := service.SysImAuditLog().View(ctx, &req.ImAuditLogViewInp)

server/internal/controller/admin/sys/im_dashboard.go

@@ -0,0 +1,31 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imdashboard"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImDashboard = cImDashboard{}
+
+type cImDashboard struct{}
+
+func (c *cImDashboard) Overview(ctx context.Context, req *imdashboard.OverviewReq) (res *imdashboard.OverviewRes, err error) {
+	data, err := service.SysImDashboard().Overview(ctx, &req.ImDashboardOverviewInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imdashboard.OverviewRes{ImDashboardOverviewModel: data}, nil
+}
+
+func (c *cImDashboard) Trends(ctx context.Context, req *imdashboard.TrendsReq) (res *imdashboard.TrendsRes, err error) {
+	list, err := service.SysImDashboard().Trends(ctx, &req.ImDashboardTrendsInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImDashboardTrendModel{}
+	}
+	return &imdashboard.TrendsRes{List: list}, nil
+}

server/internal/controller/admin/sys/im_external_config.go

@@ -0,0 +1,46 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imexternalconfig"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImExternalConfig = cImExternalConfig{}
+
+type cImExternalConfig struct{}
+
+func (c *cImExternalConfig) List(ctx context.Context, req *imexternalconfig.ListReq) (res *imexternalconfig.ListRes, err error) {
+	list, totalCount, err := service.SysImExternalConfig().List(ctx, &req.ImExternalConfigListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImExternalConfigListModel{}
+	}
+	res = new(imexternalconfig.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImExternalConfig) View(ctx context.Context, req *imexternalconfig.ViewReq) (res *imexternalconfig.ViewRes, err error) {
+	data, err := service.SysImExternalConfig().View(ctx, &req.ImExternalConfigViewInp)
+	if err != nil {
+		return
+	}
+	res = new(imexternalconfig.ViewRes)
+	res.ImExternalConfigViewModel = data
+	return
+}
+
+func (c *cImExternalConfig) Update(ctx context.Context, req *imexternalconfig.UpdateReq) (res *imexternalconfig.UpdateRes, err error) {
+	err = service.SysImExternalConfig().Update(ctx, &req.ImExternalConfigUpdateInp)
+	return
+}
+
+func (c *cImExternalConfig) Check(ctx context.Context, req *imexternalconfig.CheckReq) (res *imexternalconfig.CheckRes, err error) {
+	err = service.SysImExternalConfig().Check(ctx, &req.ImExternalConfigCheckInp)
+	return
+}

server/internal/controller/admin/sys/im_feedback_config.go

@@ -0,0 +1,25 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imfeedbackconfig"
+	"hotgo/internal/service"
+)
+
+var ImFeedbackConfig = cImFeedbackConfig{}
+
+type cImFeedbackConfig struct{}
+
+func (c *cImFeedbackConfig) Get(ctx context.Context, req *imfeedbackconfig.GetReq) (res *imfeedbackconfig.GetRes, err error) {
+	data, err := service.SysImFeedbackConfig().Get(ctx, &req.ImFeedbackConfigGetInp)
+	if err != nil {
+		return
+	}
+	res = &imfeedbackconfig.GetRes{ImFeedbackConfigModel: data}
+	return
+}
+
+func (c *cImFeedbackConfig) Update(ctx context.Context, req *imfeedbackconfig.UpdateReq) (res *imfeedbackconfig.UpdateRes, err error) {
+	err = service.SysImFeedbackConfig().Update(ctx, &req.ImFeedbackConfigUpdateInp)
+	return
+}

server/internal/controller/admin/sys/im_file.go

@@ -0,0 +1,68 @@
+// Package sys
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imfile"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var (
+	ImFile = cImFile{}
+)
+
+type cImFile struct{}
+
+// List 查看IM文件列表
+func (c *cImFile) List(ctx context.Context, req *imfile.ListReq) (res *imfile.ListRes, err error) {
+	list, totalCount, err := service.SysImFile().List(ctx, &req.ImFileListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImFileListModel{}
+	}
+	res = new(imfile.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+// View 获取IM文件详情
+func (c *cImFile) View(ctx context.Context, req *imfile.ViewReq) (res *imfile.ViewRes, err error) {
+	data, err := service.SysImFile().View(ctx, &req.ImFileViewInp)
+	if err != nil {
+		return
+	}
+	res = new(imfile.ViewRes)
+	res.ImFileViewModel = data
+	return
+}
+
+// Quarantine 隔离IM文件
+func (c *cImFile) Quarantine(ctx context.Context, req *imfile.QuarantineReq) (res *imfile.QuarantineRes, err error) {
+	err = service.SysImFile().Quarantine(ctx, &req.ImFileActionInp)
+	return
+}
+
+// Delete 删除IM文件
+func (c *cImFile) Delete(ctx context.Context, req *imfile.DeleteReq) (res *imfile.DeleteRes, err error) {
+	err = service.SysImFile().Delete(ctx, &req.ImFileActionInp)
+	return
+}
+
+// CleanupOrphan 清理IM孤儿文件
+func (c *cImFile) CleanupOrphan(ctx context.Context, req *imfile.CleanupOrphanReq) (res *imfile.CleanupOrphanRes, err error) {
+	data, err := service.SysImFile().CleanupOrphan(ctx, &req.ImFileCleanupOrphanInp)
+	if err != nil {
+		return
+	}
+	res = new(imfile.CleanupOrphanRes)
+	res.ImFileCleanupOrphanModel = data
+	return
+}

server/internal/controller/admin/sys/im_file_policy.go

@@ -0,0 +1,31 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imfilepolicy"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImFilePolicy = cImFilePolicy{}
+
+type cImFilePolicy struct{}
+
+func (c *cImFilePolicy) List(ctx context.Context, req *imfilepolicy.ListReq) (res *imfilepolicy.ListRes, err error) {
+	list, totalCount, err := service.SysImFilePolicy().List(ctx, &req.ImFilePolicyListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImFilePolicyListModel{}
+	}
+	res = new(imfilepolicy.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImFilePolicy) Update(ctx context.Context, req *imfilepolicy.UpdateReq) (res *imfilepolicy.UpdateRes, err error) {
+	err = service.SysImFilePolicy().Update(ctx, &req.ImFilePolicyUpdateInp)
+	return
+}

server/internal/controller/admin/sys/im_group.go

@@ -75,6 +75,150 @@ func (c *cImGroup) Governance(ctx context.Context, req *imgroup.GovernanceReq) (
 	return
 }
 
+// GovernanceUpdate 更新IM群治理配置
+func (c *cImGroup) GovernanceUpdate(ctx context.Context, req *imgroup.GovernanceUpdateReq) (res *imgroup.GovernanceUpdateRes, err error) {
+	data, err := service.SysImGroup().GovernanceUpdate(ctx, &req.ImGroupGovernanceUpdateInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.GovernanceUpdateRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// ProfileUpdate 修改IM群资料
+func (c *cImGroup) ProfileUpdate(ctx context.Context, req *imgroup.ProfileUpdateReq) (res *imgroup.ProfileUpdateRes, err error) {
+	data, err := service.SysImGroup().ProfileUpdate(ctx, &req.ImGroupProfileUpdateInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.ProfileUpdateRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// Dissolve 解散IM群
+func (c *cImGroup) Dissolve(ctx context.Context, req *imgroup.DissolveReq) (res *imgroup.DissolveRes, err error) {
+	data, err := service.SysImGroup().Dissolve(ctx, &req.ImGroupDissolveInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.DissolveRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// Mute 禁言IM群成员
+func (c *cImGroup) Mute(ctx context.Context, req *imgroup.MuteReq) (res *imgroup.MuteRes, err error) {
+	data, err := service.SysImGroup().Mute(ctx, &req.ImGroupMuteInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.MuteRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// MemberMute Kafka禁言IM群成员
+func (c *cImGroup) MemberMute(ctx context.Context, req *imgroup.MemberMuteReq) (res *imgroup.MemberMuteRes, err error) {
+	data, err := service.SysImGroup().MemberMute(ctx, &req.ImGroupMuteInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.MemberMuteRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// Unmute 解除IM群成员禁言
+func (c *cImGroup) Unmute(ctx context.Context, req *imgroup.UnmuteReq) (res *imgroup.UnmuteRes, err error) {
+	data, err := service.SysImGroup().Unmute(ctx, &req.ImGroupUnmuteInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.UnmuteRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// MemberUnmute Kafka解除IM群成员禁言
+func (c *cImGroup) MemberUnmute(ctx context.Context, req *imgroup.MemberUnmuteReq) (res *imgroup.MemberUnmuteRes, err error) {
+	data, err := service.SysImGroup().MemberUnmute(ctx, &req.ImGroupUnmuteInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.MemberUnmuteRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// MemberRemove 移出IM群成员
+func (c *cImGroup) MemberRemove(ctx context.Context, req *imgroup.MemberRemoveReq) (res *imgroup.MemberRemoveRes, err error) {
+	data, err := service.SysImGroup().MemberRemove(ctx, &req.ImGroupMemberRemoveInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.MemberRemoveRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// JoinRequestApprove 通过IM入群申请
+func (c *cImGroup) JoinRequestApprove(ctx context.Context, req *imgroup.JoinRequestApproveReq) (res *imgroup.JoinRequestApproveRes, err error) {
+	err = service.SysImGroup().JoinRequestApprove(ctx, &req.ImGroupJoinRequestResolveInp)
+	return
+}
+
+// JoinRequestReject 拒绝IM入群申请
+func (c *cImGroup) JoinRequestReject(ctx context.Context, req *imgroup.JoinRequestRejectReq) (res *imgroup.JoinRequestRejectRes, err error) {
+	err = service.SysImGroup().JoinRequestReject(ctx, &req.ImGroupJoinRequestResolveInp)
+	return
+}
+
+// RoleUpdate 更新IM群成员角色
+func (c *cImGroup) RoleUpdate(ctx context.Context, req *imgroup.RoleUpdateReq) (res *imgroup.RoleUpdateRes, err error) {
+	data, err := service.SysImGroup().RoleUpdate(ctx, &req.ImGroupRoleUpdateInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.RoleUpdateRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// AdminSet 设置IM群管理员
+func (c *cImGroup) AdminSet(ctx context.Context, req *imgroup.AdminSetReq) (res *imgroup.AdminSetRes, err error) {
+	data, err := service.SysImGroup().AdminSet(ctx, &req.ImGroupRoleUpdateInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.AdminSetRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// AdminRemove 删除IM群管理员
+func (c *cImGroup) AdminRemove(ctx context.Context, req *imgroup.AdminRemoveReq) (res *imgroup.AdminRemoveRes, err error) {
+	data, err := service.SysImGroup().AdminRemove(ctx, &req.ImGroupRoleUpdateInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.AdminRemoveRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
+// OwnerTransfer 转让IM群主
+func (c *cImGroup) OwnerTransfer(ctx context.Context, req *imgroup.OwnerTransferReq) (res *imgroup.OwnerTransferRes, err error) {
+	data, err := service.SysImGroup().OwnerTransfer(ctx, &req.ImGroupOwnerTransferInp)
+	if err != nil {
+		return
+	}
+	res = new(imgroup.OwnerTransferRes)
+	res.ImGroupCommandModel = data
+	return
+}
+
 // JoinRequestList 查看IM入群申请列表
 func (c *cImGroup) JoinRequestList(ctx context.Context, req *imgroup.JoinRequestListReq) (res *imgroup.JoinRequestListRes, err error) {
 	list, totalCount, err := service.SysImGroup().JoinRequestList(ctx, &req.ImGroupJoinRequestListInp)
@@ -90,6 +234,27 @@ func (c *cImGroup) JoinRequestList(ctx context.Context, req *imgroup.JoinRequest
 	return
 }
 
+// FileList 查看IM群文件列表
+func (c *cImGroup) FileList(ctx context.Context, req *imgroup.FileListReq) (res *imgroup.FileListRes, err error) {
+	list, totalCount, err := service.SysImGroup().FileList(ctx, &req.ImGroupFileListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImGroupFileListModel{}
+	}
+	res = new(imgroup.FileListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+// FileDelete 删除IM群文件
+func (c *cImGroup) FileDelete(ctx context.Context, req *imgroup.FileDeleteReq) (res *imgroup.FileDeleteRes, err error) {
+	err = service.SysImGroup().FileDelete(ctx, &req.ImGroupFileDeleteInp)
+	return
+}
+
 // InvitationList 查看IM群邀请列表
 func (c *cImGroup) InvitationList(ctx context.Context, req *imgroup.InvitationListReq) (res *imgroup.InvitationListRes, err error) {
 	list, totalCount, err := service.SysImGroup().InvitationList(ctx, &req.ImGroupInvitationListInp)

server/internal/controller/admin/sys/im_group_message.go

@@ -0,0 +1,40 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imgroupmessage"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImGroupMessage = cImGroupMessage{}
+
+type cImGroupMessage struct{}
+
+func (c *cImGroupMessage) List(ctx context.Context, req *imgroupmessage.ListReq) (res *imgroupmessage.ListRes, err error) {
+	list, total, err := service.SysImGroupMessage().List(ctx, &req.ImGroupMessageListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImMessageListModel{}
+	}
+	res = &imgroupmessage.ListRes{List: list}
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImGroupMessage) View(ctx context.Context, req *imgroupmessage.ViewReq) (*imgroupmessage.ViewRes, error) {
+	data, err := service.SysImGroupMessage().View(ctx, &req.ImMessageViewInp)
+	return &imgroupmessage.ViewRes{ImMessageViewModel: data}, err
+}
+func (c *cImGroupMessage) Hide(ctx context.Context, req *imgroupmessage.HideReq) (*imgroupmessage.HideRes, error) {
+	data, err := service.SysImGroupMessage().Hide(ctx, &req.ImMessageActionInp)
+	return &imgroupmessage.HideRes{ImMessageCommandModel: data}, err
+}
+func (c *cImGroupMessage) Delete(ctx context.Context, req *imgroupmessage.DeleteReq) (*imgroupmessage.DeleteRes, error) {
+	data, err := service.SysImGroupMessage().Delete(ctx, &req.ImMessageActionInp)
+	return &imgroupmessage.DeleteRes{ImMessageCommandModel: data}, err
+}
+func (c *cImGroupMessage) Export(ctx context.Context, req *imgroupmessage.ExportReq) (*imgroupmessage.ExportRes, error) {
+	return &imgroupmessage.ExportRes{}, service.SysImGroupMessage().Export(ctx, &req.ImGroupMessageListInp)
+}

server/internal/controller/admin/sys/im_invite.go

@@ -60,6 +60,11 @@ func (c *cImInvite) Revoke(ctx context.Context, req *iminvite.RevokeReq) (res *i
 	return
 }
 
+func (c *cImInvite) BindUser(ctx context.Context, req *iminvite.BindUserReq) (res *iminvite.BindUserRes, err error) {
+	err = service.SysImInvite().BindUser(ctx, &req.ImInviteBindUserInp)
+	return
+}
+
 func (c *cImInvite) BatchRevoke(ctx context.Context, req *iminvite.BatchRevokeReq) (res *iminvite.BatchRevokeRes, err error) {
 	data, err := service.SysImInvite().BatchRevoke(ctx, &req.ImInviteBatchRevokeInp)
 	if err != nil {

server/internal/controller/admin/sys/im_login_failure_log.go

@@ -0,0 +1,39 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imloginfailurelog"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImLoginFailureLog = cImLoginFailureLog{}
+
+type cImLoginFailureLog struct{}
+
+func (c *cImLoginFailureLog) List(ctx context.Context, req *imloginfailurelog.ListReq) (res *imloginfailurelog.ListRes, err error) {
+	list, total, err := service.SysImLoginFailureLog().List(ctx, &req.ImLoginFailureLogListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImLoginFailureLogModel{}
+	}
+	res = &imloginfailurelog.ListRes{List: list}
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImLoginFailureLog) View(ctx context.Context, req *imloginfailurelog.ViewReq) (*imloginfailurelog.ViewRes, error) {
+	data, err := service.SysImLoginFailureLog().View(ctx, &req.ImLoginFailureViewInp)
+	return &imloginfailurelog.ViewRes{ImLoginFailureLogModel: data}, err
+}
+func (c *cImLoginFailureLog) Export(ctx context.Context, req *imloginfailurelog.ExportReq) (*imloginfailurelog.ExportRes, error) {
+	return &imloginfailurelog.ExportRes{}, service.SysImLoginFailureLog().Export(ctx, &req.ImLoginFailureLogListInp)
+}
+func (c *cImLoginFailureLog) AddBlacklist(ctx context.Context, req *imloginfailurelog.AddBlacklistReq) (*imloginfailurelog.AddBlacklistRes, error) {
+	return &imloginfailurelog.AddBlacklistRes{}, service.SysImLoginFailureLog().AddBlacklist(ctx, &req.ImLoginFailureAddBlacklistInp)
+}
+func (c *cImLoginFailureLog) BanUser(ctx context.Context, req *imloginfailurelog.BanUserReq) (*imloginfailurelog.BanUserRes, error) {
+	data, err := service.SysImLoginFailureLog().BanUser(ctx, &req.ImLoginFailureBanUserInp)
+	return &imloginfailurelog.BanUserRes{ImUserCommandModel: data}, err
+}

server/internal/controller/admin/sys/im_mailbox_config.go

@@ -0,0 +1,25 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/immailboxconfig"
+	"hotgo/internal/service"
+)
+
+var ImMailboxConfig = cImMailboxConfig{}
+
+type cImMailboxConfig struct{}
+
+func (c *cImMailboxConfig) Get(ctx context.Context, req *immailboxconfig.GetReq) (res *immailboxconfig.GetRes, err error) {
+	data, err := service.SysImMailboxConfig().Get(ctx, &req.ImMailboxConfigGetInp)
+	if err != nil {
+		return
+	}
+	res = &immailboxconfig.GetRes{ImMailboxConfigModel: data}
+	return
+}
+
+func (c *cImMailboxConfig) Update(ctx context.Context, req *immailboxconfig.UpdateReq) (res *immailboxconfig.UpdateRes, err error) {
+	err = service.SysImMailboxConfig().Update(ctx, &req.ImMailboxConfigUpdateInp)
+	return
+}

server/internal/controller/admin/sys/im_notification.go

@@ -0,0 +1,31 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imnotification"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImNotification = cImNotification{}
+
+type cImNotification struct{}
+
+func (c *cImNotification) TemplateList(ctx context.Context, req *imnotification.TemplateListReq) (res *imnotification.TemplateListRes, err error) {
+	list, totalCount, err := service.SysImNotification().TemplateList(ctx, &req.ImNotificationTemplateListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImNotificationTemplateListModel{}
+	}
+	res = new(imnotification.TemplateListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImNotification) TemplateUpdate(ctx context.Context, req *imnotification.TemplateUpdateReq) (res *imnotification.TemplateUpdateRes, err error) {
+	err = service.SysImNotification().TemplateUpdate(ctx, &req.ImNotificationTemplateUpdateInp)
+	return
+}

server/internal/controller/admin/sys/im_org.go

@@ -0,0 +1,79 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imorg"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImOrg = cImOrg{}
+
+type cImOrg struct{}
+
+func (c *cImOrg) DepartmentList(ctx context.Context, req *imorg.DepartmentListReq) (res *imorg.DepartmentListRes, err error) {
+	list, totalCount, err := service.SysImOrg().DepartmentList(ctx, &req.ImOrgDepartmentListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImOrgDepartmentModel{}
+	}
+	res = new(imorg.DepartmentListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImOrg) DepartmentEdit(ctx context.Context, req *imorg.DepartmentEditReq) (res *imorg.DepartmentEditRes, err error) {
+	err = service.SysImOrg().DepartmentEdit(ctx, &req.ImOrgDepartmentEditInp)
+	return
+}
+
+func (c *cImOrg) DepartmentExport(ctx context.Context, req *imorg.DepartmentExportReq) (res *imorg.DepartmentExportRes, err error) {
+	err = service.SysImOrg().DepartmentExport(ctx, &req.ImOrgDepartmentListInp)
+	return
+}
+
+func (c *cImOrg) DepartmentDelete(ctx context.Context, req *imorg.DepartmentDeleteReq) (res *imorg.DepartmentDeleteRes, err error) {
+	err = service.SysImOrg().DepartmentDelete(ctx, &req.ImOrgDepartmentDeleteInp)
+	return
+}
+
+func (c *cImOrg) MemberList(ctx context.Context, req *imorg.MemberListReq) (res *imorg.MemberListRes, err error) {
+	list, totalCount, err := service.SysImOrg().MemberList(ctx, &req.ImOrgMemberListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImOrgMemberModel{}
+	}
+	res = new(imorg.MemberListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImOrg) MemberEdit(ctx context.Context, req *imorg.MemberEditReq) (res *imorg.MemberEditRes, err error) {
+	err = service.SysImOrg().MemberEdit(ctx, &req.ImOrgMemberEditInp)
+	return
+}
+
+func (c *cImOrg) MemberExport(ctx context.Context, req *imorg.MemberExportReq) (res *imorg.MemberExportRes, err error) {
+	err = service.SysImOrg().MemberExport(ctx, &req.ImOrgMemberListInp)
+	return
+}
+
+func (c *cImOrg) MemberDelete(ctx context.Context, req *imorg.MemberDeleteReq) (res *imorg.MemberDeleteRes, err error) {
+	err = service.SysImOrg().MemberDelete(ctx, &req.ImOrgMemberDeleteInp)
+	return
+}
+
+func (c *cImOrg) Search(ctx context.Context, req *imorg.SearchReq) (res *imorg.SearchRes, err error) {
+	data, err := service.SysImOrg().Search(ctx, &req.ImOrgSearchInp)
+	if err != nil {
+		return
+	}
+	res = &imorg.SearchRes{ImOrgSearchModel: data}
+	return
+}

server/internal/controller/admin/sys/im_outbox.go

@@ -0,0 +1,55 @@
+// Package sys
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imoutbox"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var (
+	ImOutbox = cImOutbox{}
+)
+
+type cImOutbox struct{}
+
+func (c *cImOutbox) List(ctx context.Context, req *imoutbox.ListReq) (res *imoutbox.ListRes, err error) {
+	list, totalCount, err := service.SysImOutbox().List(ctx, &req.ImOutboxListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImOutboxListModel{}
+	}
+
+	res = new(imoutbox.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImOutbox) View(ctx context.Context, req *imoutbox.ViewReq) (res *imoutbox.ViewRes, err error) {
+	data, err := service.SysImOutbox().View(ctx, &req.ImOutboxViewInp)
+	if err != nil {
+		return
+	}
+
+	res = new(imoutbox.ViewRes)
+	res.ImOutboxViewModel = data
+	return
+}
+
+func (c *cImOutbox) Retry(ctx context.Context, req *imoutbox.RetryReq) (res *imoutbox.RetryRes, err error) {
+	err = service.SysImOutbox().Retry(ctx, &req.ImOutboxActionInp)
+	return
+}
+
+func (c *cImOutbox) Dead(ctx context.Context, req *imoutbox.DeadReq) (res *imoutbox.DeadRes, err error) {
+	err = service.SysImOutbox().Dead(ctx, &req.ImOutboxActionInp)
+	return
+}

server/internal/controller/admin/sys/im_private_message.go

@@ -0,0 +1,40 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imprivatemessage"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImPrivateMessage = cImPrivateMessage{}
+
+type cImPrivateMessage struct{}
+
+func (c *cImPrivateMessage) List(ctx context.Context, req *imprivatemessage.ListReq) (res *imprivatemessage.ListRes, err error) {
+	list, total, err := service.SysImPrivateMessage().List(ctx, &req.ImPrivateMessageListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImMessageListModel{}
+	}
+	res = &imprivatemessage.ListRes{List: list}
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImPrivateMessage) View(ctx context.Context, req *imprivatemessage.ViewReq) (*imprivatemessage.ViewRes, error) {
+	data, err := service.SysImPrivateMessage().View(ctx, &req.ImMessageViewInp)
+	return &imprivatemessage.ViewRes{ImMessageViewModel: data}, err
+}
+func (c *cImPrivateMessage) Hide(ctx context.Context, req *imprivatemessage.HideReq) (*imprivatemessage.HideRes, error) {
+	data, err := service.SysImPrivateMessage().Hide(ctx, &req.ImMessageActionInp)
+	return &imprivatemessage.HideRes{ImMessageCommandModel: data}, err
+}
+func (c *cImPrivateMessage) Delete(ctx context.Context, req *imprivatemessage.DeleteReq) (*imprivatemessage.DeleteRes, error) {
+	data, err := service.SysImPrivateMessage().Delete(ctx, &req.ImMessageActionInp)
+	return &imprivatemessage.DeleteRes{ImMessageCommandModel: data}, err
+}
+func (c *cImPrivateMessage) Export(ctx context.Context, req *imprivatemessage.ExportReq) (*imprivatemessage.ExportRes, error) {
+	return &imprivatemessage.ExportRes{}, service.SysImPrivateMessage().Export(ctx, &req.ImPrivateMessageListInp)
+}

server/internal/controller/admin/sys/im_security_policy.go

@@ -0,0 +1,72 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imsecuritypolicy"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImSecurityPolicy = cImSecurityPolicy{}
+
+type cImSecurityPolicy struct{}
+
+func (c *cImSecurityPolicy) List(ctx context.Context, req *imsecuritypolicy.ListReq) (res *imsecuritypolicy.ListRes, err error) {
+	list, total, err := service.SysImSecurityPolicy().List(ctx, &req.ImSecurityPolicyListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImSecurityPolicyModel{}
+	}
+	res = new(imsecuritypolicy.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImSecurityPolicy) View(ctx context.Context, req *imsecuritypolicy.ViewReq) (res *imsecuritypolicy.ViewRes, err error) {
+	data, err := service.SysImSecurityPolicy().View(ctx, &req.ImSecurityPolicyViewInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imsecuritypolicy.ViewRes{ImSecurityPolicyModel: data}, nil
+}
+func (c *cImSecurityPolicy) Save(ctx context.Context, req *imsecuritypolicy.SaveReq) (res *imsecuritypolicy.SaveRes, err error) {
+	id, err := service.SysImSecurityPolicy().Save(ctx, &req.ImSecurityPolicySaveInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imsecuritypolicy.SaveRes{Id: id}, nil
+}
+func (c *cImSecurityPolicy) Publish(ctx context.Context, req *imsecuritypolicy.PublishReq) (res *imsecuritypolicy.PublishRes, err error) {
+	err = service.SysImSecurityPolicy().Publish(ctx, &req.ImSecurityPolicyPublishInp)
+	return
+}
+func (c *cImSecurityPolicy) RestoreDefault(ctx context.Context, req *imsecuritypolicy.RestoreDefaultReq) (res *imsecuritypolicy.RestoreDefaultRes, err error) {
+	id, err := service.SysImSecurityPolicy().RestoreDefault(ctx, &req.ImSecurityPolicyRestoreInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imsecuritypolicy.RestoreDefaultRes{Id: id}, nil
+}
+func (c *cImSecurityPolicy) IPRuleList(ctx context.Context, req *imsecuritypolicy.IPRuleListReq) (res *imsecuritypolicy.IPRuleListRes, err error) {
+	list, total, err := service.SysImSecurityPolicy().IPRuleList(ctx, &req.ImSecurityIPRuleListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImSecurityIPRuleModel{}
+	}
+	res = new(imsecuritypolicy.IPRuleListRes)
+	res.List = list
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImSecurityPolicy) IPRuleEdit(ctx context.Context, req *imsecuritypolicy.IPRuleEditReq) (res *imsecuritypolicy.IPRuleEditRes, err error) {
+	err = service.SysImSecurityPolicy().IPRuleEdit(ctx, &req.ImSecurityIPRuleEditInp)
+	return
+}
+func (c *cImSecurityPolicy) IPRuleDelete(ctx context.Context, req *imsecuritypolicy.IPRuleDeleteReq) (res *imsecuritypolicy.IPRuleDeleteRes, err error) {
+	err = service.SysImSecurityPolicy().IPRuleDelete(ctx, &req.ImSecurityIPRuleDeleteInp)
+	return
+}

server/internal/controller/admin/sys/im_sensitive_word.go

@@ -0,0 +1,59 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imsensitiveword"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImSensitiveWord = cImSensitiveWord{}
+
+type cImSensitiveWord struct{}
+
+func (c *cImSensitiveWord) List(ctx context.Context, req *imsensitiveword.ListReq) (res *imsensitiveword.ListRes, err error) {
+	list, total, err := service.SysImSensitiveWord().List(ctx, &req.ImSensitiveWordListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImSensitiveWordListModel{}
+	}
+	res = new(imsensitiveword.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImSensitiveWord) Edit(ctx context.Context, req *imsensitiveword.EditReq) (res *imsensitiveword.EditRes, err error) {
+	err = service.SysImSensitiveWord().Edit(ctx, &req.ImSensitiveWordEditInp)
+	return
+}
+func (c *cImSensitiveWord) Delete(ctx context.Context, req *imsensitiveword.DeleteReq) (res *imsensitiveword.DeleteRes, err error) {
+	err = service.SysImSensitiveWord().Delete(ctx, &req.ImSensitiveWordDeleteInp)
+	return
+}
+func (c *cImSensitiveWord) Status(ctx context.Context, req *imsensitiveword.StatusReq) (res *imsensitiveword.StatusRes, err error) {
+	err = service.SysImSensitiveWord().Status(ctx, &req.ImSensitiveWordStatusInp)
+	return
+}
+func (c *cImSensitiveWord) BatchImport(ctx context.Context, req *imsensitiveword.BatchImportReq) (res *imsensitiveword.BatchImportRes, err error) {
+	data, err := service.SysImSensitiveWord().BatchImport(ctx, &req.ImSensitiveWordBatchImportInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imsensitiveword.BatchImportRes{ImSensitiveWordBatchImportModel: data}, nil
+}
+func (c *cImSensitiveWord) GroupList(ctx context.Context, req *imsensitiveword.GroupListReq) (res *imsensitiveword.GroupListRes, err error) {
+	list, err := service.SysImSensitiveWord().GroupList(ctx, &req.ImSensitiveWordGroupListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImSensitiveWordGroupModel{}
+	}
+	return &imsensitiveword.GroupListRes{List: list}, nil
+}
+func (c *cImSensitiveWord) GroupEdit(ctx context.Context, req *imsensitiveword.GroupEditReq) (res *imsensitiveword.GroupEditRes, err error) {
+	err = service.SysImSensitiveWord().GroupEdit(ctx, &req.ImSensitiveWordGroupEditInp)
+	return
+}

server/internal/controller/admin/sys/im_task_dashboard.go

@@ -0,0 +1,26 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imtaskdashboard"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImTaskDashboard = cImTaskDashboard{}
+
+type cImTaskDashboard struct{}
+
+func (c *cImTaskDashboard) List(ctx context.Context, req *imtaskdashboard.ListReq) (res *imtaskdashboard.ListRes, err error) {
+	list, totalCount, err := service.SysImTaskDashboard().List(ctx, &req.ImTaskDashboardListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImTaskDashboardListModel{}
+	}
+	res = new(imtaskdashboard.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}

server/internal/controller/admin/sys/im_tenant.go

@@ -58,3 +58,35 @@ func (c *cImTenant) Status(ctx context.Context, req *imtenant.StatusReq) (res *i
 	err = service.SysImTenant().Status(ctx, &req.ImTenantStatusInp)
 	return
 }
+
+func (c *cImTenant) Usage(ctx context.Context, req *imtenant.UsageReq) (res *imtenant.UsageRes, err error) {
+	data, err := service.SysImTenant().Usage(ctx, &req.ImTenantUsageInp)
+	if err != nil {
+		return
+	}
+
+	res = new(imtenant.UsageRes)
+	res.ImTenantUsageModel = data
+	return
+}
+
+func (c *cImTenant) DeletionCheck(ctx context.Context, req *imtenant.DeletionCheckReq) (res *imtenant.DeletionCheckRes, err error) {
+	data, err := service.SysImTenant().DeletionCheck(ctx, &req.ImTenantDeletionCheckInp)
+	if err != nil {
+		return
+	}
+
+	res = new(imtenant.DeletionCheckRes)
+	res.ImTenantDeletionCheckModel = data
+	return
+}
+
+func (c *cImTenant) EnterDeleting(ctx context.Context, req *imtenant.EnterDeletingReq) (res *imtenant.EnterDeletingRes, err error) {
+	err = service.SysImTenant().EnterDeleting(ctx, &req.ImTenantLifecycleInp)
+	return
+}
+
+func (c *cImTenant) Restore(ctx context.Context, req *imtenant.RestoreReq) (res *imtenant.RestoreRes, err error) {
+	err = service.SysImTenant().Restore(ctx, &req.ImTenantLifecycleInp)
+	return
+}

server/internal/controller/admin/sys/im_user.go

@@ -10,6 +10,8 @@ import (
 	"hotgo/api/admin/imuser"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/errors/gerror"
 )
 
 var (
@@ -18,6 +20,40 @@ var (
 
 type cImUser struct{}
 
+func (c *cImUser) Create(ctx context.Context, req *imuser.CreateReq) (res *imuser.CreateRes, err error) {
+	data, err := service.SysImUser().Create(ctx, &req.ImUserCreateInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imuser.CreateRes{ImUserCreateModel: data}, nil
+}
+
+func (c *cImUser) BatchCreate(ctx context.Context, req *imuser.BatchCreateReq) (res *imuser.BatchCreateRes, err error) {
+	data, err := service.SysImUser().BatchCreate(ctx, &req.ImUserBatchCreateInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imuser.BatchCreateRes{ImUserBatchCreateModel: data}, nil
+}
+
+func (c *cImUser) Import(ctx context.Context, req *imuser.ImportReq) (res *imuser.ImportRes, err error) {
+	file, err := req.File.Open()
+	if err != nil {
+		return nil, gerror.Wrap(err, "打开Excel文件失败")
+	}
+	defer file.Close()
+	data, err := service.SysImUser().ImportExcel(ctx, req.TenantId, req.GroupId, file)
+	if err != nil {
+		return nil, err
+	}
+	return &imuser.ImportRes{ImUserBatchCreateModel: data}, nil
+}
+
+func (c *cImUser) DownloadTemplate(ctx context.Context, req *imuser.DownloadTemplateReq) (res *imuser.DownloadTemplateRes, err error) {
+	err = service.SysImUser().DownloadTemplate(ctx)
+	return
+}
+
 // List 查看IM用户列表
 func (c *cImUser) List(ctx context.Context, req *imuser.ListReq) (res *imuser.ListRes, err error) {
 	list, totalCount, err := service.SysImUser().List(ctx, &req.ImUserListInp)
@@ -47,6 +83,60 @@ func (c *cImUser) View(ctx context.Context, req *imuser.ViewReq) (res *imuser.Vi
 	return
 }
 
+func (c *cImUser) ResetPassword(ctx context.Context, req *imuser.ResetPasswordReq) (res *imuser.ResetPasswordRes, err error) {
+	data, err := service.SysImUser().ResetPassword(ctx, &req.ImUserPasswordResetInp)
+	if err != nil {
+		return
+	}
+	res = new(imuser.ResetPasswordRes)
+	res.ImUserCommandModel = data
+	return
+}
+
+func (c *cImUser) RevokeSessions(ctx context.Context, req *imuser.RevokeSessionsReq) (res *imuser.RevokeSessionsRes, err error) {
+	err = service.SysImUser().RevokeSessions(ctx, &req.ImUserRevokeSessionsInp)
+	return
+}
+
+func (c *cImUser) Status(ctx context.Context, req *imuser.StatusReq) (res *imuser.StatusRes, err error) {
+	err = service.SysImUser().Status(ctx, &req.ImUserStatusInp)
+	return
+}
+
+func (c *cImUser) AdjustGroup(ctx context.Context, req *imuser.AdjustGroupReq) (res *imuser.AdjustGroupRes, err error) {
+	err = service.SysImUser().AdjustGroup(ctx, &req.ImUserAdjustGroupInp)
+	return
+}
+
+func (c *cImUser) IPWhitelist(ctx context.Context, req *imuser.IPWhitelistReq) (res *imuser.IPWhitelistRes, err error) {
+	data, err := service.SysImUser().IPWhitelist(ctx, &req.ImUserIPWhitelistInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imuser.IPWhitelistRes{ImUserIPWhitelistModel: data}, nil
+}
+
+func (c *cImUser) IPWhitelistSave(ctx context.Context, req *imuser.IPWhitelistSaveReq) (res *imuser.IPWhitelistSaveRes, err error) {
+	err = service.SysImUser().IPWhitelistSave(ctx, &req.ImUserIPWhitelistInp)
+	return
+}
+
+func (c *cImUser) Devices(ctx context.Context, req *imuser.DevicesReq) (res *imuser.DevicesRes, err error) {
+	list, totalCount, err := service.SysImUser().Devices(ctx, &req.ImUserDeviceListInp)
+	if err != nil {
+		return
+	}
+
+	if list == nil {
+		list = []*sysin.ImUserDeviceListModel{}
+	}
+
+	res = new(imuser.DevicesRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
 func (c *cImUser) Ban(ctx context.Context, req *imuser.BanReq) (res *imuser.BanRes, err error) {
 	data, err := service.SysImUser().Ban(ctx, &req.ImUserGovernanceInp)
 	if err != nil {

server/internal/controller/admin/sys/im_user_login_history.go

@@ -0,0 +1,28 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imuserloginhistory"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImUserLoginHistory = cImUserLoginHistory{}
+
+type cImUserLoginHistory struct{}
+
+func (c *cImUserLoginHistory) List(ctx context.Context, req *imuserloginhistory.ListReq) (res *imuserloginhistory.ListRes, err error) {
+	list, total, err := service.SysImUserLoginHistory().List(ctx, &req.ImUserLoginHistoryListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImUserLoginHistoryModel{}
+	}
+	res = &imuserloginhistory.ListRes{List: list}
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImUserLoginHistory) Export(ctx context.Context, req *imuserloginhistory.ExportReq) (*imuserloginhistory.ExportRes, error) {
+	return &imuserloginhistory.ExportRes{}, service.SysImUserLoginHistory().Export(ctx, &req.ImUserLoginHistoryListInp)
+}

server/internal/controller/admin/sys/im_user_policy_group.go

@@ -0,0 +1,79 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imuserpolicygroup"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImUserPolicyGroup = cImUserPolicyGroup{}
+
+type cImUserPolicyGroup struct{}
+
+func (c *cImUserPolicyGroup) List(ctx context.Context, req *imuserpolicygroup.ListReq) (res *imuserpolicygroup.ListRes, err error) {
+	list, total, err := service.SysImUserPolicyGroup().List(ctx, &req.ImUserPolicyGroupListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImUserPolicyGroupListModel{}
+	}
+	res = new(imuserpolicygroup.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImUserPolicyGroup) View(ctx context.Context, req *imuserpolicygroup.ViewReq) (res *imuserpolicygroup.ViewRes, err error) {
+	data, err := service.SysImUserPolicyGroup().View(ctx, &req.ImUserPolicyGroupViewInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imuserpolicygroup.ViewRes{ImUserPolicyGroupViewModel: data}, nil
+}
+func (c *cImUserPolicyGroup) Edit(ctx context.Context, req *imuserpolicygroup.EditReq) (res *imuserpolicygroup.EditRes, err error) {
+	err = service.SysImUserPolicyGroup().Edit(ctx, &req.ImUserPolicyGroupEditInp)
+	return
+}
+func (c *cImUserPolicyGroup) Delete(ctx context.Context, req *imuserpolicygroup.DeleteReq) (res *imuserpolicygroup.DeleteRes, err error) {
+	err = service.SysImUserPolicyGroup().Delete(ctx, &req.ImUserPolicyGroupDeleteInp)
+	return
+}
+func (c *cImUserPolicyGroup) Status(ctx context.Context, req *imuserpolicygroup.StatusReq) (res *imuserpolicygroup.StatusRes, err error) {
+	err = service.SysImUserPolicyGroup().Status(ctx, &req.ImUserPolicyGroupStatusInp)
+	return
+}
+func (c *cImUserPolicyGroup) MemberList(ctx context.Context, req *imuserpolicygroup.MemberListReq) (res *imuserpolicygroup.MemberListRes, err error) {
+	list, total, err := service.SysImUserPolicyGroup().MemberList(ctx, &req.ImUserPolicyGroupMemberListInp)
+	if err != nil {
+		return nil, err
+	}
+	if list == nil {
+		list = []*sysin.ImUserPolicyGroupMemberModel{}
+	}
+	res = new(imuserpolicygroup.MemberListRes)
+	res.List = list
+	res.PageRes.Pack(req, total)
+	return
+}
+func (c *cImUserPolicyGroup) MemberAdd(ctx context.Context, req *imuserpolicygroup.MemberAddReq) (res *imuserpolicygroup.MemberAddRes, err error) {
+	err = service.SysImUserPolicyGroup().MemberAdd(ctx, &req.ImUserPolicyGroupMemberAddInp)
+	return
+}
+func (c *cImUserPolicyGroup) MemberRemove(ctx context.Context, req *imuserpolicygroup.MemberRemoveReq) (res *imuserpolicygroup.MemberRemoveRes, err error) {
+	err = service.SysImUserPolicyGroup().MemberRemove(ctx, &req.ImUserPolicyGroupMemberRemoveInp)
+	return
+}
+
+func (c *cImUserPolicyGroup) LoginIPWhitelist(ctx context.Context, req *imuserpolicygroup.LoginIPWhitelistReq) (res *imuserpolicygroup.LoginIPWhitelistRes, err error) {
+	data, err := service.SysImUserPolicyGroup().LoginIPWhitelist(ctx, &req.ImTenantLoginIPWhitelistInp)
+	if err != nil {
+		return nil, err
+	}
+	return &imuserpolicygroup.LoginIPWhitelistRes{ImTenantLoginIPWhitelistModel: data}, nil
+}
+
+func (c *cImUserPolicyGroup) LoginIPWhitelistSave(ctx context.Context, req *imuserpolicygroup.LoginIPWhitelistSaveReq) (res *imuserpolicygroup.LoginIPWhitelistSaveRes, err error) {
+	err = service.SysImUserPolicyGroup().LoginIPWhitelistSave(ctx, &req.ImTenantLoginIPWhitelistSaveInp)
+	return
+}

server/internal/controller/admin/sys/im_workbench.go

@@ -0,0 +1,41 @@
+package sys
+
+import (
+	"context"
+	"hotgo/api/admin/imworkbench"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+)
+
+var ImWorkbench = cImWorkbench{}
+
+type cImWorkbench struct{}
+
+func (c *cImWorkbench) List(ctx context.Context, req *imworkbench.ListReq) (res *imworkbench.ListRes, err error) {
+	list, totalCount, err := service.SysImWorkbench().List(ctx, &req.ImWorkbenchAppListInp)
+	if err != nil {
+		return
+	}
+	if list == nil {
+		list = []*sysin.ImWorkbenchAppModel{}
+	}
+	res = new(imworkbench.ListRes)
+	res.List = list
+	res.PageRes.Pack(req, totalCount)
+	return
+}
+
+func (c *cImWorkbench) Edit(ctx context.Context, req *imworkbench.EditReq) (res *imworkbench.EditRes, err error) {
+	err = service.SysImWorkbench().Edit(ctx, &req.ImWorkbenchAppEditInp)
+	return
+}
+
+func (c *cImWorkbench) Delete(ctx context.Context, req *imworkbench.DeleteReq) (res *imworkbench.DeleteRes, err error) {
+	err = service.SysImWorkbench().Delete(ctx, &req.ImWorkbenchAppDeleteInp)
+	return
+}
+
+func (c *cImWorkbench) Reorder(ctx context.Context, req *imworkbench.ReorderReq) (res *imworkbench.ReorderRes, err error) {
+	err = service.SysImWorkbench().Reorder(ctx, &req.ImWorkbenchAppReorderInp)
+	return
+}

server/internal/controller/health/health.go

@@ -0,0 +1,69 @@
+package health
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/net/ghttp"
+
+	"hotgo/internal/library/queue"
+)
+
+type response struct {
+	Status string            `json:"status"`
+	Checks map[string]string `json:"checks"`
+}
+
+// Serve exposes an unauthenticated dependency health endpoint for container probes.
+func Serve(r *ghttp.Request) {
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		r.Response.Header().Set("Allow", http.MethodGet+", "+http.MethodHead)
+		r.Response.WriteStatusExit(http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+	defer cancel()
+	checks := map[string]string{}
+	statusCode := http.StatusOK
+
+	if err := g.DB().Ctx(ctx).Raw("SELECT 1").Scan(new(int)); err != nil {
+		checks["mysql"] = err.Error()
+		statusCode = http.StatusServiceUnavailable
+	} else {
+		checks["mysql"] = "ok"
+	}
+
+	if _, err := g.Redis().Do(ctx, "PING"); err != nil {
+		checks["redis"] = err.Error()
+		statusCode = http.StatusServiceUnavailable
+	} else {
+		checks["redis"] = "ok"
+	}
+
+	if strings.EqualFold(strings.TrimSpace(g.Cfg().MustGet(ctx, "queue.driver").String()), "kafka") {
+		if err := queue.KafkaHealthCheck(ctx); err != nil {
+			checks["kafka"] = err.Error()
+			statusCode = http.StatusServiceUnavailable
+		} else {
+			checks["kafka"] = "ok"
+		}
+	} else {
+		checks["kafka"] = "disabled"
+	}
+
+	body := response{Status: "ok", Checks: checks}
+	if statusCode != http.StatusOK {
+		body.Status = "error"
+	}
+	r.Response.Header().Set("Content-Type", "application/json; charset=utf-8")
+	r.Response.WriteHeader(statusCode)
+	if r.Method != http.MethodHead {
+		r.Response.WriteJsonExit(body)
+		return
+	}
+	r.Exit()
+}

server/internal/controller/internalapi/imconfig/im_config.go

@@ -6,10 +6,10 @@ import (
 	"hotgo/internal/dao"
 	"hotgo/internal/library/imtenant"
 	"hotgo/internal/model/entity"
+	"hotgo/internal/service"
 	"strings"
 
