feat: 将安全策略模板化，新建商户时自动复制初始策略

2026-09-22 18:32:08 +08:00
parent 9a9e30f94e
commit dc3c45cd53
17 changed files with 1172 additions and 795 deletions
@@ -27,11 +27,6 @@ type SaveReq struct {
 type SaveRes struct {
 	Id int64 `json:"id"`
 }
-type PublishReq struct {
-	g.Meta `path:"/imSecurityPolicy/publish" method:"post" tags:"IM安全策略" summary:"发布安全策略"`
-	sysin.ImSecurityPolicyPublishInp
-}
-type PublishRes struct{}
 type RestoreDefaultReq struct {
 	g.Meta `path:"/imSecurityPolicy/restoreDefault" method:"post" tags:"IM安全策略" summary:"恢复默认安全策略"`
 	sysin.ImSecurityPolicyRestoreInp
@@ -38,10 +38,6 @@ func (c *cImSecurityPolicy) Save(ctx context.Context, req *imsecuritypolicy.Save
 	}
 	return &imsecuritypolicy.SaveRes{Id: id}, nil
 }
-func (c *cImSecurityPolicy) Publish(ctx context.Context, req *imsecuritypolicy.PublishReq) (res *imsecuritypolicy.PublishRes, err error) {
-	err = service.SysImSecurityPolicy().Publish(ctx, &req.ImSecurityPolicyPublishInp)
-	return
-}
 func (c *cImSecurityPolicy) RestoreDefault(ctx context.Context, req *imsecuritypolicy.RestoreDefaultReq) (res *imsecuritypolicy.RestoreDefaultRes, err error) {
 	id, err := service.SysImSecurityPolicy().RestoreDefault(ctx, &req.ImSecurityPolicyRestoreInp)
 	if err != nil {
@@ -10,8 +10,10 @@ import (
 	"hotgo/internal/library/imkafka"
 	"hotgo/internal/library/imtenant"
 	"hotgo/internal/model/entity"
+	"hotgo/internal/model/input/sysin"
 	"hotgo/internal/service"

+	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/encoding/gjson"
 	"github.com/gogf/gf/v2/errors/gerror"
 )
@@ -43,6 +45,38 @@ func policyJSON(value *gjson.Json, fallback string) string {
 	return value.String()
 }

+// imPolicyTemplateTable 安全策略模板表（平台级单行，新建商户初始策略来源）
+const imPolicyTemplateTable = "im_security_policy_template"
+
+// loadPolicyTemplateRow 读取安全策略模板单行（取最小 id），返回 nil 表示模板未初始化。
+func loadPolicyTemplateRow(model *gdb.Model) (gdb.Record, error) {
+	row, err := model.Order("id ASC").Limit(1).One()
+	if err != nil {
+		return nil, err
+	}
+	if row.IsEmpty() {
+		return nil, nil
+	}
+	return row, nil
+}
+
+// templateCurfewRules 解析模板行 curfew_rules JSON 为宵禁规则输入列表
+func templateCurfewRules(tpl gdb.Record) []*sysin.ImMessageCurfewRuleInp {
+	rules := make([]*sysin.ImMessageCurfewRuleInp, 0)
+	for _, item := range gjson.New(tpl["curfew_rules"].String()).Array() {
+		j := gjson.New(item)
+		rules = append(rules, &sysin.ImMessageCurfewRuleInp{
+			RuleCode: j.Get("ruleCode").String(), RuleName: j.Get("ruleName").String(), DateType: j.Get("dateType").String(),
+			CustomDates: gjson.New(j.Get("customDates").String()), Weekdays: gjson.New(j.Get("weekdays").String()),
+			Timezone: j.Get("timezone").String(), StartTime: j.Get("startTime").String(), EndTime: j.Get("endTime").String(),
+			Scope: j.Get("scope").String(),
+			WhitelistUserIds: gjson.New(j.Get("whitelistUserIds").String()), WhitelistGroupIds: gjson.New(j.Get("whitelistGroupIds").String()),
+			Message: j.Get("message").String(), Status: j.Get("status").Int(), Sort: j.Get("sort").Int(),
+		})
+	}
+	return rules
+}
+
 func publishImPolicyEvent(ctx context.Context, tenantID int64, tenantCode, eventType, group string, version uint) error {
 	return imkafka.PublishConfigEvent(ctx, imkafka.ConfigEventInput{
 		TenantID:   tenantID,
@@ -65,8 +65,34 @@ func (s *sSysImSecurityPolicy) View(ctx context.Context, in *sysin.ImSecurityPol
 		err = baseModel.Where(c.TenantId, tenantID).
 			Where(c.PublishStatus, consts.ImSecurityPublishPublished).
 			OrderDesc(c.PolicyVersion).Scan(&res)
-		if err == nil && res == nil {
-			err = baseModel.Where(c.TenantId, tenantID).OrderDesc(c.PolicyVersion).Scan(&res)
+		if err != nil {
+			return nil, gerror.Wrap(err, "获取安全策略失败")
+		}
+		if res == nil {
+			// 无自建策略时回落默认模板展示，保存后成为本商户自己的策略
+			tpl, tplErr := loadPolicyTemplateRow(imtenant.RegistryDB().Model(imPolicyTemplateTable).Safe().Ctx(ctx))
+			if tplErr != nil {
+				return nil, gerror.Wrap(tplErr, "读取安全策略模板失败")
+			}
+			if tpl != nil {
+				res = &sysin.ImSecurityPolicyModel{
+					TenantId:             tenantID,
+					PolicyName:           tpl["policy_name"].String(),
+					PasswordPolicy:       tpl["password_policy"].String(),
+					LoginRateLimit:       tpl["login_rate_limit"].String(),
+					SensitiveWordPolicy:  tpl["sensitive_word_policy"].String(),
+					FileReviewPolicy:     tpl["file_review_policy"].String(),
+					RealnamePolicy:       tpl["realname_policy"].String(),
+					RiskChallengePolicy:  tpl["risk_challenge_policy"].String(),
+					GlobalFriendEnabled:  tpl["global_friend_enabled"].Int(),
+					FriendDisabledPolicy: tpl["friend_disabled_policy"].String(),
+					MessageCurfewEnabled: tpl["message_curfew_enabled"].Int(),
+				}
+				for _, rule := range templateCurfewRules(tpl) {
+					res.CurfewRules = append(res.CurfewRules, &sysin.ImMessageCurfewRuleModel{RuleCode: rule.RuleCode, RuleName: rule.RuleName, DateType: rule.DateType, CustomDates: rule.CustomDates.String(), Weekdays: rule.Weekdays.String(), Timezone: rule.Timezone, StartTime: rule.StartTime, EndTime: rule.EndTime, Scope: rule.Scope, WhitelistUserIds: rule.WhitelistUserIds.String(), WhitelistGroupIds: rule.WhitelistGroupIds.String(), Message: rule.Message, Status: rule.Status, Sort: rule.Sort})
+				}
+			}
+			return
 		}
 	}
 	if err != nil {
@@ -88,6 +114,8 @@ func (s *sSysImSecurityPolicy) curfewRules(ctx context.Context, policyID int64)
 	return
 }

+// Save 保存安全策略并立即生效：每租户仅一条当前生效记录（单记录模型，无草稿/发布工作流）。
+// 已有记录则原地更新（版本号自增仅作审计），无则创建；同步 im_tenant 冗余开关并投递策略变更事件。
 func (s *sSysImSecurityPolicy) Save(ctx context.Context, in *sysin.ImSecurityPolicySaveInp) (id int64, err error) {
 	if err = in.Filter(ctx); err != nil {
 		return
@@ -96,55 +124,52 @@ func (s *sSysImSecurityPolicy) Save(ctx context.Context, in *sysin.ImSecurityPol
 	if err != nil {
 		return 0, err
 	}
+	if tenantID == 0 {
+		// 默认模板不可通过商户策略保存入口修改
+		return 0, gerror.New("默认模板不可修改，请选择具体商户")
+	}
 	db := imtenant.RegistryDB()
 	c := dao.ImSecurityPolicy.Columns()
 	rc := dao.ImMessageCurfewRules.Columns()
+	tc := dao.ImTenant.Columns()
 	operator := contexts.GetUserId(ctx)
 	now := gtime.Now()
+	version := uint(1)
 	err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
-		version := uint(0)
-		if in.Id > 0 {
-			current, readErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).WhereNull(c.DeletedAt).One()
-			if readErr != nil {
-				return readErr
-			}
-			if current.IsEmpty() || current[c.TenantId].Int64() != tenantID {
-				return gerror.New("安全策略不存在")
-			}
-			if current[c.PublishStatus].String() != consts.ImSecurityPublishDraft {
-				return gerror.New("只有草稿状态的安全策略可以编辑")
-			}
-			version = current[c.PolicyVersion].Uint()
-			id = in.Id
-		} else {
-			maxValue, maxErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.TenantId, tenantID).Max(c.PolicyVersion)
-			if maxErr != nil {
-				return maxErr
-			}
-			version = uint(maxValue) + 1
+		current, readErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
+			Where(c.TenantId, tenantID).Where(c.PublishStatus, consts.ImSecurityPublishPublished).