 	"github.com/gogf/gf/v2/errors/gerror"
-	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/os/gtime"
 	"github.com/gogf/gf/v2/util/gconv"
 )
@@ -39,7 +39,7 @@ func (c *cConfig) TenantList(ctx context.Context, req *api.TenantListReq) (res *
 	if limit <= 0 || limit > 1000 {
 		limit = 1000
 	}
-	mod := imtenant.RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Limit(limit)
+	mod := imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Limit(limit)
 	if req.State != "" {
 		if req.State == "active" {
 			mod = mod.Where(dao.ImTenant.Columns().State, 1)
@@ -59,7 +59,7 @@ func (c *cConfig) TenantList(ctx context.Context, req *api.TenantListReq) (res *
 }
 
 func (c *cConfig) RegistrationSms(ctx context.Context, req *api.RegistrationSmsReq) (res *api.RegistrationSmsRes, err error) {
-	var record g.Map
+	var record *entity.SysConfig
 	if err = dao.SysConfig.Ctx(ctx).
 		Where(dao.SysConfig.Columns().Group, "im").
 		Where(dao.SysConfig.Columns().Key, "register_sms_enabled").
@@ -69,7 +69,7 @@ func (c *cConfig) RegistrationSms(ctx context.Context, req *api.RegistrationSmsR
 	}
 	enabled := true
 	if record != nil {
-		enabled = gconv.String(record[dao.SysConfig.Columns().Value]) != "0"
+		enabled = gconv.String(record.Value) != "0"
 	}
 	return &api.RegistrationSmsRes{Enabled: enabled}, nil
 }
@@ -91,9 +91,65 @@ func (c *cConfig) ThirdParty(ctx context.Context, req *api.ThirdPartyReq) (res *
 	return &api.ThirdPartyRes{Values: values}, nil
 }
 
+func (c *cConfig) TenantLoginIPWhitelist(ctx context.Context, req *api.TenantLoginIPWhitelistReq) (res *api.TenantLoginIPWhitelistRes, err error) {
+	if _, err = getTenant(ctx, dao.ImTenant.Columns().Id, req.Id); err != nil {
+		return nil, err
+	}
+	data, err := service.SysImUserPolicyGroup().LoginIPWhitelistByTenant(ctx, req.Id)
+	if err != nil {
+		return nil, err
+	}
+	return &api.TenantLoginIPWhitelistRes{TenantId: data.TenantId, AppList: data.AppList, WebList: data.WebList}, nil
+}
+
+func (c *cConfig) AppReleaseLatest(ctx context.Context, req *api.AppReleaseLatestReq) (res *api.AppReleaseLatestRes, err error) {
+	platform := strings.ToLower(strings.TrimSpace(req.Platform))
+	channel := strings.ToLower(strings.TrimSpace(req.Channel))
+	if platform != "ios" && platform != "android" {
+		return nil, gerror.New("客户端平台不合法")
+	}
+	if channel == "" {
+		channel = "stable"
+	}
+	if strings.ContainsAny(channel, " \t\r\n/") || len(channel) > 32 {
+		return nil, gerror.New("客户端渠道不合法")
+	}
+	var row struct {
+		ID                  int64       `json:"id"`
+		Platform            string      `json:"platform"`
+		Channel             string      `json:"channel"`
+		LatestVersion       string      `json:"latest_version"`
+		MinSupportedVersion string      `json:"min_supported_version"`
+		UpdateType          string      `json:"update_type"`
+		ReleaseNotes        string      `json:"release_notes"`
+		StoreURL            string      `json:"store_url"`
+		PackageURL          string      `json:"package_url"`
+		Checksum            string      `json:"checksum"`
+		RemindAfterSeconds  int         `json:"remind_after_seconds"`
+		PublishedAt         *gtime.Time `json:"published_at"`
+		CreatedAt           *gtime.Time `json:"created_at"`
+		UpdatedAt           *gtime.Time `json:"updated_at"`
+	}
+	err = imtenant.RegistryDB().Model("im_app_releases").Safe().Ctx(ctx).
+		Where("platform", platform).Where("channel", channel).Limit(1).Scan(&row)
+	if err != nil {
+		return nil, gerror.Wrap(err, "获取IM客户端版本策略失败")
+	}
+	if row.ID <= 0 {
+		return nil, gerror.New("IM客户端版本策略不存在")
+	}
+	return &api.AppReleaseLatestRes{
+		ID: row.ID, Platform: row.Platform, Channel: row.Channel,
+		LatestVersion: row.LatestVersion, MinSupportedVersion: row.MinSupportedVersion,
+		UpdateType: row.UpdateType, ReleaseNotes: row.ReleaseNotes, StoreURL: row.StoreURL,
+		PackageURL: row.PackageURL, Checksum: row.Checksum, RemindAfterSeconds: row.RemindAfterSeconds,
+		PublishedAt: gtimeToRFC3339(row.PublishedAt), CreatedAt: gtimeToRFC3339(row.CreatedAt), UpdatedAt: gtimeToRFC3339(row.UpdatedAt),
+	}, nil
+}
+
 func getTenant(ctx context.Context, field string, value any) (*entity.ImTenant, error) {
 	var tenant *entity.ImTenant
-	if err := imtenant.RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(field, value).Scan(&tenant); err != nil {
+	if err := imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(field, value).Scan(&tenant); err != nil {
 		return nil, gerror.Wrap(err, "获取IM租户配置失败")
 	}
 	if tenant == nil || tenant.Id <= 0 {

server/internal/crons/im_file_cleanup_orphan.go

@@ -0,0 +1,98 @@
+// Package crons
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package crons
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/dao"
+	"hotgo/internal/library/cron"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+	"github.com/gogf/gf/v2/util/gconv"
+)
+
+func init() {
+	cron.Register(ImFileCleanupOrphan)
+}
+
+// ImFileCleanupOrphan 清理IM孤儿文件，参数：保留天数、单租户处理上限。
+var ImFileCleanupOrphan = &cImFileCleanupOrphan{name: "imFileCleanupOrphan"}
+
+type cImFileCleanupOrphan struct {
+	name string
+}
+
+func (c *cImFileCleanupOrphan) GetName() string {
+	return c.name
+}
+
+func (c *cImFileCleanupOrphan) Execute(ctx context.Context, parser *cron.Parser) (err error) {
+	days := 7
+	limit := 100
+	if len(parser.Args) > 0 {
+		days = gconv.Int(parser.Args[0])
+	}
+	if len(parser.Args) > 1 {
+		limit = gconv.Int(parser.Args[1])
+	}
+	if days <= 0 {
+		days = 7
+	}
+	if limit <= 0 || limit > 1000 {
+		limit = 100
+	}
+
+	var tenants []*entity.ImTenant
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).
+		Where(dao.ImTenant.Columns().State, consts.ImTenantStateActive).
+		Scan(&tenants); err != nil {
+		parser.Logger.Warningf(ctx, "cron ImFileCleanupOrphan load tenants err:%+v", err)
+		return err
+	}
+
+	cutoff := gtime.Now().AddDate(0, 0, -days)
+	for _, tenant := range tenants {
+		db, _, dbErr := imtenant.DB(ctx, tenant.Id)
+		if dbErr != nil {
+			parser.Logger.Warningf(ctx, "cron ImFileCleanupOrphan tenant:%d db err:%+v", tenant.Id, dbErr)
+			continue
+		}
+		rows, dbErr := db.Model("im_fileuploads fu").Safe().Ctx(ctx).
+			LeftJoin("im_filemsglinks fml", "fml.fileid=fu.id").
+			Fields("fu.id").
+			Where("fml.id IS NULL").
+			WhereLT("fu.updatedat", cutoff).
+			WhereNotIn("fu.status", []int{consts.ImFileStatusDeleted, consts.ImFileStatusQuarantined}).
+			Group("fu.id").
+			OrderAsc("fu.updatedat").
+			Limit(limit).
+			All()
+		if dbErr != nil {
+			parser.Logger.Warningf(ctx, "cron ImFileCleanupOrphan tenant:%d scan err:%+v", tenant.Id, dbErr)
+			continue
+		}
+		if len(rows) == 0 {
+			continue
+		}
+		ids := make([]int64, 0, len(rows))
+		for _, row := range rows {
+			ids = append(ids, row["id"].Int64())
+		}
+		if _, dbErr = db.Model("im_fileuploads").Safe().Ctx(ctx).
+			WhereIn("id", ids).
+			Data(g.Map{"status": consts.ImFileStatusDeleted, "updatedat": gtime.Now()}).
+			Update(); dbErr != nil {
+			parser.Logger.Warningf(ctx, "cron ImFileCleanupOrphan tenant:%d update err:%+v", tenant.Id, dbErr)
+			continue
+		}
+		parser.Logger.Infof(ctx, "cron ImFileCleanupOrphan tenant:%d count:%d", tenant.Id, len(ids))
+	}
+	return nil
+}

server/internal/dao/im_message_curfew_rules.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imMessageCurfewRulesDao is the data access object for the table im_message_curfew_rules.
+// You can define custom methods on it to extend its functionality as needed.
+type imMessageCurfewRulesDao struct {
+	*internal.ImMessageCurfewRulesDao
+}
+
+var (
+	// ImMessageCurfewRules is a globally accessible object for table im_message_curfew_rules operations.
+	ImMessageCurfewRules = imMessageCurfewRulesDao{internal.NewImMessageCurfewRulesDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_security_ip_rules.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imSecurityIpRulesDao is the data access object for the table im_security_ip_rules.
+// You can define custom methods on it to extend its functionality as needed.
+type imSecurityIpRulesDao struct {
+	*internal.ImSecurityIpRulesDao
+}
+
+var (
+	// ImSecurityIpRules is a globally accessible object for table im_security_ip_rules operations.
+	ImSecurityIpRules = imSecurityIpRulesDao{internal.NewImSecurityIpRulesDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_security_policy.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imSecurityPolicyDao is the data access object for the table im_security_policy.
+// You can define custom methods on it to extend its functionality as needed.
+type imSecurityPolicyDao struct {
+	*internal.ImSecurityPolicyDao
+}
+
+var (
+	// ImSecurityPolicy is a globally accessible object for table im_security_policy operations.
+	ImSecurityPolicy = imSecurityPolicyDao{internal.NewImSecurityPolicyDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_sensitive_word_groups.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imSensitiveWordGroupsDao is the data access object for the table im_sensitive_word_groups.
+// You can define custom methods on it to extend its functionality as needed.
+type imSensitiveWordGroupsDao struct {
+	*internal.ImSensitiveWordGroupsDao
+}
+
+var (
+	// ImSensitiveWordGroups is a globally accessible object for table im_sensitive_word_groups operations.
+	ImSensitiveWordGroups = imSensitiveWordGroupsDao{internal.NewImSensitiveWordGroupsDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_sensitive_words.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imSensitiveWordsDao is the data access object for the table im_sensitive_words.
+// You can define custom methods on it to extend its functionality as needed.
+type imSensitiveWordsDao struct {
+	*internal.ImSensitiveWordsDao
+}
+
+var (
+	// ImSensitiveWords is a globally accessible object for table im_sensitive_words operations.
+	ImSensitiveWords = imSensitiveWordsDao{internal.NewImSensitiveWordsDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_user_policy_group_members.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imUserPolicyGroupMembersDao is the data access object for the table im_user_policy_group_members.
+// You can define custom methods on it to extend its functionality as needed.
+type imUserPolicyGroupMembersDao struct {
+	*internal.ImUserPolicyGroupMembersDao
+}
+
+var (
+	// ImUserPolicyGroupMembers is a globally accessible object for table im_user_policy_group_members operations.
+	ImUserPolicyGroupMembers = imUserPolicyGroupMembersDao{internal.NewImUserPolicyGroupMembersDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/im_user_policy_groups.go

@@ -0,0 +1,22 @@
+// =================================================================================
+// This file is auto-generated by the GoFrame CLI tool. You may modify it as needed.
+// =================================================================================
+
+package dao
+
+import (
+	"hotgo/internal/dao/internal"
+)
+
+// imUserPolicyGroupsDao is the data access object for the table im_user_policy_groups.
+// You can define custom methods on it to extend its functionality as needed.
+type imUserPolicyGroupsDao struct {
+	*internal.ImUserPolicyGroupsDao
+}
+
+var (
+	// ImUserPolicyGroups is a globally accessible object for table im_user_policy_groups operations.
+	ImUserPolicyGroups = imUserPolicyGroupsDao{internal.NewImUserPolicyGroupsDao()}
+)
+
+// Add your custom methods and functionality below.

server/internal/dao/internal/im_message_curfew_rules.go

@@ -0,0 +1,123 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImMessageCurfewRulesDao is the data access object for the table im_message_curfew_rules.
+type ImMessageCurfewRulesDao struct {
+	table    string                      // table is the underlying table name of the DAO.
+	group    string                      // group is the database configuration group name of the current DAO.
+	columns  ImMessageCurfewRulesColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler          // handlers for customized model modification.
+}
+
+// ImMessageCurfewRulesColumns defines and stores column names for the table im_message_curfew_rules.
+type ImMessageCurfewRulesColumns struct {
+	Id                string //
+	TenantId          string //
+	PolicyId          string //
+	RuleCode          string //
+	RuleName          string //
+	DateType          string // daily, weekday, weekend, custom
+	CustomDates       string // YYYY-MM-DD values for custom date type
+	Weekdays          string // ISO weekdays 1 through 7
+	Timezone          string //
+	StartTime         string //
+	EndTime           string // Less than start_time means crossing midnight
+	Scope             string // private_message or group_message
+	WhitelistUserIds  string //
+	WhitelistGroupIds string //
+	Message           string //
+	Status            string // 1 enabled, 2 disabled
+	Sort              string //
+	CreatedAt         string //
+	CreatedBy         string //
+	UpdatedAt         string //
+	UpdatedBy         string //
+	DeletedAt         string //
+	DeletedBy         string //
+}
+
+// imMessageCurfewRulesColumns holds the columns for the table im_message_curfew_rules.
+var imMessageCurfewRulesColumns = ImMessageCurfewRulesColumns{
+	Id:                "id",
+	TenantId:          "tenant_id",
+	PolicyId:          "policy_id",
+	RuleCode:          "rule_code",
+	RuleName:          "rule_name",
+	DateType:          "date_type",
+	CustomDates:       "custom_dates",
+	Weekdays:          "weekdays",
+	Timezone:          "timezone",
+	StartTime:         "start_time",
+	EndTime:           "end_time",
+	Scope:             "scope",
+	WhitelistUserIds:  "whitelist_user_ids",
+	WhitelistGroupIds: "whitelist_group_ids",
+	Message:           "message",
+	Status:            "status",
+	Sort:              "sort",
+	CreatedAt:         "created_at",
+	CreatedBy:         "created_by",
+	UpdatedAt:         "updated_at",
+	UpdatedBy:         "updated_by",
+	DeletedAt:         "deleted_at",
+	DeletedBy:         "deleted_by",
+}
+
+// NewImMessageCurfewRulesDao creates and returns a new DAO object for table data access.
+func NewImMessageCurfewRulesDao(handlers ...gdb.ModelHandler) *ImMessageCurfewRulesDao {
+	return &ImMessageCurfewRulesDao{
+		group:    "default",
+		table:    "im_message_curfew_rules",
+		columns:  imMessageCurfewRulesColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImMessageCurfewRulesDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImMessageCurfewRulesDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImMessageCurfewRulesDao) Columns() ImMessageCurfewRulesColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImMessageCurfewRulesDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImMessageCurfewRulesDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImMessageCurfewRulesDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_security_ip_rules.go

@@ -0,0 +1,109 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImSecurityIpRulesDao is the data access object for the table im_security_ip_rules.
+type ImSecurityIpRulesDao struct {
+	table    string                   // table is the underlying table name of the DAO.
+	group    string                   // group is the database configuration group name of the current DAO.
+	columns  ImSecurityIpRulesColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler       // handlers for customized model modification.
+}
+
+// ImSecurityIpRulesColumns defines and stores column names for the table im_security_ip_rules.
+type ImSecurityIpRulesColumns struct {
+	Id        string //
+	TenantId  string //
+	RuleType  string // whitelist or blacklist
+	IpCidr    string // IPv4, IPv6 or CIDR
+	Action    string // allow, challenge, block, audit_only
+	SceneJson string // login, register, message, upload and other scenes
+	RiskLevel string //
+	Status    string // 1 enabled, 2 disabled
+	ExpiresAt string //
+	Remark    string //
+	CreatedAt string //
+	CreatedBy string //
+	UpdatedAt string //
+	UpdatedBy string //
+	DeletedAt string //
+	DeletedBy string //
+}
+
+// imSecurityIpRulesColumns holds the columns for the table im_security_ip_rules.
+var imSecurityIpRulesColumns = ImSecurityIpRulesColumns{
+	Id:        "id",
+	TenantId:  "tenant_id",
+	RuleType:  "rule_type",
+	IpCidr:    "ip_cidr",
+	Action:    "action",
+	SceneJson: "scene_json",
+	RiskLevel: "risk_level",
+	Status:    "status",
+	ExpiresAt: "expires_at",
+	Remark:    "remark",
+	CreatedAt: "created_at",
+	CreatedBy: "created_by",
+	UpdatedAt: "updated_at",
+	UpdatedBy: "updated_by",
+	DeletedAt: "deleted_at",
+	DeletedBy: "deleted_by",
+}
+
+// NewImSecurityIpRulesDao creates and returns a new DAO object for table data access.
+func NewImSecurityIpRulesDao(handlers ...gdb.ModelHandler) *ImSecurityIpRulesDao {
+	return &ImSecurityIpRulesDao{
+		group:    "default",
+		table:    "im_security_ip_rules",
+		columns:  imSecurityIpRulesColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImSecurityIpRulesDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImSecurityIpRulesDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImSecurityIpRulesDao) Columns() ImSecurityIpRulesColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImSecurityIpRulesDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImSecurityIpRulesDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImSecurityIpRulesDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_security_policy.go

@@ -0,0 +1,123 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImSecurityPolicyDao is the data access object for the table im_security_policy.
+type ImSecurityPolicyDao struct {
+	table    string                  // table is the underlying table name of the DAO.
+	group    string                  // group is the database configuration group name of the current DAO.
+	columns  ImSecurityPolicyColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler      // handlers for customized model modification.
+}
+
+// ImSecurityPolicyColumns defines and stores column names for the table im_security_policy.
+type ImSecurityPolicyColumns struct {
+	Id                   string //
+	TenantId             string // 0 means global fallback policy
+	PolicyVersion        string //
+	PolicyName           string //
+	PublishStatus        string //
+	PasswordPolicy       string //
+	LoginRateLimit       string //
+	SensitiveWordPolicy  string //
+	FileReviewPolicy     string //
+	RealnamePolicy       string //
+	RiskChallengePolicy  string //
+	GlobalFriendEnabled  string // Backend master switch for every add-friend entry
+	FriendDisabledPolicy string // Profile masking, QR and group-member restrictions
+	MessageCurfewEnabled string // Backend master switch for message curfew
+	Remark               string //
+	PublishedAt          string //
+	PublishedBy          string //
+	CreatedAt            string //
+	CreatedBy            string //
+	UpdatedAt            string //
+	UpdatedBy            string //
+	DeletedAt            string //
+	DeletedBy            string //
+}
+
+// imSecurityPolicyColumns holds the columns for the table im_security_policy.
+var imSecurityPolicyColumns = ImSecurityPolicyColumns{
+	Id:                   "id",
+	TenantId:             "tenant_id",
+	PolicyVersion:        "policy_version",
+	PolicyName:           "policy_name",
+	PublishStatus:        "publish_status",
+	PasswordPolicy:       "password_policy",
+	LoginRateLimit:       "login_rate_limit",
+	SensitiveWordPolicy:  "sensitive_word_policy",
+	FileReviewPolicy:     "file_review_policy",
+	RealnamePolicy:       "realname_policy",
+	RiskChallengePolicy:  "risk_challenge_policy",
+	GlobalFriendEnabled:  "global_friend_enabled",
+	FriendDisabledPolicy: "friend_disabled_policy",
+	MessageCurfewEnabled: "message_curfew_enabled",
+	Remark:               "remark",
+	PublishedAt:          "published_at",
+	PublishedBy:          "published_by",
+	CreatedAt:            "created_at",
+	CreatedBy:            "created_by",
+	UpdatedAt:            "updated_at",
+	UpdatedBy:            "updated_by",
+	DeletedAt:            "deleted_at",
+	DeletedBy:            "deleted_by",
+}
+
+// NewImSecurityPolicyDao creates and returns a new DAO object for table data access.
+func NewImSecurityPolicyDao(handlers ...gdb.ModelHandler) *ImSecurityPolicyDao {
+	return &ImSecurityPolicyDao{
+		group:    "default",
+		table:    "im_security_policy",
+		columns:  imSecurityPolicyColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImSecurityPolicyDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImSecurityPolicyDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImSecurityPolicyDao) Columns() ImSecurityPolicyColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImSecurityPolicyDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImSecurityPolicyDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImSecurityPolicyDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_sensitive_word_groups.go

@@ -0,0 +1,103 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImSensitiveWordGroupsDao is the data access object for the table im_sensitive_word_groups.
+type ImSensitiveWordGroupsDao struct {
+	table    string                       // table is the underlying table name of the DAO.
+	group    string                       // group is the database configuration group name of the current DAO.
+	columns  ImSensitiveWordGroupsColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler           // handlers for customized model modification.
+}
+
+// ImSensitiveWordGroupsColumns defines and stores column names for the table im_sensitive_word_groups.
+type ImSensitiveWordGroupsColumns struct {
+	Id        string //
+	TenantId  string // 0 means global dictionary
+	GroupCode string //
+	GroupName string //
+	Priority  string //
+	Status    string // 1 enabled, 2 disabled
+	Remark    string //
+	CreatedAt string //
+	CreatedBy string //
+	UpdatedAt string //
+	UpdatedBy string //
+	DeletedAt string //
+	DeletedBy string //
+}
+
+// imSensitiveWordGroupsColumns holds the columns for the table im_sensitive_word_groups.
+var imSensitiveWordGroupsColumns = ImSensitiveWordGroupsColumns{
+	Id:        "id",
+	TenantId:  "tenant_id",
+	GroupCode: "group_code",
+	GroupName: "group_name",
+	Priority:  "priority",
+	Status:    "status",
+	Remark:    "remark",
+	CreatedAt: "created_at",
+	CreatedBy: "created_by",
+	UpdatedAt: "updated_at",
+	UpdatedBy: "updated_by",
+	DeletedAt: "deleted_at",
+	DeletedBy: "deleted_by",
+}
+
+// NewImSensitiveWordGroupsDao creates and returns a new DAO object for table data access.
+func NewImSensitiveWordGroupsDao(handlers ...gdb.ModelHandler) *ImSensitiveWordGroupsDao {
+	return &ImSensitiveWordGroupsDao{
+		group:    "default",
+		table:    "im_sensitive_word_groups",
+		columns:  imSensitiveWordGroupsColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImSensitiveWordGroupsDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImSensitiveWordGroupsDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImSensitiveWordGroupsDao) Columns() ImSensitiveWordGroupsColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImSensitiveWordGroupsDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImSensitiveWordGroupsDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImSensitiveWordGroupsDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_sensitive_words.go

@@ -0,0 +1,115 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImSensitiveWordsDao is the data access object for the table im_sensitive_words.
+type ImSensitiveWordsDao struct {
+	table    string                  // table is the underlying table name of the DAO.
+	group    string                  // group is the database configuration group name of the current DAO.
+	columns  ImSensitiveWordsColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler      // handlers for customized model modification.
+}
+
+// ImSensitiveWordsColumns defines and stores column names for the table im_sensitive_words.
+type ImSensitiveWordsColumns struct {
+	Id          string //
+	TenantId    string // 0 means global dictionary
+	GroupId     string //
+	Word        string //
+	WordHash    string // SHA-256 of normalized word
+	MatchType   string //
+	SceneJson   string // Enabled scenes
+	Action      string //
+	Replacement string //
+	RiskLevel   string //
+	Priority    string //
+	Status      string // 1 enabled, 2 disabled
+	Remark      string //
+	CreatedAt   string //
+	CreatedBy   string //
+	UpdatedAt   string //
+	UpdatedBy   string //
+	DeletedAt   string //
+	DeletedBy   string //
+}
+
+// imSensitiveWordsColumns holds the columns for the table im_sensitive_words.
+var imSensitiveWordsColumns = ImSensitiveWordsColumns{
+	Id:          "id",
+	TenantId:    "tenant_id",
+	GroupId:     "group_id",
+	Word:        "word",
+	WordHash:    "word_hash",
+	MatchType:   "match_type",
+	SceneJson:   "scene_json",
+	Action:      "action",
+	Replacement: "replacement",
+	RiskLevel:   "risk_level",
+	Priority:    "priority",
+	Status:      "status",
+	Remark:      "remark",
+	CreatedAt:   "created_at",
+	CreatedBy:   "created_by",
+	UpdatedAt:   "updated_at",
+	UpdatedBy:   "updated_by",
+	DeletedAt:   "deleted_at",
+	DeletedBy:   "deleted_by",
+}
+
+// NewImSensitiveWordsDao creates and returns a new DAO object for table data access.
+func NewImSensitiveWordsDao(handlers ...gdb.ModelHandler) *ImSensitiveWordsDao {
+	return &ImSensitiveWordsDao{
+		group:    "default",
+		table:    "im_sensitive_words",
+		columns:  imSensitiveWordsColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImSensitiveWordsDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImSensitiveWordsDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImSensitiveWordsDao) Columns() ImSensitiveWordsColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImSensitiveWordsDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImSensitiveWordsDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImSensitiveWordsDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_tenant_config.go

@@ -21,28 +21,36 @@ type ImTenantConfigDao struct {
 
 // ImTenantConfigColumns defines and stores column names for the table im_tenant_config.
 type ImTenantConfigColumns struct {
-	Id              string //
-	TenantId        string //
-	MaxUsers        string // 0 means unlimited
-	MaxGroups       string // 0 means unlimited
-	MaxGroupMembers string // 0 means unlimited
-	CreatedAt       string //
-	CreatedBy       string //
-	UpdatedAt       string //
-	UpdatedBy       string //
+	Id                    string //
+	TenantId              string //
+	MaxUsers              string // 0 means unlimited
+	MaxGroups             string // 0 means unlimited
+	MaxGroupMembers       string // 0 means unlimited
+	DefaultPolicyGroupId  string // Default user policy group
+	SecurityPolicyVersion string // Published security policy version
+	GlobalFriendEnabled   string // Published global friend switch
+	MessageCurfewEnabled  string // Published message curfew switch
+	CreatedAt             string //
+	CreatedBy             string //
+	UpdatedAt             string //
+	UpdatedBy             string //
 }
 
 // imTenantConfigColumns holds the columns for the table im_tenant_config.
 var imTenantConfigColumns = ImTenantConfigColumns{
-	Id:              "id",
-	TenantId:        "tenant_id",
-	MaxUsers:        "max_users",
-	MaxGroups:       "max_groups",
-	MaxGroupMembers: "max_group_members",
-	CreatedAt:       "created_at",
-	CreatedBy:       "created_by",
-	UpdatedAt:       "updated_at",
-	UpdatedBy:       "updated_by",
+	Id:                    "id",
+	TenantId:              "tenant_id",
+	MaxUsers:              "max_users",
+	MaxGroups:             "max_groups",
+	MaxGroupMembers:       "max_group_members",
+	DefaultPolicyGroupId:  "default_policy_group_id",
+	SecurityPolicyVersion: "security_policy_version",
+	GlobalFriendEnabled:   "global_friend_enabled",
+	MessageCurfewEnabled:  "message_curfew_enabled",
+	CreatedAt:             "created_at",
+	CreatedBy:             "created_by",
+	UpdatedAt:             "updated_at",
+	UpdatedBy:             "updated_by",
 }
 
 // NewImTenantConfigDao creates and returns a new DAO object for table data access.

server/internal/dao/internal/im_user_policy_group_members.go

@@ -0,0 +1,105 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImUserPolicyGroupMembersDao is the data access object for the table im_user_policy_group_members.
+type ImUserPolicyGroupMembersDao struct {
+	table    string                          // table is the underlying table name of the DAO.
+	group    string                          // group is the database configuration group name of the current DAO.
+	columns  ImUserPolicyGroupMembersColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler              // handlers for customized model modification.
+}
+
+// ImUserPolicyGroupMembersColumns defines and stores column names for the table im_user_policy_group_members.
+type ImUserPolicyGroupMembersColumns struct {
+	Id         string //
+	TenantId   string //
+	GroupId    string //
+	UserId     string // User ID in the tenant database
+	Status     string // 1 enabled, 2 disabled
+	ValidFrom  string //
+	ValidUntil string //
+	Remark     string //
+	CreatedAt  string //
+	CreatedBy  string //
+	UpdatedAt  string //
+	UpdatedBy  string //
+	DeletedAt  string //
+	DeletedBy  string //
+}
+
+// imUserPolicyGroupMembersColumns holds the columns for the table im_user_policy_group_members.
+var imUserPolicyGroupMembersColumns = ImUserPolicyGroupMembersColumns{
+	Id:         "id",
+	TenantId:   "tenant_id",
+	GroupId:    "group_id",
+	UserId:     "user_id",
+	Status:     "status",
+	ValidFrom:  "valid_from",
+	ValidUntil: "valid_until",
+	Remark:     "remark",
+	CreatedAt:  "created_at",
+	CreatedBy:  "created_by",
+	UpdatedAt:  "updated_at",
+	UpdatedBy:  "updated_by",
+	DeletedAt:  "deleted_at",
+	DeletedBy:  "deleted_by",
+}
+
+// NewImUserPolicyGroupMembersDao creates and returns a new DAO object for table data access.
+func NewImUserPolicyGroupMembersDao(handlers ...gdb.ModelHandler) *ImUserPolicyGroupMembersDao {
+	return &ImUserPolicyGroupMembersDao{
+		group:    "default",
+		table:    "im_user_policy_group_members",
+		columns:  imUserPolicyGroupMembersColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImUserPolicyGroupMembersDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImUserPolicyGroupMembersDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImUserPolicyGroupMembersDao) Columns() ImUserPolicyGroupMembersColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImUserPolicyGroupMembersDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImUserPolicyGroupMembersDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImUserPolicyGroupMembersDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/dao/internal/im_user_policy_groups.go

@@ -0,0 +1,111 @@
+// ==========================================================================
+// Code generated and maintained by GoFrame CLI tool. DO NOT EDIT.
+// ==========================================================================
+
+package internal
+
+import (
+	"context"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/frame/g"
+)
+
+// ImUserPolicyGroupsDao is the data access object for the table im_user_policy_groups.
+type ImUserPolicyGroupsDao struct {
+	table    string                    // table is the underlying table name of the DAO.
+	group    string                    // group is the database configuration group name of the current DAO.
+	columns  ImUserPolicyGroupsColumns // columns contains all the column names of Table for convenient usage.
+	handlers []gdb.ModelHandler        // handlers for customized model modification.
+}
+
+// ImUserPolicyGroupsColumns defines and stores column names for the table im_user_policy_groups.
+type ImUserPolicyGroupsColumns struct {
+	Id          string //
+	TenantId    string // 0 means global default
+	GroupCode   string // Stable policy group code
+	GroupName   string // Policy group name
+	Priority    string // Higher value has higher priority
+	Status      string // 1 enabled, 2 disabled
+	PolicyJson  string // Login, friend, message, group and file policies
+	IpWhitelist string // IPv4/IPv6 or CIDR list
+	IpBlacklist string // IPv4/IPv6 or CIDR list
+	Version     string // Optimistic-lock/config version
+	Remark      string //
+	CreatedAt   string //
+	CreatedBy   string //
+	UpdatedAt   string //
+	UpdatedBy   string //
+	DeletedAt   string //
+	DeletedBy   string //
+}
+
+// imUserPolicyGroupsColumns holds the columns for the table im_user_policy_groups.
+var imUserPolicyGroupsColumns = ImUserPolicyGroupsColumns{
+	Id:          "id",
+	TenantId:    "tenant_id",
+	GroupCode:   "group_code",
+	GroupName:   "group_name",
+	Priority:    "priority",
+	Status:      "status",
+	PolicyJson:  "policy_json",
+	IpWhitelist: "ip_whitelist",
+	IpBlacklist: "ip_blacklist",
+	Version:     "version",
+	Remark:      "remark",
+	CreatedAt:   "created_at",
+	CreatedBy:   "created_by",
+	UpdatedAt:   "updated_at",
+	UpdatedBy:   "updated_by",
+	DeletedAt:   "deleted_at",
+	DeletedBy:   "deleted_by",
+}
+
+// NewImUserPolicyGroupsDao creates and returns a new DAO object for table data access.
+func NewImUserPolicyGroupsDao(handlers ...gdb.ModelHandler) *ImUserPolicyGroupsDao {
+	return &ImUserPolicyGroupsDao{
+		group:    "default",
+		table:    "im_user_policy_groups",
+		columns:  imUserPolicyGroupsColumns,
+		handlers: handlers,
+	}
+}
+
+// DB retrieves and returns the underlying raw database management object of the current DAO.
+func (dao *ImUserPolicyGroupsDao) DB() gdb.DB {
+	return g.DB(dao.group)
+}
+
+// Table returns the table name of the current DAO.
+func (dao *ImUserPolicyGroupsDao) Table() string {
+	return dao.table
+}
+
+// Columns returns all column names of the current DAO.
+func (dao *ImUserPolicyGroupsDao) Columns() ImUserPolicyGroupsColumns {
+	return dao.columns
+}
+
+// Group returns the database configuration group name of the current DAO.
+func (dao *ImUserPolicyGroupsDao) Group() string {
+	return dao.group
+}
+
+// Ctx creates and returns a Model for the current DAO. It automatically sets the context for the current operation.
+func (dao *ImUserPolicyGroupsDao) Ctx(ctx context.Context) *gdb.Model {
+	model := dao.DB().Model(dao.table)
+	for _, handler := range dao.handlers {
+		model = handler(model)
+	}
+	return model.Safe().Ctx(ctx)
+}
+
+// Transaction wraps the transaction logic using function f.
+// It rolls back the transaction and returns the error if function f returns a non-nil error.
+// It commits the transaction and returns nil if function f returns nil.
+//
+// Note: Do not commit or roll back the transaction in function f,
+// as it is automatically handled by this function.
+func (dao *ImUserPolicyGroupsDao) Transaction(ctx context.Context, f func(ctx context.Context, tx gdb.TX) error) (err error) {
+	return dao.Ctx(ctx).Transaction(ctx, f)
+}

server/internal/library/casbin/casbin_test.go

@@ -1,67 +1,66 @@
-// Package casbin
-// @Link  https://github.com/bufanyun/hotgo
-// @Copyright  Copyright (c) 2023 HotGo CLI
-// @Author  Ms <133814250@qq.com>
-// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
 package casbin
 
 import (
-	"context"
 	"net/http"
 	"testing"
+
+	casbinv2 "github.com/casbin/casbin/v2"
+	"github.com/casbin/casbin/v2/model"
 )
 
-// TestNew description
-func TestNew(t *testing.T) {
+const testModel = `
+[request_definition]
+r = sub, obj, act
 
-	InitEnforcer(context.TODO())
+[policy_definition]
+p = sub, obj, act
 
-	user := "admin"
-	path := "/"
-	method := http.MethodGet
-	t.Logf("\nuser:%v\npath:%v\nmethod:%v", user, path, method)
+[role_definition]
+g = _, _
 
-	ok, err := Enforcer.DeletePermissionsForUser(user)
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
+`
+
+func TestEnforcerPermissions(t *testing.T) {
+	m, err := model.NewModelFromString(testModel)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("创建Casbin测试模型失败: %v", err)
 	}
-	t.Logf("delete user premission:%v", ok)
-	CheckPremission(t, user, path, method)
-	AddPremission(t, user, "*", ActionAll)
-	CheckPremission(t, user, path, method)
-
-	user1 := "user1"
-	path1 := "/api/v1/*"
-	checkPathTrue := "/api/v1/user/list"
-	checkPathFalse := "/api/v2/user/list"
-	AddPremission(t, user1, path1, ActionAll)
-	CheckPremission(t, user1, checkPathTrue, ActionPost)
-	CheckPremission(t, user1, checkPathFalse, http.MethodGet)
-	CheckPremission(t, user1, checkPathTrue, http.MethodGet)
-	CheckPremission(t, user1, "/api/v1/user/list2", http.MethodGet)
-
-	ok, err = Enforcer.DeletePermissionsForUser(user1)
+	enforcer, err := casbinv2.NewEnforcer(m)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("创建Casbin测试实例失败: %v", err)
 	}
-	t.Logf("delete user premission:%v", ok)
-	CheckPremission(t, user1, "/api/v1/user1/list", http.MethodGet)
+
+	assertPermission(t, enforcer, "admin", "/", http.MethodGet, false)
+	if ok, addErr := enforcer.AddPolicy("admin", "*", ActionAll); addErr != nil || !ok {
+		t.Fatalf("添加管理员策略失败: ok=%v err=%v", ok, addErr)
+	}
+	assertPermission(t, enforcer, "admin", "/", http.MethodGet, true)
+
+	if ok, addErr := enforcer.AddPolicy("user1", "/api/v1/*", ActionAll); addErr != nil || !ok {
+		t.Fatalf("添加用户策略失败: ok=%v err=%v", ok, addErr)
+	}
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodPost, true)
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, true)
+	assertPermission(t, enforcer, "user1", "/api/v2/user/list", http.MethodGet, false)
+
+	if ok, deleteErr := enforcer.DeletePermissionsForUser("user1"); deleteErr != nil || !ok {
+		t.Fatalf("删除用户策略失败: ok=%v err=%v", ok, deleteErr)
+	}
+	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, false)
 }
 