+			WhereNull(c.DeletedAt).OrderDesc(c.PolicyVersion).One()
+		if readErr != nil {
+			return readErr
 		}
-		data := g.Map{c.TenantId: tenantID, c.PolicyVersion: version, c.PolicyName: in.PolicyName, c.PublishStatus: consts.ImSecurityPublishDraft, c.PasswordPolicy: policyJSON(in.PasswordPolicy, "{}"), c.LoginRateLimit: policyJSON(in.LoginRateLimit, "{}"), c.SensitiveWordPolicy: normalizedModerationPolicy(in.SensitiveWordPolicy, tenantCode), c.FileReviewPolicy: policyJSON(in.FileReviewPolicy, "{}"), c.RealnamePolicy: policyJSON(in.RealnamePolicy, "{}"), c.RiskChallengePolicy: policyJSON(in.RiskChallengePolicy, "{}"), c.GlobalFriendEnabled: in.GlobalFriendEnabled, c.FriendDisabledPolicy: policyJSON(in.FriendDisabledPolicy, `{"hide_profile":true,"block_qrcode":true,"block_group_member_entry":true,"blocked_entries":["search","profile_card","group_member","qrcode","invite_auto_add","recommendation"],"message":"当前时段暂不允许添加好友"}`), c.MessageCurfewEnabled: in.MessageCurfewEnabled, c.Remark: in.Remark, c.UpdatedAt: now, c.UpdatedBy: operator}
-		if in.Id > 0 && in.LoginRateLimit == nil {
-			// 未提交登录失败策略时保留原值（登录失败锁定已迁移至独立配置入口，避免保存草稿清空配置）
+		data := g.Map{c.PolicyName: in.PolicyName, c.PublishStatus: consts.ImSecurityPublishPublished, c.PasswordPolicy: policyJSON(in.PasswordPolicy, "{}"), c.LoginRateLimit: policyJSON(in.LoginRateLimit, "{}"), c.SensitiveWordPolicy: normalizedModerationPolicy(in.SensitiveWordPolicy, tenantCode), c.FileReviewPolicy: policyJSON(in.FileReviewPolicy, "{}"), c.RealnamePolicy: policyJSON(in.RealnamePolicy, "{}"), c.RiskChallengePolicy: policyJSON(in.RiskChallengePolicy, "{}"), c.GlobalFriendEnabled: in.GlobalFriendEnabled, c.FriendDisabledPolicy: policyJSON(in.FriendDisabledPolicy, `{"hide_profile":true,"block_qrcode":true,"block_group_member_entry":true,"blocked_entries":["search","profile_card","group_member","qrcode","invite_auto_add","recommendation"],"message":"当前时段暂不允许添加好友"}`), c.MessageCurfewEnabled: in.MessageCurfewEnabled, c.Remark: in.Remark, c.UpdatedAt: now, c.UpdatedBy: operator}
+		if in.LoginRateLimit == nil {
+			// 未提交登录失败策略时保留原值（登录失败锁定由独立配置入口管理，避免保存时清空配置）
 			delete(data, c.LoginRateLimit)
 		}
-		if in.Id > 0 {
-			if _, updateErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).Data(data).Update(); updateErr != nil {
-				return updateErr
-			}
-		} else {
+		if current.IsEmpty() {
+			version = 1
+			data[c.TenantId] = tenantID
+			data[c.PolicyVersion] = version
 			data[c.CreatedAt] = now
 			data[c.CreatedBy] = operator
 			result, insertErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Data(data).Insert()
 			if insertErr != nil {
 				return insertErr
 			}
-			id, insertErr = result.LastInsertId()
-			if insertErr != nil {
+			if id, insertErr = result.LastInsertId(); insertErr != nil {
 				return insertErr
 			}
+		} else {
+			id = current[c.Id].Int64()
+			version = current[c.PolicyVersion].Uint() + 1
+			data[c.PolicyVersion] = version
+			if _, updateErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, id).Data(data).Update(); updateErr != nil {
+				return updateErr
+			}
 		}
-		if _, deleteErr := tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Where(rc.PolicyId, id).Delete(); deleteErr != nil {
+		// 规则整体重建：uk_im_message_curfew_rule 唯一键含 tenant_id+rule_code，软删行仍占键会冲突，必须硬删
+		if _, deleteErr := tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Where(rc.PolicyId, id).Unscoped().Delete(); deleteErr != nil {
 			return deleteErr
 		}
 		for _, rule := range in.CurfewRules {
@@ -153,12 +178,23 @@ func (s *sSysImSecurityPolicy) Save(ctx context.Context, in *sysin.ImSecurityPol
 				return insertErr
 			}
 		}
+		if tenantID > 0 {
+			// 上游已将商户配置并入 im_tenant 表，此处同步冗余开关与策略版本（商户行必然存在，无需补建）
+			if _, cfgErr := tx.Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(tc.Id, tenantID).