-// CheckPremission description
-func CheckPremission(t *testing.T, user string, path string, method string) {
-	ok, err := Enforcer.Enforce(user, path, method)
+func assertPermission(t *testing.T, enforcer *casbinv2.Enforcer, user, path, method string, expected bool) {
+	t.Helper()
+	actual, err := enforcer.Enforce(user, path, method)
 	if err != nil {
-		t.Error(err)
+		t.Fatalf("检查权限失败: %v", err)
 	}
-	t.Logf("check \tuser[%s] \tpremission[%s] \tpath[%s] \tallow[%v]", user, method, path, ok)
-}
-
-// Add description
-func AddPremission(t *testing.T, user string, path string, method string) {
-	ok, err := Enforcer.AddPolicy(user, path, method)
-	if err != nil {
-		t.Error(err)
+	if actual != expected {
+		t.Fatalf("权限结果不符 user=%s path=%s method=%s expected=%v actual=%v", user, path, method, expected, actual)
 	}
-	t.Logf("add \tuser[%s] \tpremission[%s] \tpath[%s] \tresult[%v]", user, method, path, ok)
 }

server/internal/library/imadmin/client.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/os/gctx"
 )
 
@@ -198,6 +199,9 @@ func (c *Client) parseError(resp *http.Response) error {
 		Reason  string `json:"reason"`
 	}
 	_ = json.Unmarshal(body, &envelope)
+	if envelope.Message == "" && envelope.Reason == "" {
+		g.Log().Warningf(context.Background(), "IM API returned non-success status:%d url:%s body:%s", resp.StatusCode, resp.Request.URL.String(), string(body))
+	}
 	return stableError(envelope.Message, envelope.Reason)
 }
 

server/internal/library/imadmin/client_test.go

@@ -58,6 +58,39 @@ func TestListCodesWithInviteCodeUsesSignedSearchPost(t *testing.T) {
 	}
 }
 
+func TestInternalPostUsesInternalSignatureAndBody(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/internal/admin-query/tenants/default/users" {
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("read body: %v", err)
+		}
+		if string(body) != `{"username":"alice"}` {
+			t.Fatalf("unexpected body %s", body)
+		}
+		if r.Header.Get("X-Service-Name") != "hotgo-admin" || r.Header.Get("X-Signature") == "" {
+			t.Fatalf("missing internal authentication headers")
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"code":0,"data":{"user_id":123,"username":"alice"}}`))
+	}))
+	defer server.Close()
+
+	client := NewClient(Config{InternalBaseUrl: server.URL, InternalServiceName: "hotgo-admin", InternalServiceSecret: "secret", Timeout: time.Second})
+	var out struct {
+		UserID   int64  `json:"user_id"`
+		Username string `json:"username"`
+	}
+	if err := client.InternalPost(context.Background(), "/internal/admin-query/tenants/default/users", map[string]string{"username": "alice"}, &out); err != nil {
+		t.Fatalf("InternalPost returned error: %v", err)
+	}
+	if out.UserID != 123 || out.Username != "alice" {
+		t.Fatalf("unexpected response: %+v", out)
+	}
+}
+
 func signedTestServer(t *testing.T, method string, path string, inspect func(t *testing.T, r *http.Request, body []byte)) *httptest.Server {
 	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

server/internal/library/imadmin/internal.go

@@ -14,15 +14,29 @@ import (
 	"time"
 
 	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
 )
 
 func (c *Client) InternalGet(ctx context.Context, path string, out any) error {
-	req, err := c.newInternalRequest(ctx, http.MethodGet, path, nil)
+	return c.internalJSON(ctx, http.MethodGet, path, nil, out)
+}
+
+func (c *Client) InternalPost(ctx context.Context, path string, in any, out any) error {
+	body, err := json.Marshal(in)
+	if err != nil {
+		return gerror.Wrap(err, "序列化IM内部请求失败")
+	}
+	return c.internalJSON(ctx, http.MethodPost, path, body, out)
+}
+
+func (c *Client) internalJSON(ctx context.Context, method, path string, body []byte, out any) error {
+	req, err := c.newInternalRequest(ctx, method, path, body)
 	if err != nil {
 		return err
 	}
 	resp, err := c.http.Do(req)
 	if err != nil {
+		g.Log().Warningf(ctx, "IM internal query request failed url:%s err:%+v", req.URL.String(), err)
 		return gerror.New("IM内部查询服务暂不可用")
 	}
 	defer resp.Body.Close()
@@ -32,7 +46,7 @@ func (c *Client) InternalGet(ctx context.Context, path string, out any) error {
 	if out == nil {
 		return nil
 	}
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
+	responseBody, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
 	if err != nil {
 		return gerror.Wrap(err, "读取IM内部查询响应失败")
 	}
@@ -42,13 +56,13 @@ func (c *Client) InternalGet(ctx context.Context, path string, out any) error {
 		Reason  string          `json:"reason"`
 		Data    json.RawMessage `json:"data"`
 	}
-	if err = json.Unmarshal(body, &envelope); err == nil && len(envelope.Data) > 0 {
+	if err = json.Unmarshal(responseBody, &envelope); err == nil && len(envelope.Data) > 0 {
 		if envelope.Code != 0 {
 			return stableError(envelope.Message, envelope.Reason)
 		}
 		return json.Unmarshal(envelope.Data, out)
 	}
-	return json.Unmarshal(body, out)
+	return json.Unmarshal(responseBody, out)
 }
 
 func (c *Client) newInternalRequest(ctx context.Context, method string, path string, bodyBytes []byte) (*http.Request, error) {

server/internal/library/imkafka/command.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"hotgo/internal/consts"
+	"hotgo/internal/library/imtenant"
 	"hotgo/internal/library/queue"
 	"time"
 
@@ -16,11 +17,6 @@ import (
 	"github.com/gogf/gf/v2/util/guid"
 )
 
-const (
-	adminCommandTable = "im_admin_commands"
-	adminOutboxTable  = "im_admin_outbox"
-)
-
 func PublishAdminCommand(ctx context.Context, in AdminCommandInput) (res *AdminCommandModel, err error) {
 	if in.TenantID <= 0 || in.TenantCode == "" {
 		return nil, gerror.New("IM租户信息不完整")
@@ -65,41 +61,22 @@ func PublishAdminCommand(ctx context.Context, in AdminCommandInput) (res *AdminC
 		return nil, gerror.Wrap(err, "序列化IM命令Envelope失败")
 	}
 
-	db := g.DB()
+	db := adminDB()
 	err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
-		data := g.Map{
-			"command_id":      commandID,
-			"tenant_id":       in.TenantID,
-			"tenant_code":     in.TenantCode,
-			"event_id":        eventID,
-			"event_type":      in.EventType,
-			"biz_type":        in.BizType,
-			"biz_id":          in.BizID,
-			"idempotency_key": in.IdempotencyKey,
-			"status":          consts.ImAdminCommandStatusPending,
-			"payload":         string(payloadBytes),
-			"envelope":        string(envelopeBytes),
-			"created_by":      in.CreatedBy,
-			"created_at":      gtime.Now(),
-			"updated_at":      gtime.Now(),
-		}
-		if _, err := tx.Model(adminCommandTable).Safe().Ctx(ctx).Data(data).Insert(); err != nil {
+		nowTime := gtime.Now()
+		if _, err := tx.Exec(`INSERT INTO im_admin_commands
+				(command_id,tenant_id,tenant_code,event_id,event_type,biz_type,biz_id,idempotency_key,status,payload,envelope,created_by,created_at,updated_at)
+				VALUES(?,?,?,?,?,?,?,?,?,CAST(? AS JSON),CAST(? AS JSON),?,?,?)`,
+			commandID, in.TenantID, in.TenantCode, eventID, in.EventType, in.BizType, in.BizID,
+			in.IdempotencyKey, consts.ImAdminCommandStatusPending, string(payloadBytes), string(envelopeBytes),
+			in.CreatedBy, nowTime, nowTime); err != nil {
 			return gerror.Wrap(err, "创建IM后台命令失败")
 		}
-		outbox := g.Map{
-			"event_id":   eventID,
-			"command_id": commandID,
-			"topic":      consts.QueueImAdminCommandTopic,
-			"event_type": in.EventType,
-			"biz_type":   in.BizType,
-			"biz_id":     in.BizID,
-			"key_value":  in.BizID,
-			"envelope":   string(envelopeBytes),
-			"status":     consts.ImAdminOutboxStatusPending,
-			"created_at": gtime.Now(),
-			"updated_at": gtime.Now(),
-		}
-		if _, err := tx.Model(adminOutboxTable).Safe().Ctx(ctx).Data(outbox).Insert(); err != nil {
+		if _, err := tx.Exec(`INSERT INTO im_admin_outbox
+				(event_id,command_id,topic,event_type,biz_type,biz_id,key_value,envelope,status,created_at,updated_at)
+				VALUES(?,?,?,?,?,?,?,CAST(? AS JSON),?,?,?)`,
+			eventID, commandID, consts.QueueImAdminCommandTopic, in.EventType, in.BizType, in.BizID,
+			in.BizID, string(envelopeBytes), consts.ImAdminOutboxStatusPending, nowTime, nowTime); err != nil {
 			return gerror.Wrap(err, "创建IM后台命令Outbox失败")
 		}
 		return nil
@@ -125,11 +102,9 @@ func PublishAdminCommand(ctx context.Context, in AdminCommandInput) (res *AdminC
 }
 
 func DispatchOutboxByEvent(ctx context.Context, eventID string) error {
-	var row gdb.Record
-	if err := g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).
-		Where("event_id", eventID).
-		Where("status", consts.ImAdminOutboxStatusPending).
-		Scan(&row); err != nil {
+	row, err := adminDB().GetOne(ctx, `SELECT * FROM im_admin_outbox WHERE event_id=? AND status=? LIMIT 1`,
+		eventID, consts.ImAdminOutboxStatusPending)
+	if err != nil {
 		return gerror.Wrap(err, "读取IM命令Outbox失败")
 	}
 	if row.IsEmpty() {
@@ -171,19 +146,12 @@ func PublishConfigEvent(ctx context.Context, in ConfigEventInput) error {
 	if err != nil {
 		return gerror.Wrap(err, "序列化IM配置事件Envelope失败")
 	}
-	_, err = g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).Data(g.Map{
-		"event_id":   eventID,
-		"command_id": "",
-		"topic":      consts.QueueImConfigEventTopic,
-		"event_type": in.EventType,
-		"biz_type":   "config",
-		"biz_id":     in.BizID,
-		"key_value":  in.TenantCode,
-		"envelope":   string(envelopeBytes),
-		"status":     consts.ImAdminOutboxStatusPending,
-		"created_at": gtime.Now(),
-		"updated_at": gtime.Now(),
-	}).Insert()
+	nowTime := gtime.Now()
+	_, err = adminDB().Exec(ctx, `INSERT INTO im_admin_outbox
+		(event_id,command_id,topic,event_type,biz_type,biz_id,key_value,envelope,status,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,CAST(? AS JSON),?,?,?)`,
+		eventID, "", consts.QueueImConfigEventTopic, in.EventType, "config", in.BizID, in.TenantCode,
+		string(envelopeBytes), consts.ImAdminOutboxStatusPending, nowTime, nowTime)
 	if err != nil {
 		return gerror.Wrap(err, "创建IM配置事件Outbox失败")
 	}
@@ -230,19 +198,12 @@ func PublishEvent(ctx context.Context, in EventInput) (eventID string, err error
 	if err != nil {
 		return "", gerror.Wrap(err, "序列化IM Kafka事件Envelope失败")
 	}
-	_, err = g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).Data(g.Map{
-		"event_id":   eventID,
-		"command_id": "",
-		"topic":      in.Topic,
-		"event_type": in.EventType,
-		"biz_type":   in.BizType,
-		"biz_id":     in.BizID,
-		"key_value":  in.BizID,
-		"envelope":   string(envelopeBytes),
-		"status":     consts.ImAdminOutboxStatusPending,
-		"created_at": gtime.Now(),
-		"updated_at": gtime.Now(),
-	}).Insert()
+	nowTime := gtime.Now()
+	_, err = adminDB().Exec(ctx, `INSERT INTO im_admin_outbox
+		(event_id,command_id,topic,event_type,biz_type,biz_id,key_value,envelope,status,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,CAST(? AS JSON),?,?,?)`,
+		eventID, "", in.Topic, in.EventType, in.BizType, in.BizID, in.BizID,
+		string(envelopeBytes), consts.ImAdminOutboxStatusPending, nowTime, nowTime)
 	if err != nil {
 		return "", gerror.Wrap(err, "创建IM Kafka事件Outbox失败")
 	}
@@ -256,13 +217,9 @@ func DispatchPendingOutbox(ctx context.Context, limit int) (sent int, err error)
 	if limit <= 0 {
 		limit = 100
 	}
-	var rows []gdb.Record
-	err = g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).
-		WhereIn("status", []string{consts.ImAdminOutboxStatusPending, consts.ImAdminOutboxStatusFailed}).
-		Where("next_retry_at IS NULL OR next_retry_at <= NOW()").
-		OrderAsc("id").
-		Limit(limit).
-		Scan(&rows)
+	rows, err := adminDB().GetAll(ctx, `SELECT * FROM im_admin_outbox
+		WHERE status IN (?,?) AND (next_retry_at IS NULL OR next_retry_at <= NOW())
+		ORDER BY id ASC LIMIT ?`, consts.ImAdminOutboxStatusPending, consts.ImAdminOutboxStatusFailed, limit)
 	if err != nil {
 		return 0, gerror.Wrap(err, "读取待投递IM命令Outbox失败")
 	}
@@ -294,27 +251,16 @@ func dispatchOutboxRecord(ctx context.Context, row gdb.Record) error {
 		return err
 	}
 	now := gtime.Now()
-	_, err := g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).
-		Where("event_id", eventID).
-		Data(g.Map{
-			"status":      consts.ImAdminOutboxStatusSent,
-			"attempts":    gdb.Raw("attempts + 1"),
-			"sent_at":     now,
-			"last_reason": "",
-			"last_error":  "",
-			"updated_at":  now,
-		}).Update()
+	_, err := adminDB().Exec(ctx, `UPDATE im_admin_outbox
+		SET status=?,attempts=attempts+1,sent_at=?,last_reason='',last_error='',updated_at=?
+		WHERE event_id=?`, consts.ImAdminOutboxStatusSent, now, now, eventID)
 	if err != nil {
 		return gerror.Wrap(err, "更新IM命令Outbox投递状态失败")
 	}
 	if commandID != "" {
-		_, err = g.DB().Model(adminCommandTable).Safe().Ctx(ctx).
-			Where("command_id", commandID).
-			Data(g.Map{
-				"status":     consts.ImAdminCommandStatusRunning,
-				"sent_at":    now,
-				"updated_at": now,
-			}).Update()
+		_, err = adminDB().Exec(ctx, `UPDATE im_admin_commands
+			SET status=?,sent_at=?,updated_at=? WHERE command_id=?`,
+			consts.ImAdminCommandStatusRunning, now, now, commandID)
 		if err != nil {
 			return gerror.Wrap(err, "更新IM后台命令投递状态失败")
 		}
@@ -324,16 +270,9 @@ func dispatchOutboxRecord(ctx context.Context, row gdb.Record) error {
 
 func markOutboxFailed(ctx context.Context, eventID string, reason string, message string) error {
 	now := gtime.Now()
-	_, err := g.DB().Model(adminOutboxTable).Safe().Ctx(ctx).
-		Where("event_id", eventID).
-		Data(g.Map{
-			"status":        consts.ImAdminOutboxStatusFailed,
-			"attempts":      gdb.Raw("attempts + 1"),
-			"next_retry_at": now.Add(30 * time.Second),
-			"last_reason":   reason,
-			"last_error":    message,
-			"updated_at":    now,
-		}).Update()
+	_, err := adminDB().Exec(ctx, `UPDATE im_admin_outbox
+		SET status=?,attempts=attempts+1,next_retry_at=?,last_reason=?,last_error=?,updated_at=?
+		WHERE event_id=?`, consts.ImAdminOutboxStatusFailed, now.Add(30*time.Second), reason, message, now, eventID)
 	if err != nil {
 		return gerror.Wrap(err, "更新IM命令Outbox失败状态失败")
 	}
@@ -364,15 +303,27 @@ func ApplyCommandResult(ctx context.Context, result CommandResult) error {
 	if len(result.Result) > 0 {
 		data["result"] = string(result.Result)
 	}
-	mod := g.DB().Model(adminCommandTable).Safe().Ctx(ctx)
+	whereColumn := "event_id"
+	whereValue := result.CommandEventID
 	if result.CommandID != "" {
-		mod = mod.Where("command_id", result.CommandID)
-	} else {
-		mod = mod.Where("event_id", result.CommandEventID)
+		whereColumn = "command_id"
+		whereValue = result.CommandID
 	}
-	_, err := mod.Data(data).Update()
+	sql := `UPDATE im_admin_commands SET status=?,reason=?,message=?,completed_at=?,updated_at=?`
+	args := []any{data["status"], data["reason"], data["message"], data["completed_at"], data["updated_at"]}
+	if resultValue, ok := data["result"]; ok {
+		sql += `,result=CAST(? AS JSON)`
+		args = append(args, resultValue)
+	}
+	sql += ` WHERE ` + whereColumn + `=?`
+	args = append(args, whereValue)
+	_, err := adminDB().Exec(ctx, sql, args...)
 	if err != nil {
 		return gerror.Wrap(err, "更新IM后台命令结果失败")
 	}
 	return nil
 }
+
+func adminDB() gdb.DB {
+	return imtenant.RegistryDB()
+}

server/internal/library/imtenant/db.go

@@ -7,6 +7,7 @@ import (
 	"hash/fnv"
 	"hotgo/internal/dao"
 	"hotgo/internal/model/entity"
+	"net/url"
 	"strings"
 	"sync"
 
@@ -20,14 +21,7 @@ var tenantDbGroups sync.Map
 
 const registryDbGroup = "imRegistry"
 
-// RegistryDB returns the tenant registry DB. It falls back to the default DB for
-// single-database deployments where database.imRegistry is not configured.
-func RegistryDB(ctx context.Context) gdb.DB {
-	if configs, err := gdb.GetConfigGroup(registryDbGroup); err == nil && len(configs) > 0 {
-		return g.DB(registryDbGroup)
-	}
-	return g.DB()
-}
+var registryDbGroupOnce sync.Once
 
 // DB resolves a tenant registry record and returns the corresponding business DB.
 func DB(ctx context.Context, tenantId int64) (db gdb.DB, tenant *entity.ImTenant, err error) {
@@ -35,7 +29,7 @@ func DB(ctx context.Context, tenantId int64) (db gdb.DB, tenant *entity.ImTenant
 		return nil, nil, gerror.New("租户ID不能为空")
 	}
 
-	if err = RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(tenantId).Scan(&tenant); err != nil {
+	if err = RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(tenantId).Scan(&tenant); err != nil {
 		return nil, nil, gerror.Wrap(err, "获取租户信息失败")
 	}
 	if tenant == nil || tenant.Id <= 0 {
@@ -65,9 +59,40 @@ func DB(ctx context.Context, tenantId int64) (db gdb.DB, tenant *entity.ImTenant
 	return db, tenant, nil
 }
 
+// RegistryDB returns the dedicated tenant registry connection, or the default
+// HotGo database when a separate registry group is not configured.
+func RegistryDB() gdb.DB {
+	registryDbGroupOnce.Do(func() {
+		ensureRegistryDBGroup()
+	})
+	if configs, err := gdb.GetConfigGroup(registryDbGroup); err == nil && len(configs) > 0 {
+		return g.DB(registryDbGroup)
+	}
+	return g.DB()
+}
+
+func ensureRegistryDBGroup() {
+	if configs, err := gdb.GetConfigGroup(registryDbGroup); err == nil && len(configs) > 0 {
+		configs[0].Prefix = ""
+		_ = gdb.SetConfigGroup(registryDbGroup, configs)
+		return
+	}
+
+	configs, err := gdb.GetConfigGroup("default")
+	if err != nil || len(configs) == 0 {
+		return
+	}
+	cloned := make(gdb.ConfigGroup, len(configs))
+	copy(cloned, configs)
+	for i := range cloned {
+		cloned[i].Prefix = ""
+	}
+	_ = gdb.SetConfigGroup(registryDbGroup, cloned)
+}
+
 func tenantLink(ctx context.Context, tenant *entity.ImTenant) (string, error) {
 	if tenant.DbDsn != "" {
-		return tenant.DbDsn, nil
+		return normalizeMySQLTimeOptions(tenant.DbDsn)
 	}
 	if tenant.DbName == "" {
 		return "", gerror.New("租户业务库未配置")
@@ -115,10 +140,31 @@ func replaceMySQLDatabase(link string, dbName string) (string, error) {
 	dbStart += 2
 	queryStart := strings.Index(link[dbStart:], "?")
 	if queryStart < 0 {
-		return link[:dbStart] + dbName, nil
+		return normalizeMySQLTimeOptions(link[:dbStart] + dbName)
 	}
 	queryStart += dbStart
-	return link[:dbStart] + dbName + link[queryStart:], nil
+	return normalizeMySQLTimeOptions(link[:dbStart] + dbName + link[queryStart:])
+}
+
+func normalizeMySQLTimeOptions(link string) (string, error) {
+	if !strings.HasPrefix(link, "mysql:") {
+		if !strings.Contains(link, "@tcp(") {
+			return "", gerror.New("租户业务库仅支持 MySQL")
+		}
+		link = "mysql:" + link
+	}
+	parts := strings.SplitN(link, "?", 2)
+	values := make(url.Values)
+	if len(parts) == 2 {
+		var err error
+		values, err = url.ParseQuery(parts[1])
+		if err != nil {
+			return "", gerror.Wrap(err, "租户业务库连接参数格式不正确")
+		}
+	}
+	values.Set("loc", "UTC")
+	values.Set("parseTime", "true")
+	return parts[0] + "?" + values.Encode(), nil
 }
 
 func hash(s string) uint64 {

server/internal/library/imtenant/db_test.go

@@ -0,0 +1,52 @@
+package imtenant
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+func TestNormalizeMySQLTimeOptions(t *testing.T) {
+	link, err := normalizeMySQLTimeOptions("user:pass@tcp(127.0.0.1:3306)/tinode?charset=utf8mb4")
+	if err != nil {
+		t.Fatalf("normalize raw mysql dsn: %v", err)
+	}
+	if !strings.HasPrefix(link, "mysql:user:pass@tcp(127.0.0.1:3306)/tinode?") {
+		t.Fatalf("unexpected normalized link: %s", link)
+	}
+	if !strings.Contains(link, "loc=UTC") || !strings.Contains(link, "parseTime=true") {
+		t.Fatalf("missing required time options: %s", link)
+	}
+}
+
+func TestNormalizeMySQLTimeOptionsRejectsUnsupportedFormat(t *testing.T) {
+	if _, err := normalizeMySQLTimeOptions("postgres://user:pass@127.0.0.1:5432/tinode"); err == nil {
+		t.Fatal("expected unsupported format error")
+	}
+}
+
+func TestReplaceMySQLDatabaseUsesUTC(t *testing.T) {
+	link, err := replaceMySQLDatabase("mysql:user:pass@tcp(127.0.0.1:3306)/hotgo?loc=Local&parseTime=false&charset=utf8mb4", "tinode")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{"/tinode?", "loc=UTC", "parseTime=true", "charset=utf8mb4"} {
+		if !strings.Contains(link, expected) {
+			t.Fatalf("link %q does not contain %q", link, expected)
+		}
+	}
+}
+
+func TestNextSnowflakeID(t *testing.T) {
+	first, err := NextSnowflakeID(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := NextSnowflakeID(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first <= 0 || second <= first {
+		t.Fatalf("Snowflake IDs are not increasing: %d, %d", first, second)
+	}
+}

server/internal/library/imtenant/im_table_prefix_guard_test.go

@@ -0,0 +1,56 @@
+package imtenant
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestNoDirectDefaultDBModelForIMTables(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("runtime caller unavailable")
+	}
+	serverRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", "..", ".."))
+	internalRoot := filepath.Join(serverRoot, "internal")
+	patterns := []*regexp.Regexp{
+		regexp.MustCompile(`g\.DB\(\)\.Model\(\s*"im_`),
+		regexp.MustCompile(`g\.DB\(\)\.Model\(\s*` + "`" + `im_`),
+		regexp.MustCompile(`g\.DB\(\)\.(Insert|InsertIgnore|Replace|Save|Update|Delete)\([^,\n]+,\s*"im_`),
+		regexp.MustCompile(`g\.DB\(\)\.(Insert|InsertIgnore|Replace|Save|Update|Delete)\([^,\n]+,\s*` + "`" + `im_`),
+	}
+
+	var violations []string
+	err := filepath.WalkDir(internalRoot, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+		content, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		for _, pattern := range patterns {
+			if pattern.Match(content) {
+				rel, _ := filepath.Rel(serverRoot, path)
+				violations = append(violations, rel)
+				break
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(violations) > 0 {
+		t.Fatalf("IM public tables must not use default g.DB() model helpers because the default DB has table prefix: %s", strings.Join(violations, ", "))
+	}
+}

server/internal/library/network/tcp/client.go

@@ -281,6 +281,8 @@ func (client *Client) handleRoutineTask(ctx context.Context, task func()) {
 
 // Conn 获取当前连接
 func (client *Client) Conn() *Conn {
+	client.mutex.Lock()
+	defer client.mutex.Unlock()
 	return client.conn
 }
 

server/internal/library/network/tcp/rpc.go

@@ -43,7 +43,6 @@ func (r *RPC) Request(ctx context.Context, msgId string, send func()) (res inter
 
 	defer func() {
 		isClose.Set(true)
-		close(resCh)
 		r.popCallback(msgId)
 	}()
 
@@ -57,8 +56,13 @@ func (r *RPC) Request(ctx context.Context, msgId string, send func()) (res inter
 
 	r.task(ctx, send)
 
+	timer := time.NewTimer(time.Second * RPCTimeout)
+	defer timer.Stop()
 	select {
-	case <-time.After(time.Second * RPCTimeout):
+	case <-ctx.Done():
+		err = gerror.Wrap(ctx.Err(), "RPC request canceled")
+		return
+	case <-timer.C:
 		err = gerror.New("RPC response timeout")
 		return
 	case got := <-resCh:

server/internal/library/network/tcp/tcp_example_test.go

@@ -1,21 +1,14 @@
-// Package tcp_test
-// @Link  https://github.com/bufanyun/hotgo
-// @Copyright  Copyright (c) 2023 HotGo CLI
-// @Author  Ms <133814250@qq.com>
-// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
 package tcp_test
 
 import (
 	"context"
 	"fmt"
-	"github.com/gogf/gf/v2/os/gctx"
-	"github.com/gogf/gf/v2/test/gtest"
-	"hotgo/internal/library/network/tcp"
+	"net"
 	"testing"
 	"time"
-)
 
-var T *testing.T // 声明一个全局的 *testing.T 变量
+	"hotgo/internal/library/network/tcp"
+)
 
 type TestMsgReq struct {
 	Name string `json:"name"`
@@ -33,101 +26,95 @@ type TestRPCMsgRes struct {
 	tcp.ServerRes
 }
 
-func onTestMsg(ctx context.Context, req *TestMsgReq) {
-	fmt.Printf("服务器收到消息 ==> onTestMsg:%+v\n", req)
-	conn := tcp.ConnFromCtx(ctx)
-	gtest.C(T, func(t *gtest.T) {
-		t.AssertNE(conn, nil)
-	})
-
-	res := new(TestMsgRes)
-	res.Message = fmt.Sprintf("你的名字：%v", req.Name)
-	conn.Send(ctx, res)
-}
-
-func onResponseTestMsg(ctx context.Context, req *TestMsgRes) {
-	fmt.Printf("客户端收到响应消息 ==> TestMsgRes:%+v\n", req)
-	err := req.GetError()
-	gtest.C(T, func(t *gtest.T) {
-		t.AssertNil(err)
-	})
-}
-
-func onTestRPCMsg(ctx context.Context, req *TestRPCMsgReq) (res *TestRPCMsgRes, err error) {
-	fmt.Printf("服务器收到消息 ==> onTestRPCMsg:%+v\n", req)
-	res = new(TestRPCMsgRes)
-	res.Message = fmt.Sprintf("你的名字：%v", req.Name)
-	return
-}
-
-func startTCPServer() {
-	serv := tcp.NewServer(&tcp.ServerConfig{
-		Name: "hotgo",
-		Addr: ":8002",
-	})
-
-	// 注册路由
-	serv.RegisterRouter(
-		onTestMsg,
-	)
-
-	// 注册RPC路由
-	serv.RegisterRPCRouter(
-		onTestRPCMsg,
-	)
-
-	// 服务监听
-	err := serv.Listen()
-	gtest.C(T, func(t *gtest.T) {
-		t.AssertNil(err)
-	})
-}
-
-// 一个基本的消息收发
 func TestSendMsg(t *testing.T) {
-	T = t
-	go startTCPServer()
-
-	ctx := gctx.New()
-	client := tcp.NewClient(&tcp.ClientConfig{
-		Addr: "127.0.0.1:8002",
+	address := freeTCPAddress(t)
+	messageResponse := make(chan string, 1)
+	server := tcp.NewServer(&tcp.ServerConfig{Name: "hotgo-test", Addr: address})
+	server.RegisterRouter(func(ctx context.Context, req *TestMsgReq) {
+		res := &TestMsgRes{}
+		res.SetMessage(fmt.Sprintf("你的名字：%s", req.Name))
+		if err := tcp.ConnFromCtx(ctx).Send(ctx, res); err != nil {
+			messageResponse <- "send-error:" + err.Error()
+		}
 	})
-
-	// 注册路由
-	client.RegisterRouter(
-		onResponseTestMsg,
-	)
-
+	server.RegisterRPCRouter(func(ctx context.Context, req *TestRPCMsgReq) (*TestRPCMsgRes, error) {
+		res := &TestRPCMsgRes{}
+		res.SetMessage(fmt.Sprintf("你的名字：%s", req.Name))
+		return res, nil
+	})
+	serverErrors := make(chan error, 1)
 	go func() {
-		err := client.Start()
-		gtest.C(T, func(t *gtest.T) {
-			t.AssertNil(err)
-		})
+		serverErrors <- server.Listen()
 	}()
+	defer server.Close()
 
-	// 确保服务都启动完成
-	time.Sleep(time.Second * 1)
-
-	// 拿到客户端的连接
-	conn := client.Conn()
-	gtest.C(T, func(t *gtest.T) {
-		t.AssertNE(conn, nil)
+	client := tcp.NewClient(&tcp.ClientConfig{
+		Addr:            address,
+		Timeout:         time.Second,
+		ConnectInterval: 10 * time.Millisecond,
+		MaxConnectCount: 100,
 	})
-
-	// 向服务器发送tcp消息，不会阻塞程序执行
-	err := conn.Send(ctx, &TestMsgReq{Name: "Tom"})
-	gtest.C(T, func(t *gtest.T) {
-		t.AssertNil(err)
+	client.RegisterRouter(func(ctx context.Context, res *TestMsgRes) {
+		messageResponse <- res.Message
 	})
+	if err := client.Start(); err != nil {
+		t.Fatalf("启动TCP客户端失败: %v", err)
+	}
+	defer client.Stop()
 
-	// 向服务器发送rpc消息，会等待服务器响应结果，直到拿到结果或响应超时才会继续
-	var res TestRPCMsgRes
-	if err = conn.RequestScan(ctx, &TestRPCMsgReq{Name: "Tony"}, &res); err != nil {
-		gtest.C(T, func(t *gtest.T) {
-			t.AssertNil(err)
-		})
+	conn := waitForConnection(t, client, serverErrors)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	if err := conn.Send(ctx, &TestMsgReq{Name: "Tom"}); err != nil {
+		t.Fatalf("发送TCP消息失败: %v", err)
+	}
+	select {
+	case message := <-messageResponse:
+		if message != "你的名字：Tom" {
+			t.Fatalf("TCP响应不符: %s", message)
+		}
+	case <-ctx.Done():
+		t.Fatal("等待TCP响应超时")
 	}
 
-	fmt.Printf("客户端收到RPC消息响应 ==> TestRPCMsgRes:%+v\n", res)
-	time.Sleep(time.Second * 1)
+	var rpcResponse TestRPCMsgRes
+	if err := conn.RequestScan(ctx, &TestRPCMsgReq{Name: "Tony"}, &rpcResponse); err != nil {
+		t.Fatalf("发送RPC消息失败: %v", err)
+	}
+	if rpcResponse.Message != "你的名字：Tony" {
+		t.Fatalf("RPC响应不符: %s", rpcResponse.Message)
+	}
+}
+
+func freeTCPAddress(t *testing.T) string {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("申请测试端口失败: %v", err)
+	}
+	address := listener.Addr().String()
+	if err = listener.Close(); err != nil {
+		t.Fatalf("释放测试端口失败: %v", err)
+	}
+	return address
+}
+
+func waitForConnection(t *testing.T, client *tcp.Client, serverErrors <-chan error) *tcp.Conn {
+	t.Helper()
+	deadline := time.NewTimer(2 * time.Second)
+	defer deadline.Stop()
+	ticker := time.NewTicker(10 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		select {
+		case err := <-serverErrors:
+			t.Fatalf("TCP服务启动失败: %v", err)
+		case <-deadline.C:
+			t.Fatal("等待TCP连接超时")
+		case <-ticker.C:
+			if conn := client.Conn(); conn != nil {
+				return conn
+			}
+		}
+	}
 }

server/internal/library/queue/consumer.go

@@ -55,7 +55,7 @@ func consumerListen(ctx context.Context, job Consumer) {
 	)
 
 	if err != nil {
-		Logger().Fatalf(ctx, "InstanceConsumer %s err:%+v", topic, err)
+		Logger().Errorf(ctx, "InstanceConsumer %s err:%+v", topic, err)
 		return
 	}
 
@@ -70,6 +70,6 @@ func consumerListen(ctx context.Context, job Consumer) {
 		// 记录消费队列日志
 		ConsumerLog(ctx, topic, mqMsg, err)
 	}); listenErr != nil {
-		Logger().Fatalf(ctx, "消费队列：%s 监听失败, err:%+v", topic, listenErr)
+		Logger().Errorf(ctx, "消费队列：%s 监听失败, err:%+v", topic, listenErr)
 	}
 }

server/internal/library/queue/kafkamq.go

@@ -7,7 +7,10 @@ package queue
 
 import (
 	"context"
-	"crypto/tls"
+	"crypto/sha256"
+	"crypto/sha512"
+	"errors"
+	"hash"
 	"strings"
 	"time"
 
@@ -15,6 +18,7 @@ import (
 	"github.com/gogf/gf/v2/errors/gerror"
 	"github.com/gogf/gf/v2/frame/g"
 	"github.com/xdg-go/scram"
+
 	"hotgo/internal/consts"
 	"hotgo/utility/simple"
 )
@@ -26,17 +30,37 @@ type KafkaMq struct {
 }
 
 type KafkaConfig struct {
-	ClientId      string
-	Brokers       []string
-	GroupID       string
-	Partitions    int32
-	Replication   int16
-	Version       string
-	UserName      string
-	Password      string
-	SASLEnabled   bool
-	SASLMechanism string
-	TLSEnabled    bool
+	ClientId    string
+	Brokers     []string
+	GroupID     string
+	Partitions  int32
+	Replication int16
+	Version     string
+	UserName    string
+	Password    string
+	Mechanism   string
+}
+
+type xdgSCRAMClient struct {
+	*scram.ClientConversation
+	HashGeneratorFcn scram.HashGeneratorFcn
+}
+
+func (x *xdgSCRAMClient) Begin(userName, password, authzID string) error {
+	client, err := x.HashGeneratorFcn.NewClient(userName, password, authzID)
+	if err != nil {
+		return err
+	}
+	x.ClientConversation = client.NewConversation()
+	return nil
+}
+
+func (x *xdgSCRAMClient) Step(challenge string) (string, error) {
+	return x.ClientConversation.Step(challenge)
+}
+
+func (x *xdgSCRAMClient) Done() bool {
+	return x.ClientConversation.Done()
 }
 
 // SendMsg 按字符串类型生产数据
@@ -100,11 +124,16 @@ func (r *KafkaMq) ListenReceiveMsgDo(topic string, receiveDo func(mqMsg MqMsg))
 	go func(consumerCtx context.Context) {
 		for {
 			if err = r.consumerIns.Consume(consumerCtx, []string{topic}, &consumer); err != nil {
-				Logger().Fatalf(ctx, "kafka Error from consumer, err%+v", err)
+				Logger().Errorf(ctx, "kafka error from consumer, topic:%s err:%+v", topic, err)
+				select {
+				case <-consumerCtx.Done():
+					return
+				case <-time.After(3 * time.Second):
+				}
 			}
 
 			if consumerCtx.Err() != nil {
-				Logger().Debugf(ctx, "kafka consoumer stop : %v", consumerCtx.Err())
+				Logger().Debugf(ctx, "kafka consumer stop : %v", consumerCtx.Err())
 				return
 			}
 			consumer.ready = make(chan bool)
@@ -112,14 +141,18 @@ func (r *KafkaMq) ListenReceiveMsgDo(topic string, receiveDo func(mqMsg MqMsg))
 	}(consumerCtx)
 
 	// await till the consumer has been set up
-	<-consumer.ready
+	select {
+	case <-consumer.ready:
+	case <-time.After(10 * time.Second):
+		Logger().Warningf(ctx, "kafka consumer setup timeout, topic:%s", topic)
+	}
 	Logger().Debug(ctx, "kafka consumer up and running!...")
 
 	simple.Event().Register(consts.EventServerClose, func(ctx context.Context, args ...interface{}) {
 		Logger().Debug(ctx, "kafka consumer close...")
 		cancel()
 		if err = r.consumerIns.Close(); err != nil {
-			Logger().Fatalf(ctx, "kafka Error closing client, err:%+v", err)
+			Logger().Errorf(ctx, "kafka error closing client, err:%+v", err)
 		}
 	})
 	return
@@ -128,7 +161,7 @@ func (r *KafkaMq) ListenReceiveMsgDo(topic string, receiveDo func(mqMsg MqMsg))
 // RegisterKafkaMqConsumer 注册消费者
 func RegisterKafkaMqConsumer(connOpt KafkaConfig) (client MqConsumer, err error) {
 	mqIns := &KafkaMq{}
-	kfkVersion, err := sarama.ParseKafkaVersion(connOpt.Version)
+	kfkVersion, err := parseKafkaVersion(connOpt.Version)
 	if err != nil {
 		return
 	}
@@ -140,9 +173,7 @@ func RegisterKafkaMqConsumer(connOpt KafkaConfig) (client MqConsumer, err error)
 	conf := sarama.NewConfig()
 	conf.Consumer.Return.Errors = true
 	conf.Version = kfkVersion
-	if err = configureKafkaSecurity(conf, connOpt); err != nil {
-		return
-	}
+	configureKafkaSASL(conf, connOpt)
 
 	// 默认按随机方式消费
 	conf.Consumer.Group.Rebalance.Strategy = sarama.BalanceStrategyRange
@@ -161,9 +192,7 @@ func RegisterKafkaMqConsumer(connOpt KafkaConfig) (client MqConsumer, err error)
 // RegisterKafkaProducer 注册并启动生产者接口实现
 func RegisterKafkaProducer(connOpt KafkaConfig) (client MqProducer, err error) {
 	mqIns := &KafkaMq{}
-	if connOpt.ClientId == "" {
-		connOpt.ClientId = "hotgo-producer"
-	}
+	connOpt.ClientId = "HOTGO-Producer"
 
 	// 这里如果使用go程需要处理chan同步问题
 	if err = doRegisterKafkaProducer(connOpt, mqIns); err != nil {
@@ -175,7 +204,7 @@ func RegisterKafkaProducer(connOpt KafkaConfig) (client MqProducer, err error) {
 
 // doRegisterKafkaProducer 注册同步类型实例
 func doRegisterKafkaProducer(connOpt KafkaConfig, mqIns *KafkaMq) (err error) {
-	kfkVersion, err := sarama.ParseKafkaVersion(connOpt.Version)
+	kfkVersion, err := parseKafkaVersion(connOpt.Version)
 	if err != nil {
 		return
 	}
@@ -197,9 +226,7 @@ func doRegisterKafkaProducer(connOpt KafkaConfig, mqIns *KafkaMq) (err error) {
 	conf.ClientID = connOpt.ClientId
 
 	conf.Version = kfkVersion
-	if err = configureKafkaSecurity(conf, connOpt); err != nil {
-		return
-	}
+	configureKafkaSASL(conf, connOpt)
 
 	mqIns.producerIns, err = sarama.NewAsyncProducer(brokers, conf)
 	if err != nil {
@@ -213,61 +240,81 @@ func doRegisterKafkaProducer(connOpt KafkaConfig, mqIns *KafkaMq) (err error) {
 	return
 }
 
-func configureKafkaSecurity(conf *sarama.Config, connOpt KafkaConfig) error {
-	if connOpt.TLSEnabled {
-		conf.Net.TLS.Enable = true
-		conf.Net.TLS.Config = &tls.Config{MinVersion: tls.VersionTLS12}
+func parseKafkaVersion(version string) (sarama.KafkaVersion, error) {
+	parts := strings.Split(version, ".")
+	if len(parts) == 4 && parts[0] != "0" && parts[3] == "0" {
+		version = strings.Join(parts[:3], ".")
 	}
-	if !connOpt.SASLEnabled && connOpt.UserName == "" {
-		return nil
-	}
-	if connOpt.UserName == "" || connOpt.Password == "" {
-		return gerror.New("queue kafka sasl username or password is empty")
+	return sarama.ParseKafkaVersion(version)
+}
+
+func configureKafkaSASL(conf *sarama.Config, connOpt KafkaConfig) {
+	if connOpt.UserName == "" {
+		return
 	}
 	conf.Net.SASL.Enable = true
 	conf.Net.SASL.User = connOpt.UserName
 	conf.Net.SASL.Password = connOpt.Password
-	mechanism := strings.ToUpper(strings.ReplaceAll(connOpt.SASLMechanism, "_", "-"))
+	mechanism := strings.ToUpper(strings.ReplaceAll(connOpt.Mechanism, "_", "-"))
+	if mechanism == "" {
+		mechanism = sarama.SASLTypeSCRAMSHA512
+	}
 	switch mechanism {
-	case "", "PLAIN":
-		conf.Net.SASL.Mechanism = sarama.SASLTypePlaintext
-	case "SCRAM-SHA-256":
+	case sarama.SASLTypeSCRAMSHA512:
+		conf.Net.SASL.Mechanism = sarama.SASLTypeSCRAMSHA512
+		conf.Net.SASL.SCRAMClientGeneratorFunc = scramClientGenerator(sha512.New)
+	case sarama.SASLTypeSCRAMSHA256:
 		conf.Net.SASL.Mechanism = sarama.SASLTypeSCRAMSHA256
-		conf.Net.SASL.SCRAMClientGeneratorFunc = func() sarama.SCRAMClient {
-			return &xdgSCRAMClient{HashGeneratorFcn: scram.SHA256}
-		}
-	case "SCRAM-SHA-512":
-		conf.Net.SASL.Mechanism = sarama.SASLTypeSCRAMSHA512
-		conf.Net.SASL.SCRAMClientGeneratorFunc = func() sarama.SCRAMClient {
-			return &xdgSCRAMClient{HashGeneratorFcn: scram.SHA512}
-		}
+		conf.Net.SASL.SCRAMClientGeneratorFunc = scramClientGenerator(sha256.New)
 	default:
-		return gerror.New("queue kafka sasl mechanism is not support")
+		conf.Net.SASL.Mechanism = sarama.SASLMechanism(mechanism)
 	}
-	return nil
 }
 
-type xdgSCRAMClient struct {
-	*scram.Client
-	*scram.ClientConversation
-	scram.HashGeneratorFcn
-}
-
-func (x *xdgSCRAMClient) Begin(userName, password, authzID string) (err error) {
-	x.Client, err = x.HashGeneratorFcn.NewClient(userName, password, authzID)
+// KafkaHealthCheck verifies broker connectivity by creating a short-lived Sarama client.
+func KafkaHealthCheck(ctx context.Context) error {
+	if len(config.Kafka.Address) == 0 {
+		return errors.New("queue kafka address is empty")
+	}
+	kfkVersion, err := parseKafkaVersion(config.Kafka.Version)
 	if err != nil {
 		return err
 	}
-	x.ClientConversation = x.Client.NewConversation()
+	if !validateVersion(kfkVersion) {
+		kfkVersion = sarama.V2_4_0_0
+	}
+	conf := sarama.NewConfig()
+	conf.Version = kfkVersion
+	conf.ClientID = "hotgo-healthz"
+	conf.Net.DialTimeout = 2 * time.Second
+	conf.Net.ReadTimeout = 2 * time.Second
+	conf.Net.WriteTimeout = 2 * time.Second
+	configureKafkaSASL(conf, KafkaConfig{
+		UserName:  config.Kafka.Username,
+		Password:  config.Kafka.Password,
+		Mechanism: config.Kafka.Mechanism,
+	})
+
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
+	client, err := sarama.NewClient(config.Kafka.Address, conf)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = client.Close() }()
+	if len(client.Brokers()) == 0 {
+		return errors.New("no kafka brokers available")
+	}
 	return nil
 }
 
-func (x *xdgSCRAMClient) Step(challenge string) (response string, err error) {
-	return x.ClientConversation.Step(challenge)
-}
-
-func (x *xdgSCRAMClient) Done() bool {
-	return x.ClientConversation.Done()
+func scramClientGenerator(hashFunc func() hash.Hash) func() sarama.SCRAMClient {
+	return func() sarama.SCRAMClient {
+		return &xdgSCRAMClient{HashGeneratorFcn: scram.HashGeneratorFcn(hashFunc)}
+	}
 }
 
 // validateVersion 验证版本是否有效

server/internal/library/queue/queue.go

@@ -11,8 +11,6 @@ import (
 	"github.com/gogf/gf/v2/os/gctx"
 	"hotgo/internal/library/queue/disk"
 	"hotgo/utility/charset"
-	"os"
-	"strings"
 	"sync"
 	"time"
 )
@@ -59,14 +57,11 @@ type RocketmqConf struct {
 type KafkaConf struct {
 	Address       []string `json:"address"`
 	Version       string   `json:"version"`
+	Username      string   `json:"username"`
+	Password      string   `json:"password"`
+	Mechanism     string   `json:"mechanism"`
 	RandClient    bool     `json:"randClient"`
 	MultiConsumer bool     `json:"multiConsumer"`
-	ClientId      string   `json:"clientId"`
-	UserName      string   `json:"userName"`
-	Password      string   `json:"password"`
-	SASLEnabled   bool     `json:"saslEnabled"`
-	SASLMechanism string   `json:"saslMechanism"`
-	TLSEnabled    bool     `json:"tlsEnabled"`
 }
 
 type MqMsg struct {
@@ -93,7 +88,6 @@ func init() {
 	if err := g.Cfg().MustGet(ctx, "queue").Scan(&config); err != nil {
 		Logger().Warningf(ctx, "queue init err:%+v", err)
 	}
-	normalizeKafkaConf()
 }
 
 // InstanceConsumer 实例化消费者
@@ -130,15 +124,12 @@ func NewProducer(groupName string) (mqClient MqProducer, err error) {
 			return
 		}
 		mqClient, err = RegisterKafkaProducer(KafkaConfig{
-			Brokers:       config.Kafka.Address,
-			GroupID:       groupName,
-			Version:       config.Kafka.Version,
-			ClientId:      firstKafkaClientId(config.Kafka.ClientId, "hotgo-producer"),
-			UserName:      config.Kafka.UserName,
-			Password:      config.Kafka.Password,
-			SASLEnabled:   config.Kafka.SASLEnabled,
-			SASLMechanism: config.Kafka.SASLMechanism,
-			TLSEnabled:    config.Kafka.TLSEnabled,
+			Brokers:   config.Kafka.Address,
+			GroupID:   groupName,
+			Version:   config.Kafka.Version,
+			UserName:  config.Kafka.Username,
+			Password:  config.Kafka.Password,
+			Mechanism: config.Kafka.Mechanism,
 		})
 	case "redis":
 		if _, err = g.Redis().Do(ctx, "ping"); err == nil {
@@ -200,15 +191,13 @@ func NewConsumer(groupName string) (mqClient MqConsumer, err error) {
 		}
 
 		mqClient, err = RegisterKafkaMqConsumer(KafkaConfig{
-			Brokers:       config.Kafka.Address,
-			GroupID:       groupName,
-			Version:       config.Kafka.Version,
-			ClientId:      clientId,
-			UserName:      config.Kafka.UserName,
-			Password:      config.Kafka.Password,
-			SASLEnabled:   config.Kafka.SASLEnabled,
-			SASLMechanism: config.Kafka.SASLMechanism,
-			TLSEnabled:    config.Kafka.TLSEnabled,
+			Brokers:   config.Kafka.Address,
+			GroupID:   groupName,
+			Version:   config.Kafka.Version,
+			ClientId:  clientId,
+			UserName:  config.Kafka.Username,
+			Password:  config.Kafka.Password,
+			Mechanism: config.Kafka.Mechanism,
 		})
 	case "redis":
 		if _, err = g.Redis().Do(ctx, "ping"); err == nil {
@@ -233,30 +222,6 @@ func NewConsumer(groupName string) (mqClient MqConsumer, err error) {
 	return
 }
 
-func normalizeKafkaConf() {
-	config.Kafka.UserName = resolveEnvPlaceholder(config.Kafka.UserName)
-	config.Kafka.Password = resolveEnvPlaceholder(config.Kafka.Password)
-	if config.Kafka.SASLMechanism == "" {
-		config.Kafka.SASLMechanism = "SCRAM-SHA-512"
-	}
-}
-
-func resolveEnvPlaceholder(value string) string {
-	value = strings.TrimSpace(value)
-	if strings.HasPrefix(value, "${") && strings.HasSuffix(value, "}") {
-		return os.Getenv(strings.TrimSuffix(strings.TrimPrefix(value, "${"), "}"))
-	}
-	return value
-}
-
-func firstKafkaClientId(value string, fallback string) string {
-	value = strings.TrimSpace(value)
-	if value != "" {
-		return value
-	}
-	return fallback
-}
-
 // BodyString 返回消息体
 func (m *MqMsg) BodyString() string {
 	return string(m.Body)

server/internal/library/storager/upload_local.go

@@ -13,6 +13,7 @@ import (
 	"github.com/gogf/gf/v2/os/gfile"
 	"github.com/gogf/gf/v2/os/gtime"
 	"github.com/gogf/gf/v2/util/gconv"
+	"io"
 	"os"
 	"path/filepath"
 	"sort"
@@ -137,20 +138,53 @@ func (d *LocalDrive) UploadPart(ctx context.Context, in *UploadPartParams) (res
 
 // MergePartFile 合并分片文件
 func MergePartFile(srcPath, dstPath string) (err error) {
-	dir, err := os.ReadDir(srcPath)
+	entries, err := os.ReadDir(srcPath)
 	if err != nil {
 		return err
 	}
-	sort.Slice(dir, func(i, j int) bool {
-		fiIndex, _ := strconv.Atoi(dir[i].Name())
-		fjIndex, _ := strconv.Atoi(dir[j].Name())
-		return fiIndex < fjIndex
+	type filePart struct {
+		index int
+		path  string
+	}
+	parts := make([]filePart, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		index, parseErr := strconv.Atoi(entry.Name())
+		if parseErr != nil || index <= 0 {
+			return gerror.Newf("无效的分片文件名：%s", entry.Name())
+		}
+		parts = append(parts, filePart{index: index, path: filepath.Join(srcPath, entry.Name())})
+	}
+	if len(parts) == 0 {
+		return gerror.New("没有可合并的分片文件")
+	}
+	sort.Slice(parts, func(i, j int) bool {
+		return parts[i].index < parts[j].index
 	})
-	for _, file := range dir {
-		filePath := filepath.Join(srcPath, file.Name())
-		if err = gfile.PutBytesAppend(dstPath, gfile.GetBytes(filePath)); err != nil {
-			return err
+	if err = os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
+		return gerror.Wrap(err, "创建目标目录失败")
+	}
+	dstFile, err := os.OpenFile(dstPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return gerror.Wrap(err, "创建合并文件失败")
+	}
+	defer dstFile.Close()
+
+	for _, part := range parts {
+		srcFile, openErr := os.Open(part.path)
+		if openErr != nil {
+			return gerror.Wrapf(openErr, "打开分片%d失败", part.index)
+		}
+		_, copyErr := io.Copy(dstFile, srcFile)
+		closeErr := srcFile.Close()
+		if copyErr != nil {
+			return gerror.Wrapf(copyErr, "合并分片%d失败", part.index)
+		}
+		if closeErr != nil {
+			return gerror.Wrapf(closeErr, "关闭分片%d失败", part.index)
 		}
 	}
-	return
+	return dstFile.Sync()
 }

server/internal/library/storager/upload_local_test.go

@@ -1,61 +1,52 @@
 package storager
 
 import (
-	"crypto/md5"
-	"errors"
-	"fmt"
-	"io"
+	"bytes"
 	"os"
+	"path/filepath"
 	"testing"
 )
 
 func TestMergePartFile(t *testing.T) {
-	srcFile, _ := os.Open("1.zip")
-	defer srcFile.Close()
-	fileInfo, err := srcFile.Stat()
-	if err != nil {
-		t.Error(err)
+	tempDir := t.TempDir()
+	partDir := filepath.Join(tempDir, "parts")
+	if err := os.MkdirAll(partDir, 0o755); err != nil {
+		t.Fatal(err)
 	}
-	hash := md5.New()
-	_, err = io.Copy(hash, srcFile)
-	sum := hash.Sum(nil)
-	fileHash := fmt.Sprintf("%x", sum)
 
-	var singleSize = int64(1024 * 1024 * 100)
-	chunks := int(fileInfo.Size() / singleSize)
-	if fileInfo.Size()%singleSize != 0 {
-		chunks += 1
+	parts := map[string][]byte{
+		"1":  []byte("first-"),
+		"2":  []byte("second-"),
+		"10": []byte("tenth"),
 	}
-	srcFile.Seek(0, io.SeekStart)
-	for j := 0; j < chunks; j++ {
-		partSize := singleSize
-		if j == chunks-1 {
-			partSize = fileInfo.Size() - int64(j)*singleSize
+	for name, content := range parts {
+		if err := os.WriteFile(filepath.Join(partDir, name), content, 0o644); err != nil {
+			t.Fatal(err)
 		}
-		partData := make([]byte, partSize)
-		_, err = io.ReadFull(srcFile, partData)
-		pf, _ := os.Create(fmt.Sprintf("tmp/%d", j+1))
-		_, err = pf.Write(partData)
-		if err != nil {
-			t.Error(err)
-			return
-		}
-		pf.Close()
 	}
 
-	err = MergePartFile("tmp/", "2.zip")
+	destination := filepath.Join(tempDir, "merged.bin")
+	if err := os.WriteFile(destination, []byte("stale-data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := MergePartFile(partDir, destination); err != nil {
+		t.Fatalf("合并分片失败: %v", err)
+	}
+
+	actual, err := os.ReadFile(destination)
 	if err != nil {
-		t.Error(err)
-		return
+		t.Fatal(err)
 	}
+	expected := []byte("first-second-tenth")
+	if !bytes.Equal(actual, expected) {
+		t.Fatalf("合并内容不符 expected=%q actual=%q", expected, actual)
+	}
+}
 
-	f2, _ := os.Open("2.zip")
-	hash2 := md5.New()
-	_, err = io.Copy(hash2, f2)
-	sum2 := hash.Sum(nil)
-	fileHash2 := fmt.Sprintf("%x", sum2)
-	if fileHash != fileHash2 {
-		t.Error(errors.New("hash mismatch"))
+func TestMergePartFileRejectsEmptyDirectory(t *testing.T) {
+	partDir := t.TempDir()
+	err := MergePartFile(partDir, filepath.Join(t.TempDir(), "merged.bin"))
+	if err == nil {
+		t.Fatal("空分片目录应返回错误")
 	}
-
 }

server/internal/logic/admin/member.go

@@ -470,7 +470,7 @@ func (s *sAdminMember) Edit(ctx context.Context, in *adminin.MemberEditInp) (err
 
 	if service.AdminMember().VerifySuperId(ctx, opMemberId) {
 		if in.TenantId > 0 {
-			count, queryErr := imtenant.RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).
+			count, queryErr := imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).
 				Where(dao.ImTenant.Columns().Id, in.TenantId).
 				Where(dao.ImTenant.Columns().State, consts.ImTenantStateActive).
 				Count()
@@ -488,7 +488,6 @@ func (s *sAdminMember) Edit(ctx context.Context, in *adminin.MemberEditInp) (err
 			return gerror.New("当前管理员未关联租户")
 		}
 	} else {
-		// 非租户域管理员不能通过浏览器为账号指定租户。
 		in.TenantId = 0
 	}
 

server/internal/logic/hook/init.go

@@ -8,6 +8,7 @@ package hook
 import (
 	"github.com/gogf/gf/v2/net/ghttp"
 	"hotgo/internal/service"
+	"strings"
 )
 
 type sHook struct {
@@ -22,10 +23,23 @@ func New() *sHook {
 }
 
 func (s *sHook) BeforeServe(r *ghttp.Request) {
-
+	s.setAdminStaticCacheHeader(r)
 }
 
 func (s *sHook) AfterOutput(r *ghttp.Request) {
 	s.accessLog(r)
 	s.lastAdminActive(r)
 }
+
+func (s *sHook) setAdminStaticCacheHeader(r *ghttp.Request) {
+	path := r.URL.Path
+	if path == "/admin" || path == "/admin/" || path == "/admin/index.html" || path == "/admin/app.config.js" {
+		r.Response.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+		r.Response.Header().Set("Pragma", "no-cache")
+		r.Response.Header().Set("Expires", "0")
+		return
+	}
+	if strings.HasPrefix(path, "/admin/assets/") {
+		r.Response.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	}
+}

server/internal/logic/sys/im_abuse_reason.go

@@ -0,0 +1,166 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+const imAbuseReasonsTable = "im_abuse_reasons"
+
+type sSysImAbuseReason struct{}
+
+func NewSysImAbuseReason() *sSysImAbuseReason { return &sSysImAbuseReason{} }
+
+func init() {
+	service.RegisterSysImAbuseReason(NewSysImAbuseReason())
+}
+
+func (s *sSysImAbuseReason) List(ctx context.Context, in *sysin.ImAbuseReasonListInp) (list []*sysin.ImAbuseReasonModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if err = s.ensureDefaults(ctx, db); err != nil {
+		return
+	}
+	mod := s.model(ctx, db)
+	if in.TargetType != "" {
+		mod = mod.Where("target_type", in.TargetType)
+	}
+	if in.ReasonCode != "" {
+		mod = mod.WhereLike("reason_code", "%"+in.ReasonCode+"%")
+	}
+	if in.Enabled != nil {
+		mod = mod.Where("enabled", *in.Enabled)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderAsc("target_type").OrderAsc("sort_order").OrderAsc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM举报原因失败，请稍后重试！")
+		return
+	}
+	for _, item := range list {
+		item.TenantId = tenant.Id
+		item.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImAbuseReason) Edit(ctx context.Context, in *sysin.ImAbuseReasonEditInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if err = s.ensureDefaults(ctx, db); err != nil {
+		return
+	}
+	data := g.Map{
+		"target_type":          in.TargetType,
+		"reason_code":          in.ReasonCode,
+		"label":                in.Label,
+		"requires_description": in.RequiresDescription,
+		"allows_evidence":      in.AllowsEvidence,
+		"sort_order":           in.SortOrder,
+		"enabled":              in.Enabled,
+		"updated_at":           gtime.Now(),
+	}
+	action := "im_abuse_reason_create"
+	targetId := in.Id
+	if in.Id > 0 {
+		if _, err = db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).WherePri(in.Id).Data(data).Update(); err != nil {
+			return gerror.Wrap(err, "更新IM举报原因失败，请稍后重试！")
+		}
+		action = "im_abuse_reason_update"
+	} else {
+		data["created_at"] = gtime.Now()
+		if _, err = db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).Data(data).Insert(); err != nil {
+			return gerror.Wrap(err, "新增IM举报原因失败，请稍后重试！")
+		}
+		idValue, err := db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).Fields("id").
+			Where("target_type", in.TargetType).Where("reason_code", in.ReasonCode).Value()
+		if err != nil {
+			return gerror.Wrap(err, "获取IM举报原因ID失败，请稍后重试！")
+		}
+		targetId = idValue.Int64()
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, action, "im_abuse_reason", targetId, "success", g.Map{
+		"target_type": in.TargetType, "reason_code": in.ReasonCode, "enabled": in.Enabled,
+	})
+	return nil
+}
+
+func (s *sSysImAbuseReason) Delete(ctx context.Context, in *sysin.ImAbuseReasonDeleteInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if _, err = db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).WherePri(in.Id).
+		Data(g.Map{"enabled": 0, "updated_at": gtime.Now()}).Update(); err != nil {
+		return gerror.Wrap(err, "禁用IM举报原因失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_abuse_reason_disable", "im_abuse_reason", in.Id, "success", nil)
+	return nil
+}
+
+func (s *sSysImAbuseReason) model(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).Fields(
+		"id",
+		"target_type",
+		"reason_code",
+		"label",
+		"requires_description",
+		"allows_evidence",
+		"sort_order",
+		"enabled",
+		"created_at",
+		"updated_at",
+	)
+}
+
+func (s *sSysImAbuseReason) ensureDefaults(ctx context.Context, db gdb.DB) (err error) {
+	defaults := []g.Map{
+		{"target_type": consts.ImAbuseTargetTypeUser, "reason_code": "fraud", "label": "诈骗欺诈", "requires_description": 0, "allows_evidence": 1, "sort_order": 10},
+		{"target_type": consts.ImAbuseTargetTypeUser, "reason_code": "harassment", "label": "骚扰辱骂", "requires_description": 0, "allows_evidence": 1, "sort_order": 20},
+		{"target_type": consts.ImAbuseTargetTypeUser, "reason_code": "illegal", "label": "违法违规", "requires_description": 1, "allows_evidence": 1, "sort_order": 30},
+		{"target_type": consts.ImAbuseTargetTypeGroup, "reason_code": "fraud", "label": "诈骗欺诈", "requires_description": 0, "allows_evidence": 1, "sort_order": 10},
+		{"target_type": consts.ImAbuseTargetTypeGroup, "reason_code": "spam", "label": "垃圾广告", "requires_description": 0, "allows_evidence": 1, "sort_order": 20},
+		{"target_type": consts.ImAbuseTargetTypeGroup, "reason_code": "illegal", "label": "违法违规", "requires_description": 1, "allows_evidence": 1, "sort_order": 30},
+		{"target_type": consts.ImAbuseTargetTypeMessage, "reason_code": "fraud", "label": "诈骗欺诈", "requires_description": 0, "allows_evidence": 1, "sort_order": 10},
+		{"target_type": consts.ImAbuseTargetTypeMessage, "reason_code": "spam", "label": "垃圾广告", "requires_description": 0, "allows_evidence": 1, "sort_order": 20},
+		{"target_type": consts.ImAbuseTargetTypeMessage, "reason_code": "harassment", "label": "骚扰辱骂", "requires_description": 0, "allows_evidence": 1, "sort_order": 30},
+		{"target_type": consts.ImAbuseTargetTypeMessage, "reason_code": "illegal", "label": "违法违规", "requires_description": 1, "allows_evidence": 1, "sort_order": 40},
+	}
+	now := gtime.Now()
+	for _, item := range defaults {
+		var count int
+		if count, err = db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).
+			Where("target_type", item["target_type"]).Where("reason_code", item["reason_code"]).Count(); err != nil {
+			return gerror.Wrap(err, "检查IM举报默认原因失败，请稍后重试！")
+		}
+		if count > 0 {
+			continue
+		}
+		item["enabled"] = 1
+		item["created_at"] = now
+		item["updated_at"] = now
+		if _, err = db.Model(imAbuseReasonsTable).Safe().Ctx(ctx).Data(item).Insert(); err != nil {
+			return gerror.Wrap(err, "初始化IM举报默认原因失败，请稍后重试！")
+		}
+	}
+	return nil
+}

server/internal/logic/sys/im_admin_query_client.go

@@ -0,0 +1,258 @@
+package sys
+
+import (
+	"context"
+	"encoding/json"
+	"hotgo/internal/dao"
+	"hotgo/internal/library/imadmin"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type imAdminQueryPage struct {
+	Items   []map[string]any `json:"items"`
+	Total   int              `json:"total"`
+	Page    int              `json:"page"`
+	PerPage int              `json:"per_page"`
+}
+
+func resolveImAdminTenant(ctx context.Context, selectedTenantId int64) (tenant *entity.ImTenant, err error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(scope.TenantId).Scan(&tenant); err != nil {
+		return nil, gerror.Wrap(err, "获取IM租户失败")
+	}
+	if tenant == nil || tenant.Id <= 0 || tenant.Code == "" {
+		return nil, gerror.New("IM租户不存在或编码为空")
+	}
+	return tenant, nil
+}
+
+func imAdminQueryList[T any](ctx context.Context, tenant *entity.ImTenant, path string, values url.Values, aliases map[string]string) (list []*T, totalCount int, err error) {
+	if values == nil {
+		values = url.Values{}
+	}
+	query := values.Encode()
+	if query != "" {
+		path += "?" + query
+	}
+	var page imAdminQueryPage
+	if err = imadmin.DefaultClient(ctx).InternalGet(ctx, path, &page); err != nil {
+		return nil, 0, err
+	}
+	normalizeImAdminRows(page.Items, aliases)
+	if len(page.Items) == 0 {
+		return []*T{}, page.Total, nil
+	}
+	raw, err := json.Marshal(page.Items)
+	if err != nil {
+		return nil, 0, gerror.Wrap(err, "转换IM内部查询列表失败")
+	}
+	if err = json.Unmarshal(raw, &list); err != nil {
+		return nil, 0, gerror.Wrap(err, "解析IM内部查询列表失败")
+	}
+	fillImTenantFields(tenant, &list)
+	return list, page.Total, nil
+}
+
+func imAdminQueryOne[T any](ctx context.Context, tenant *entity.ImTenant, path string, aliases map[string]string) (res *T, err error) {
+	row := map[string]any{}
+	if err = imadmin.DefaultClient(ctx).InternalGet(ctx, path, &row); err != nil {
+		return nil, err
+	}
+	normalizeImAdminRow(row, aliases)
+	raw, err := json.Marshal(row)
+	if err != nil {
+		return nil, gerror.Wrap(err, "转换IM内部查询详情失败")
+	}
+	if err = json.Unmarshal(raw, &res); err != nil {
+		return nil, gerror.Wrap(err, "解析IM内部查询详情失败")
+	}
+	fillImTenantFields(tenant, res)
+	return res, nil
+}
+
+func normalizeImAdminRows(rows []map[string]any, aliases map[string]string) {
+	for _, row := range rows {
+		normalizeImAdminRow(row, aliases)
+	}
+}
+
+func normalizeImAdminRow(row map[string]any, aliases map[string]string) {
+	for key, value := range row {
+		target := snakeToLowerCamel(key)
+		if aliases != nil {
+			if alias := aliases[key]; alias != "" {
+				target = alias
+			}
+		}
+		value = normalizeImAdminValue(target, value)
+		if target == key {
+			row[key] = value
+			continue
+		}
+		row[target] = value
+		delete(row, key)
+	}
+	if _, ok := row["authNames"]; !ok {
+		username, _ := row["username"].(string)
+		phone, _ := row["phone"].(string)
+		authNames := username
+		if phone != "" && phone != username {
+			if authNames != "" {
+				authNames += ", "
+			}
+			authNames += phone
+		}
+		if authNames != "" {
+			row["authNames"] = authNames
+		}
+	}
+}
+
+func normalizeImAdminValue(target string, value any) any {
+	switch target {
+	case "credentials":
+		items, ok := value.([]any)
+		if !ok {
+			return value
+		}
+		parts := make([]string, 0, len(items))
+		for _, item := range items {
+			m, ok := item.(map[string]any)
+			if !ok {
+				continue
+			}
+			method, _ := m["method"].(string)
+			val, _ := m["value"].(string)
+			if method == "" && val == "" {
+				continue
+			}
+			text := method
+			if val != "" {
+				if text != "" {
+					text += ":"
+				}
+				text += val
+			}
+			if done, ok := m["done"].(bool); ok && !done {
+				text += "(未验证)"
+			}
+			parts = append(parts, text)
+		}
+		return strings.Join(parts, ", ")
+	case "profileJson", "trustedJson", "accessJson", "head", "content", "metadata", "atUsers":
+		return normalizeImAdminJSONString(value)
+	default:
+		return value
+	}
+}
+
+func normalizeImAdminJSONString(value any) string {
+	switch v := value.(type) {
+	case nil:
+		return ""
+	case string:
+		return v
+	default:
+		encoded, err := json.Marshal(v)
+		if err != nil {
+			return ""
+		}
+		return string(encoded)
+	}
+}
+
+func snakeToLowerCamel(s string) string {
+	if !strings.Contains(s, "_") {
+		return s
+	}
+	parts := strings.Split(s, "_")
+	var b strings.Builder
+	for i, part := range parts {
+		if part == "" {
+			continue
+		}
+		if i == 0 {
+			b.WriteString(part)
+			continue
+		}
+		b.WriteString(strings.ToUpper(part[:1]))
+		if len(part) > 1 {
+			b.WriteString(part[1:])
+		}
+	}
+	return b.String()
+}
+
+func fillImTenantFields(tenant *entity.ImTenant, target any) {
+	raw, err := json.Marshal(target)
+	if err != nil {
+		return
+	}
+	var rows []map[string]any
+	if err = json.Unmarshal(raw, &rows); err == nil {
+		for _, row := range rows {
+			row["tenantId"] = tenant.Id
+			row["tenantName"] = tenant.Name
+		}
+		updated, _ := json.Marshal(rows)
+		_ = json.Unmarshal(updated, target)
+		return
+	}
+	var row map[string]any
+	if err = json.Unmarshal(raw, &row); err == nil {
+		row["tenantId"] = tenant.Id
+		row["tenantName"] = tenant.Name
+		updated, _ := json.Marshal(row)
+		_ = json.Unmarshal(updated, target)
+	}
+}
+
+func addPageQuery(values url.Values, page int, perPage int) url.Values {
+	if values == nil {
+		values = url.Values{}
+	}
+	if page <= 0 {
+		page = 1
+	}
+	if perPage <= 0 {
+		perPage = 20
+	}
+	values.Set("page", intToString(page))
+	values.Set("per_page", intToString(perPage))
+	return values
+}
+
+func addTimeRangeQuery(values url.Values, prefix string, times []*gtime.Time) {
+	if len(times) != 2 {
+		return
+	}
+	if times[0] != nil {
+		values.Set(prefix+"_start", times[0].Time.UTC().Format(time.RFC3339Nano))
+	}
+	if times[1] != nil {
+		values.Set(prefix+"_end", times[1].Time.UTC().Format(time.RFC3339Nano))
+	}
+}
+
+func intToString(v int) string {
+	return strconvFormatInt(int64(v))
+}
+
+func int64ToString(v int64) string {
+	return strconvFormatInt(v)
+}
+
+func strconvFormatInt(v int64) string {
+	return strconv.FormatInt(v, 10)
+}

server/internal/logic/sys/im_admin_scope.go

@@ -11,6 +11,7 @@ import (
 	"hotgo/internal/service"
 	"hotgo/utility/simple"
 
+	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/encoding/gjson"
 	"github.com/gogf/gf/v2/errors/gerror"
 	"github.com/gogf/gf/v2/frame/g"
@@ -28,7 +29,7 @@ func resolveImAdminScope(ctx context.Context, selectedTenantId int64) (scope ima
 	scope.OperatorId = operatorId
 	scope.RoleKey = contexts.GetRoleKey(ctx)
 	scope.RequestId = gctx.CtxId(ctx)
-	if service.AdminMember().VerifySuperId(ctx, operatorId) {
+	if isImPlatformAdmin(ctx, operatorId) {
 		if selectedTenantId <= 0 {
 			return scope, gerror.New("请选择IM租户")
 		}
@@ -39,12 +40,12 @@ func resolveImAdminScope(ctx context.Context, selectedTenantId int64) (scope ima
 		return scope, nil
 	}
 
-	if contexts.GetDeptType(ctx) != consts.DeptTypeTenant {
-		return scope, gerror.New("当前账号不是租户管理员，不能管理邀请码")
+	if !contexts.IsTenantDept(ctx) {
+		return scope, gerror.New("当前账号无权管理IM租户")
 	}
-	tenantId := contexts.GetTenantId(ctx)
-	if tenantId <= 0 {
-		return scope, gerror.New("当前管理员未关联租户")
+	tenantId, err := resolveImAdminBoundTenant(ctx)
+	if err != nil {
+		return scope, err
 	}
 	if err = ensureImTenantActive(ctx, tenantId); err != nil {
 		return scope, err
@@ -53,6 +54,21 @@ func resolveImAdminScope(ctx context.Context, selectedTenantId int64) (scope ima
 	return scope, nil
 }
 
+func isImPlatformAdmin(ctx context.Context, operatorId int64) bool {
+	if contexts.IsCompanyDept(ctx) {
+		return true
+	}
+	return service.AdminMember().VerifySuperId(ctx, operatorId)
+}
+
+func resolveImAdminBoundTenant(ctx context.Context) (int64, error) {
+	tenantId := contexts.GetTenantId(ctx)
+	if tenantId <= 0 {
+		return 0, gerror.New("当前管理员未关联IM租户")
+	}
+	return tenantId, nil
+}
+
 func ensureImTenantActive(ctx context.Context, tenantId int64) (err error) {
 	var tenant *entity.ImTenant
 	if err = imtenant.RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(tenantId).Scan(&tenant); err != nil {
@@ -67,6 +83,14 @@ func ensureImTenantActive(ctx context.Context, tenantId int64) (err error) {
 	return nil
 }
 
+func resolveImTenantDB(ctx context.Context, selectedTenantId int64) (db gdb.DB, tenant *entity.ImTenant, err error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantId)
+	if err != nil {
+		return nil, nil, err
+	}
+	return imtenant.DB(ctx, scope.TenantId)
+}
+
 func writeImAdminAudit(ctx context.Context, tenantId int64, action string, targetType string, targetId int64, result string, detail g.Map) error {
 	operatorId := contexts.GetUserId(ctx)
 	request := ghttp.RequestFromCtx(ctx)

server/internal/logic/sys/im_admin_scope_test.go

@@ -0,0 +1,57 @@
+package sys
+
+import (
+	"context"
+	"testing"
+
+	"hotgo/internal/consts"
+	"hotgo/internal/model"
+)
+
+func TestCompanyDepartmentIsImPlatformAdmin(t *testing.T) {
+	ctx := context.WithValue(context.Background(), consts.ContextHTTPKey, &model.Context{
+		User: &model.Identity{Id: 14, TenantId: 1, DeptType: consts.DeptTypeCompany, RoleKey: "imManage"},
+	})
+	if !isImPlatformAdmin(ctx, 14) {
+		t.Fatal("expected company department IM manager to use platform tenant selection")
+	}
+}
+
+func TestResolveImAdminBoundTenant(t *testing.T) {
+	tests := []struct {
+		name     string
+		identity *model.Identity
+		want     int64
+	}{
+		{
+			name: "tenant department with tenant binding",
+			identity: &model.Identity{
+				TenantId: 2,
+				DeptType: consts.DeptTypeTenant,
+			},
+			want: 2,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := context.WithValue(context.Background(), consts.ContextHTTPKey, &model.Context{User: tt.identity})
+			got, err := resolveImAdminBoundTenant(ctx)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got != tt.want {
+				t.Fatalf("tenant binding mismatch: got %d, want %d", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestResolveImAdminBoundTenantRejectsUnboundAccount(t *testing.T) {
+	ctx := context.WithValue(context.Background(), consts.ContextHTTPKey, &model.Context{
+		User: &model.Identity{DeptType: consts.DeptTypeTenant, RoleKey: "tenantManager"},
+	})
+	if _, err := resolveImAdminBoundTenant(ctx); err == nil {
+		t.Fatal("expected unbound account to be rejected")
+	}
+}

server/internal/logic/sys/im_app_release.go

@@ -0,0 +1,153 @@
+package sys
+
+import (
+	"context"
+	"fmt"
+
+	"hotgo/internal/consts"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imkafka"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+const imAppReleasesTable = "im_app_releases"
+
+type sSysImAppRelease struct{}
+
+func NewSysImAppRelease() *sSysImAppRelease { return &sSysImAppRelease{} }
+
+func init() {
+	service.RegisterSysImAppRelease(NewSysImAppRelease())
+}
+
+func (s *sSysImAppRelease) List(ctx context.Context, in *sysin.ImAppReleaseListInp) (list []*sysin.ImAppReleaseModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db := imtenant.RegistryDB()
+	if err = s.ensureDefaults(ctx, db); err != nil {
+		return
+	}
+	mod := s.model(ctx, db)
+	if in.Platform != "" {
+		mod = mod.Where("platform", in.Platform)
+	}
+	if in.Channel != "" {
+		mod = mod.WhereLike("channel", "%"+in.Channel+"%")
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderAsc("platform").OrderAsc("channel")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM客户端版本策略失败，请稍后重试！")
+		return
+	}
+	return
+}
+
+func (s *sSysImAppRelease) Edit(ctx context.Context, in *sysin.ImAppReleaseEditInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db := imtenant.RegistryDB()
+	if err = s.ensureDefaults(ctx, db); err != nil {
+		return
+	}
+	data := g.Map{
+		"platform":              in.Platform,
+		"channel":               in.Channel,
+		"latest_version":        in.LatestVersion,
+		"min_supported_version": in.MinSupportedVersion,
+		"update_type":           in.UpdateType,
+		"release_notes":         in.ReleaseNotes,
+		"store_url":             in.StoreUrl,
+		"package_url":           in.PackageUrl,
+		"checksum":              in.Checksum,
+		"remind_after_seconds":  in.RemindAfterSeconds,
+		"published_at":          gtime.Now(),
+		"updated_at":            gtime.Now(),
+	}
+	action := "im_app_release_create"
+	targetId := in.Id
+	if in.Id > 0 {
+		if _, err = db.Model(imAppReleasesTable).Safe().Ctx(ctx).WherePri(in.Id).Data(data).Update(); err != nil {
+			return gerror.Wrap(err, "更新IM客户端版本策略失败，请稍后重试！")
+		}
+		action = "im_app_release_update"
+	} else {
+		data["created_at"] = gtime.Now()
+		if _, err = db.Model(imAppReleasesTable).Safe().Ctx(ctx).Data(data).Insert(); err != nil {
+			return gerror.Wrap(err, "新增IM客户端版本策略失败，请稍后重试！")
+		}
+		idValue, err := db.Model(imAppReleasesTable).Safe().Ctx(ctx).Fields("id").
+			Where("platform", in.Platform).Where("channel", in.Channel).Value()
+		if err != nil {
+			return gerror.Wrap(err, "获取IM客户端版本策略ID失败，请稍后重试！")
+		}
+		targetId = idValue.Int64()
+	}
+	_ = writeImAdminAudit(ctx, 0, action, "im_app_release", targetId, "success", g.Map{
+		"platform": in.Platform, "channel": in.Channel, "update_type": in.UpdateType,
+	})
+	if err = imkafka.PublishConfigEvent(ctx, imkafka.ConfigEventInput{
+		TenantCode: "*", EventType: "app.release.updated", Group: "app_release",
+		Keys: []string{in.Platform, in.Channel}, BizID: in.Platform + ":" + in.Channel,
+		Actor:     &imkafka.Actor{Type: "admin", ID: fmt.Sprint(contexts.GetUserId(ctx))},
+		CreatedBy: contexts.GetUserId(ctx),
+	}); err != nil {
+		g.Log().Warningf(ctx, "版本策略已保存，缓存失效事件等待 Outbox 重试: %v", err)
+	}
+	return nil
+}
+
+func (s *sSysImAppRelease) model(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model(imAppReleasesTable).Safe().Ctx(ctx).Fields(
+		"id",
+		"platform",
+		"channel",
+		"latest_version",
+		"min_supported_version",
+		"update_type",
+		"release_notes",
+		"store_url",
+		"package_url",
+		"checksum",
+		"remind_after_seconds",
+		"published_at",
+		"created_at",
+		"updated_at",
+	)
+}
+
+func (s *sSysImAppRelease) ensureDefaults(ctx context.Context, db gdb.DB) (err error) {
+	defaults := []g.Map{
+		{"platform": consts.ImAppPlatformIos, "channel": "stable", "latest_version": "1.0.0", "min_supported_version": "1.0.0", "update_type": consts.ImAppUpdateTypeNone, "release_notes": "当前已是最新版本。", "remind_after_seconds": 0},
+		{"platform": consts.ImAppPlatformAndroid, "channel": "stable", "latest_version": "1.0.0", "min_supported_version": "1.0.0", "update_type": consts.ImAppUpdateTypeNone, "release_notes": "当前已是最新版本。", "remind_after_seconds": 0},
+	}
+	now := gtime.Now()
+	for _, item := range defaults {
+		var count int
+		if count, err = db.Model(imAppReleasesTable).Safe().Ctx(ctx).
+			Where("platform", item["platform"]).Where("channel", item["channel"]).Count(); err != nil {
+			return gerror.Wrap(err, "检查IM客户端默认版本策略失败，请稍后重试！")
+		}
+		if count > 0 {
+			continue
+		}
+		item["store_url"] = ""
+		item["package_url"] = ""
+		item["checksum"] = ""
+		item["published_at"] = now
+		item["created_at"] = now
+		item["updated_at"] = now
+		if _, err = db.Model(imAppReleasesTable).Safe().Ctx(ctx).Data(item).Insert(); err != nil {
+			return gerror.Wrap(err, "初始化IM客户端默认版本策略失败，请稍后重试！")
+		}
+	}
+	return nil
+}

server/internal/logic/sys/im_audit_log.go

@@ -7,12 +7,18 @@ package sys
 
 import (
 	"context"
+	"fmt"
 	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/input/form"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
+	"hotgo/utility/convert"
+	"hotgo/utility/excel"
 