+				Data(g.Map{tc.SecurityPolicyVersion: version, tc.GlobalFriendEnabled: in.GlobalFriendEnabled, tc.MessageCurfewEnabled: in.MessageCurfewEnabled, tc.UpdatedAt: now, tc.UpdatedBy: operator}).Update(); cfgErr != nil {
+				return cfgErr
+			}
+		}
 		return nil
 	})
 	if err != nil {
-		return 0, gerror.Wrap(err, "保存安全策略草稿失败")
+		return 0, gerror.Wrap(err, "保存安全策略失败")
+	}
+	_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_save", "im_security_policy", id, "success", g.Map{"version": version, "global_friend_enabled": in.GlobalFriendEnabled, "message_curfew_enabled": in.MessageCurfewEnabled})
+	// 保存即生效：投递策略变更事件，IM 端消费后失效策略缓存并回源拉取新配置
+	if err = publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", version); err != nil {
+		return id, err
 	}
-	_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_save", "im_security_policy", id, "success", g.Map{"global_friend_enabled": in.GlobalFriendEnabled, "message_curfew_enabled": in.MessageCurfewEnabled})
 	return id, nil
 }

@@ -176,51 +212,6 @@ func normalizedModerationPolicy(value *gjson.Json, _ string) string {
 	return gjson.New(policy).String()
 }

-func (s *sSysImSecurityPolicy) Publish(ctx context.Context, in *sysin.ImSecurityPolicyPublishInp) error {
-	if err := in.Filter(ctx); err != nil {
-		return err
-	}
-	db := imtenant.RegistryDB()
-	c := dao.ImSecurityPolicy.Columns()
-	var row gdb.Record
-	var err error
-	if row, err = db.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).WhereNull(c.DeletedAt).One(); err != nil {
-		return err
-	}
-	if row.IsEmpty() {
-		return gerror.New("安全策略不存在")
-	}
-	if row[c.PublishStatus].String() != consts.ImSecurityPublishDraft {
-		return gerror.New("只有草稿状态可以发布")
-	}
-	tenantID, tenantCode, err := resolveImPolicyTenant(ctx, row[c.TenantId].Int64())
-	if err != nil {
-		return err
-	}
-	operator := contexts.GetUserId(ctx)
-	now := gtime.Now()
-	err = db.Transaction(ctx, func(ctx context.Context, tx gdb.TX) error {
-		if _, updateErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.TenantId, tenantID).Where(c.PublishStatus, consts.ImSecurityPublishPublished).WhereNot(c.Id, in.Id).WhereNull(c.DeletedAt).Data(g.Map{c.PublishStatus: consts.ImSecurityPublishArchived, c.UpdatedAt: now, c.UpdatedBy: operator}).Update(); updateErr != nil {
-			return updateErr
-		}
-		if _, updateErr := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Where(c.Id, in.Id).Data(g.Map{c.PublishStatus: consts.ImSecurityPublishPublished, c.PublishedAt: now, c.PublishedBy: operator, c.UpdatedAt: now, c.UpdatedBy: operator}).Update(); updateErr != nil {
-			return updateErr
-		}
-		if tenantID > 0 {
-			tc := dao.ImTenant.Columns()
-			if _, updateErr := tx.Model(dao.ImTenant.Table()).Safe().Ctx(ctx).Where(tc.Id, tenantID).Data(g.Map{tc.SecurityPolicyVersion: row[c.PolicyVersion].Uint(), tc.GlobalFriendEnabled: row[c.GlobalFriendEnabled].Int(), tc.MessageCurfewEnabled: row[c.MessageCurfewEnabled].Int(), tc.UpdatedAt: now, tc.UpdatedBy: operator}).Update(); updateErr != nil {
-				return updateErr
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		return gerror.Wrap(err, "发布安全策略失败")
-	}
-	_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_publish", "im_security_policy", in.Id, "success", g.Map{"reason": in.Reason, "version": row[c.PolicyVersion].Uint()})
-	return publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", row[c.PolicyVersion].Uint())
-}
-
 func (s *sSysImSecurityPolicy) RestoreDefault(ctx context.Context, in *sysin.ImSecurityPolicyRestoreInp) (int64, error) {
 	if err := in.Filter(ctx); err != nil {
 		return 0, err
@@ -229,27 +220,15 @@ func (s *sSysImSecurityPolicy) RestoreDefault(ctx context.Context, in *sysin.ImS
 	if err != nil {
 		return 0, err
 	}
-	c := dao.ImSecurityPolicy.Columns()
-	var source *sysin.ImSecurityPolicyModel
-	err = imtenant.RegistryDB().Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
-		Fields(securityPolicyFields("")...).Where(c.TenantId, 0).