 	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/os/gctx"
+	"github.com/gogf/gf/v2/util/gconv"
 )
 
 type sSysImAuditLog struct{}
@@ -30,7 +36,11 @@ func (s *sSysImAuditLog) List(ctx context.Context, in *sysin.ImAuditLogListInp)
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	db, tenant, err := imtenant.DB(ctx, scope.TenantId)
 	if err != nil {
 		return
 	}
@@ -107,7 +117,11 @@ func (s *sSysImAuditLog) View(ctx context.Context, in *sysin.ImAuditLogViewInp)
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	db, tenant, err := imtenant.DB(ctx, scope.TenantId)
 	if err != nil {
 		return nil, err
 	}
@@ -123,3 +137,23 @@ func (s *sSysImAuditLog) View(ctx context.Context, in *sysin.ImAuditLogViewInp)
 	res.TenantName = tenant.Name
 	return
 }
+
+// Export 导出IM审计日志列表
+func (s *sSysImAuditLog) Export(ctx context.Context, in *sysin.ImAuditLogListInp) (err error) {
+	list, totalCount, err := s.List(ctx, in)
+	if err != nil {
+		return
+	}
+	tags, err := convert.GetEntityDescTags(sysin.ImAuditLogExportModel{})
+	if err != nil {
+		return
+	}
+
+	var exports []sysin.ImAuditLogExportModel
+	if err = gconv.Scan(list, &exports); err != nil {
+		return
+	}
+	fileName := "导出IM审计日志-" + gctx.CtxId(ctx)
+	sheetName := fmt.Sprintf("索引条件共%v行,共%v页,当前导出是第%v页,本页共%v行", totalCount, form.CalPageCount(totalCount, in.PerPage), in.Page, len(list))
+	return excel.ExportByStructs(ctx, tags, exports, fileName, sheetName)
+}

server/internal/logic/sys/im_dashboard.go

@@ -0,0 +1,38 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+	"net/url"
+)
+
+type sSysImDashboard struct{}
+
+func NewSysImDashboard() *sSysImDashboard { return &sSysImDashboard{} }
+
+func init() { service.RegisterSysImDashboard(NewSysImDashboard()) }
+
+func (s *sSysImDashboard) Overview(ctx context.Context, in *sysin.ImDashboardOverviewInp) (*sysin.ImDashboardOverviewModel, error) {
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	return imAdminQueryOne[sysin.ImDashboardOverviewModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/dashboard/overview", nil)
+}
+
+func (s *sSysImDashboard) Trends(ctx context.Context, in *sysin.ImDashboardTrendsInp) ([]*sysin.ImDashboardTrendModel, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	values := addPageQuery(url.Values{}, 1, in.Days)
+	values.Set("days", intToString(in.Days))
+	list, _, err := imAdminQueryList[sysin.ImDashboardTrendModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/dashboard/trends", values, nil)
+	return list, err
+}

server/internal/logic/sys/im_dead_letter.go

@@ -166,7 +166,7 @@ func (s *sSysImDeadLetter) getTenant(ctx context.Context, tenantId int64) (tenan
 	if tenantId <= 0 {
 		return nil, gerror.New("请选择IM租户")
 	}
-	if err = imtenant.RegistryDB(ctx).Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(tenantId).Scan(&tenant); err != nil {
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(tenantId).Scan(&tenant); err != nil {
 		return nil, gerror.Wrap(err, "获取IM租户失败")
 	}
 	if tenant == nil || tenant.Id <= 0 {

server/internal/logic/sys/im_external_config.go

@@ -0,0 +1,227 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/dao"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/encoding/gjson"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type sSysImExternalConfig struct{}
+
+func NewSysImExternalConfig() *sSysImExternalConfig { return &sSysImExternalConfig{} }
+
+func init() {
+	service.RegisterSysImExternalConfig(NewSysImExternalConfig())
+}
+
+func (s *sSysImExternalConfig) List(ctx context.Context, in *sysin.ImExternalConfigListInp) (list []*sysin.ImExternalConfigListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return
+	}
+	mod := s.model(ctx).Where("tenant_id", tenant.Id)
+	if in.Service != "" {
+		mod = mod.Where("service", in.Service)
+	}
+	if in.Provider != "" {
+		mod = mod.WhereLike("provider", "%"+in.Provider+"%")
+	}
+	if in.Enabled != nil {
+		mod = mod.Where("enabled", *in.Enabled)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderAsc("service")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM外部服务配置失败，请稍后重试！")
+		return
+	}
+	for _, item := range list {
+		item.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImExternalConfig) View(ctx context.Context, in *sysin.ImExternalConfigViewInp) (res *sysin.ImExternalConfigViewModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return nil, err
+	}
+	if err = s.model(ctx).Where("tenant_id", tenant.Id).Where("service", in.Service).Scan(&res); err != nil {
+		return nil, gerror.Wrap(err, "获取IM外部服务配置详情失败，请稍后重试！")
+	}
+	if res != nil {
+		res.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImExternalConfig) Update(ctx context.Context, in *sysin.ImExternalConfigUpdateInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	if !s.validService(in.Service) {
+		return gerror.New("服务类型不正确")
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return err
+	}
+	configJson := "{}"
+	if in.ConfigJson != nil && in.ConfigJson.String() != "" && in.ConfigJson.String() != "null" {
+		configJson = in.ConfigJson.String()
+	}
+	data := g.Map{
+		"provider":    in.Provider,
+		"endpoint":    in.Endpoint,
+		"enabled":     in.Enabled,
+		"config_json": configJson,
+		"updated_at":  gtime.Now(),
+		"updated_by":  contexts.GetUserId(ctx),
+	}
+	if in.SecretJson != nil && in.SecretJson.String() != "" && in.SecretJson.String() != "null" && in.SecretJson.String() != "{}" {
+		data["secret_json"] = in.SecretJson.String()
+	}
+	if _, err = imtenant.RegistryDB().Model("im_external_config").Safe().Ctx(ctx).
+		Where("tenant_id", tenant.Id).Where("service", in.Service).Data(data).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM外部服务配置失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_external_config_update", "im_external_config", 0, "success", g.Map{
+		"service": in.Service, "provider": in.Provider, "enabled": in.Enabled,
+	})
+	return nil
+}
+
+func (s *sSysImExternalConfig) Check(ctx context.Context, in *sysin.ImExternalConfigCheckInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return err
+	}
+	var row gdb.Record
+	if row, err = imtenant.RegistryDB().Model("im_external_config").Safe().Ctx(ctx).
+		Where("tenant_id", tenant.Id).Where("service", in.Service).One(); err != nil {
+		return gerror.Wrap(err, "检查IM外部服务配置失败，请稍后重试！")
+	}
+	status := consts.ImExternalConfigStatusConfigured
+	result := "配置完整"
+	if row == nil || row["enabled"].Int() != 1 || row["provider"].String() == "" {
+		status = consts.ImExternalConfigStatusUnconfigured
+		result = "未启用或服务商为空"
+	}
+	if _, err = imtenant.RegistryDB().Model("im_external_config").Safe().Ctx(ctx).
+		Where("tenant_id", tenant.Id).Where("service", in.Service).
+		Data(g.Map{"status": status, "checked_at": gtime.Now(), "check_result": result, "updated_at": gtime.Now()}).
+		Update(); err != nil {
+		return gerror.Wrap(err, "更新IM外部服务检查结果失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_external_config_check", "im_external_config", 0, "success", g.Map{
+		"service": in.Service, "status": status,
+	})
+	return nil
+}
+
+func (s *sSysImExternalConfig) model(ctx context.Context) *gdb.Model {
+	return imtenant.RegistryDB().Model("im_external_config").Safe().Ctx(ctx).Fields(
+		"tenant_id",
+		"id",
+		"service",
+		"provider",
+		"endpoint",
+		"enabled",
+		"status",
+		"CAST(config_json AS CHAR) config_json",
+		"CASE WHEN secret_json IS NULL OR CAST(secret_json AS CHAR)='{}' THEN 0 ELSE 1 END has_secret",
+		"checked_at",
+		"check_result",
+		"created_at",
+		"updated_at",
+	)
+}
+
+func (s *sSysImExternalConfig) resolveTenant(ctx context.Context, selectedTenantId int64) (tenant *entity.ImTenant, err error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(scope.TenantId).Scan(&tenant); err != nil {
+		return nil, gerror.Wrap(err, "获取IM租户失败")
+	}
+	if tenant == nil {
+		return nil, gerror.New("IM租户不存在")
+	}
+	return tenant, nil
+}
+
+func (s *sSysImExternalConfig) ensureRows(ctx context.Context, tenantId int64) error {
+	services := []string{
+		consts.ImExternalServiceSms,
+		consts.ImExternalServicePush,
+		consts.ImExternalServiceTurn,
+		consts.ImExternalServiceStorage,
+		consts.ImExternalServiceModeration,
+	}
+	for _, serviceName := range services {
+		count, err := imtenant.RegistryDB().Model("im_external_config").Safe().Ctx(ctx).
+			Where("tenant_id", tenantId).Where("service", serviceName).Count()
+		if err != nil {
+			return gerror.Wrap(err, "初始化IM外部服务配置失败")
+		}
+		if count > 0 {
+			continue
+		}
+		_, err = imtenant.RegistryDB().Exec(ctx, `INSERT INTO im_external_config
+			(tenant_id,service,provider,endpoint,enabled,status,config_json,secret_json,created_by,updated_by)
+			VALUES(?,?,?,?,?,?,CAST(? AS JSON),CAST(? AS JSON),?,?)`,
+			tenantId, serviceName, "", "", 0, consts.ImExternalConfigStatusUnconfigured, "{}", "{}", contexts.GetUserId(ctx), contexts.GetUserId(ctx))
+		if err != nil {
+			return gerror.Wrap(err, "初始化IM外部服务配置失败")
+		}
+	}
+	return nil
+}
+
+func (s *sSysImExternalConfig) validService(serviceName string) bool {
+	switch serviceName {
+	case consts.ImExternalServiceSms, consts.ImExternalServicePush, consts.ImExternalServiceTurn, consts.ImExternalServiceStorage, consts.ImExternalServiceModeration:
+		return true
+	default:
+		return false
+	}
+}
+
+func externalConfigJson(value string) *gjson.Json {
+	if value == "" {
+		return gjson.New("{}")
+	}
+	return gjson.New(value)
+}

server/internal/logic/sys/im_feedback_config.go

@@ -0,0 +1,112 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+const imFeedbackConfigTable = "im_feedback_config"
+
+type sSysImFeedbackConfig struct{}
+
+func NewSysImFeedbackConfig() *sSysImFeedbackConfig { return &sSysImFeedbackConfig{} }
+
+func init() {
+	service.RegisterSysImFeedbackConfig(NewSysImFeedbackConfig())
+}
+
+func (s *sSysImFeedbackConfig) Get(ctx context.Context, in *sysin.ImFeedbackConfigGetInp) (res *sysin.ImFeedbackConfigModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.ensureDefault(ctx, db); err != nil {
+		return nil, err
+	}
+	if err = s.model(ctx, db).OrderAsc("id").Limit(1).Scan(&res); err != nil {
+		return nil, gerror.Wrap(err, "获取IM意见反馈配置失败，请稍后重试！")
+	}
+	if res != nil {
+		res.TenantId = tenant.Id
+		res.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImFeedbackConfig) Update(ctx context.Context, in *sysin.ImFeedbackConfigUpdateInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	if err = s.ensureDefault(ctx, db); err != nil {
+		return err
+	}
+	categories := `["bug","suggestion","complaint","other"]`
+	if in.Categories != nil && in.Categories.String() != "" && in.Categories.String() != "null" {
+		categories = in.Categories.String()
+	}
+	attachmentPolicy := `{"max_files":5,"purpose":"feedback"}`
+	if in.AttachmentPolicy != nil && in.AttachmentPolicy.String() != "" && in.AttachmentPolicy.String() != "null" {
+		attachmentPolicy = in.AttachmentPolicy.String()
+	}
+	if _, err = db.Model(imFeedbackConfigTable).Safe().Ctx(ctx).Where("id", 1).Data(g.Map{
+		"categories":         categories,
+		"max_length":         in.MaxLength,
+		"attachment_policy":  attachmentPolicy,
+		"allow_contact":      in.AllowContact,
+		"diagnostics_notice": in.DiagnosticsNotice,
+		"updated_at":         gtime.Now(),
+	}).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM意见反馈配置失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_feedback_config_update", "im_feedback_config", 1, "success", g.Map{"allow_contact": in.AllowContact})
+	return nil
+}
+
+func (s *sSysImFeedbackConfig) model(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model(imFeedbackConfigTable).Safe().Ctx(ctx).Fields(
+		"id",
+		"CAST(categories AS CHAR) categories",
+		"max_length",
+		"CAST(attachment_policy AS CHAR) attachment_policy",
+		"allow_contact",
+		"diagnostics_notice",
+		"updated_at",
+	)
+}
+
+func (s *sSysImFeedbackConfig) ensureDefault(ctx context.Context, db gdb.DB) (err error) {
+	var count int
+	if count, err = db.Model(imFeedbackConfigTable).Safe().Ctx(ctx).Where("id", 1).Count(); err != nil {
+		return gerror.Wrap(err, "检查IM意见反馈默认配置失败，请稍后重试！")
+	}
+	if count > 0 {
+		return nil
+	}
+	_, err = db.Model(imFeedbackConfigTable).Safe().Ctx(ctx).Data(g.Map{
+		"id":                 1,
+		"categories":         `["bug","suggestion","complaint","other"]`,
+		"max_length":         1000,
+		"attachment_policy":  `{"max_files":5,"purpose":"feedback"}`,
+		"allow_contact":      1,
+		"diagnostics_notice": "仅在你同意时上传脱敏诊断信息。",
+		"created_at":         gtime.Now(),
+		"updated_at":         gtime.Now(),
+	}).Insert()
+	if err != nil {
+		return gerror.Wrap(err, "初始化IM意见反馈默认配置失败，请稍后重试！")
+	}
+	return nil
+}

server/internal/logic/sys/im_file.go

@@ -0,0 +1,244 @@
+// Package sys
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package sys
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type sSysImFile struct{}
+
+func NewSysImFile() *sSysImFile {
+	return &sSysImFile{}
+}
+
+func init() {
+	service.RegisterSysImFile(NewSysImFile())
+}
+
+// List 获取IM文件列表
+func (s *sSysImFile) List(ctx context.Context, in *sysin.ImFileListInp) (list []*sysin.ImFileListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := s.fileModel(ctx, db)
+	mod = s.applyWhere(mod, in)
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("fu.updatedat").OrderDesc("fu.id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM文件列表失败，请稍后重试！")
+		return
+	}
+	for _, item := range list {
+		item.TenantId = tenant.Id
+		item.TenantName = tenant.Name
+		if !contexts.IsCompanyDept(ctx) {
+			item.Location = ""
+		}
+	}
+	return
+}
+
+// View 获取IM文件详情
+func (s *sSysImFile) View(ctx context.Context, in *sysin.ImFileViewInp) (res *sysin.ImFileViewModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.fileModel(ctx, db).Where("fu.id", in.Id).Scan(&res); err != nil {
+		return nil, gerror.Wrap(err, "获取IM文件详情失败，请稍后重试！")
+	}
+	if res == nil {
+		return nil, nil
+	}
+	res.TenantId = tenant.Id
+	res.TenantName = tenant.Name
+	if !contexts.IsCompanyDept(ctx) {
+		res.Location = ""
+	}
+	if err = db.Model("im_filemsglinks").Safe().Ctx(ctx).
+		Fields("id", "createdat created_at", "fileid file_id", "COALESCE(msgid,0) msg_id", "COALESCE(topic,'') topic", "COALESCE(userid,0) user_id").
+		Where("fileid", in.Id).
+		OrderDesc("id").
+		Limit(50).
+		Scan(&res.Links); err != nil {
+		return nil, gerror.Wrap(err, "获取IM文件引用失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_file_view", "im_file", in.Id, "success", g.Map{
+		"file_id": in.Id,
+	})
+	return
+}
+
+// Quarantine 隔离IM文件
+func (s *sSysImFile) Quarantine(ctx context.Context, in *sysin.ImFileActionInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.updateStatus(ctx, in, consts.ImFileStatusQuarantined, "im_file_quarantine")
+}
+
+// Delete 删除IM文件
+func (s *sSysImFile) Delete(ctx context.Context, in *sysin.ImFileActionInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.updateStatus(ctx, in, consts.ImFileStatusDeleted, "im_file_delete")
+}
+
+// CleanupOrphan 清理IM孤儿文件
+func (s *sSysImFile) CleanupOrphan(ctx context.Context, in *sysin.ImFileCleanupOrphanInp) (res *sysin.ImFileCleanupOrphanModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	cutoff := gtime.Now().AddDate(0, 0, -in.Days)
+	rows, err := db.Model("im_fileuploads fu").Safe().Ctx(ctx).
+		LeftJoin("im_filemsglinks fml", "fml.fileid=fu.id").
+		Fields("fu.id", "fu.location").
+		Where("fml.id IS NULL").
+		WhereLT("fu.updatedat", cutoff).
+		WhereNotIn("fu.status", []int{consts.ImFileStatusDeleted, consts.ImFileStatusQuarantined}).
+		Group("fu.id").
+		OrderAsc("fu.updatedat").
+		Limit(in.Limit).
+		All()
+	if err != nil {
+		return nil, gerror.Wrap(err, "扫描IM孤儿文件失败，请稍后重试！")
+	}
+	res = &sysin.ImFileCleanupOrphanModel{Locations: []string{}}
+	if len(rows) == 0 {
+		return res, nil
+	}
+	ids := make([]int64, 0, len(rows))
+	for _, row := range rows {
+		ids = append(ids, row["id"].Int64())
+		if location := row["location"].String(); location != "" {
+			res.Locations = append(res.Locations, location)
+		}
+	}
+	if _, err = db.Model("im_fileuploads").Safe().Ctx(ctx).
+		WhereIn("id", ids).
+		Data(g.Map{"status": consts.ImFileStatusDeleted, "updatedat": gtime.Now()}).
+		Update(); err != nil {
+		return nil, gerror.Wrap(err, "标记IM孤儿文件失败，请稍后重试！")
+	}
+	res.Count = len(ids)
+	if !contexts.IsCompanyDept(ctx) {
+		res.Locations = []string{}
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_file_cleanup_orphan", "im_file", 0, "success", g.Map{
+		"days": in.Days, "limit": in.Limit, "count": res.Count,
+	})
+	return
+}
+
+func (s *sSysImFile) fileModel(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model("im_fileuploads fu").Safe().Ctx(ctx).
+		LeftJoin("im_filemsglinks fml", "fml.fileid=fu.id").
+		Fields(
+			"fu.id",
+			"fu.createdat created_at",
+			"fu.updatedat updated_at",
+			"COALESCE(fu.userid,0) user_id",
+			"fu.status",
+			"fu.mimetype mime_type",
+			"fu.size",
+			"COALESCE(fu.etag,'') etag",
+			"fu.location",
+			"COUNT(fml.id) link_count",
+			"COALESCE(MIN(fml.topic),'') first_topic",
+			"COALESCE(MIN(fml.msgid),0) first_msg_id",
+			"MIN(fml.createdat) first_link_at",
+			`CASE
+				WHEN COUNT(fml.id)=0 THEN 'orphan'
+				WHEN SUM(CASE WHEN fml.topic LIKE 'grp%' THEN 1 ELSE 0 END)>0 THEN 'chat'
+				ELSE 'chat'
+			END purpose`,
+		).
+		Group("fu.id")
+}
+
+func (s *sSysImFile) applyWhere(mod *gdb.Model, in *sysin.ImFileListInp) *gdb.Model {
+	if in.FileId > 0 {
+		mod = mod.Where("fu.id", in.FileId)
+	}
+	if in.UserId > 0 {
+		mod = mod.Where("fu.userid", in.UserId)
+	}
+	if in.Status != nil {
+		mod = mod.Where("fu.status", *in.Status)
+	}
+	if in.MimeType != "" {
+		mod = mod.WhereLike("fu.mimetype", "%"+in.MimeType+"%")
+	}
+	if in.Topic != "" {
+		mod = mod.WhereLike("fml.topic", "%"+in.Topic+"%")
+	}
+	if in.Purpose == consts.ImFilePurposeOrphan {
+		mod = mod.Having("link_count = 0")
+	}
+	if in.Purpose != "" && in.Purpose != consts.ImFilePurposeOrphan && in.Purpose != consts.ImFilePurposeUnknown {
+		mod = mod.Having("purpose", in.Purpose)
+	}
+	if len(in.CreatedAt) == 2 {
+		mod = mod.WhereBetween("fu.createdat", in.CreatedAt[0], in.CreatedAt[1])
+	}
+	if len(in.UpdatedAt) == 2 {
+		mod = mod.WhereBetween("fu.updatedat", in.UpdatedAt[0], in.UpdatedAt[1])
+	}
+	return mod
+}
+
+func (s *sSysImFile) updateStatus(ctx context.Context, in *sysin.ImFileActionInp, status int, action string) (err error) {
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	current, err := db.Model("im_fileuploads").Safe().Ctx(ctx).Where("id", in.Id).One()
+	if err != nil {
+		return gerror.Wrap(err, "获取IM文件失败，请稍后重试！")
+	}
+	if current == nil {
+		return gerror.New("IM文件不存在")
+	}
+	if current["status"].Int() == consts.ImFileStatusDeleted && status == consts.ImFileStatusDeleted {
+		return gerror.New("IM文件已删除")
+	}
+	if _, err = db.Model("im_fileuploads").Safe().Ctx(ctx).
+		Where("id", in.Id).
+		Data(g.Map{"status": status, "updatedat": gtime.Now()}).
+		Update(); err != nil {
+		return gerror.Wrap(err, "更新IM文件状态失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, action, "im_file", in.Id, "success", g.Map{
+		"file_id": in.Id, "before_status": current["status"].Int(), "after_status": status, "reason": in.Reason,
+	})
+	return nil
+}
+
+func (s *sSysImFile) tenantDB(ctx context.Context, selectedTenantId int64) (db gdb.DB, tenant *entity.ImTenant, err error) {
+	return resolveImTenantDB(ctx, selectedTenantId)
+}

server/internal/logic/sys/im_file_policy.go

@@ -0,0 +1,169 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/dao"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type sSysImFilePolicy struct{}
+
+func NewSysImFilePolicy() *sSysImFilePolicy {
+	return &sSysImFilePolicy{}
+}
+
+func init() {
+	service.RegisterSysImFilePolicy(NewSysImFilePolicy())
+}
+
+func (s *sSysImFilePolicy) List(ctx context.Context, in *sysin.ImFilePolicyListInp) (list []*sysin.ImFilePolicyListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return
+	}
+	mod := s.model(ctx).Where("tenant_id", tenant.Id)
+	if in.Purpose != "" {
+		mod = mod.Where("purpose", in.Purpose)
+	}
+	if in.AutoCleanup != nil {
+		mod = mod.Where("auto_cleanup", *in.AutoCleanup)
+	}
+	if in.ScanEnabled != nil {
+		mod = mod.Where("scan_enabled", *in.ScanEnabled)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderAsc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM文件策略失败，请稍后重试！")
+		return
+	}
+	for _, item := range list {
+		item.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImFilePolicy) Update(ctx context.Context, in *sysin.ImFilePolicyUpdateInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := s.resolveTenant(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	if err = s.ensureRows(ctx, tenant.Id); err != nil {
+		return err
+	}
+	allowedMimes := "[]"
+	if in.AllowedMimes != nil && in.AllowedMimes.String() != "" && in.AllowedMimes.String() != "null" {
+		allowedMimes = in.AllowedMimes.String()
+	}
+	if _, err = imtenant.RegistryDB().Model("im_file_policy").Safe().Ctx(ctx).
+		Where("tenant_id", tenant.Id).
+		Where("purpose", in.Purpose).
+		Data(g.Map{
+			"max_size":       in.MaxSize,
+			"retention_days": in.RetentionDays,
+			"allowed_mimes":  allowedMimes,
+			"auto_cleanup":   in.AutoCleanup,
+			"scan_enabled":   in.ScanEnabled,
+			"remark":         in.Remark,
+			"updated_at":     gtime.Now(),
+			"updated_by":     contexts.GetUserId(ctx),
+		}).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM文件策略失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_file_policy_update", "im_file_policy", 0, "success", g.Map{
+		"purpose": in.Purpose, "auto_cleanup": in.AutoCleanup, "scan_enabled": in.ScanEnabled,
+	})
+	return nil
+}
+
+func (s *sSysImFilePolicy) model(ctx context.Context) *gdb.Model {
+	return imtenant.RegistryDB().Model("im_file_policy").Safe().Ctx(ctx).Fields(
+		"id",
+		"tenant_id",
+		"purpose",
+		"max_size",
+		"retention_days",
+		"CAST(allowed_mimes AS CHAR) allowed_mimes",
+		"auto_cleanup",
+		"scan_enabled",
+		"remark",
+		"updated_at",
+	)
+}
+
+func (s *sSysImFilePolicy) resolveTenant(ctx context.Context, selectedTenantId int64) (tenant *entity.ImTenant, err error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).WherePri(scope.TenantId).Scan(&tenant); err != nil {
+		return nil, gerror.Wrap(err, "获取IM租户失败")
+	}
+	if tenant == nil {
+		return nil, gerror.New("IM租户不存在")
+	}
+	return tenant, nil
+}
+
+func (s *sSysImFilePolicy) ensureRows(ctx context.Context, tenantId int64) error {
+	for _, item := range defaultFilePolicies() {
+		count, err := imtenant.RegistryDB().Model("im_file_policy").Safe().Ctx(ctx).
+			Where("tenant_id", tenantId).
+			Where("purpose", item.Purpose).
+			Count()
+		if err != nil {
+			return gerror.Wrap(err, "检查IM文件策略失败")
+		}
+		if count > 0 {
+			continue
+		}
+		_, err = imtenant.RegistryDB().Exec(ctx, `INSERT INTO im_file_policy
+			(tenant_id,purpose,max_size,retention_days,allowed_mimes,auto_cleanup,scan_enabled,remark,created_by,updated_by)
+			VALUES(?,?,?,?,CAST(? AS JSON),?,?,?,?,?)`,
+			tenantId, item.Purpose, item.MaxSize, item.RetentionDays, item.AllowedMimes, item.AutoCleanup, item.ScanEnabled, item.Remark, contexts.GetUserId(ctx), contexts.GetUserId(ctx))
+		if err != nil {
+			return gerror.Wrap(err, "初始化IM文件策略失败")
+		}
+	}
+	return nil
+}
+
+type filePolicySeed struct {
+	Purpose       string
+	MaxSize       int64
+	RetentionDays int
+	AllowedMimes  string
+	AutoCleanup   int
+	ScanEnabled   int
+	Remark        string
+}
+
+func defaultFilePolicies() []*filePolicySeed {
+	const mb = 1024 * 1024
+	return []*filePolicySeed{
+		{Purpose: consts.ImFilePurposeChat, MaxSize: 100 * mb, RetentionDays: 365, AllowedMimes: "[]", AutoCleanup: 0, ScanEnabled: 0, Remark: "聊天附件默认策略"},
+		{Purpose: consts.ImFilePurposeUserAvatar, MaxSize: 5 * mb, RetentionDays: 0, AllowedMimes: `["image/jpeg","image/png","image/webp"]`, AutoCleanup: 0, ScanEnabled: 0, Remark: "用户头像长期保留"},
+		{Purpose: consts.ImFilePurposeGroupAvatar, MaxSize: 5 * mb, RetentionDays: 0, AllowedMimes: `["image/jpeg","image/png","image/webp"]`, AutoCleanup: 0, ScanEnabled: 0, Remark: "群头像长期保留"},
+		{Purpose: consts.ImFilePurposeGroupFile, MaxSize: 200 * mb, RetentionDays: 365, AllowedMimes: "[]", AutoCleanup: 0, ScanEnabled: 0, Remark: "群文件默认策略"},
+		{Purpose: consts.ImFilePurposeAbuseEvidence, MaxSize: 50 * mb, RetentionDays: 730, AllowedMimes: "[]", AutoCleanup: 0, ScanEnabled: 0, Remark: "举报证据默认策略"},
+		{Purpose: consts.ImFilePurposeFeedback, MaxSize: 50 * mb, RetentionDays: 365, AllowedMimes: "[]", AutoCleanup: 0, ScanEnabled: 0, Remark: "反馈附件默认策略"},
+	}
+}

server/internal/logic/sys/im_group.go

@@ -7,6 +7,8 @@ package sys
 
 import (
 	"context"
+	"encoding/json"
+	"fmt"
 	"hotgo/internal/consts"
 	"hotgo/internal/library/contexts"
 	"hotgo/internal/library/imkafka"
@@ -14,14 +16,23 @@ import (
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
 	"strconv"
-	"time"
 
 	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gctx"
+	"github.com/gogf/gf/v2/os/gtime"
+	"github.com/gogf/gf/v2/util/guid"
 )
 
 type sSysImGroup struct{}
 
+const (
+	imGroupModeMember = "JRWPS"
+	imGroupModeAdmin  = "JRWPASO"
+	imGroupModeOwner  = "JRWPASDO"
+)
+
 func NewSysImGroup() *sSysImGroup {
 	return &sSysImGroup{}
 }
@@ -36,7 +47,7 @@ func (s *sSysImGroup) List(ctx context.Context, in *sysin.ImGroupListInp) (list
 		return
 	}
 
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return
 	}
@@ -59,10 +70,14 @@ func (s *sSysImGroup) List(ctx context.Context, in *sysin.ImGroupListInp) (list
 func (s *sSysImGroup) groupModel(ctx context.Context, db gdb.DB) *gdb.Model {
 	return db.Model("im_topics t").Safe().Ctx(ctx).
 		LeftJoin("im_group_settings gs", "gs.topic = t.name").
+		LeftJoin("im_users owner", "owner.id = COALESCE(gs.owner_user_id, t.owner)").
+		LeftJoin("im_user_profiles owner_profile", "owner_profile.user_id = COALESCE(gs.owner_user_id, t.owner)").
 		Fields(
 			"t.name topic",
 			"t.state",
 			"COALESCE(gs.owner_user_id, t.owner) owner_id",
+			"COALESCE(NULLIF(owner_profile.nickname, ''), owner.username, '') owner_nickname",
+			"COALESCE(owner.username, '') owner_username",
 			"t.seqid seq_id",
 			"t.delid del_id",
 			"t.subcnt sub_cnt",
@@ -73,7 +88,7 @@ func (s *sSysImGroup) groupModel(ctx context.Context, db gdb.DB) *gdb.Model {
 			"t.trusted trusted_json",
 			"t.tags tags_json",
 			"t.aux aux_json",
-			"COALESCE(gs.name, '') group_name",
+			"COALESCE(NULLIF(gs.name, ''), NULLIF(JSON_UNQUOTE(JSON_EXTRACT(t.public, '$.fn')), ''), NULLIF(JSON_UNQUOTE(JSON_EXTRACT(t.public, '$.name')), ''), t.name) group_name",
 			"COALESCE(gs.avatar_file_id, '') avatar_file_id",
 			"COALESCE(gs.description, '') description",
 			"COALESCE(gs.group_status, '') group_status",
@@ -119,17 +134,21 @@ func (s *sSysImGroup) View(ctx context.Context, in *sysin.ImGroupViewInp) (res *
 		return
 	}
 
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return
 	}
 
 	err = db.Model("im_topics t").Safe().Ctx(ctx).
 		LeftJoin("im_group_settings gs", "gs.topic = t.name").
+		LeftJoin("im_users owner", "owner.id = COALESCE(gs.owner_user_id, t.owner)").
+		LeftJoin("im_user_profiles owner_profile", "owner_profile.user_id = COALESCE(gs.owner_user_id, t.owner)").
 		Fields(
 			"t.name topic",
 			"t.state",
 			"COALESCE(gs.owner_user_id, t.owner) owner_id",
+			"COALESCE(NULLIF(owner_profile.nickname, ''), owner.username, '') owner_nickname",
+			"COALESCE(owner.username, '') owner_username",
 			"t.seqid seq_id",
 			"t.delid del_id",
 			"t.subcnt sub_cnt",
@@ -142,7 +161,7 @@ func (s *sSysImGroup) View(ctx context.Context, in *sysin.ImGroupViewInp) (res *
 			"t.aux aux_json",
 			"t.access access_json",
 			"t.usebt use_bt",
-			"COALESCE(gs.name, '') group_name",
+			"COALESCE(NULLIF(gs.name, ''), NULLIF(JSON_UNQUOTE(JSON_EXTRACT(t.public, '$.fn')), ''), NULLIF(JSON_UNQUOTE(JSON_EXTRACT(t.public, '$.name')), ''), t.name) group_name",
 			"COALESCE(gs.avatar_file_id, '') avatar_file_id",
 			"COALESCE(gs.description, '') description",
 			"COALESCE(gs.group_status, '') group_status",
@@ -177,7 +196,7 @@ func (s *sSysImGroup) MemberList(ctx context.Context, in *sysin.ImGroupMemberLis
 		return
 	}
 
-	db, _, err := imtenant.DB(ctx, in.TenantId)
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return
 	}
@@ -289,7 +308,7 @@ func (s *sSysImGroup) Governance(ctx context.Context, in *sysin.ImGroupTopicInp)
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return nil, err
 	}
@@ -329,303 +348,241 @@ func (s *sSysImGroup) Governance(ctx context.Context, in *sysin.ImGroupTopicInp)
 	return
 }
 
-// JoinRequestList 获取IM入群申请列表
-func (s *sSysImGroup) JoinRequestList(ctx context.Context, in *sysin.ImGroupJoinRequestListInp) (list []*sysin.ImGroupJoinRequestListModel, totalCount int, err error) {
-	if err = in.Filter(ctx); err != nil {
-		return
-	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
-	if err != nil {
-		return
-	}
-	mod := db.Model("im_group_join_requests").Safe().Ctx(ctx).Where("topic", in.Topic)
-	if in.Status != "" {
-		mod = mod.Where("status", in.Status)
-	}
-	if in.ApplicantUserId > 0 {
-		mod = mod.Where("applicant_user_id", in.ApplicantUserId)
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
-		err = gerror.Wrap(err, "获取IM入群申请列表失败，请稍后重试！")
-	}
-	return
-}
-
-// InvitationList 获取IM群邀请列表
-func (s *sSysImGroup) InvitationList(ctx context.Context, in *sysin.ImGroupInvitationListInp) (list []*sysin.ImGroupInvitationListModel, totalCount int, err error) {
-	if err = in.Filter(ctx); err != nil {
-		return
-	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
-	if err != nil {
-		return
-	}
-	mod := db.Model("im_group_invitations").Safe().Ctx(ctx).Where("topic", in.Topic)
-	if in.Status != "" {
-		mod = mod.Where("status", in.Status)
-	}
-	if in.TargetUserId > 0 {
-		mod = mod.Where("target_user_id", in.TargetUserId)
-	}
-	if in.InviterUserId > 0 {
-		mod = mod.Where("inviter_user_id", in.InviterUserId)
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
-		err = gerror.Wrap(err, "获取IM群邀请列表失败，请稍后重试！")
-	}
-	return
-}
-
-// AnnouncementList 获取IM群公告列表
-func (s *sSysImGroup) AnnouncementList(ctx context.Context, in *sysin.ImGroupAnnouncementListInp) (list []*sysin.ImGroupAnnouncementListModel, totalCount int, err error) {
-	if err = in.Filter(ctx); err != nil {
-		return
-	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
-	if err != nil {
-		return
-	}
-	mod := db.Model("im_group_announcements").Safe().Ctx(ctx).Where("topic", in.Topic)
-	if in.Status != "" {
-		mod = mod.Where("status", in.Status)
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("published_at").OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
-		err = gerror.Wrap(err, "获取IM群公告列表失败，请稍后重试！")
-	}
-	return
-}
-
-// MuteList 获取IM群禁言列表
-func (s *sSysImGroup) MuteList(ctx context.Context, in *sysin.ImGroupMuteListInp) (list []*sysin.ImGroupMuteListModel, totalCount int, err error) {
-	if err = in.Filter(ctx); err != nil {
-		return
-	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
-	if err != nil {
-		return
-	}
-	mod := db.Model("im_group_mutes").Safe().Ctx(ctx).Where("topic", in.Topic)
-	if in.Status != "" {
-		mod = mod.Where("status", in.Status)
-	}
-	if in.UserId > 0 {
-		mod = mod.Where("user_id", in.UserId)
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("muted_at").OrderDesc("user_id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
-		err = gerror.Wrap(err, "获取IM群禁言列表失败，请稍后重试！")
-	}
-	return
-}
-
-// AdminLogList 获取IM群管理日志列表
-func (s *sSysImGroup) AdminLogList(ctx context.Context, in *sysin.ImGroupAdminLogListInp) (list []*sysin.ImGroupAdminLogListModel, totalCount int, err error) {
-	if err = in.Filter(ctx); err != nil {
-		return
-	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
-	if err != nil {
-		return
-	}
-	mod := db.Model("im_group_admin_logs").Safe().Ctx(ctx).
-		Fields(
-			"id",
-			"log_id",
-			"topic",
-			"operator_id",
-			"target_user_id",
-			"action",
-			"object_type",
-			"object_id",
-			"CAST(before_data AS CHAR) before_data",
-			"CAST(after_data AS CHAR) after_data",
-			"request_id",
-			"idempotency_key",
-			"created_at",
-		).
-		Where("topic", in.Topic)
-	if in.Action != "" {
-		mod = mod.WhereLike("action", "%"+in.Action+"%")
-	}
-	if in.OperatorId > 0 {
-		mod = mod.Where("operator_id", in.OperatorId)
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
-		err = gerror.Wrap(err, "获取IM群管理日志列表失败，请稍后重试！")
-	}
-	return
-}
-
-// ProfileUpdate 通过Kafka修改IM群资料
-func (s *sSysImGroup) ProfileUpdate(ctx context.Context, in *sysin.ImGroupProfileUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
-		return nil, err
-	}
-	if in.ActorUserId <= 0 {
-		return nil, gerror.New("操作IM用户ID不能为空")
-	}
-	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
-		"topic":         in.Topic,
-		"profile":       map[string]any{},
-		"version":       in.Version,
-	}
-	profile := payload["profile"].(map[string]any)
-	if in.Name != "" {
-		profile["name"] = in.Name
-	}
-	if in.AvatarFileId != "" {
-		profile["avatar_file_id"] = in.AvatarFileId
-	}
-	if in.Description != "" {
-		profile["description"] = in.Description
-	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupProfileUpdate, in.Topic, int64(in.Version), payload)
-}
-
-// GovernanceUpdate 通过Kafka修改IM群治理配置
+// GovernanceUpdate 更新IM群治理配置
 func (s *sSysImGroup) GovernanceUpdate(ctx context.Context, in *sysin.ImGroupGovernanceUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 {
-		return nil, gerror.New("操作IM用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"governance":    map[string]any{},
-		"version":       in.Version,
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"governance": map[string]any{
+			"join_approval":       in.JoinApproval == 1,
+			"mute_all":            in.MuteAll == 1,
+			"member_upload_files": in.MemberUploadFiles == 1,
+			"member_private_chat": in.MemberPrivateChat == 1,
+			"member_invite":       in.MemberInvite == 1,
+			"max_member_count":    in.MaxMemberCount,
+			"max_admin_count":     in.MaxAdminCount,
+		},
 	}
-	governance := payload["governance"].(map[string]any)
-	if in.JoinApproval != nil {
-		governance["join_approval"] = *in.JoinApproval
-	}
-	if in.MuteAll != nil {
-		governance["mute_all"] = *in.MuteAll
-	}
-	if in.MemberUploadFiles != nil {
-		governance["member_upload_files"] = *in.MemberUploadFiles
-	}
-	if in.MemberPrivateChat != nil {
-		governance["member_private_chat"] = *in.MemberPrivateChat
-	}
-	if in.MemberInvite != nil {
-		governance["member_invite"] = *in.MemberInvite
-	}
-	if len(governance) == 0 {
-		return nil, gerror.New("请至少选择一个治理配置")
-	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupGovernUpdate, in.Topic, int64(in.Version), payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupGovernUpdate, payload, 0)
 }
 
-// AdminSet 通过Kafka设置IM群管理员
-func (s *sSysImGroup) AdminSet(ctx context.Context, in *sysin.ImGroupAdminSetInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+func (s *sSysImGroup) ProfileUpdate(ctx context.Context, in *sysin.ImGroupProfileUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || len(in.UserIds) == 0 {
-		return nil, gerror.New("操作IM用户ID和用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"user_ids":      imUserIds(in.UserIds),
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"profile": map[string]any{
+			"name":           in.Name,
+			"avatar_file_id": in.AvatarFileId,
+			"description":    in.Description,
+		},
 	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupAdminSet, in.Topic, 0, payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupProfileUpdate, payload, in.Version)
 }
 
-// AdminRemove 通过Kafka删除IM群管理员
-func (s *sSysImGroup) AdminRemove(ctx context.Context, in *sysin.ImGroupAdminRemoveInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+// Dissolve 解散IM群
+func (s *sSysImGroup) Dissolve(ctx context.Context, in *sysin.ImGroupDissolveInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || in.UserId <= 0 {
-		return nil, gerror.New("操作IM用户ID和用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"user_id":       imUserId(in.UserId),
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"reason":        in.Reason,
 	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupAdminRemove, in.Topic, 0, payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupDissolve, payload, 0)
 }
 
-// MemberMute 通过Kafka禁言IM群成员
-func (s *sSysImGroup) MemberMute(ctx context.Context, in *sysin.ImGroupMemberMuteInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+// Mute 禁言IM群成员
+func (s *sSysImGroup) Mute(ctx context.Context, in *sysin.ImGroupMuteInp) (res *sysin.ImGroupCommandModel, err error) {
+	return s.MemberMute(ctx, in)
+}
+
+func (s *sSysImGroup) MemberMute(ctx context.Context, in *sysin.ImGroupMuteInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || in.UserId <= 0 {
-		return nil, gerror.New("操作IM用户ID和用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"user_id":       imUserId(in.UserId),
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"user_id":       strconv.FormatInt(in.UserId, 10),
 		"reason":        in.Reason,
 	}
 	if in.ExpiresAt != nil {
-		payload["expires_at"] = in.ExpiresAt.Time.UTC().Format(time.RFC3339Nano)
+		payload["expires_at"] = in.ExpiresAt.Time.Format("2006-01-02T15:04:05.000Z07:00")
 	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupMemberMute, in.Topic, 0, payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupMemberMute, payload, 0)
 }
 
-// MemberUnmute 通过Kafka解除IM群成员禁言
-func (s *sSysImGroup) MemberUnmute(ctx context.Context, in *sysin.ImGroupMemberUnmuteInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+// Unmute 解除IM群成员禁言
+func (s *sSysImGroup) Unmute(ctx context.Context, in *sysin.ImGroupUnmuteInp) (res *sysin.ImGroupCommandModel, err error) {
+	return s.MemberUnmute(ctx, in)
+}
+
+func (s *sSysImGroup) MemberUnmute(ctx context.Context, in *sysin.ImGroupUnmuteInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || in.UserId <= 0 {
-		return nil, gerror.New("操作IM用户ID和用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"user_id":       imUserId(in.UserId),
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"user_id":       strconv.FormatInt(in.UserId, 10),
 	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupMemberUnmute, in.Topic, 0, payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupMemberUnmute, payload, 0)
 }
 
-// MemberRemove 通过Kafka移出IM群成员
 func (s *sSysImGroup) MemberRemove(ctx context.Context, in *sysin.ImGroupMemberRemoveInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || in.UserId <= 0 {
-		return nil, gerror.New("操作IM用户ID和用户ID不能为空")
-	}
 	payload := map[string]any{
-		"actor_user_id": imUserId(in.ActorUserId),
 		"topic":         in.Topic,
-		"user_id":       imUserId(in.UserId),
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"user_id":       strconv.FormatInt(in.UserId, 10),
+		"reason":        in.Reason,
 	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupMemberRemove, in.Topic, 0, payload)
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupMemberRemove, payload, 0)
 }
 
-// OwnerTransfer 通过Kafka转让IM群主
-func (s *sSysImGroup) OwnerTransfer(ctx context.Context, in *sysin.ImGroupOwnerTransferInp) (res *sysin.ImGroupCommandModel, err error) {
-	if err = in.ImGroupTopicInp.Filter(ctx); err != nil {
+// JoinRequestApprove 通过IM入群申请
+func (s *sSysImGroup) JoinRequestApprove(ctx context.Context, in *sysin.ImGroupJoinRequestResolveInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.resolveJoinRequest(ctx, in, consts.ImGroupRequestStatusAccepted)
+}
+
+// JoinRequestReject 拒绝IM入群申请
+func (s *sSysImGroup) JoinRequestReject(ctx context.Context, in *sysin.ImGroupJoinRequestResolveInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.resolveJoinRequest(ctx, in, consts.ImGroupRequestStatusRejected)
+}
+
+func (s *sSysImGroup) resolveJoinRequest(ctx context.Context, in *sysin.ImGroupJoinRequestResolveInp, status string) (err error) {
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	actor := contexts.GetUserId(ctx)
+	requestId := gctx.CtxId(ctx)
+	if requestId == "" {
+		requestId = guid.S()
+	}
+	now := gtime.Now()
+	return db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
+		if err := s.ensureActiveGroup(ctx, tx, in.Topic); err != nil {
+			return err
+		}
+		before, txErr := s.groupJoinRequestSnapshot(ctx, tx, in.Topic, in.RequestId)
+		if txErr != nil {
+			return txErr
+		}
+		if before == nil {
+			return gerror.New("入群申请不存在")
+		}
+		if before["status"].String() != consts.ImGroupRequestStatusPending {
+			return gerror.New("入群申请已处理")
+		}
+		applicantUserId := before["applicant_user_id"].Int64()
+		if status == consts.ImGroupRequestStatusAccepted {
+			if txErr = s.upsertGroupSubscription(ctx, tx, in.Topic, applicantUserId, imGroupModeMember, now); txErr != nil {
+				return txErr
+			}
+			if txErr = s.upsertGroupMember(ctx, tx, in.Topic, applicantUserId, consts.ImGroupRoleMember, "approval", actor, now); txErr != nil {
+				return txErr
+			}
+		}
+		result, txErr := tx.Exec(`UPDATE im_group_join_requests
+			SET status=?,reject_reason=?,handled_by=?,handled_at=?,updated_at=?,version=version+1
+			WHERE topic=? AND request_id=? AND status=?`,
+			status, in.RejectReason, actor, now, now, in.Topic, in.RequestId, consts.ImGroupRequestStatusPending)
+		if txErr != nil {
+			return txErr
+		}
+		if affected, _ := result.RowsAffected(); affected == 0 {
+			return gerror.New("入群申请已处理")
+		}
+		if txErr = s.recountGroupMembers(ctx, tx, in.Topic); txErr != nil {
+			return txErr
+		}
+		after, txErr := s.groupJoinRequestSnapshot(ctx, tx, in.Topic, in.RequestId)
+		if txErr != nil {
+			return txErr
+		}
+		action := "join_request_reject"
+		if status == consts.ImGroupRequestStatusAccepted {
+			action = "join_request_accept"
+		}
+		if txErr = s.insertGroupAdminLog(ctx, tx, in.Topic, actor, applicantUserId, action, "join_request", in.RequestId, recordMap(before), recordMap(after), requestId); txErr != nil {
+			return txErr
+		}
+		return s.insertGroupEvent(ctx, tx, in.Topic, actor, "group.join_request."+status, g.Map{
+			"topic": in.Topic, "request_id": in.RequestId, "applicant_user_id": applicantUserId, "status": status, "request_id_admin": requestId,
+		})
+	})
+}
+
+// RoleUpdate 更新IM群成员角色
+func (s *sSysImGroup) RoleUpdate(ctx context.Context, in *sysin.ImGroupRoleUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	if in.ActorUserId <= 0 || in.TargetUserId <= 0 {
-		return nil, gerror.New("操作IM用户ID和新群主ID不能为空")
+	switch in.Role {
+	case consts.ImGroupRoleAdmin:
+		return s.AdminSet(ctx, in)
+	case consts.ImGroupRoleMember:
+		return s.AdminRemove(ctx, in)
+	default:
+		return nil, gerror.New("只能设置管理员或普通成员")
 	}
-	payload := map[string]any{
-		"actor_user_id":  imUserId(in.ActorUserId),
-		"topic":          in.Topic,
-		"target_user_id": imUserId(in.TargetUserId),
-		"version":        in.Version,
-	}
-	return s.publishGroupCommand(ctx, in.TenantId, consts.ImAdminCommandGroupOwnerTransfer, in.Topic, int64(in.Version), payload)
 }
 
-func (s *sSysImGroup) publishGroupCommand(ctx context.Context, tenantId int64, eventType string, topic string, version int64, payload map[string]any) (*sysin.ImGroupCommandModel, error) {
-	_, tenant, err := imtenant.DB(ctx, tenantId)
+func (s *sSysImGroup) AdminSet(ctx context.Context, in *sysin.ImGroupRoleUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	payload := map[string]any{
+		"topic":         in.Topic,
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"user_ids":      []string{strconv.FormatInt(in.UserId, 10)},
+	}
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupAdminSet, payload, 0)
+}
+
+func (s *sSysImGroup) AdminRemove(ctx context.Context, in *sysin.ImGroupRoleUpdateInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	payload := map[string]any{
+		"topic":         in.Topic,
+		"actor_user_id": strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"user_id":       strconv.FormatInt(in.UserId, 10),
+	}
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupAdminRemove, payload, 0)
+}
+
+// OwnerTransfer 转让IM群主
+func (s *sSysImGroup) OwnerTransfer(ctx context.Context, in *sysin.ImGroupOwnerTransferInp) (res *sysin.ImGroupCommandModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	payload := map[string]any{
+		"topic":          in.Topic,
+		"actor_user_id":  strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		"target_user_id": strconv.FormatInt(in.UserId, 10),
+	}
+	return s.publishGroupCommand(ctx, in.TenantId, in.Topic, consts.ImAdminCommandGroupOwnerTransfer, payload, 0)
+}
+
+func (s *sSysImGroup) publishGroupCommand(ctx context.Context, tenantId int64, topic string, eventType string, payload map[string]any, version int64) (*sysin.ImGroupCommandModel, error) {
+	_, tenant, err := resolveImTenantDB(ctx, tenantId)
 	if err != nil {
 		return nil, err
 	}
@@ -663,16 +620,385 @@ func (s *sSysImGroup) publishGroupCommand(ctx context.Context, tenantId int64, e
 	}, nil
 }
 
-func imUserId(id int64) string {
-	return strconv.FormatInt(id, 10)
+func (s *sSysImGroup) groupGovernanceSnapshot(ctx context.Context, tx gdb.TX, topic string) (res gdb.Record, err error) {
+	return tx.Model("im_group_settings").Safe().Ctx(ctx).
+		Fields(
+			"topic", "owner_user_id", "name", "group_status", "join_approval", "mute_all",
+			"member_upload_files", "member_private_chat", "member_invite", "max_member_count",
+			"max_admin_count", "member_count", "version", "created_by", "dissolved_by",
+			"dissolved_at", "created_at", "updated_at",
+		).
+		Where("topic", topic).
+		One()
 }
 
-func imUserIds(ids []int64) []string {
-	list := make([]string, 0, len(ids))
-	for _, id := range ids {
-		if id > 0 {
-			list = append(list, imUserId(id))
+func (s *sSysImGroup) groupJoinRequestSnapshot(ctx context.Context, tx gdb.TX, topic string, requestId string) (res gdb.Record, err error) {
+	return tx.Model("im_group_join_requests").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("request_id", requestId).
+		One()
+}
+
+func (s *sSysImGroup) groupMemberSnapshot(ctx context.Context, tx gdb.TX, topic string, userId int64) (res gdb.Record, err error) {
+	return tx.Model("im_group_members").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("user_id", userId).
+		One()
+}
+
+func (s *sSysImGroup) groupFileSnapshot(ctx context.Context, tx gdb.TX, topic string, groupFileId string) (res gdb.Record, err error) {
+	return tx.Model("im_group_files").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("group_file_id", groupFileId).
+		One()
+}
+
+func (s *sSysImGroup) ensureActiveGroup(ctx context.Context, tx gdb.TX, topic string) error {
+	status, err := tx.Model("im_group_settings").Safe().Ctx(ctx).Where("topic", topic).Value("group_status")
+	if err != nil {
+		return err
+	}
+	if status.IsNil() {
+		return gerror.New("群治理配置不存在")
+	}
+	if status.String() == consts.ImGroupStatusDissolved {
+		return gerror.New("已解散群不能执行该操作")
+	}
+	return nil
+}
+
+func (s *sSysImGroup) groupMuteSnapshot(ctx context.Context, tx gdb.TX, topic string, userId int64) (res gdb.Record, err error) {
+	return tx.Model("im_group_mutes").Safe().Ctx(ctx).
+		Fields(
+			"topic", "user_id", "muted_by", "muted_at", "expires_at", "reason", "status",
+			"revoked_by", "revoked_at", "version", "created_at", "updated_at",
+		).
+		Where("topic", topic).
+		Where("user_id", userId).
+		One()
+}
+
+func (s *sSysImGroup) ensureActiveGroupMember(ctx context.Context, tx gdb.TX, topic string, userId int64) error {
+	count, err := tx.Model("im_group_members").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("user_id", userId).
+		Where("member_status", consts.ImGroupMemberStatusActive).
+		Count()
+	if err != nil {
+		return err
+	}
+	if count == 0 {
+		return gerror.New("成员不在群内或不是正常状态")
+	}
+	return nil
+}
+
+func (s *sSysImGroup) ensureAdminLimit(ctx context.Context, tx gdb.TX, topic string, userId int64) error {
+	currentRole, err := tx.Model("im_group_members").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("user_id", userId).
+		Where("member_status", consts.ImGroupMemberStatusActive).
+		Value("role")
+	if err != nil {
+		return err
+	}
+	if currentRole.String() == consts.ImGroupRoleAdmin {
+		return nil
+	}
+	maxAdminCount, err := tx.Model("im_group_settings").Safe().Ctx(ctx).Where("topic", topic).Value("max_admin_count")
+	if err != nil {
+		return err
+	}
+	if maxAdminCount.Int() <= 0 {
+		return nil
+	}
+	adminCount, err := tx.Model("im_group_members").Safe().Ctx(ctx).
+		Where("topic", topic).
+		Where("role", consts.ImGroupRoleAdmin).
+		Where("member_status", consts.ImGroupMemberStatusActive).
+		Count()
+	if err != nil {
+		return err
+	}
+	if adminCount >= maxAdminCount.Int() {
+		return gerror.New("群管理员数量已达上限")
+	}
+	return nil
+}
+
+func (s *sSysImGroup) upsertGroupSubscription(ctx context.Context, tx gdb.TX, topic string, userId int64, modeGiven string, now *gtime.Time) error {
+	_, err := tx.Exec(`INSERT INTO im_subscriptions(createdat,updatedat,deletedat,userid,topic,modewant,modegiven,private)
+		VALUES(?,?,NULL,?,?,?,?,CAST('{}' AS JSON))
+		ON DUPLICATE KEY UPDATE createdat=VALUES(createdat),updatedat=VALUES(updatedat),deletedat=NULL,
+		modewant=VALUES(modewant),modegiven=VALUES(modegiven),delid=0,recvseqid=0,readseqid=0`,
+		now, now, userId, topic, imGroupModeMember, modeGiven)
+	return err
+}
+
+func (s *sSysImGroup) upsertGroupMember(ctx context.Context, tx gdb.TX, topic string, userId int64, role string, joinSource string, joinedBy int64, now *gtime.Time) error {
+	_, err := tx.Exec(`INSERT INTO im_group_members(topic,user_id,role,member_status,join_source,joined_by,joined_at,version,created_at,updated_at)
+		VALUES(?,?,?,?,?,?,?,?,?,?)
+		ON DUPLICATE KEY UPDATE role=VALUES(role),member_status=VALUES(member_status),join_source=VALUES(join_source),
+		joined_by=VALUES(joined_by),joined_at=VALUES(joined_at),left_at=NULL,removed_by=NULL,version=version+1,updated_at=VALUES(updated_at)`,
+		topic, userId, role, consts.ImGroupMemberStatusActive, joinSource, joinedBy, now, 1, now, now)
+	return err
+}
+
+func (s *sSysImGroup) recountGroupMembers(ctx context.Context, tx gdb.TX, topic string) error {
+	if _, err := tx.Exec(`UPDATE im_group_settings
+		SET member_count=(SELECT COUNT(*) FROM im_group_members WHERE topic=? AND member_status=?),updated_at=CURRENT_TIMESTAMP(3)
+		WHERE topic=?`, topic, consts.ImGroupMemberStatusActive, topic); err != nil {
+		return err
+	}
+	_, err := tx.Exec(`UPDATE im_topics
+		SET subcnt=(SELECT COUNT(*) FROM im_subscriptions WHERE topic=? AND deletedat IS NULL),updatedat=CURRENT_TIMESTAMP(3)
+		WHERE name=?`, topic, topic)
+	return err
+}
+
+func recordMap(record gdb.Record) any {
+	if record == nil {
+		return nil
+	}
+	return record.Map()
+}
+
+func (s *sSysImGroup) insertGroupAdminLog(ctx context.Context, tx gdb.TX, topic string, operatorId int64, targetUserId int64, action string, objectType string, objectId string, beforeData any, afterData any, requestId string) error {
+	id, err := imtenant.NextSnowflakeID(ctx)
+	if err != nil {
+		return gerror.Wrap(err, "生成群管理日志ID失败")
+	}
+	logId := fmt.Sprintf("gal_%d", id)
+	beforeJson, _ := json.Marshal(beforeData)
+	afterJson, _ := json.Marshal(afterData)
+	_, err = tx.Exec(`INSERT INTO im_group_admin_logs
+		(log_id,topic,operator_id,target_user_id,action,object_type,object_id,before_data,after_data,request_id,idempotency_key)
+		VALUES(?,?,?,?,?,?,?,CAST(? AS JSON),CAST(? AS JSON),?,?)`,
+		logId, topic, operatorId, targetUserId, action, objectType, objectId, string(beforeJson), string(afterJson), requestId, requestId)
+	return err
+}
+
+func (s *sSysImGroup) insertGroupEvent(ctx context.Context, tx gdb.TX, topic string, actorId int64, eventType string, payload any) error {
+	id, err := imtenant.NextSnowflakeID(ctx)
+	if err != nil {
+		return gerror.Wrap(err, "生成群事件ID失败")
+	}
+	payloadJson, _ := json.Marshal(payload)
+	_, err = tx.Exec(`INSERT INTO im_group_events_outbox
+		(event_id,topic,actor_user_id,event_type,payload,status)
+		VALUES(?,?,?,?,CAST(? AS JSON),'pending')`,
+		fmt.Sprintf("gev_%d", id), topic, actorId, eventType, string(payloadJson))
+	return err
+}
+
+// JoinRequestList 获取IM入群申请列表
+func (s *sSysImGroup) JoinRequestList(ctx context.Context, in *sysin.ImGroupJoinRequestListInp) (list []*sysin.ImGroupJoinRequestListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_join_requests").Safe().Ctx(ctx).Where("topic", in.Topic)
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	if in.ApplicantUserId > 0 {
+		mod = mod.Where("applicant_user_id", in.ApplicantUserId)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM入群申请列表失败，请稍后重试！")
+	}
+	return
+}
+
+// FileList 获取IM群文件列表
+func (s *sSysImGroup) FileList(ctx context.Context, in *sysin.ImGroupFileListInp) (list []*sysin.ImGroupFileListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_files").Safe().Ctx(ctx).Where("topic", in.Topic)
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	if in.FileType != "" {
+		mod = mod.Where("file_type", in.FileType)
+	}
+	if in.FileName != "" {
+		mod = mod.WhereLike("file_name", "%"+in.FileName+"%")
+	}
+	if in.UploaderId > 0 {
+		mod = mod.Where("uploader_id", in.UploaderId)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM群文件列表失败，请稍后重试！")
+	}
+	return
+}
+
+// FileDelete 删除IM群文件
+func (s *sSysImGroup) FileDelete(ctx context.Context, in *sysin.ImGroupFileDeleteInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	actor := contexts.GetUserId(ctx)
+	requestId := gctx.CtxId(ctx)
+	if requestId == "" {
+		requestId = guid.S()
+	}
+	now := gtime.Now()
+	return db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
+		if err := s.ensureActiveGroup(ctx, tx, in.Topic); err != nil {
+			return err
+		}
+		before, txErr := s.groupFileSnapshot(ctx, tx, in.Topic, in.GroupFileId)
+		if txErr != nil {
+			return txErr
+		}
+		if before == nil {
+			return gerror.New("群文件不存在")
+		}
+		if before["status"].String() == consts.ImGroupFileStatusDeleted {
+			return gerror.New("群文件已删除")
+		}
+		result, txErr := tx.Exec(`UPDATE im_group_files
+			SET status=?,deleted_by=?,deleted_at=?,updated_at=?
+			WHERE topic=? AND group_file_id=? AND status<>?`,
+			consts.ImGroupFileStatusDeleted, actor, now, now, in.Topic, in.GroupFileId, consts.ImGroupFileStatusDeleted)
+		if txErr != nil {
+			return txErr
+		}
+		if affected, _ := result.RowsAffected(); affected == 0 {
+			return gerror.New("群文件已删除")
 		}
+		after, txErr := s.groupFileSnapshot(ctx, tx, in.Topic, in.GroupFileId)
+		if txErr != nil {
+			return txErr
+		}
+		if txErr = s.insertGroupAdminLog(ctx, tx, in.Topic, actor, before["uploader_id"].Int64(), "group_file_delete", "group_file", in.GroupFileId, recordMap(before), recordMap(after), requestId); txErr != nil {
+			return txErr
+		}
+		return s.insertGroupEvent(ctx, tx, in.Topic, actor, "group.file.deleted", g.Map{
+			"topic": in.Topic, "group_file_id": in.GroupFileId, "file_id": before["file_id"].String(), "request_id": requestId,
+		})
+	})
+}
+
+// InvitationList 获取IM群邀请列表
+func (s *sSysImGroup) InvitationList(ctx context.Context, in *sysin.ImGroupInvitationListInp) (list []*sysin.ImGroupInvitationListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_invitations").Safe().Ctx(ctx).Where("topic", in.Topic)
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	if in.TargetUserId > 0 {
+		mod = mod.Where("target_user_id", in.TargetUserId)
+	}
+	if in.InviterUserId > 0 {
+		mod = mod.Where("inviter_user_id", in.InviterUserId)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM群邀请列表失败，请稍后重试！")
+	}
+	return
+}
+
+// AnnouncementList 获取IM群公告列表
+func (s *sSysImGroup) AnnouncementList(ctx context.Context, in *sysin.ImGroupAnnouncementListInp) (list []*sysin.ImGroupAnnouncementListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_announcements").Safe().Ctx(ctx).Where("topic", in.Topic)
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("published_at").OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM群公告列表失败，请稍后重试！")
+	}
+	return
+}
+
+// MuteList 获取IM群禁言列表
+func (s *sSysImGroup) MuteList(ctx context.Context, in *sysin.ImGroupMuteListInp) (list []*sysin.ImGroupMuteListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_mutes").Safe().Ctx(ctx).Where("topic", in.Topic)
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	if in.UserId > 0 {
+		mod = mod.Where("user_id", in.UserId)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("muted_at").OrderDesc("user_id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM群禁言列表失败，请稍后重试！")
+	}
+	return
+}
+
+// AdminLogList 获取IM群管理日志列表
+func (s *sSysImGroup) AdminLogList(ctx context.Context, in *sysin.ImGroupAdminLogListInp) (list []*sysin.ImGroupAdminLogListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	mod := db.Model("im_group_admin_logs").Safe().Ctx(ctx).
+		Fields(
+			"id",
+			"log_id",
+			"topic",
+			"operator_id",
+			"target_user_id",
+			"action",
+			"object_type",
+			"object_id",
+			"CAST(before_data AS CHAR) before_data",
+			"CAST(after_data AS CHAR) after_data",
+			"request_id",
+			"idempotency_key",
+			"created_at",
+		).
+		Where("topic", in.Topic)
+	if in.Action != "" {
+		mod = mod.WhereLike("action", "%"+in.Action+"%")
+	}
+	if in.OperatorId > 0 {
+		mod = mod.Where("operator_id", in.OperatorId)
+	}
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM群管理日志列表失败，请稍后重试！")
 	}
-	return list
+	return
 }

server/internal/logic/sys/im_invite.go

@@ -2,247 +2,512 @@ package sys
 
 import (
 	"context"
+	cryptorand "crypto/rand"
+	"encoding/csv"
+	"errors"
 	"fmt"
-	"hotgo/internal/library/imadmin"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
-	"io"
+	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
+	mysqldriver "github.com/go-sql-driver/mysql"
+	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/errors/gerror"
 	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/net/ghttp"
 	"github.com/gogf/gf/v2/os/gtime"
 )
 
+const inviteGenerateRetries = 10
+
+var errInviteBatchNotFound = errors.New("invite batch not found")
+
 type sSysImInvite struct{}
 
-func NewSysImInvite() *sSysImInvite {
-	return &sSysImInvite{}
-}
+func NewSysImInvite() *sSysImInvite { return &sSysImInvite{} }
 
-func init() {
-	service.RegisterSysImInvite(NewSysImInvite())
-}
+func init() { service.RegisterSysImInvite(NewSysImInvite()) }
 
 type imInviteListRequest struct {
-	Page           int    `json:"page,omitempty"`
-	PerPage        int    `json:"per_page,omitempty"`
-	InviteCode     string `json:"invite_code,omitempty"`
-	Status         string `json:"status,omitempty"`
-	BatchID        int64  `json:"batch_id,omitempty"`
-	CreatedBy      int64  `json:"created_by,omitempty"`
-	CreatedAtStart string `json:"created_at_start,omitempty"`
-	CreatedAtEnd   string `json:"created_at_end,omitempty"`
-	ExpiresAtStart string `json:"expires_at_start,omitempty"`
-	ExpiresAtEnd   string `json:"expires_at_end,omitempty"`
-}
-
-type imInviteCreateRequest struct {
-	ExpiresAt      string `json:"expires_at"`
-	Remark         string `json:"remark,omitempty"`
-	IdempotencyKey string `json:"idempotency_key,omitempty"`
-}
-
-type imInviteBatchCreateRequest struct {
-	Quantity       int    `json:"quantity"`
-	ExpiresAt      string `json:"expires_at"`
-	Remark         string `json:"remark,omitempty"`
-	IdempotencyKey string `json:"idempotency_key,omitempty"`
+	TenantID       int64
+	InviteCode     string
+	Status         string
+	BatchID        int64
+	CreatedBy      int64
+	CreatedAtStart *time.Time
+	CreatedAtEnd   *time.Time
+	ExpiresAtStart *time.Time
+	ExpiresAtEnd   *time.Time
 }
 
 type imInviteCodeResponse struct {
-	ID        int64      `json:"id"`
-	BatchID   *int64     `json:"batch_id"`
-	Code      string     `json:"code"`
-	Status    string     `json:"status"`
-	ExpiresAt *time.Time `json:"expires_at"`
-	UsedBy    *int64     `json:"used_by"`
-	UsedAt    *time.Time `json:"used_at"`
-	RequestID string     `json:"request_id"`
-	CreatedBy int64      `json:"created_by"`
-	Remark    string     `json:"remark"`
-	CreatedAt *time.Time `json:"created_at"`
+	ID             int64      `json:"id"`
+	TenantID       int64      `json:"tenant_id"`
+	TenantName     string     `json:"tenant_name"`
+	BatchID        *int64     `json:"batch_id"`
+	Code           string     `json:"code"`
+	Status         string     `json:"status"`
+	ExpiresAt      time.Time  `json:"expires_at"`
+	MaxUses        int        `json:"max_uses"`
+	UsageCount     int        `json:"usage_count"`
+	BoundUserID    *int64     `json:"bound_user_id"`
+	BoundUserLabel string     `json:"bound_user_label"`
+	LastUsedAt     *time.Time `json:"last_used_at"`
+	CreatedBy      int64      `json:"created_by"`
+	Remark         string     `json:"remark"`
+	CreatedAt      time.Time  `json:"created_at"`
 }
 
 type imInviteBatchResponse struct {
-	BatchID      int64      `json:"batch_id"`
-	Quantity     int        `json:"quantity"`
-	ActiveCount  int        `json:"active_count"`
-	UsedCount    int        `json:"used_count"`
-	RevokedCount int        `json:"revoked_count"`
-	ExpiredCount int        `json:"expired_count"`
-	ExpiresAt    *time.Time `json:"expires_at"`
-	CreatedAt    *time.Time `json:"created_at"`
+	BatchID        int64     `json:"batch_id"`
+	TenantID       int64     `json:"tenant_id"`
+	Quantity       int       `json:"quantity"`
+	IdempotencyKey string    `json:"idempotency_key"`
+	Remark         string    `json:"remark"`
+	ActiveCount    int       `json:"active_count"`
+	UsageCount     int       `json:"usage_count"`
+	RevokedCount   int       `json:"revoked_count"`
+	ExpiredCount   int       `json:"expired_count"`
+	ExpiresAt      time.Time `json:"expires_at"`
+	CreatedAt      time.Time `json:"created_at"`
 }
 
 func (s *sSysImInvite) List(ctx context.Context, in *sysin.ImInviteListInp) (list []*sysin.ImInviteCodeModel, totalCount int, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteQueryDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return nil, 0, err
 	}
 	req, err := buildInviteListRequest(in)
 	if err != nil {
-		return
+		return nil, 0, err
 	}
-	var page imadmin.Page[imInviteCodeResponse]
-	if err = imadmin.DefaultClient(ctx).ListCodes(ctx, scope, req, &page); err != nil {
-		_ = writeImAdminAudit(ctx, scope.TenantId, "invite_list", "invite_code", 0, "failed", g.Map{"hasInviteCode": in.InviteCode != ""})
-		return
+	if !validInviteStatus(req.Status) {
+		return nil, 0, gerror.New("邀请码状态不正确")
 	}
-	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_list", "invite_code", 0, "success", g.Map{"hasInviteCode": in.InviteCode != ""})
-	list = make([]*sysin.ImInviteCodeModel, 0, len(page.Items))
-	for i := range page.Items {
-		list = append(list, convertInviteCode(page.Items[i]))
+	req.TenantID = scope.TenantId
+	items, total, err := queryInviteCodes(ctx, db, req, in.PerPage, (in.Page-1)*in.PerPage)
+	result := "success"
+	if err != nil {
+		result = "failed"
+	} else {
+		list = convertInviteCodes(items)
+		totalCount = total
 	}
-	totalCount = page.Total
-	return
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_list", "invite_code", 0, result, g.Map{"hasInviteCode": in.InviteCode != ""})
+	return list, totalCount, err
 }
 
 func (s *sSysImInvite) Create(ctx context.Context, in *sysin.ImInviteCreateInp) (res *sysin.ImInviteCodeModel, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return nil, err
+	}
+	expiresAt := in.ExpiresAt.Time.UTC().Round(time.Millisecond)
+	var item imInviteCodeResponse
+	if key := strings.TrimSpace(in.IdempotencyKey); key != "" {
+		batch, codes, createErr := createInviteBatch(ctx, db, scope.TenantId, scope.OperatorId, 1, expiresAt, in.Remark, key)
+		if createErr != nil {
+			err = createErr
+		} else if len(codes) > 0 {
+			item = codes[0]
+		} else {
+			codes, _, err = queryInviteCodes(ctx, db, imInviteListRequest{TenantID: scope.TenantId, BatchID: batch.BatchID}, 1, 0)
+			if err == nil && len(codes) > 0 {
+				item = codes[0]
+			} else if err == nil {
+				err = gerror.New("邀请码生成结果不存在")
+			}
+		}
+	} else {
+		item, err = createSingleInvite(ctx, db, scope.TenantId, scope.OperatorId, expiresAt, in.Remark)
 	}
-	req := imInviteCreateRequest{ExpiresAt: formatRFC3339(in.ExpiresAt), Remark: in.Remark, IdempotencyKey: in.IdempotencyKey}
-	var upstream imInviteCodeResponse
-	err = imadmin.DefaultClient(ctx).CreateCode(ctx, scope, req, &upstream)
-	res = convertInviteCode(upstream)
 	result := "success"
 	if err != nil {
 		result = "failed"
+	} else {
+		res = convertInviteCode(item)
 	}
-	targetId, _ := strconv.ParseInt(res.Id, 10, 64)
-	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_create", "invite_code", targetId, result, g.Map{"expiresAt": in.ExpiresAt, "remark": in.Remark})
-	return
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_create", "invite_code", item.ID, result, g.Map{"expiresAt": in.ExpiresAt, "remark": in.Remark})
+	return res, err
 }
 
 func (s *sSysImInvite) BatchCreate(ctx context.Context, in *sysin.ImInviteBatchCreateInp) (res *sysin.ImInviteBatchModel, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return nil, err
 	}
-	req := imInviteBatchCreateRequest{Quantity: in.Quantity, ExpiresAt: formatRFC3339(in.ExpiresAt), Remark: in.Remark, IdempotencyKey: in.IdempotencyKey}
-	var upstream imInviteBatchResponse
-	err = imadmin.DefaultClient(ctx).CreateBatch(ctx, scope, req, &upstream)
-	res = convertInviteBatch(upstream)
+	key := strings.TrimSpace(in.IdempotencyKey)
+	batch, _, err := createInviteBatch(ctx, db, scope.TenantId, scope.OperatorId, in.Quantity, in.ExpiresAt.Time.UTC().Round(time.Millisecond), in.Remark, key)
 	result := "success"
 	if err != nil {
 		result = "failed"
+	} else {
+		res = convertInviteBatch(batch)
 	}
-	targetId, _ := strconv.ParseInt(res.BatchId, 10, 64)
-	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_batch_create", "invite_batch", targetId, result, g.Map{"quantity": in.Quantity, "expiresAt": in.ExpiresAt, "remark": in.Remark})
-	return
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_batch_create", "invite_batch", batchID(batch), result, g.Map{"quantity": in.Quantity, "expiresAt": in.ExpiresAt, "remark": in.Remark})
+	return res, err
 }
 
 func (s *sSysImInvite) BatchView(ctx context.Context, in *sysin.ImInviteBatchViewInp) (res *sysin.ImInviteBatchDetailModel, err error) {
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return nil, err
 	}
-	batchId, err := sysin.ParseOptionalInt64(in.BatchId)
+	id, err := sysin.ParseOptionalInt64(in.BatchId)
 	if err != nil {
-		return
+		return nil, err
 	}
-	var upstream imInviteBatchResponse
-	err = imadmin.DefaultClient(ctx).GetBatch(ctx, scope, batchId, &upstream)
-	res = &sysin.ImInviteBatchDetailModel{ImInviteBatchModel: *convertInviteBatch(upstream)}
-	return
+	batch, err := getInviteBatch(ctx, db, scope.TenantId, "b.id=?", id)
+	if err != nil {
+		return nil, err
+	}
+	codes, _, err := queryInviteCodes(ctx, db, imInviteListRequest{TenantID: scope.TenantId, BatchID: id}, batch.Quantity, 0)
+	if err != nil {
+		return nil, err
+	}
+	return &sysin.ImInviteBatchDetailModel{ImInviteBatchModel: *convertInviteBatch(batch), List: convertInviteCodes(codes)}, nil
 }
 
 func (s *sSysImInvite) Revoke(ctx context.Context, in *sysin.ImInviteRevokeInp) (err error) {
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return err
 	}
 	id, err := sysin.ParseOptionalInt64(in.Id)
 	if err != nil {
-		return
+		return err
 	}
-	err = imadmin.DefaultClient(ctx).RevokeCode(ctx, scope, id)
-	result := "success"
+	now := time.Now().UTC().Round(time.Millisecond)
+	result, err := db.Exec(ctx, `UPDATE im_registration_invite_codes SET status='revoked',updated_at=?
+		WHERE tenant_id=? AND id=? AND status='active' AND expires_at>?`, now, scope.TenantId, id, now)
+	if err == nil {
+		if affected, _ := result.RowsAffected(); affected == 0 {
+			err = gerror.New("有效邀请码不存在")
+		}
+	}
+	auditResult := "success"
 	if err != nil {
-		result = "failed"
+		auditResult = "failed"
 	}
-	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_revoke", "invite_code", id, result, nil)
-	return
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_revoke", "invite_code", id, auditResult, nil)
+	return err
+}
+
+func (s *sSysImInvite) BindUser(ctx context.Context, in *sysin.ImInviteBindUserInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return err
+	}
+	scope, db, err := inviteDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	id, err := sysin.ParseOptionalInt64(in.Id)
+	if err != nil || id <= 0 {
+		return gerror.New("邀请码ID不能为空")
+	}
+	tenant, err := resolveImAdminTenant(ctx, scope.TenantId)
+	if err != nil {
+		return err
+	}
+	label, err := inviteBoundUserLabel(ctx, tenant, in.UserId)
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC().Round(time.Millisecond)
+	result, err := db.Exec(ctx, `UPDATE im_registration_invite_codes
+		SET bound_user_id=?,bound_user_label=?,updated_at=?
+		WHERE tenant_id=? AND id=? AND status='active' AND usage_count=0 AND (bound_user_id IS NULL OR bound_user_id=0)`,
+		in.UserId, label, now, scope.TenantId, id)
+	if err == nil {
+		if affected, _ := result.RowsAffected(); affected == 0 {
+			err = gerror.New("邀请码不存在、已使用、已绑定或不可绑定")
+		}
+	}
+	auditResult := "success"
+	if err != nil {
+		auditResult = "failed"
+	}
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_bind_user", "invite_code", id, auditResult, g.Map{"user_id": in.UserId})
+	if err != nil {
+		return err
+	}
+	return nil
 }
 
 func (s *sSysImInvite) BatchRevoke(ctx context.Context, in *sysin.ImInviteBatchRevokeInp) (res *sysin.ImInviteBatchModel, err error) {
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return nil, err
 	}
-	batchId, err := sysin.ParseOptionalInt64(in.BatchId)
+	id, err := sysin.ParseOptionalInt64(in.BatchId)
 	if err != nil {
-		return
+		return nil, err
 	}
-	var upstream struct {
-		Batch        *imInviteBatchResponse `json:"batch"`
-		RevokedCount int                    `json:"revoked_count"`
+	if _, err = getInviteBatch(ctx, db, scope.TenantId, "b.id=?", id); err == nil {
+		now := time.Now().UTC().Round(time.Millisecond)
+		_, err = db.Exec(ctx, `UPDATE im_registration_invite_codes SET status='revoked',updated_at=?
+			WHERE tenant_id=? AND batch_id=? AND status='active' AND expires_at>?`, now, scope.TenantId, id, now)
 	}
-	err = imadmin.DefaultClient(ctx).RevokeBatch(ctx, scope, batchId, &upstream)
-	if upstream.Batch != nil {
-		res = convertInviteBatch(*upstream.Batch)
+	var batch *imInviteBatchResponse
+	if err == nil {
+		batch, err = getInviteBatch(ctx, db, scope.TenantId, "b.id=?", id)
+	}
+	auditResult := "success"
+	if err != nil {
+		auditResult = "failed"
 	} else {
-		res = &sysin.ImInviteBatchModel{BatchId: strconv.FormatInt(batchId, 10), RevokedCount: upstream.RevokedCount}
+		res = convertInviteBatch(batch)
 	}
-	result := "success"
-	if err != nil {
-		result = "failed"
-	}
-	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_batch_revoke", "invite_batch", batchId, result, nil)
-	return
+	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_batch_revoke", "invite_batch", id, auditResult, nil)
+	return res, err
 }
 