-		Where(c.PublishStatus, consts.ImSecurityPublishPublished).WhereNull(c.DeletedAt).
-		OrderDesc(c.PolicyVersion).Scan(&source)
+	// 读取安全策略模板，将模板内容覆盖为当前商户的策略（复制后商户可自行修改）
+	tpl, err := loadPolicyTemplateRow(imtenant.RegistryDB().Model(imPolicyTemplateTable).Safe().Ctx(ctx))
 	if err != nil {
-		return 0, gerror.Wrap(err, "读取全局默认安全策略失败")
+		return 0, gerror.Wrap(err, "读取安全策略模板失败")
 	}
-	if source == nil {
-		return 0, gerror.New("全局默认安全策略不存在")
+	if tpl == nil {
+		return 0, gerror.New("安全策略模板未初始化")
 	}
-	source.CurfewRules, err = s.curfewRules(ctx, source.Id)
-	if err != nil {
-		return 0, err
-	}
-	rules := make([]*sysin.ImMessageCurfewRuleInp, 0, len(source.CurfewRules))
-	for _, rule := range source.CurfewRules {
-		rules = append(rules, &sysin.ImMessageCurfewRuleInp{RuleCode: rule.RuleCode, RuleName: rule.RuleName, DateType: rule.DateType, CustomDates: gjson.New(rule.CustomDates), Weekdays: gjson.New(rule.Weekdays), Timezone: rule.Timezone, StartTime: rule.StartTime, EndTime: rule.EndTime, Scope: rule.Scope, WhitelistUserIds: gjson.New(rule.WhitelistUserIds), WhitelistGroupIds: gjson.New(rule.WhitelistGroupIds), Message: rule.Message, Status: rule.Status, Sort: rule.Sort})
-	}
-	id, err := s.Save(ctx, &sysin.ImSecurityPolicySaveInp{TenantId: tenantID, PolicyName: "恢复默认安全策略", PasswordPolicy: gjson.New(source.PasswordPolicy), LoginRateLimit: gjson.New(source.LoginRateLimit), SensitiveWordPolicy: gjson.New(source.SensitiveWordPolicy), FileReviewPolicy: gjson.New(source.FileReviewPolicy), RealnamePolicy: gjson.New(source.RealnamePolicy), RiskChallengePolicy: gjson.New(source.RiskChallengePolicy), GlobalFriendEnabled: source.GlobalFriendEnabled, FriendDisabledPolicy: gjson.New(source.FriendDisabledPolicy), MessageCurfewEnabled: source.MessageCurfewEnabled, Remark: in.Reason, CurfewRules: rules})
+	id, err := s.Save(ctx, &sysin.ImSecurityPolicySaveInp{TenantId: tenantID, PolicyName: tpl["policy_name"].String(), PasswordPolicy: gjson.New(tpl["password_policy"].String()), LoginRateLimit: gjson.New(tpl["login_rate_limit"].String()), SensitiveWordPolicy: gjson.New(tpl["sensitive_word_policy"].String()), FileReviewPolicy: gjson.New(tpl["file_review_policy"].String()), RealnamePolicy: gjson.New(tpl["realname_policy"].String()), RiskChallengePolicy: gjson.New(tpl["risk_challenge_policy"].String()), GlobalFriendEnabled: tpl["global_friend_enabled"].Int(), FriendDisabledPolicy: gjson.New(tpl["friend_disabled_policy"].String()), MessageCurfewEnabled: tpl["message_curfew_enabled"].Int(), Remark: in.Reason, CurfewRules: templateCurfewRules(tpl)})
 	if err == nil {
 		_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_restore_default", "im_security_policy", id, "success", g.Map{"reason": in.Reason})
 	}
@@ -328,14 +307,11 @@ func (s *sSysImSecurityPolicy) SaveLoginLockoutConfig(ctx context.Context, in *s
 		_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_login_lockout_save", "im_security_policy", policyID, "success", g.Map{"enabled": in.Enabled, "password_max_attempts": in.PasswordMaxAttempts, "lock_minutes": in.LockMinutes, "window_minutes": in.WindowMinutes})
 		return publishImPolicyEvent(ctx, tenantID, tenantCode, "security.policy.updated", "security_policy", version)
 	}
-	// 租户尚无已发布策略：创建默认策略草稿并直接发布（Publish 内部已发送策略变更事件）
+	// 租户尚无策略：保存默认策略，保存即生效并投递策略变更事件