 func (s *sSysImInvite) Export(ctx context.Context, in *sysin.ImInviteListInp) (err error) {
 	if err = in.Filter(ctx); err != nil {
-		return
+		return err
 	}
-	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	scope, db, err := inviteQueryDB(ctx, in.TenantId)
 	if err != nil {
-		return
+		return err
 	}
 	req, err := buildInviteListRequest(in)
-	if err != nil {
-		return
+	if err != nil || !validInviteStatus(req.Status) {
+		return gerror.New("导出条件不正确")
 	}
-	resp, err := imadmin.DefaultClient(ctx).ExportCodes(ctx, scope, req)
-	if err != nil {
-		_ = writeImAdminAudit(ctx, scope.TenantId, "invite_export", "invite_code", 0, "failed", g.Map{"hasInviteCode": in.InviteCode != ""})
-		return
-	}
-	defer resp.Body.Close()
+	req.TenantID = scope.TenantId
 	request := ghttp.RequestFromCtx(ctx)
 	if request == nil {
 		return gerror.New("请求上下文不存在")
 	}
-	filename := resp.Header.Get("Content-Disposition")
-	if filename == "" {
-		filename = `attachment; filename="registration-invite-codes.csv"`
-	}
-	request.Response.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
-	request.Response.Header().Set("Content-Disposition", filename)
-	if _, err = io.Copy(request.Response.Writer, resp.Body); err != nil {
-		return gerror.Wrap(err, "转发导出文件失败")
+	request.Response.Header().Set("Content-Type", "text/csv; charset=utf-8")
+	request.Response.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=registration-invite-codes-%s.csv", time.Now().Format("20060102-150405")))
+	_, _ = request.Response.Writer.Write([]byte{0xef, 0xbb, 0xbf})
+	writer := csv.NewWriter(request.Response.Writer)
+	_ = writer.Write([]string{"tenant_id", "tenant_name", "code", "status", "expires_at", "usage_count", "available_uses", "last_used_at", "created_by", "created_at", "remark"})
+	for offset := 0; ; offset += 100 {
+		items, total, queryErr := queryInviteCodes(ctx, db, req, 100, offset)
+		if queryErr != nil {
+			return gerror.Wrap(queryErr, "导出邀请码失败")
+		}
+		for _, item := range items {
+			_ = writer.Write([]string{strconv.FormatInt(item.TenantID, 10), item.TenantName, item.Code, item.Status, item.ExpiresAt.Format(time.RFC3339), strconv.Itoa(item.UsageCount), formatInviteAvailableUses(item.MaxUses, item.UsageCount), formatTime(item.LastUsedAt), strconv.FormatInt(item.CreatedBy, 10), item.CreatedAt.Format(time.RFC3339), item.Remark})
+		}
+		writer.Flush()
+		if writer.Error() != nil {
+			return writer.Error()
+		}
+		if offset+len(items) >= total || len(items) == 0 {
+			break
+		}
 	}
 	_ = writeImAdminAudit(ctx, scope.TenantId, "invite_export", "invite_code", 0, "success", g.Map{"hasInviteCode": in.InviteCode != ""})
-	fmt.Fprint(request.Response.Writer, "")
-	return
+	return nil
+}
+
+func inviteDB(ctx context.Context, selectedTenantID int64) (imAdminScope, gdb.DB, error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantID)
+	if err != nil {
+		return scope, nil, err
+	}
+	return scope, imtenant.RegistryDB(), nil
+}
+
+func inviteQueryDB(ctx context.Context, selectedTenantID int64) (imAdminScope, gdb.DB, error) {
+	scope, err := resolveImAdminScopeWithAll(ctx, selectedTenantID, true)
+	if err != nil {
+		return scope, nil, err
+	}
+	return scope, imtenant.RegistryDB(), nil
+}
+
+func createSingleInvite(ctx context.Context, db gdb.DB, tenantID, operatorID int64, expiresAt time.Time, remark string) (imInviteCodeResponse, error) {
+	for attempt := 0; attempt < inviteGenerateRetries; attempt++ {
+		id, err := imtenant.NextSnowflakeID(ctx)
+		if err != nil {
+			return imInviteCodeResponse{}, err
+		}
+		code, err := randomInviteCode()
+		if err != nil {
+			return imInviteCodeResponse{}, err
+		}
+		now := time.Now().UTC().Round(time.Millisecond)
+		_, err = db.Exec(ctx, `INSERT INTO im_registration_invite_codes
+			(id,tenant_id,batch_id,code,status,expires_at,max_uses,usage_count,last_used_at,created_by,remark,created_at,updated_at)
+			VALUES(?,?,NULL,?,'active',?,1,0,NULL,?,?,?,?)`, id, tenantID, code, expiresAt, operatorID, remark, now, now)
+		if err == nil {
+			return imInviteCodeResponse{ID: id, TenantID: tenantID, Code: code, Status: "active", ExpiresAt: expiresAt, MaxUses: 1, CreatedBy: operatorID, Remark: remark, CreatedAt: now}, nil
+		}
+		if !isDuplicateError(err) {
+			return imInviteCodeResponse{}, err
+		}
+	}
+	return imInviteCodeResponse{}, gerror.New("无法生成不重复的邀请码，请重试")
+}
+
+func createInviteBatch(ctx context.Context, db gdb.DB, tenantID, operatorID int64, quantity int, expiresAt time.Time, remark, key string) (*imInviteBatchResponse, []imInviteCodeResponse, error) {
+	if existing, err := getInviteBatch(ctx, db, tenantID, "b.idempotency_key=?", key); err == nil {
+		if !sameInviteBatch(existing, quantity, expiresAt, remark) {
+			return nil, nil, gerror.New("幂等键已被其他批量生成请求使用")
+		}
+		return existing, nil, nil
+	} else if !errors.Is(err, errInviteBatchNotFound) {
+		return nil, nil, err
+	}
+	for attempt := 0; attempt < inviteGenerateRetries; attempt++ {
+		batchID, err := imtenant.NextSnowflakeID(ctx)
+		if err != nil {
+			return nil, nil, err
+		}
+		codes := make([]imInviteCodeResponse, quantity)
+		seen := make(map[string]struct{}, quantity)
+		for i := range codes {
+			for {
+				code, randomErr := randomInviteCode()
+				if randomErr != nil {
+					return nil, nil, randomErr
+				}
+				if _, ok := seen[code]; ok {
+					continue
+				}
+				seen[code] = struct{}{}
+				codes[i].Code = code
+				break
+			}
+			codes[i].ID, err = imtenant.NextSnowflakeID(ctx)
+			if err != nil {
+				return nil, nil, err
+			}
+			codes[i].BatchID = &batchID
+		}
+		now := time.Now().UTC().Round(time.Millisecond)
+		err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
+			if _, txErr := tx.Exec(`INSERT INTO im_registration_invite_batches
+				(id,tenant_id,quantity,idempotency_key,expires_at,created_by,remark,created_at,updated_at)
+				VALUES(?,?,?,?,?,?,?,?,?)`, batchID, tenantID, quantity, key, expiresAt, operatorID, remark, now, now); txErr != nil {
+				return txErr
+			}
+			for i := range codes {
+				if _, txErr := tx.Exec(`INSERT INTO im_registration_invite_codes
+					(id,tenant_id,batch_id,code,status,expires_at,max_uses,usage_count,last_used_at,created_by,remark,created_at,updated_at)
+					VALUES(?,?,?,?,'active',?,0,0,NULL,?,?,?,?)`, codes[i].ID, tenantID, batchID, codes[i].Code, expiresAt, operatorID, remark, now, now); txErr != nil {
+					return txErr
+				}
+				codes[i].TenantID, codes[i].Status, codes[i].ExpiresAt, codes[i].CreatedBy, codes[i].Remark, codes[i].CreatedAt = tenantID, "active", expiresAt, operatorID, remark, now
+			}
+			return nil
+		})
+		if err == nil {
+			return &imInviteBatchResponse{BatchID: batchID, TenantID: tenantID, Quantity: quantity, IdempotencyKey: key, Remark: remark, ActiveCount: quantity, ExpiresAt: expiresAt, CreatedAt: now}, codes, nil
+		}
+		if !isDuplicateError(err) {
+			return nil, nil, err
+		}
+		if existing, lookupErr := getInviteBatch(ctx, db, tenantID, "b.idempotency_key=?", key); lookupErr == nil {
+			if !sameInviteBatch(existing, quantity, expiresAt, remark) {
+				return nil, nil, gerror.New("幂等键已被其他批量生成请求使用")
+			}
+			return existing, nil, nil
+		} else if !errors.Is(lookupErr, errInviteBatchNotFound) {
+			return nil, nil, lookupErr
+		}
+	}
+	return nil, nil, gerror.New("无法生成不重复的邀请码，请重试")
+}
+
+func queryInviteCodes(ctx context.Context, db gdb.DB, req imInviteListRequest, limit, offset int) ([]imInviteCodeResponse, int, error) {
+	now := time.Now().UTC().Round(time.Millisecond)
+	expireWhere := "status='active' AND expires_at<=?"
+	expireArgs := []any{now, now}
+	if req.TenantID > 0 {
+		expireWhere = "tenant_id=? AND " + expireWhere
+		expireArgs = []any{now, req.TenantID, now}
+	}
+	if _, err := db.Exec(ctx, `UPDATE im_registration_invite_codes SET status='expired',updated_at=? WHERE `+expireWhere, expireArgs...); err != nil {
+		return nil, 0, err
+	}
+	where, args := inviteWhere(req)
+	totalValue, err := db.GetValue(ctx, "SELECT COUNT(*) FROM im_registration_invite_codes c WHERE "+where, args...)
+	if err != nil {
+		return nil, 0, err
+	}
+	queryArgs := append(append([]any{}, args...), limit, offset)
+	items := make([]imInviteCodeResponse, 0)
+	err = db.Raw(`SELECT c.id,c.tenant_id,t.name tenant_name,c.batch_id,c.code,c.status,c.expires_at,c.max_uses,c.bound_user_id,c.bound_user_label,c.created_by,c.remark,c.created_at,
+		c.usage_count,c.last_used_at
+		FROM im_registration_invite_codes c
+		LEFT JOIN im_tenant t ON t.id=c.tenant_id
+		WHERE `+where+` ORDER BY c.created_at DESC,c.id DESC LIMIT ? OFFSET ?`, queryArgs...).Ctx(ctx).Scan(&items)
+	return items, totalValue.Int(), err
+}
+
+func inviteWhere(req imInviteListRequest) (string, []any) {
+	where := []string{"1=1"}
+	args := make([]any, 0, 8)
+	if req.TenantID > 0 {
+		where, args = append(where, "c.tenant_id=?"), append(args, req.TenantID)
+	}
+	if req.InviteCode != "" {
+		where, args = append(where, "c.code=?"), append(args, req.InviteCode)
+	}
+	if req.Status != "" {
+		where, args = append(where, "c.status=?"), append(args, req.Status)
+	}
+	if req.BatchID > 0 {
+		where, args = append(where, "c.batch_id=?"), append(args, req.BatchID)
+	}
+	if req.CreatedBy > 0 {
+		where, args = append(where, "c.created_by=?"), append(args, req.CreatedBy)
+	}
+	if req.CreatedAtStart != nil {
+		where, args = append(where, "c.created_at>=?"), append(args, *req.CreatedAtStart)
+	}
+	if req.CreatedAtEnd != nil {
+		where, args = append(where, "c.created_at<=?"), append(args, *req.CreatedAtEnd)
+	}
+	if req.ExpiresAtStart != nil {
+		where, args = append(where, "c.expires_at>=?"), append(args, *req.ExpiresAtStart)
+	}
+	if req.ExpiresAtEnd != nil {
+		where, args = append(where, "c.expires_at<=?"), append(args, *req.ExpiresAtEnd)
+	}
+	return strings.Join(where, " AND "), args
+}
+
+func getInviteBatch(ctx context.Context, db gdb.DB, tenantID int64, where string, arg any) (*imInviteBatchResponse, error) {
+	items := make([]imInviteBatchResponse, 0, 1)
+	now := time.Now().UTC().Round(time.Millisecond)
+	err := db.Raw(`SELECT b.id batch_id,b.tenant_id,b.quantity,b.idempotency_key,b.expires_at,b.remark,b.created_at,
+		COALESCE(SUM(CASE WHEN c.status='active' AND c.expires_at>? THEN 1 ELSE 0 END),0) active_count,
+		COALESCE(SUM(c.usage_count),0) usage_count,
+		COALESCE(SUM(CASE WHEN (c.status='active' AND c.expires_at<=?) OR c.status='expired' THEN 1 ELSE 0 END),0) expired_count,
+		COALESCE(SUM(CASE WHEN c.status='revoked' THEN 1 ELSE 0 END),0) revoked_count
+		FROM im_registration_invite_batches b LEFT JOIN im_registration_invite_codes c ON c.tenant_id=b.tenant_id AND c.batch_id=b.id
+		WHERE b.tenant_id=? AND `+where+` GROUP BY b.id LIMIT 1`, now, now, tenantID, arg).Ctx(ctx).Scan(&items)
+	if err != nil {
+		return nil, err
+	}
+	if len(items) == 0 {
+		return nil, gerror.Wrap(errInviteBatchNotFound, "邀请码批次不存在")
+	}
+	return &items[0], nil
 }
 
 func buildInviteListRequest(in *sysin.ImInviteListInp) (imInviteListRequest, error) {
-	batchId, err := sysin.ParseOptionalInt64(in.BatchId)
+	batchID, err := sysin.ParseOptionalInt64(in.BatchId)
 	if err != nil {
 		return imInviteListRequest{}, err
 	}
@@ -250,32 +515,120 @@ func buildInviteListRequest(in *sysin.ImInviteListInp) (imInviteListRequest, err
 	if err != nil {
 		return imInviteListRequest{}, err
 	}
-	return imInviteListRequest{
-		Page:           in.Page,
-		PerPage:        in.PerPage,
-		InviteCode:     in.InviteCode,
-		Status:         in.Status,
-		BatchID:        batchId,
-		CreatedBy:      createdBy,
-		CreatedAtStart: formatRFC3339(in.CreatedAtStart),
-		CreatedAtEnd:   formatRFC3339(in.CreatedAtEnd),
-		ExpiresAtStart: formatRFC3339(in.ExpiresAtStart),
-		ExpiresAtEnd:   formatRFC3339(in.ExpiresAtEnd),
-	}, nil
+	return imInviteListRequest{InviteCode: in.InviteCode, Status: in.Status, BatchID: batchID, CreatedBy: createdBy,
+		CreatedAtStart: nativeTime(in.CreatedAtStart), CreatedAtEnd: nativeTime(in.CreatedAtEnd),
+		ExpiresAtStart: nativeTime(in.ExpiresAtStart), ExpiresAtEnd: nativeTime(in.ExpiresAtEnd)}, nil
 }
 
-func formatRFC3339(t *gtime.Time) string {
-	if t == nil {
-		return ""
+func randomInviteCode() (string, error) {
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+	result := make([]byte, 5)
+	buffer := make([]byte, 10)
+	for index := 0; index < len(result); {
+		if _, err := cryptorand.Read(buffer); err != nil {
+			return "", err
+		}
+		for _, value := range buffer {
+			if value >= 208 {
+				continue
+			}
+			result[index] = alphabet[int(value)%len(alphabet)]
+			index++
+			if index == len(result) {
+				break
+			}
+		}
 	}
-	return t.Time.UTC().Format(time.RFC3339)
+	return string(result), nil
 }
 
-func convertTime(t *time.Time) *gtime.Time {
-	if t == nil {
+func isDuplicateError(err error) bool {
+	var mysqlErr *mysqldriver.MySQLError
+	return errors.As(err, &mysqlErr) && mysqlErr.Number == 1062
+}
+
+func validInviteStatus(status string) bool {
+	return status == "" || status == "active" || status == "expired" || status == "revoked"
+}
+
+func sameInviteBatch(batch *imInviteBatchResponse, quantity int, expiresAt time.Time, remark string) bool {
+	return batch != nil && batch.Quantity == quantity &&
+		batch.ExpiresAt.UTC().Round(time.Millisecond).Equal(expiresAt.UTC().Round(time.Millisecond)) && batch.Remark == remark
+}
+
+func convertInviteCodes(items []imInviteCodeResponse) []*sysin.ImInviteCodeModel {
+	list := make([]*sysin.ImInviteCodeModel, 0, len(items))
+	for _, item := range items {
+		list = append(list, convertInviteCode(item))
+	}
+	return list
+}
+
+func convertInviteCode(item imInviteCodeResponse) *sysin.ImInviteCodeModel {
+	return &sysin.ImInviteCodeModel{Id: strconv.FormatInt(item.ID, 10), BatchId: formatOptionalInt64(item.BatchID), Code: item.Code,
+		TenantId: strconv.FormatInt(item.TenantID, 10), TenantName: item.TenantName,
+		Status: item.Status, ExpiresAt: gtime.New(item.ExpiresAt), MaxUses: item.MaxUses, UsageCount: item.UsageCount,
+		BoundUserId: formatOptionalInt64(item.BoundUserID), BoundUserLabel: item.BoundUserLabel, LastUsedAt: convertTime(item.LastUsedAt),
+		CreatedBy: strconv.FormatInt(item.CreatedBy, 10), Remark: item.Remark, CreatedAt: gtime.New(item.CreatedAt)}
+}
+
+func inviteBoundUserLabel(ctx context.Context, tenant *entity.ImTenant, userID int64) (string, error) {
+	if tenant == nil || tenant.Code == "" || userID <= 0 {
+		return "", gerror.New("绑定用户不合法")
+	}
+	values := addPageQuery(url.Values{}, 1, 1)
+	values.Set("user_ids", strconv.FormatInt(userID, 10))
+	users, _, err := imAdminQueryList[sysin.ImUserListModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/users",
+		values,
+		map[string]string{
+			"public":  "profileJson",
+			"trusted": "trustedJson",
+			"access":  "accessJson",
+		},
+	)
+	if err != nil {
+		return "", err
+	}
+	if len(users) == 0 {
+		return "", gerror.New("绑定用户不存在")
+	}
+	user := users[0]
+	if user.Nickname != "" {
+		return fmt.Sprintf("%s（%s）", user.Nickname, user.UserId), nil
+	}
+	if user.Username != "" {
+		return fmt.Sprintf("%s（%s）", user.Username, user.UserId), nil
+	}
+	if user.Phone != "" {
+		return fmt.Sprintf("%s（%s）", user.Phone, user.UserId), nil
+	}
+	return user.UserId, nil
+}
+
+func convertInviteBatch(item *imInviteBatchResponse) *sysin.ImInviteBatchModel {
+	if item == nil {
 		return nil
 	}
-	return gtime.New(t)
+	return &sysin.ImInviteBatchModel{BatchId: strconv.FormatInt(item.BatchID, 10), Quantity: item.Quantity, ActiveCount: item.ActiveCount,
+		TenantId:   strconv.FormatInt(item.TenantID, 10),
+		UsageCount: item.UsageCount, RevokedCount: item.RevokedCount, ExpiredCount: item.ExpiredCount,
+		ExpiresAt: gtime.New(item.ExpiresAt), CreatedAt: gtime.New(item.CreatedAt)}
+}
+
+func nativeTime(value *gtime.Time) *time.Time {
+	if value == nil {
+		return nil
+	}
+	t := value.Time.UTC()
+	return &t
+}
+
+func convertTime(value *time.Time) *gtime.Time {
+	if value == nil {
+		return nil
+	}
+	return gtime.New(value)
 }
 
 func formatOptionalInt64(value *int64) string {
@@ -285,31 +638,27 @@ func formatOptionalInt64(value *int64) string {
 	return strconv.FormatInt(*value, 10)
 }
 
-func convertInviteCode(item imInviteCodeResponse) *sysin.ImInviteCodeModel {
-	return &sysin.ImInviteCodeModel{
-		Id:        strconv.FormatInt(item.ID, 10),
-		BatchId:   formatOptionalInt64(item.BatchID),
-		Code:      item.Code,
-		Status:    item.Status,
-		ExpiresAt: convertTime(item.ExpiresAt),
-		UsedBy:    formatOptionalInt64(item.UsedBy),
-		UsedAt:    convertTime(item.UsedAt),
-		RequestId: item.RequestID,
-		CreatedBy: strconv.FormatInt(item.CreatedBy, 10),
-		Remark:    item.Remark,
-		CreatedAt: convertTime(item.CreatedAt),
+func formatTime(value *time.Time) string {
+	if value == nil {
+		return ""
 	}
+	return value.Format(time.RFC3339)
 }
 
-func convertInviteBatch(item imInviteBatchResponse) *sysin.ImInviteBatchModel {
-	return &sysin.ImInviteBatchModel{
-		BatchId:      strconv.FormatInt(item.BatchID, 10),
-		Quantity:     item.Quantity,
-		ActiveCount:  item.ActiveCount,
-		UsedCount:    item.UsedCount,
-		RevokedCount: item.RevokedCount,
-		ExpiredCount: item.ExpiredCount,
-		ExpiresAt:    convertTime(item.ExpiresAt),
-		CreatedAt:    convertTime(item.CreatedAt),
+func formatInviteAvailableUses(maxUses, usageCount int) string {
+	if maxUses <= 0 {
+		return "不限制"
 	}
+	available := maxUses - usageCount
+	if available < 0 {
+		available = 0
+	}
+	return strconv.Itoa(available)
+}
+
+func batchID(batch *imInviteBatchResponse) int64 {
+	if batch == nil {
+		return 0
+	}
+	return batch.BatchID
 }

server/internal/logic/sys/im_kafka_audit.go

@@ -2,11 +2,12 @@ package sys
 
 import (
 	"context"
+	"hotgo/internal/library/imtenant"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
+	"strings"
 
 	"github.com/gogf/gf/v2/errors/gerror"
-	"github.com/gogf/gf/v2/frame/g"
 )
 
 type sSysImKafkaAudit struct{}
@@ -23,64 +24,118 @@ func (s *sSysImKafkaAudit) List(ctx context.Context, in *sysin.ImKafkaAuditListI
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	mod := g.DB().Model("im_audit_events").Safe().Ctx(ctx).
-		Fields("id", "event_id", "tenant_code", "event_type", "biz_type", "biz_id", "actor_type", "actor_id", "action", "resource", "resource_id", "result", "reason", "occurred_at", "received_at")
-	if in.TenantCode != "" {
-		mod = mod.Where("tenant_code", in.TenantCode)
+	where, args := buildImKafkaAuditWhere(in)
+	db := imtenant.RegistryDB()
+	totalValue, err := db.GetValue(ctx, "SELECT COUNT(*) FROM im_audit_events "+where, args...)
+	if err != nil {
+		err = gerror.Wrap(err, "获取IM Kafka审计事件总数失败，请稍后重试！")
+		return
 	}
-	if in.EventId != "" {
-		mod = mod.WhereLike("event_id", "%"+in.EventId+"%")
+	totalCount = totalValue.Int()
+
+	page := in.Page
+	if page <= 0 {
+		page = 1
 	}
-	if in.EventType != "" {
-		mod = mod.WhereLike("event_type", "%"+in.EventType+"%")
+	perPage := in.PerPage
+	if perPage <= 0 {
+		perPage = 20
 	}
-	if in.BizType != "" {
-		mod = mod.Where("biz_type", in.BizType)
-	}
-	if in.BizId != "" {
-		mod = mod.WhereLike("biz_id", "%"+in.BizId+"%")
-	}
-	if in.ActorType != "" {
-		mod = mod.Where("actor_type", in.ActorType)
-	}
-	if in.ActorId != "" {
-		mod = mod.WhereLike("actor_id", "%"+in.ActorId+"%")
-	}
-	if in.Action != "" {
-		mod = mod.WhereLike("action", "%"+in.Action+"%")
-	}
-	if in.Resource != "" {
-		mod = mod.Where("resource", in.Resource)
-	}
-	if in.ResourceId != "" {
-		mod = mod.WhereLike("resource_id", "%"+in.ResourceId+"%")
-	}
-	if in.Result != "" {
-		mod = mod.Where("result", in.Result)
-	}
-	if len(in.CreatedAt) == 2 {
-		mod = mod.WhereBetween("received_at", in.CreatedAt[0], in.CreatedAt[1])
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+	offset := (page - 1) * perPage
+	query := `SELECT id,event_id,tenant_code,event_type,biz_type,biz_id,actor_type,actor_id,
+		action,resource,resource_id,result,reason,occurred_at,received_at
+		FROM im_audit_events ` + where + ` ORDER BY id DESC LIMIT ? OFFSET ?`
+	queryArgs := append(append([]any{}, args...), perPage, offset)
+	rows, err := db.GetAll(ctx, query, queryArgs...)
+	if err != nil {
 		err = gerror.Wrap(err, "获取IM Kafka审计事件列表失败，请稍后重试！")
+		return
+	}
+	if err = rows.Structs(&list); err != nil {
+		err = gerror.Wrap(err, "解析IM Kafka审计事件列表失败，请稍后重试！")
 	}
 	return
 }
 
+func buildImKafkaAuditWhere(in *sysin.ImKafkaAuditListInp) (string, []any) {
+	parts := []string{"1=1"}
+	args := []any{}
+	if in.TenantCode != "" {
+		parts = append(parts, "tenant_code=?")
+		args = append(args, in.TenantCode)
+	}
+	if in.EventId != "" {
+		parts = append(parts, "event_id LIKE ?")
+		args = append(args, "%"+in.EventId+"%")
+	}
+	if in.EventType != "" {
+		parts = append(parts, "event_type LIKE ?")
+		args = append(args, "%"+in.EventType+"%")
+	}
+	if in.BizType != "" {
+		parts = append(parts, "biz_type=?")
+		args = append(args, in.BizType)
+	}
+	if in.BizId != "" {
+		parts = append(parts, "biz_id LIKE ?")
+		args = append(args, "%"+in.BizId+"%")
+	}
+	if in.ActorType != "" {
+		parts = append(parts, "actor_type=?")
+		args = append(args, in.ActorType)
+	}
+	if in.ActorId != "" {
+		parts = append(parts, "actor_id LIKE ?")
+		args = append(args, "%"+in.ActorId+"%")
+	}
+	if in.Action != "" {
+		parts = append(parts, "action LIKE ?")
+		args = append(args, "%"+in.Action+"%")
+	}
+	if in.Resource != "" {
+		parts = append(parts, "resource=?")
+		args = append(args, in.Resource)
+	}
+	if in.ResourceId != "" {
+		parts = append(parts, "resource_id LIKE ?")
+		args = append(args, "%"+in.ResourceId+"%")
+	}
+	if in.Result != "" {
+		parts = append(parts, "result=?")
+		args = append(args, in.Result)
+	}
+	if len(in.CreatedAt) == 2 {
+		parts = append(parts, "received_at BETWEEN ? AND ?")
+		args = append(args, in.CreatedAt[0], in.CreatedAt[1])
+	}
+	return "WHERE " + strings.Join(parts, " AND "), args
+}
+
 func (s *sSysImKafkaAudit) View(ctx context.Context, in *sysin.ImKafkaAuditViewInp) (res *sysin.ImKafkaAuditViewModel, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	mod := g.DB().Model("im_audit_events").Safe().Ctx(ctx).
-		Fields("id", "event_id", "tenant_code", "event_type", "biz_type", "biz_id", "actor_type", "actor_id", "action", "resource", "resource_id", "result", "reason", "CAST(payload AS CHAR) payload", "CAST(envelope AS CHAR) envelope", "occurred_at", "received_at")
+	query := `SELECT id,event_id,tenant_code,event_type,biz_type,biz_id,actor_type,actor_id,
+		action,resource,resource_id,result,reason,CAST(payload AS CHAR) payload,
+		CAST(envelope AS CHAR) envelope,occurred_at,received_at FROM im_audit_events WHERE `
+	args := []any{}
 	if in.Id > 0 {
-		mod = mod.Where("id", in.Id)
+		query += "id=?"
+		args = append(args, in.Id)
 	} else {
-		mod = mod.Where("event_id", in.EventId)
+		query += "event_id=?"
+		args = append(args, in.EventId)
 	}
-	if err = mod.Scan(&res); err != nil {
+	query += " LIMIT 1"
+	row, err := imtenant.RegistryDB().GetOne(ctx, query, args...)
+	if err != nil {
 		return nil, gerror.Wrap(err, "获取IM Kafka审计事件详情失败，请稍后重试！")
 	}
+	if row.IsEmpty() {
+		return nil, nil
+	}
+	if err = row.Struct(&res); err != nil {
+		return nil, gerror.Wrap(err, "解析IM Kafka审计事件详情失败，请稍后重试！")
+	}
 	return
 }

server/internal/logic/sys/im_kafka_command.go

@@ -10,11 +10,12 @@ import (
 	"hotgo/internal/consts"
 	"hotgo/internal/library/contexts"
 	"hotgo/internal/library/imkafka"
+	"hotgo/internal/library/imtenant"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
+	"strings"
 
 	"github.com/gogf/gf/v2/errors/gerror"
-	"github.com/gogf/gf/v2/frame/g"
 	"github.com/gogf/gf/v2/util/gconv"
 )
 
@@ -32,53 +33,34 @@ func (s *sSysImKafkaCommand) List(ctx context.Context, in *sysin.ImKafkaCommandL
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	mod := g.DB().Model("im_admin_commands").Safe().Ctx(ctx).
-		Fields(
-			"id",
-			"command_id",
-			"tenant_id",
-			"tenant_code",
-			"event_id",
-			"event_type",
-			"biz_type",
-			"biz_id",
-			"idempotency_key",
-			"status",
-			"reason",
-			"message",
-			"sent_at",
-			"completed_at",
-			"created_by",
-			"created_at",
-			"updated_at",
-		)
-	if in.TenantId > 0 {
-		mod = mod.Where("tenant_id", in.TenantId)
+	where, args := buildImKafkaCommandWhere(in)
+	db := imtenant.RegistryDB()
+	totalValue, err := db.GetValue(ctx, "SELECT COUNT(*) FROM im_admin_commands "+where, args...)
+	if err != nil {
+		err = gerror.Wrap(err, "获取IM后台命令总数失败，请稍后重试！")
+		return
 	}
-	if in.CommandId != "" {
-		mod = mod.WhereLike("command_id", "%"+in.CommandId+"%")
+	totalCount = totalValue.Int()
+	page := in.Page
+	if page <= 0 {
+		page = 1
 	}
-	if in.EventId != "" {
-		mod = mod.WhereLike("event_id", "%"+in.EventId+"%")
+	perPage := in.PerPage
+	if perPage <= 0 {
+		perPage = 20
 	}
-	if in.EventType != "" {
-		mod = mod.WhereLike("event_type", "%"+in.EventType+"%")
-	}
-	if in.BizType != "" {
-		mod = mod.Where("biz_type", in.BizType)
-	}
-	if in.BizId != "" {
-		mod = mod.WhereLike("biz_id", "%"+in.BizId+"%")
-	}
-	if in.Status != "" {
-		mod = mod.Where("status", in.Status)
-	}
-	if len(in.CreatedAt) == 2 {
-		mod = mod.WhereBetween("created_at", in.CreatedAt[0], in.CreatedAt[1])
-	}
-	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
-	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+	offset := (page - 1) * perPage
+	query := `SELECT id,command_id,tenant_id,tenant_code,event_id,event_type,biz_type,biz_id,idempotency_key,
+		status,reason,message,sent_at,completed_at,created_by,created_at,updated_at
+		FROM im_admin_commands ` + where + ` ORDER BY id DESC LIMIT ? OFFSET ?`
+	queryArgs := append(append([]any{}, args...), perPage, offset)
+	rows, err := db.GetAll(ctx, query, queryArgs...)
+	if err != nil {
 		err = gerror.Wrap(err, "获取IM后台命令列表失败，请稍后重试！")
+		return
+	}
+	if err = rows.Structs(&list); err != nil {
+		err = gerror.Wrap(err, "解析IM后台命令列表失败，请稍后重试！")
 	}
 	return
 }
@@ -87,40 +69,69 @@ func (s *sSysImKafkaCommand) View(ctx context.Context, in *sysin.ImKafkaCommandV
 	if err = in.Filter(ctx); err != nil {
 		return nil, err
 	}
-	mod := g.DB().Model("im_admin_commands").Safe().Ctx(ctx).
-		Fields(
-			"id",
-			"command_id",
-			"tenant_id",
-			"tenant_code",
-			"event_id",
-			"event_type",
-			"biz_type",
-			"biz_id",
-			"idempotency_key",
-			"status",
-			"reason",
-			"message",
-			"CAST(payload AS CHAR) payload",
-			"CAST(envelope AS CHAR) envelope",
-			"CAST(result AS CHAR) result",
-			"sent_at",
-			"completed_at",
-			"created_by",
-			"created_at",
-			"updated_at",
-		)
+	query := `SELECT id,command_id,tenant_id,tenant_code,event_id,event_type,biz_type,biz_id,idempotency_key,
+		status,reason,message,CAST(payload AS CHAR) payload,CAST(envelope AS CHAR) envelope,CAST(result AS CHAR) result,
+		sent_at,completed_at,created_by,created_at,updated_at FROM im_admin_commands WHERE `
+	args := []any{}
 	if in.Id > 0 {
-		mod = mod.Where("id", in.Id)
+		query += "id=?"
+		args = append(args, in.Id)
 	} else {
-		mod = mod.Where("command_id", in.CommandId)
+		query += "command_id=?"
+		args = append(args, in.CommandId)
 	}
-	if err = mod.Scan(&res); err != nil {
+	query += " LIMIT 1"
+	row, err := imtenant.RegistryDB().GetOne(ctx, query, args...)
+	if err != nil {
 		return nil, gerror.Wrap(err, "获取IM后台命令详情失败，请稍后重试！")
 	}
+	if row.IsEmpty() {
+		return nil, nil
+	}
+	if err = row.Struct(&res); err != nil {
+		return nil, gerror.Wrap(err, "解析IM后台命令详情失败，请稍后重试！")
+	}
 	return
 }
 
+func buildImKafkaCommandWhere(in *sysin.ImKafkaCommandListInp) (string, []any) {
+	parts := []string{"1=1"}
+	args := []any{}
+	if in.TenantId > 0 {
+		parts = append(parts, "tenant_id=?")
+		args = append(args, in.TenantId)
+	}
+	if in.CommandId != "" {
+		parts = append(parts, "command_id LIKE ?")
+		args = append(args, "%"+in.CommandId+"%")
+	}
+	if in.EventId != "" {
+		parts = append(parts, "event_id LIKE ?")
+		args = append(args, "%"+in.EventId+"%")
+	}
+	if in.EventType != "" {
+		parts = append(parts, "event_type LIKE ?")
+		args = append(args, "%"+in.EventType+"%")
+	}
+	if in.BizType != "" {
+		parts = append(parts, "biz_type=?")
+		args = append(args, in.BizType)
+	}
+	if in.BizId != "" {
+		parts = append(parts, "biz_id LIKE ?")
+		args = append(args, "%"+in.BizId+"%")
+	}
+	if in.Status != "" {
+		parts = append(parts, "status=?")
+		args = append(args, in.Status)
+	}
+	if len(in.CreatedAt) == 2 {
+		parts = append(parts, "created_at BETWEEN ? AND ?")
+		args = append(args, in.CreatedAt[0], in.CreatedAt[1])
+	}
+	return "WHERE " + strings.Join(parts, " AND "), args
+}
+
 func (s *sSysImKafkaCommand) CacheInvalidate(ctx context.Context, in *sysin.ImKafkaCacheInvalidateInp) (res *sysin.ImKafkaEventModel, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return nil, err

server/internal/logic/sys/im_login_audit.go

@@ -0,0 +1,155 @@
+package sys
+
+import (
+	"context"
+	"fmt"
+	"hotgo/internal/consts"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imkafka"
+	"hotgo/internal/model/input/form"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+	"hotgo/utility/convert"
+	"hotgo/utility/excel"
+	"net/url"
+	"strconv"
+
+	"github.com/gogf/gf/v2/encoding/gjson"
+	"github.com/gogf/gf/v2/os/gctx"
+)
+
+type sSysImUserLoginHistory struct{}
+type sSysImLoginFailureLog struct{}
+
+func NewSysImUserLoginHistory() *sSysImUserLoginHistory { return &sSysImUserLoginHistory{} }
+func NewSysImLoginFailureLog() *sSysImLoginFailureLog   { return &sSysImLoginFailureLog{} }
+
+func init() {
+	service.RegisterSysImUserLoginHistory(NewSysImUserLoginHistory())
+	service.RegisterSysImLoginFailureLog(NewSysImLoginFailureLog())
+}
+
+func (s *sSysImUserLoginHistory) List(ctx context.Context, in *sysin.ImUserLoginHistoryListInp) ([]*sysin.ImUserLoginHistoryModel, int, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, 0, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, 0, err
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	setQuery(values, "user_id", in.UserId)
+	setQuery(values, "account", in.Account)
+	setQuery(values, "login_type", in.LoginType)
+	setQuery(values, "event_type", in.EventType)
+	setQuery(values, "platform", in.Platform)
+	setQuery(values, "ip", in.Ip)
+	addTimeRangeQuery(values, "login_at", in.LoginAt)
+	return imAdminQueryList[sysin.ImUserLoginHistoryModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/user-login-logs", values, nil)
+}
+
+func (s *sSysImUserLoginHistory) Export(ctx context.Context, in *sysin.ImUserLoginHistoryListInp) error {
+	list, total, err := s.List(ctx, in)
+	if err != nil {
+		return err
+	}
+	exports := make([]sysin.ImLoginAuditExportModel, 0, len(list))
+	for _, item := range list {
+		exports = append(exports, sysin.ImLoginAuditExportModel{Id: item.Id, UserId: item.UserId, AccountMask: item.AccountMask, EventType: item.EventType, Platform: item.Platform, Ip: item.Ip, Region: item.Region, RiskLevel: item.RiskLevel, OccurredAt: item.LoginAt})
+	}
+	return exportLoginAudit(ctx, exports, total, in.Page, in.PerPage, "用户登录历史")
+}
+
+func (s *sSysImLoginFailureLog) List(ctx context.Context, in *sysin.ImLoginFailureLogListInp) ([]*sysin.ImLoginFailureLogModel, int, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, 0, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, 0, err
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	setQuery(values, "user_id", in.UserId)
+	setQuery(values, "account", in.Account)
+	setQuery(values, "failure_type", in.FailureType)
+	setQuery(values, "platform", in.Platform)
+	setQuery(values, "ip", in.Ip)
+	addTimeRangeQuery(values, "attempt_at", in.AttemptAt)
+	return imAdminQueryList[sysin.ImLoginFailureLogModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/login-failure-logs", values, nil)
+}
+
+func (s *sSysImLoginFailureLog) View(ctx context.Context, in *sysin.ImLoginFailureViewInp) (*sysin.ImLoginFailureLogModel, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	return imAdminQueryOne[sysin.ImLoginFailureLogModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/login-failure-logs/"+strconv.FormatInt(in.Id, 10), nil)
+}
+
+func (s *sSysImLoginFailureLog) Export(ctx context.Context, in *sysin.ImLoginFailureLogListInp) error {
+	list, total, err := s.List(ctx, in)
+	if err != nil {
+		return err
+	}
+	exports := make([]sysin.ImLoginAuditExportModel, 0, len(list))
+	for _, item := range list {
+		exports = append(exports, sysin.ImLoginAuditExportModel{Id: item.Id, UserId: item.UserId, AccountMask: item.AccountMask, EventType: item.FailureType, Platform: item.Platform, Ip: item.Ip, Region: item.Region, RiskLevel: item.RiskLevel, Reason: item.Reason, OccurredAt: item.AttemptAt})
+	}
+	return exportLoginAudit(ctx, exports, total, in.Page, in.PerPage, "登录失败日志")
+}
+
+func exportLoginAudit(ctx context.Context, exports []sysin.ImLoginAuditExportModel, total int, page int, perPage int, label string) error {
+	tags, err := convert.GetEntityDescTags(sysin.ImLoginAuditExportModel{})
+	if err != nil {
+		return err
+	}
+	fileName := "导出" + label + "-" + gctx.CtxId(ctx)
+	sheetName := fmt.Sprintf("索引条件共%v行,共%v页,当前导出是第%v页,本页共%v行", total, form.CalPageCount(total, perPage), page, len(exports))
+	return excel.ExportByStructs(ctx, tags, exports, fileName, sheetName)
+}
+
+func (s *sSysImLoginFailureLog) AddBlacklist(ctx context.Context, in *sysin.ImLoginFailureAddBlacklistInp) error {
+	if err := in.Filter(ctx); err != nil {
+		return err
+	}
+	remark := in.Remark
+	if remark == "" {
+		remark = "由登录失败日志加入"
+	}
+	return service.SysImSecurityPolicy().IPRuleEdit(ctx, &sysin.ImSecurityIPRuleEditInp{
+		TenantId: in.TenantId, RuleType: "blacklist", IpCidr: in.Ip, Action: "deny",
+		SceneJson: gjson.New([]string{"login"}), RiskLevel: "high", Status: consts.StatusEnabled, Remark: remark,
+	})
+}
+
+func (s *sSysImLoginFailureLog) BanUser(ctx context.Context, in *sysin.ImLoginFailureBanUserInp) (*sysin.ImUserCommandModel, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	user := contexts.GetUser(ctx)
+	actorName := ""
+	if user != nil {
+		actorName = user.RealName
+	}
+	command, err := imkafka.PublishAdminCommand(ctx, imkafka.AdminCommandInput{
+		TenantID: tenant.Id, TenantCode: tenant.Code, EventType: consts.ImAdminCommandUserBan,
+		BizType: "user", BizID: strconv.FormatInt(in.UserId, 10),
+		Actor:     &imkafka.Actor{Type: "admin", ID: strconv.FormatInt(contexts.GetUserId(ctx), 10), DisplayName: actorName},
+		Payload:   map[string]any{"user_id": strconv.FormatInt(in.UserId, 10), "target_user_id": strconv.FormatInt(in.UserId, 10), "reason": in.Reason},
+		CreatedBy: contexts.GetUserId(ctx),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &sysin.ImUserCommandModel{CommandID: command.CommandID, EventID: command.EventID, Status: command.Status, TenantID: command.TenantID, TenantCode: command.TenantCode, EventType: command.EventType, IdempotencyKey: command.IdempotencyKey}, nil
+}