 	id, saveErr := s.Save(ctx, &sysin.ImSecurityPolicySaveInp{TenantId: tenantID, PolicyName: "默认安全策略", LoginRateLimit: gjson.New(value), GlobalFriendEnabled: 1, MessageCurfewEnabled: 0})
 	if saveErr != nil {
 		return saveErr
 	}
-	if err = s.Publish(ctx, &sysin.ImSecurityPolicyPublishInp{Id: id, Reason: "登录失败策略首次配置"}); err != nil {
-		return err
-	}
 	_ = writeImAdminAudit(ctx, tenantID, "im_security_policy_login_lockout_save", "im_security_policy", id, "success", g.Map{"enabled": in.Enabled, "password_max_attempts": in.PasswordMaxAttempts, "lock_minutes": in.LockMinutes, "window_minutes": in.WindowMinutes})
 	return nil
 }
@@ -23,6 +23,7 @@ import (
 	"github.com/gogf/gf/v2/database/gdb"
 	"github.com/gogf/gf/v2/errors/gerror"
 	"github.com/gogf/gf/v2/frame/g"
+	"github.com/gogf/gf/v2/os/gtime"
 )

 type sSysImTenant struct{}
@@ -210,6 +211,10 @@ func (s *sSysImTenant) saveTenant(ctx context.Context, in *sysin.ImTenantEditInp
 			return gerror.Wrap(err, "新增IM租户失败，请稍后重试！")
 		}
 		tenantID = in.Id
+		// 新建商户时复制安全策略模板为本商户初始策略（保存即生效模型）
+		if err = copyDefaultPolicyForTenant(ctx, tx, in.Id, userId); err != nil {
+			return err
+		}
 		return nil
 	})
 	if err != nil {
@@ -345,7 +350,94 @@ func (s *sSysImTenant) resetTenantAdminPassword(ctx context.Context, tenantId in

 // rollbackTenantCreation 商户创建补偿：删除已写入的商户及配置记录
 func (s *sSysImTenant) rollbackTenantCreation(ctx context.Context, tenantId int64) {
-	_, _ = s.Model(ctx, &handler.Option{FilterAuth: false}).WherePri(tenantId).Delete()
+	_ = imtenant.RegistryDB().Transaction(ctx, func(ctx context.Context, tx gdb.TX) (err error) {
+		if _, err = s.Model(ctx, &handler.Option{FilterAuth: false}).
+			WherePri(tenantId).Delete(); err != nil {
+			return
+		}
+		// 清理建户时复制的安全策略与宵禁规则，避免残留孤儿数据（商户未建成，硬删不留软删垃圾）
+		if _, err = tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).
+			Where(dao.ImSecurityPolicy.Columns().TenantId, tenantId).Unscoped().Delete(); err != nil {
+			return
+		}
+		_, err = tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).
+			Where(dao.ImMessageCurfewRules.Columns().TenantId, tenantId).Unscoped().Delete()
+		return
+	})
+}
+
+// copyDefaultPolicyForTenant 新建商户时复制安全策略模板为本商户自己的初始策略。
+// 模板未初始化时跳过（运行时由内部配置接口的默认值兜底），不阻断建户。
+func copyDefaultPolicyForTenant(ctx context.Context, tx gdb.TX, tenantID, operator int64) (err error) {
+	tpl, err := loadPolicyTemplateRow(tx.Model(imPolicyTemplateTable).Safe().Ctx(ctx))
+	if err != nil {
+		return gerror.Wrap(err, "读取安全策略模板失败")
+	}
+	if tpl == nil {
+		return nil
+	}
+	pc := dao.ImSecurityPolicy.Columns()
+	now := gtime.Now()
+	data := g.Map{
+		pc.TenantId:             tenantID,
+		pc.PolicyName:           tpl["policy_name"].String(),
+		pc.PolicyVersion:        1,
+		pc.PublishStatus:        consts.ImSecurityPublishPublished,
+		pc.PasswordPolicy:       tpl["password_policy"].String(),
+		pc.LoginRateLimit:       tpl["login_rate_limit"].String(),
+		pc.SensitiveWordPolicy:  tpl["sensitive_word_policy"].String(),
+		pc.FileReviewPolicy:     tpl["file_review_policy"].String(),
+		pc.RealnamePolicy:       tpl["realname_policy"].String(),
+		pc.RiskChallengePolicy:  tpl["risk_challenge_policy"].String(),
+		pc.GlobalFriendEnabled:  tpl["global_friend_enabled"].Int(),
+		pc.FriendDisabledPolicy: tpl["friend_disabled_policy"].String(),
+		pc.MessageCurfewEnabled: tpl["message_curfew_enabled"].Int(),
+		pc.Remark:               "由默认模板复制",
+		pc.PublishedAt:          now,
+		pc.PublishedBy:          operator,
+		pc.CreatedAt:            now,
+		pc.CreatedBy:            operator,
+		pc.UpdatedAt:            now,
+		pc.UpdatedBy:            operator,
+	}
+	result, err := tx.Model(dao.ImSecurityPolicy.Table()).Safe().Ctx(ctx).Data(data).Insert()
+	if err != nil {
+		return gerror.Wrap(err, "复制安全策略模板失败")
+	}
+	policyID, err := result.LastInsertId()
+	if err != nil {
+		return err
+	}
+	// 同步复制模板宵禁规则
+	rc := dao.ImMessageCurfewRules.Columns()
+	for _, rule := range templateCurfewRules(tpl) {
+		ruleData := g.Map{
+			rc.TenantId:          tenantID,
+			rc.PolicyId:          policyID,
+			rc.RuleCode:          rule.RuleCode,
+			rc.RuleName:          rule.RuleName,
+			rc.DateType:          rule.DateType,
+			rc.CustomDates:       policyJSON(rule.CustomDates, "[]"),
+			rc.Weekdays:          policyJSON(rule.Weekdays, "[]"),
+			rc.Timezone:          rule.Timezone,
+			rc.StartTime:         rule.StartTime,
+			rc.EndTime:           rule.EndTime,
+			rc.Scope:             rule.Scope,
+			rc.WhitelistUserIds:  policyJSON(rule.WhitelistUserIds, "[]"),
+			rc.WhitelistGroupIds: policyJSON(rule.WhitelistGroupIds, "[]"),
+			rc.Message:           rule.Message,
+			rc.Status:            rule.Status,
+			rc.Sort:              rule.Sort,
+			rc.CreatedAt:         now,
+			rc.CreatedBy:         operator,
+			rc.UpdatedAt:         now,
+			rc.UpdatedBy:         operator,
+		}
+		if _, err = tx.Model(dao.ImMessageCurfewRules.Table()).Safe().Ctx(ctx).Data(ruleData).Insert(); err != nil {
+			return gerror.Wrap(err, "复制模板宵禁规则失败")
+		}
+	}
+	return nil
 }

 func (s *sSysImTenant) checkCodeUnique(ctx context.Context, id int64, code string) (err error) {
@@ -78,16 +78,6 @@ func TestImSecurityPolicySaveFilterForcesEveryFriendEntryOff(t *testing.T) {
 	}
 }

-func TestImSecurityPolicyPublishFilter(t *testing.T) {
-	ctx := context.Background()
-	if err := (&ImSecurityPolicyPublishInp{Id: 1, Reason: "  "}).Filter(ctx); err == nil {
-		t.Fatal("空发布原因应被拒绝")
-	}
-	if err := (&ImSecurityPolicyPublishInp{Id: 1, Reason: "管理员发布"}).Filter(ctx); err != nil {
-		t.Fatalf("合法发布参数不应报错: %v", err)
-	}
-}
-
 func TestImSecurityIPRuleEditFilter(t *testing.T) {
 	ctx := context.Background()
 	valid := &ImSecurityIPRuleEditInp{
@@ -255,25 +255,6 @@ func normalizeLoginRateLimit(value *gjson.Json) (*gjson.Json, error) {
 	return gjson.New(map[string]any{"enabled": true, "password_max_attempts": maxAttempts, "lock_seconds": lockSeconds, "window_seconds": windowSeconds}), nil
 }

-type ImSecurityPolicyPublishInp struct {
-	Id     int64  `json:"id" v:"required|min:1#策略ID不能为空|策略ID不合法"`
-	Reason string `json:"reason" v:"required#发布原因不能为空"`
-}
-
-func (in *ImSecurityPolicyPublishInp) Filter(ctx context.Context) error {
-	in.Reason = strings.TrimSpace(in.Reason)
-	if in.Id <= 0 {
-		return gerror.New("策略ID不合法")
-	}
-	if in.Reason == "" {
-		return gerror.New("发布原因不能为空")
-	}
-	if len([]rune(in.Reason)) > 500 {
-		return gerror.New("发布原因不能超过500个字符")
-	}
-	return nil
-}
-
 type ImSecurityPolicyRestoreInp struct {
 	TenantId int64  `json:"tenantId"`
 	Reason   string `json:"reason" v:"required#恢复原因不能为空"`
@@ -424,7 +424,6 @@ type (