server/internal/logic/sys/im_mailbox_config.go

@@ -0,0 +1,121 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+const imMailboxConfigTable = "im_mailbox_config"
+
+type sSysImMailboxConfig struct{}
+
+func NewSysImMailboxConfig() *sSysImMailboxConfig { return &sSysImMailboxConfig{} }
+
+func init() {
+	service.RegisterSysImMailboxConfig(NewSysImMailboxConfig())
+}
+
+func (s *sSysImMailboxConfig) Get(ctx context.Context, in *sysin.ImMailboxConfigGetInp) (res *sysin.ImMailboxConfigModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.ensureDefault(ctx, db); err != nil {
+		return nil, err
+	}
+	if err = s.model(ctx, db).Where("id", 1).Scan(&res); err != nil {
+		return nil, gerror.Wrap(err, "获取IM总经理信箱配置失败，请稍后重试！")
+	}
+	if res != nil {
+		res.TenantId = tenant.Id
+		res.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImMailboxConfig) Update(ctx context.Context, in *sysin.ImMailboxConfigUpdateInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	if err = s.ensureDefault(ctx, db); err != nil {
+		return err
+	}
+	requiredFields := `["subject","content"]`
+	if in.RequiredFields != nil && in.RequiredFields.String() != "" && in.RequiredFields.String() != "null" {
+		requiredFields = in.RequiredFields.String()
+	}
+	attachmentPolicy := `{"max_files":5,"purpose":"executive_mailbox"}`
+	if in.AttachmentPolicy != nil && in.AttachmentPolicy.String() != "" && in.AttachmentPolicy.String() != "null" {
+		attachmentPolicy = in.AttachmentPolicy.String()
+	}
+	if _, err = db.Model(imMailboxConfigTable).Safe().Ctx(ctx).Where("id", 1).Data(g.Map{
+		"enabled":           in.Enabled,
+		"allow_anonymous":   in.AllowAnonymous,
+		"required_fields":   requiredFields,
+		"max_length":        in.MaxLength,
+		"attachment_policy": attachmentPolicy,
+		"notice_title":      in.NoticeTitle,
+		"notice_content":    in.NoticeContent,
+		"notice_updated_at": gtime.Now(),
+		"updated_at":        gtime.Now(),
+	}).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM总经理信箱配置失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_mailbox_config_update", "im_mailbox_config", 1, "success", g.Map{"enabled": in.Enabled})
+	return nil
+}
+
+func (s *sSysImMailboxConfig) model(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model(imMailboxConfigTable).Safe().Ctx(ctx).Fields(
+		"id",
+		"enabled",
+		"allow_anonymous",
+		"CAST(required_fields AS CHAR) required_fields",
+		"max_length",
+		"CAST(attachment_policy AS CHAR) attachment_policy",
+		"notice_title",
+		"notice_content",
+		"notice_updated_at",
+		"updated_at",
+	)
+}
+
+func (s *sSysImMailboxConfig) ensureDefault(ctx context.Context, db gdb.DB) (err error) {
+	var count int
+	if count, err = db.Model(imMailboxConfigTable).Safe().Ctx(ctx).Where("id", 1).Count(); err != nil {
+		return gerror.Wrap(err, "检查IM总经理信箱默认配置失败，请稍后重试！")
+	}
+	if count > 0 {
+		return nil
+	}
+	_, err = db.Model(imMailboxConfigTable).Safe().Ctx(ctx).Data(g.Map{
+		"id":                1,
+		"enabled":           1,
+		"allow_anonymous":   1,
+		"required_fields":   `["subject","content"]`,
+		"max_length":        5000,
+		"attachment_policy": `{"max_files":5,"purpose":"executive_mailbox"}`,
+		"notice_title":      "总经理信箱",
+		"notice_content":    "请如实填写诉求，匿名提交将按企业政策保护展示身份。",
+		"notice_updated_at": gtime.Now(),
+		"created_at":        gtime.Now(),
+		"updated_at":        gtime.Now(),
+	}).Insert()
+	if err != nil {
+		return gerror.Wrap(err, "初始化IM总经理信箱默认配置失败，请稍后重试！")
+	}
+	return nil
+}

server/internal/logic/sys/im_message_admin.go

@@ -0,0 +1,179 @@
+package sys
+
+import (
+	"context"
+	"fmt"
+	"hotgo/internal/consts"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imkafka"
+	"hotgo/internal/model/input/form"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+	"hotgo/utility/convert"
+	"hotgo/utility/excel"
+	"net/url"
+	"strconv"
+
+	"github.com/gogf/gf/v2/os/gctx"
+	"github.com/gogf/gf/v2/util/gconv"
+)
+
+type sSysImPrivateMessage struct{}
+type sSysImGroupMessage struct{}
+
+func NewSysImPrivateMessage() *sSysImPrivateMessage { return &sSysImPrivateMessage{} }
+func NewSysImGroupMessage() *sSysImGroupMessage     { return &sSysImGroupMessage{} }
+
+func init() {
+	service.RegisterSysImPrivateMessage(NewSysImPrivateMessage())
+	service.RegisterSysImGroupMessage(NewSysImGroupMessage())
+}
+
+func (s *sSysImPrivateMessage) List(ctx context.Context, in *sysin.ImPrivateMessageListInp) ([]*sysin.ImMessageListModel, int, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, 0, err
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	setQuery(values, "topic", in.Topic)
+	setQuery(values, "from_user_id", in.FromUserId)
+	setQuery(values, "to_user_id", in.ToUserId)
+	setQuery(values, "content_type", in.ContentType)
+	setQuery(values, "status", in.Status)
+	setQuery(values, "keyword", in.Keyword)
+	addTimeRangeQuery(values, "created_at", in.CreatedAt)
+	return queryImMessages(ctx, in.TenantId, "private-messages", values)
+}
+
+func (s *sSysImGroupMessage) List(ctx context.Context, in *sysin.ImGroupMessageListInp) ([]*sysin.ImMessageListModel, int, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, 0, err
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	setQuery(values, "topic", in.Topic)
+	if in.SeqId > 0 {
+		values.Set("seq_id", strconv.FormatInt(in.SeqId, 10))
+	}
+	setQuery(values, "sender_user_id", in.SenderUserId)
+	setQuery(values, "sender_username", in.SenderUsername)
+	setQuery(values, "sender_nickname", in.SenderNickname)
+	setQuery(values, "group_name", in.GroupName)
+	setQuery(values, "content_type", in.ContentType)
+	setQuery(values, "status", in.Status)
+	setQuery(values, "keyword", in.Keyword)
+	addTimeRangeQuery(values, "created_at", in.CreatedAt)
+	return queryImMessages(ctx, in.TenantId, "group-messages", values)
+}
+
+func queryImMessages(ctx context.Context, tenantId int64, resource string, values url.Values) ([]*sysin.ImMessageListModel, int, error) {
+	tenant, err := resolveImAdminTenant(ctx, tenantId)
+	if err != nil {
+		return nil, 0, err
+	}
+	return imAdminQueryList[sysin.ImMessageListModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/"+resource, values,
+		map[string]string{"sender_user_id": "fromUserId", "sent_at": "createdAt", "message_type": "contentType", "content_summary": "contentExcerpt"})
+}
+
+func (s *sSysImPrivateMessage) View(ctx context.Context, in *sysin.ImMessageViewInp) (*sysin.ImMessageViewModel, error) {
+	return viewImMessage(ctx, in)
+}
+
+func (s *sSysImGroupMessage) View(ctx context.Context, in *sysin.ImMessageViewInp) (*sysin.ImMessageViewModel, error) {
+	return viewImMessage(ctx, in)
+}
+
+func viewImMessage(ctx context.Context, in *sysin.ImMessageViewInp) (*sysin.ImMessageViewModel, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	path := "/internal/admin-query/tenants/" + url.PathEscape(tenant.Code) + "/messages/" + url.PathEscape(in.Topic) + "/" + strconv.FormatInt(in.SeqId, 10)
+	return imAdminQueryOne[sysin.ImMessageViewModel](ctx, tenant, path,
+		map[string]string{"sender_user_id": "fromUserId", "sent_at": "createdAt", "message_type": "contentType"})
+}
+
+func (s *sSysImPrivateMessage) Hide(ctx context.Context, in *sysin.ImMessageActionInp) (*sysin.ImMessageCommandModel, error) {
+	return publishMessageCommand(ctx, in, "private", consts.ImAdminCommandMessageHide)
+}
+
+func (s *sSysImPrivateMessage) Delete(ctx context.Context, in *sysin.ImMessageActionInp) (*sysin.ImMessageCommandModel, error) {
+	return publishMessageCommand(ctx, in, "private", consts.ImAdminCommandMessageDelete)
+}
+
+func (s *sSysImGroupMessage) Hide(ctx context.Context, in *sysin.ImMessageActionInp) (*sysin.ImMessageCommandModel, error) {
+	return publishMessageCommand(ctx, in, "group", consts.ImAdminCommandMessageHide)
+}
+
+func (s *sSysImGroupMessage) Delete(ctx context.Context, in *sysin.ImMessageActionInp) (*sysin.ImMessageCommandModel, error) {
+	return publishMessageCommand(ctx, in, "group", consts.ImAdminCommandMessageDelete)
+}
+
+func publishMessageCommand(ctx context.Context, in *sysin.ImMessageActionInp, conversationType string, eventType string) (*sysin.ImMessageCommandModel, error) {
+	if err := in.Filter(ctx); err != nil {
+		return nil, err
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	user := contexts.GetUser(ctx)
+	actorName := ""
+	if user != nil {
+		actorName = user.RealName
+	}
+	bizId := in.Topic + ":" + strconv.FormatInt(in.SeqId, 10)
+	command, err := imkafka.PublishAdminCommand(ctx, imkafka.AdminCommandInput{
+		TenantID: tenant.Id, TenantCode: tenant.Code, EventType: eventType, BizType: "message", BizID: bizId,
+		Actor:     &imkafka.Actor{Type: "admin", ID: strconv.FormatInt(contexts.GetUserId(ctx), 10), DisplayName: actorName},
+		Payload:   map[string]any{"conversation_type": conversationType, "topic": in.Topic, "seq_id": in.SeqId, "reason": in.Reason},
+		CreatedBy: contexts.GetUserId(ctx),
+	})
+	result := "success"
+	if err != nil {
+		result = "failed"
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, eventType, "message", in.SeqId, result, map[string]any{"conversation_type": conversationType, "topic": in.Topic, "reason": in.Reason})
+	if err != nil {
+		return nil, err
+	}
+	return &sysin.ImMessageCommandModel{CommandId: command.CommandID, EventId: command.EventID, Status: command.Status}, nil
+}
+
+func (s *sSysImPrivateMessage) Export(ctx context.Context, in *sysin.ImPrivateMessageListInp) error {
+	list, total, err := s.List(ctx, in)
+	if err != nil {
+		return err
+	}
+	return exportImMessages(ctx, list, total, in.Page, in.PerPage, "单聊消息")
+}
+
+func (s *sSysImGroupMessage) Export(ctx context.Context, in *sysin.ImGroupMessageListInp) error {
+	list, total, err := s.List(ctx, in)
+	if err != nil {
+		return err
+	}
+	return exportImMessages(ctx, list, total, in.Page, in.PerPage, "群聊消息")
+}
+
+func exportImMessages(ctx context.Context, list []*sysin.ImMessageListModel, total int, page int, perPage int, label string) error {
+	tags, err := convert.GetEntityDescTags(sysin.ImMessageExportModel{})
+	if err != nil {
+		return err
+	}
+	var exports []sysin.ImMessageExportModel
+	if err = gconv.Scan(list, &exports); err != nil {
+		return err
+	}
+	fileName := "导出" + label + "-" + gctx.CtxId(ctx)
+	sheetName := fmt.Sprintf("索引条件共%v行,共%v页,当前导出是第%v页,本页共%v行", total, form.CalPageCount(total, perPage), page, len(list))
+	return excel.ExportByStructs(ctx, tags, exports, fileName, sheetName)
+}
+
+func setQuery(values url.Values, key string, value string) {
+	if value != "" {
+		values.Set(key, value)
+	}
+}

server/internal/logic/sys/im_notification.go

@@ -0,0 +1,186 @@
+package sys
+
+import (
+	"context"
+	"hotgo/internal/consts"
+	"hotgo/internal/dao"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/encoding/gjson"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type sSysImNotification struct{}
+
+func NewSysImNotification() *sSysImNotification {
+	return &sSysImNotification{}
+}
+
+func init() {
+	service.RegisterSysImNotification(NewSysImNotification())
+}
+
+func (s *sSysImNotification) TemplateList(ctx context.Context, in *sysin.ImNotificationTemplateListInp) (list []*sysin.ImNotificationTemplateListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	scope, err := resolveImAdminScopeWithAll(ctx, in.TenantId, true)
+	if err != nil {
+		return
+	}
+	tenants, err := s.listTenants(ctx, scope.TenantId, in.TenantId)
+	if err != nil {
+		return
+	}
+	list = []*sysin.ImNotificationTemplateListModel{}
+	for _, tenant := range tenants {
+		if err = s.ensureTemplates(ctx, tenant.Id); err != nil {
+			return
+		}
+		var tenantList []*sysin.ImNotificationTemplateListModel
+		mod := imtenant.RegistryDB().Model("im_notification_template").Safe().Ctx(ctx).
+			Where("tenant_id", tenant.Id)
+		if in.Scene != "" {
+			mod = mod.Where("scene", in.Scene)
+		}
+		if in.Status != nil {
+			mod = mod.Where("status", *in.Status)
+		}
+		if err = mod.OrderAsc("id").Scan(&tenantList); err != nil {
+			return nil, 0, gerror.Wrap(err, "获取IM通知模板失败，请稍后重试！")
+		}
+		for _, item := range tenantList {
+			item.TenantName = tenant.Name
+			if parsed, parseErr := gjson.DecodeToJson(item.PayloadJson); parseErr == nil && parsed != nil {
+				item.PayloadJson = parsed.MustToJsonString()
+			}
+		}
+		list = append(list, tenantList...)
+	}
+	totalCount = len(list)
+	start, end := pageBounds(in.Page, in.PerPage, totalCount)
+	if start >= totalCount {
+		return []*sysin.ImNotificationTemplateListModel{}, totalCount, nil
+	}
+	return list[start:end], totalCount, nil
+}
+
+func (s *sSysImNotification) TemplateUpdate(ctx context.Context, in *sysin.ImNotificationTemplateUpdateInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	scope, err := resolveImAdminScope(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if err = s.ensureTemplates(ctx, scope.TenantId); err != nil {
+		return
+	}
+	payload := "{}"
+	if in.PayloadJson != nil {
+		payload = in.PayloadJson.MustToJsonString()
+	}
+	if _, err = imtenant.RegistryDB().Model("im_notification_template").Safe().Ctx(ctx).
+		Where("tenant_id", scope.TenantId).
+		Where("scene", in.Scene).
+		Data(g.Map{
+			"in_app_enabled":   in.InAppEnabled,
+			"push_enabled":     in.PushEnabled,
+			"sms_enabled":      in.SmsEnabled,
+			"status":           in.Status,
+			"title_template":   in.TitleTemplate,
+			"content_template": in.ContentTemplate,
+			"payload_json":     payload,
+			"updated_at":       gtime.Now(),
+		}).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM通知模板失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, scope.TenantId, "im_notification_template_update", "im_notification_template", 0, "success", g.Map{"scene": in.Scene})
+	return nil
+}
+
+func (s *sSysImNotification) listTenants(ctx context.Context, scopeTenantId, requestedTenantId int64) (tenants []*entity.ImTenant, err error) {
+	mod := imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx)
+	if scopeTenantId > 0 {
+		mod = mod.WherePri(scopeTenantId)
+	} else if requestedTenantId > 0 {
+		mod = mod.WherePri(requestedTenantId)
+	}
+	if err = mod.OrderAsc(dao.ImTenant.Columns().Id).Scan(&tenants); err != nil {
+		return nil, gerror.Wrap(err, "获取IM租户失败，请稍后重试！")
+	}
+	return tenants, nil
+}
+
+func (s *sSysImNotification) ensureTemplates(ctx context.Context, tenantId int64) error {
+	for _, item := range defaultNotificationTemplates() {
+		count, err := imtenant.RegistryDB().Model("im_notification_template").Safe().Ctx(ctx).
+			Where("tenant_id", tenantId).
+			Where("scene", item.Scene).
+			Count()
+		if err != nil {
+			return gerror.Wrap(err, "检查IM通知模板失败，请稍后重试！")
+		}
+		if count > 0 {
+			continue
+		}
+		if _, err = imtenant.RegistryDB().Model("im_notification_template").Safe().Ctx(ctx).Data(g.Map{
+			"tenant_id":        tenantId,
+			"scene":            item.Scene,
+			"name":             item.Name,
+			"in_app_enabled":   1,
+			"push_enabled":     item.PushEnabled,
+			"sms_enabled":      0,
+			"status":           consts.ImNotificationTemplateEnabled,
+			"title_template":   item.Title,
+			"content_template": item.Content,
+			"payload_json":     gdb.Raw("CAST('{}' AS JSON)"),
+			"created_at":       gtime.Now(),
+			"updated_at":       gtime.Now(),
+		}).Insert(); err != nil {
+			return gerror.Wrap(err, "初始化IM通知模板失败，请稍后重试！")
+		}
+	}
+	return nil
+}
+
+type notificationTemplateSeed struct {
+	Scene       string
+	Name        string
+	Title       string
+	Content     string
+	PushEnabled int
+}
+
+func defaultNotificationTemplates() []*notificationTemplateSeed {
+	return []*notificationTemplateSeed{
+		{Scene: consts.ImNotificationSceneAccountSecurity, Name: "账号安全", Title: "账号安全提醒", Content: "你的账号发生安全事件：{{event}}", PushEnabled: 1},
+		{Scene: consts.ImNotificationSceneFriendRequest, Name: "好友申请", Title: "新的好友申请", Content: "{{user}} 请求添加你为好友", PushEnabled: 1},
+		{Scene: consts.ImNotificationSceneGroupEvent, Name: "群事件", Title: "群通知", Content: "{{group}} 有新的群事件：{{event}}", PushEnabled: 1},
+		{Scene: consts.ImNotificationSceneFileEvent, Name: "文件事件", Title: "文件通知", Content: "{{file}} 状态已更新", PushEnabled: 0},
+		{Scene: consts.ImNotificationSceneMeetingReminder, Name: "会议提醒", Title: "会议提醒", Content: "{{meeting}} 将于 {{time}} 开始", PushEnabled: 1},
+		{Scene: consts.ImNotificationSceneReportReminder, Name: "日报月报提醒", Title: "填报提醒", Content: "请及时提交 {{report_type}}", PushEnabled: 1},
+		{Scene: consts.ImNotificationSceneWorkOrder, Name: "工单处理", Title: "工单状态更新", Content: "你的工单 {{ticket}} 已更新", PushEnabled: 1},
+	}
+}
+
+func pageBounds(page, perPage, total int) (start, end int) {
+	if page <= 0 {
+		page = 1
+	}
+	if perPage <= 0 {
+		perPage = 10
+	}
+	start = (page - 1) * perPage
+	end = start + perPage
+	if end > total {
+		end = total
+	}
+	return
+}

server/internal/logic/sys/im_org.go

@@ -0,0 +1,399 @@
+package sys
+
+import (
+	"context"
+	"fmt"
+	"hotgo/internal/consts"
+	"hotgo/internal/model/input/form"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+	"hotgo/utility/convert"
+	"hotgo/utility/excel"
+	"net/url"
+	"strings"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gctx"
+	"github.com/gogf/gf/v2/os/gtime"
+	"github.com/gogf/gf/v2/util/gconv"
+	"github.com/gogf/gf/v2/util/guid"
+)
+
+type sSysImOrg struct{}
+
+func NewSysImOrg() *sSysImOrg {
+	return &sSysImOrg{}
+}
+
+func init() {
+	service.RegisterSysImOrg(NewSysImOrg())
+}
+
+func (s *sSysImOrg) DepartmentList(ctx context.Context, in *sysin.ImOrgDepartmentListInp) (list []*sysin.ImOrgDepartmentModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	if in.DepartmentId != "" {
+		values.Set("department_id", strings.TrimSpace(in.DepartmentId))
+	}
+	if in.ParentId != "" {
+		values.Set("parent_id", strings.TrimSpace(in.ParentId))
+	}
+	if in.Name != "" {
+		values.Set("name", strings.TrimSpace(in.Name))
+	}
+	if in.State != "" {
+		values.Set("state", strings.TrimSpace(in.State))
+	}
+	return imAdminQueryList[sysin.ImOrgDepartmentModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/org/departments",
+		values,
+		nil,
+	)
+}
+
+func (s *sSysImOrg) DepartmentExport(ctx context.Context, in *sysin.ImOrgDepartmentListInp) (err error) {
+	list, totalCount, err := s.DepartmentList(ctx, in)
+	if err != nil {
+		return
+	}
+	tags, err := convert.GetEntityDescTags(sysin.ImOrgDepartmentExportModel{})
+	if err != nil {
+		return
+	}
+	var exports []sysin.ImOrgDepartmentExportModel
+	if err = gconv.Scan(list, &exports); err != nil {
+		return
+	}
+	fileName := "导出IM组织部门-" + gctx.CtxId(ctx)
+	sheetName := fmt.Sprintf("索引条件共%v行,共%v页,当前导出是第%v页,本页共%v行", totalCount, form.CalPageCount(totalCount, in.PerPage), in.Page, len(list))
+	if len(list) > 0 {
+		_ = writeImAdminAudit(ctx, list[0].TenantId, "im_org_department_export", "im_org_department", 0, "success", g.Map{"count": len(list)})
+	}
+	return excel.ExportByStructs(ctx, tags, exports, fileName, sheetName)
+}
+
+func (s *sSysImOrg) DepartmentEdit(ctx context.Context, in *sysin.ImOrgDepartmentEditInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if in.ParentId != "root" {
+		if exists, err := s.departmentExists(ctx, db, in.ParentId); err != nil {
+			return err
+		} else if !exists {
+			return gerror.New("上级部门不存在")
+		}
+	}
+	if in.Id > 0 {
+		current, err := db.Model("im_org_departments").Safe().Ctx(ctx).Where("id", in.Id).One()
+		if err != nil {
+			return gerror.Wrap(err, "获取IM组织部门失败，请稍后重试！")
+		}
+		if current.IsEmpty() {
+			return gerror.New("部门不存在")
+		}
+		departmentId := current["department_id"].String()
+		if in.ParentId == departmentId {
+			return gerror.New("上级部门不能选择自身")
+		}
+		if err = s.ensureNoDepartmentCycle(ctx, db, departmentId, in.ParentId); err != nil {
+			return err
+		}
+		if _, err = db.Model("im_org_departments").Safe().Ctx(ctx).
+			Where("id", in.Id).
+			Data(g.Map{
+				"name":       in.Name,
+				"parent_id":  in.ParentId,
+				"sort_order": in.SortOrder,
+				"state":      in.State,
+				"version":    gdb.Raw("version+1"),
+				"updated_at": gtime.Now(),
+			}).Update(); err != nil {
+			return gerror.Wrap(err, "更新IM组织部门失败，请稍后重试！")
+		}
+		_ = writeImAdminAudit(ctx, tenant.Id, "im_org_department_update", "im_org_department", in.Id, "success", g.Map{"department_id": departmentId})
+		return nil
+	}
+	departmentId := in.DepartmentId
+	if departmentId == "" {
+		departmentId = "dep_" + strings.ToLower(guid.S())
+	}
+	if exists, err := s.departmentExists(ctx, db, departmentId); err != nil {
+		return err
+	} else if exists {
+		return gerror.New("部门ID已存在")
+	}
+	if _, err = db.Model("im_org_departments").Safe().Ctx(ctx).Data(g.Map{
+		"department_id": departmentId,
+		"name":          in.Name,
+		"parent_id":     in.ParentId,
+		"sort_order":    in.SortOrder,
+		"state":         in.State,
+		"version":       1,
+		"created_at":    gtime.Now(),
+		"updated_at":    gtime.Now(),
+	}).Insert(); err != nil {
+		return gerror.Wrap(err, "创建IM组织部门失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_org_department_create", "im_org_department", 0, "success", g.Map{"department_id": departmentId})
+	return nil
+}
+
+func (s *sSysImOrg) DepartmentDelete(ctx context.Context, in *sysin.ImOrgDepartmentDeleteInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if in.DepartmentId == "root" {
+		return gerror.New("根部门不能删除")
+	}
+	if exists, err := s.departmentExists(ctx, db, in.DepartmentId); err != nil {
+		return err
+	} else if !exists {
+		return gerror.New("部门不存在")
+	}
+	childCount, err := db.Model("im_org_departments").Safe().Ctx(ctx).Where("parent_id", in.DepartmentId).Count()
+	if err != nil {
+		return gerror.Wrap(err, "检查子部门失败，请稍后重试！")
+	}
+	if childCount > 0 {
+		return gerror.New("存在子部门，请先处理后再删除")
+	}
+	memberCount, err := db.Model("im_org_members").Safe().Ctx(ctx).Where("department_id", in.DepartmentId).Count()
+	if err != nil {
+		return gerror.Wrap(err, "检查部门成员失败，请稍后重试！")
+	}
+	if memberCount > 0 {
+		return gerror.New("存在部门成员，请先移除后再删除")
+	}
+	if _, err = db.Model("im_org_departments").Safe().Ctx(ctx).Where("department_id", in.DepartmentId).Delete(); err != nil {
+		return gerror.Wrap(err, "删除IM组织部门失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_org_department_delete", "im_org_department", 0, "success", g.Map{"department_id": in.DepartmentId})
+	return nil
+}
+
+func (s *sSysImOrg) MemberList(ctx context.Context, in *sysin.ImOrgMemberListInp) (list []*sysin.ImOrgMemberModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	tenant, err := resolveImAdminTenant(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	values := addPageQuery(url.Values{}, in.Page, in.PerPage)
+	if in.DepartmentId != "" {
+		values.Set("department_id", strings.TrimSpace(in.DepartmentId))
+	}
+	if in.UserId > 0 {
+		values.Set("user_id", int64ToString(in.UserId))
+	}
+	if in.EmploymentState != "" {
+		values.Set("employment_state", strings.TrimSpace(in.EmploymentState))
+	}
+	if in.Query != "" {
+		values.Set("q", strings.TrimSpace(in.Query))
+	}
+	return imAdminQueryList[sysin.ImOrgMemberModel](ctx, tenant,
+		"/internal/admin-query/tenants/"+url.PathEscape(tenant.Code)+"/org/members",
+		values,
+		nil,
+	)
+}
+
+func (s *sSysImOrg) MemberExport(ctx context.Context, in *sysin.ImOrgMemberListInp) (err error) {
+	list, totalCount, err := s.MemberList(ctx, in)
+	if err != nil {
+		return
+	}
+	tags, err := convert.GetEntityDescTags(sysin.ImOrgMemberExportModel{})
+	if err != nil {
+		return
+	}
+	var exports []sysin.ImOrgMemberExportModel
+	if err = gconv.Scan(list, &exports); err != nil {
+		return
+	}
+	fileName := "导出IM组织成员-" + gctx.CtxId(ctx)
+	sheetName := fmt.Sprintf("索引条件共%v行,共%v页,当前导出是第%v页,本页共%v行", totalCount, form.CalPageCount(totalCount, in.PerPage), in.Page, len(list))
+	if len(list) > 0 {
+		_ = writeImAdminAudit(ctx, list[0].TenantId, "im_org_member_export", "im_org_member", 0, "success", g.Map{"count": len(list), "department_id": in.DepartmentId})
+	}
+	return excel.ExportByStructs(ctx, tags, exports, fileName, sheetName)
+}
+
+func (s *sSysImOrg) MemberEdit(ctx context.Context, in *sysin.ImOrgMemberEditInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	if exists, err := s.departmentExists(ctx, db, in.DepartmentId); err != nil {
+		return err
+	} else if !exists {
+		return gerror.New("部门不存在")
+	}
+	userCount, err := db.Model("im_users").Safe().Ctx(ctx).Where("id", in.UserId).Count()
+	if err != nil {
+		return gerror.Wrap(err, "检查IM用户失败，请稍后重试！")
+	}
+	if userCount == 0 {
+		return gerror.New("IM用户不存在")
+	}
+	data := g.Map{
+		"department_id":    in.DepartmentId,
+		"user_id":          in.UserId,
+		"display_name":     in.DisplayName,
+		"position":         in.Position,
+		"avatar_file_id":   in.AvatarFileId,
+		"mobile":           in.Mobile,
+		"email":            in.Email,
+		"employment_state": in.EmploymentState,
+		"contactable":      in.Contactable,
+		"sort_order":       in.SortOrder,
+		"updated_at":       gtime.Now(),
+	}
+	if in.Id > 0 {
+		data["version"] = gdb.Raw("version+1")
+		if _, err = db.Model("im_org_members").Safe().Ctx(ctx).Where("id", in.Id).Data(data).Update(); err != nil {
+			return gerror.Wrap(err, "更新IM组织成员失败，请稍后重试！")
+		}
+		_ = writeImAdminAudit(ctx, tenant.Id, "im_org_member_update", "im_org_member", in.Id, "success", g.Map{"department_id": in.DepartmentId, "user_id": in.UserId})
+		return nil
+	}
+	data["version"] = 1
+	data["created_at"] = gtime.Now()
+	if _, err = db.Model("im_org_members").Safe().Ctx(ctx).Data(data).Insert(); err != nil {
+		return gerror.Wrap(err, "添加IM组织成员失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_org_member_create", "im_org_member", 0, "success", g.Map{"department_id": in.DepartmentId, "user_id": in.UserId})
+	return nil
+}
+
+func (s *sSysImOrg) MemberDelete(ctx context.Context, in *sysin.ImOrgMemberDeleteInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+	current, err := db.Model("im_org_members").Safe().Ctx(ctx).Where("id", in.Id).One()
+	if err != nil {
+		return gerror.Wrap(err, "获取IM组织成员失败，请稍后重试！")
+	}
+	if current.IsEmpty() {
+		return gerror.New("组织成员不存在")
+	}
+	if _, err = db.Model("im_org_members").Safe().Ctx(ctx).Where("id", in.Id).Delete(); err != nil {
+		return gerror.Wrap(err, "删除IM组织成员失败，请稍后重试！")
+	}
+	_ = writeImAdminAudit(ctx, tenant.Id, "im_org_member_delete", "im_org_member", in.Id, "success", g.Map{"department_id": current["department_id"].String(), "user_id": current["user_id"].Int64()})
+	return nil
+}
+
+func (s *sSysImOrg) Search(ctx context.Context, in *sysin.ImOrgSearchInp) (res *sysin.ImOrgSearchModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	departments, _, err := s.DepartmentList(ctx, &sysin.ImOrgDepartmentListInp{
+		PageReq:  form.PageReq{Page: 1, PerPage: 20, Pagination: true},
+		TenantId: in.TenantId,
+		Name:     in.Query,
+		State:    consts.ImOrgDepartmentStateActive,
+	})
+	if err != nil {
+		return nil, err
+	}
+	members, _, err := s.MemberList(ctx, &sysin.ImOrgMemberListInp{
+		PageReq:         form.PageReq{Page: 1, PerPage: 20, Pagination: true},
+		TenantId:        in.TenantId,
+		Query:           in.Query,
+		EmploymentState: consts.ImOrgEmploymentStateActive,
+	})
+	if err != nil {
+		return nil, err
+	}
+	res = &sysin.ImOrgSearchModel{Departments: departments, Members: members}
+	return
+}
+
+func (s *sSysImOrg) departmentModel(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model("im_org_departments d").Safe().Ctx(ctx).Fields(
+		"d.id",
+		"d.department_id",
+		"d.name",
+		"d.parent_id",
+		"d.sort_order",
+		"d.version",
+		"d.state",
+		"d.created_at",
+		"d.updated_at",
+		"(SELECT COUNT(*) FROM im_org_departments child WHERE child.parent_id=d.department_id AND child.state='active') child_count",
+		"(SELECT COUNT(*) FROM im_org_members m WHERE m.department_id=d.department_id) member_count",
+	)
+}
+
+func (s *sSysImOrg) memberModel(ctx context.Context, db gdb.DB) *gdb.Model {
+	return db.Model("im_org_members m").Safe().Ctx(ctx).
+		LeftJoin("im_org_departments d", "d.department_id=m.department_id").
+		Fields(
+			"m.id",
+			"m.department_id",
+			"COALESCE(d.name,'') department_name",
+			"m.user_id",
+			"m.display_name",
+			"m.position",
+			"m.avatar_file_id",
+			"m.mobile",
+			"m.email",
+			"m.employment_state",
+			"m.contactable",
+			"m.sort_order",
+			"m.version",
+			"m.created_at",
+			"m.updated_at",
+		)
+}
+
+func (s *sSysImOrg) departmentExists(ctx context.Context, db gdb.DB, departmentId string) (bool, error) {
+	count, err := db.Model("im_org_departments").Safe().Ctx(ctx).Where("department_id", strings.TrimSpace(departmentId)).Count()
+	if err != nil {
+		return false, gerror.Wrap(err, "检查IM组织部门失败，请稍后重试！")
+	}
+	return count > 0, nil
+}
+
+func (s *sSysImOrg) ensureNoDepartmentCycle(ctx context.Context, db gdb.DB, departmentId, parentId string) error {
+	next := strings.TrimSpace(parentId)
+	for next != "" && next != "root" {
+		if next == departmentId {
+			return gerror.New("上级部门不能选择自身或下级部门")
+		}
+		row, err := db.Model("im_org_departments").Safe().Ctx(ctx).Fields("parent_id").Where("department_id", next).One()
+		if err != nil {
+			return gerror.Wrap(err, "检查部门层级失败，请稍后重试！")
+		}
+		if row.IsEmpty() {
+			return gerror.New("上级部门不存在")
+		}
+		next = row["parent_id"].String()
+	}
+	return nil
+}

server/internal/logic/sys/im_outbox.go

@@ -0,0 +1,190 @@
+// Package sys
+// @Link  https://github.com/bufanyun/hotgo
+// @Copyright  Copyright (c) 2026 HotGo
+// @Author  Ms <133814250@qq.com>
+// @License  https://github.com/bufanyun/hotgo/blob/master/LICENSE
+package sys
+
+import (
+	"context"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/database/gdb"
+	"github.com/gogf/gf/v2/errors/gerror"
+	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
+)
+
+type sSysImOutbox struct{}
+
+func NewSysImOutbox() *sSysImOutbox {
+	return &sSysImOutbox{}
+}
+
+func init() {
+	service.RegisterSysImOutbox(NewSysImOutbox())
+}
+
+func (s *sSysImOutbox) List(ctx context.Context, in *sysin.ImOutboxListInp) (list []*sysin.ImOutboxListModel, totalCount int, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := s.tenantDB(ctx, in.TenantId)
+	if err != nil {
+		return
+	}
+
+	mod := s.model(ctx, db, in.Source)
+	mod = s.applyWhere(mod, in)
+	mod = mod.Page(in.Page, in.PerPage).OrderDesc("id")
+	if err = mod.ScanAndCount(&list, &totalCount, false); err != nil {
+		err = gerror.Wrap(err, "获取IM Outbox列表失败，请稍后重试！")
+		return
+	}
+	for _, item := range list {
+		item.TenantId = tenant.Id
+		item.TenantName = tenant.Name
+	}
+	return
+}
+
+func (s *sSysImOutbox) View(ctx context.Context, in *sysin.ImOutboxViewInp) (res *sysin.ImOutboxViewModel, err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	db, tenant, err := s.tenantDB(ctx, in.TenantId)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.model(ctx, db, in.Source).Where("id", in.Id).Scan(&res); err != nil {
+		return nil, gerror.Wrap(err, "获取IM Outbox详情失败，请稍后重试！")
+	}
+	if res == nil {
+		return nil, nil
+	}
+	res.TenantId = tenant.Id
+	res.TenantName = tenant.Name
+	return
+}
+
+func (s *sSysImOutbox) Retry(ctx context.Context, in *sysin.ImOutboxActionInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.updateStatus(ctx, in, sysin.ImOutboxStatusPending)
+}
+
+func (s *sSysImOutbox) Dead(ctx context.Context, in *sysin.ImOutboxActionInp) (err error) {
+	if err = in.Filter(ctx); err != nil {
+		return
+	}
+	return s.updateStatus(ctx, in, sysin.ImOutboxStatusDead)
+}
+
+func (s *sSysImOutbox) tenantDB(ctx context.Context, selectedTenantId int64) (db gdb.DB, tenant *entity.ImTenant, err error) {
+	scope, err := resolveImAdminScope(ctx, selectedTenantId)
+	if err != nil {
+		return nil, nil, err
+	}
+	return imtenant.DB(ctx, scope.TenantId)
+}
+
+func (s *sSysImOutbox) model(ctx context.Context, db gdb.DB, source string) *gdb.Model {
+	if source == sysin.ImOutboxSourceGroup {
+		return db.Model("im_group_events_outbox").Safe().Ctx(ctx).Fields(
+			"'group' source",
+			"id",
+			"event_id",
+			"'topic' target_type",
+			"topic target",
+			"actor_user_id",
+			"event_type",
+			"CAST(payload AS CHAR) payload",
+			"status",
+			"attempts",
+			"next_retry_at",
+			"delivered_at",
+			"created_at",
+			"updated_at",
+		)
+	}
+	return db.Model("im_business_events_outbox").Safe().Ctx(ctx).Fields(
+		"'business' source",
+		"id",
+		"event_id",
+		"target_type",
+		"target",
+		"actor_user_id",
+		"event_type",
+		"CAST(payload AS CHAR) payload",
+		"status",
+		"attempts",
+		"next_retry_at",
+		"delivered_at",
+		"created_at",
+		"updated_at",
+	)
+}
+
+func (s *sSysImOutbox) applyWhere(mod *gdb.Model, in *sysin.ImOutboxListInp) *gdb.Model {
+	if in.EventId != "" {
+		mod = mod.WhereLike("event_id", "%"+in.EventId+"%")
+	}
+	if in.EventType != "" {
+		mod = mod.Where("event_type", in.EventType)
+	}
+	if in.TargetType != "" && in.Source == sysin.ImOutboxSourceBusiness {
+		mod = mod.Where("target_type", in.TargetType)
+	}
+	if in.Target != "" {
+		if in.Source == sysin.ImOutboxSourceGroup {
+			mod = mod.WhereLike("topic", "%"+in.Target+"%")
+		} else {
+			mod = mod.WhereLike("target", "%"+in.Target+"%")
+		}
+	}
+	if in.Status != "" {
+		mod = mod.Where("status", in.Status)
+	}
+	if len(in.CreatedAt) == 2 {
+		mod = mod.WhereBetween("created_at", in.CreatedAt[0], in.CreatedAt[1])
+	}
+	return mod
+}
+
+func (s *sSysImOutbox) updateStatus(ctx context.Context, in *sysin.ImOutboxActionInp, status string) (err error) {
+	db, _, err := s.tenantDB(ctx, in.TenantId)
+	if err != nil {
+		return err
+	}
+	table := "im_business_events_outbox"
+	if in.Source == sysin.ImOutboxSourceGroup {
+		table = "im_group_events_outbox"
+	}
+	current, err := db.Model(table).Safe().Ctx(ctx).Fields("status").Where("id", in.Id).Value()
+	if err != nil {
+		return gerror.Wrap(err, "获取IM Outbox事件失败，请稍后重试！")
+	}
+	if current.IsNil() {
+		return gerror.New("IM Outbox事件不存在")
+	}
+	if current.String() == sysin.ImOutboxStatusDelivered {
+		return gerror.New("已投递事件不能重新处置")
+	}
+
+	data := g.Map{
+		"status":     status,
+		"updated_at": gtime.Now(),
+	}
+	if status == sysin.ImOutboxStatusPending {
+		data["next_retry_at"] = nil
+		data["delivered_at"] = nil
+	}
+	if _, err = db.Model(table).Safe().Ctx(ctx).Where("id", in.Id).Data(data).Update(); err != nil {
+		return gerror.Wrap(err, "更新IM Outbox事件失败，请稍后重试！")
+	}
+	return
+}

server/internal/logic/sys/im_policy_support.go

@@ -0,0 +1,60 @@
+package sys
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"hotgo/internal/dao"
+	"hotgo/internal/library/contexts"
+	"hotgo/internal/library/imkafka"
+	"hotgo/internal/library/imtenant"
+	"hotgo/internal/model/entity"
+	"hotgo/internal/service"
+
+	"github.com/gogf/gf/v2/encoding/gjson"
+	"github.com/gogf/gf/v2/errors/gerror"
+)
+
+func resolveImPolicyTenant(ctx context.Context, selectedTenantID int64) (tenantID int64, tenantCode string, err error) {
+	operatorID := contexts.GetUserId(ctx)
+	if service.AdminMember().VerifySuperId(ctx, operatorID) && selectedTenantID == 0 {
+		return 0, "*", nil
+	}
+	scope, err := resolveImAdminScope(ctx, selectedTenantID)
+	if err != nil {
+		return 0, "", err
+	}
+	var tenant *entity.ImTenant
+	if err = imtenant.RegistryDB().Model(dao.ImTenant.Table()).Safe().Ctx(ctx).
+		Where(dao.ImTenant.Columns().Id, scope.TenantId).Scan(&tenant); err != nil {
+		return 0, "", gerror.Wrap(err, "获取IM租户失败")
+	}
+	if tenant == nil {
+		return 0, "", gerror.New("IM租户不存在")
+	}
+	return tenant.Id, tenant.Code, nil
+}
+
+func policyJSON(value *gjson.Json, fallback string) string {
+	if value == nil || value.String() == "" || value.String() == "null" {
+		return fallback
+	}
+	return value.String()
+}
+
+func publishImPolicyEvent(ctx context.Context, tenantID int64, tenantCode, eventType, group string, version uint) error {
+	return imkafka.PublishConfigEvent(ctx, imkafka.ConfigEventInput{
+		TenantID:   tenantID,
+		TenantCode: tenantCode,
+		EventType:  eventType,
+		Group:      group,
+		Keys:       []string{"version", "payload"},
+		BizID:      fmt.Sprintf("%s:%d:%d", group, tenantID, version),
+		Actor: &imkafka.Actor{
+			Type: "admin",
+			ID:   strconv.FormatInt(contexts.GetUserId(ctx), 10),
+		},
+		CreatedBy: contexts.GetUserId(ctx),
+	})
+}

server/internal/logic/sys/im_realname.go

@@ -8,7 +8,6 @@ package sys
 import (
 	"context"
 	"hotgo/internal/consts"
-	"hotgo/internal/library/imtenant"
 	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"
 
@@ -33,7 +32,7 @@ func (s *sSysImRealname) List(ctx context.Context, in *sysin.ImRealnameListInp)
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return
 	}
@@ -91,7 +90,7 @@ func (s *sSysImRealname) View(ctx context.Context, in *sysin.ImRealnameViewInp)
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, tenant, err := imtenant.DB(ctx, in.TenantId)
+	db, tenant, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return nil, err
 	}
@@ -129,7 +128,7 @@ func (s *sSysImRealname) Review(ctx context.Context, in *sysin.ImRealnameReviewI
 	if err = in.Filter(ctx); err != nil {
 		return
 	}
-	db, _, err := imtenant.DB(ctx, in.TenantId)
+	db, _, err := resolveImTenantDB(ctx, in.TenantId)
 	if err != nil {
 		return
 	}