 		List(ctx context.Context, in *sysin.ImSecurityPolicyListInp) (list []*sysin.ImSecurityPolicyModel, totalCount int, err error)
 		View(ctx context.Context, in *sysin.ImSecurityPolicyViewInp) (res *sysin.ImSecurityPolicyModel, err error)
 		Save(ctx context.Context, in *sysin.ImSecurityPolicySaveInp) (id int64, err error)
-		Publish(ctx context.Context, in *sysin.ImSecurityPolicyPublishInp) (err error)
 		RestoreDefault(ctx context.Context, in *sysin.ImSecurityPolicyRestoreInp) (id int64, err error)
 		GetLoginLockoutConfig(ctx context.Context, in *sysin.ImLoginLockoutConfigGetInp) (res *sysin.ImLoginLockoutConfigModel, err error)
 		SaveLoginLockoutConfig(ctx context.Context, in *sysin.ImLoginLockoutConfigSaveInp) (err error)
@@ -35,18 +35,37 @@ FROM (
 ) p WHERE NOT EXISTS (SELECT 1 FROM `hg_admin_menu` m WHERE m.`name`=p.name);

 INSERT INTO `hg_admin_menu` (`id`,`pid`,`title`,`name`,`path`,`icon`,`type`,`redirect`,`permissions`,`permission_name`,`component`,`always_show`,`active_menu`,`is_root`,`is_frame`,`frame_src`,`keep_alive`,`hidden`,`affix`,`level`,`tree`,`sort`,`remark`,`status`,`created_at`,`updated_at`)
-SELECT NULL,@imRootId,'安全策略','imSecurityPolicyIndex','security-policy/index','','2','','/imSecurityPolicy/list','','/imSecurityPolicy/index','1','imManager','0','0','','0','0','0','2',CONCAT('tr_',@imRootId,' '),'95','','1',@now,@now
+SELECT NULL,@imRootId,'IP黑白名单','imSecurityPolicyIndex','security-policy/index','','2','','/imSecurityPolicy/list','','/imSecurityPolicy/index','1','imManager','0','0','','0','0','0','2',CONCAT('tr_',@imRootId,' '),'95','','1',@now,@now
 WHERE NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name`='imSecurityPolicyIndex');
 SET @securityPolicyId := (SELECT `id` FROM `hg_admin_menu` WHERE `name`='imSecurityPolicyIndex' LIMIT 1);
+UPDATE `hg_admin_menu` SET `title`='IP黑白名单', `updated_at`=@now WHERE `name`='imSecurityPolicyIndex' AND `title`<>'IP黑白名单';
+
+-- Policy version page (flattened strategy form) split out of the security policy page.
+INSERT INTO `hg_admin_menu` (`id`,`pid`,`title`,`name`,`path`,`icon`,`type`,`redirect`,`permissions`,`permission_name`,`component`,`always_show`,`active_menu`,`is_root`,`is_frame`,`frame_src`,`keep_alive`,`hidden`,`affix`,`level`,`tree`,`sort`,`remark`,`status`,`created_at`,`updated_at`)
+SELECT NULL,@imRootId,'安全策略','imPolicyVersionIndex','policy-version/index','','2','','/imSecurityPolicy/list','','/imPolicyVersion/index','1','imManager','0','0','','0','0','0','2',CONCAT('tr_',@imRootId,' '),'96','','1',@now,@now
+WHERE NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name`='imPolicyVersionIndex');
+SET @policyVersionId := (SELECT `id` FROM `hg_admin_menu` WHERE `name`='imPolicyVersionIndex' LIMIT 1);
+UPDATE `hg_admin_menu` SET `title`='安全策略', `updated_at`=@now WHERE `name`='imPolicyVersionIndex' AND `title`<>'安全策略';

 INSERT INTO `hg_admin_menu` (`id`,`pid`,`title`,`name`,`path`,`icon`,`type`,`redirect`,`permissions`,`permission_name`,`component`,`always_show`,`active_menu`,`is_root`,`is_frame`,`frame_src`,`keep_alive`,`hidden`,`affix`,`level`,`tree`,`sort`,`remark`,`status`,`created_at`,`updated_at`)
-SELECT NULL,@securityPolicyId,p.title,p.name,'','','3','',p.permissions,'','','1','','0','0','','0','0','0','3',CONCAT('tr_',@imRootId,' tr_',@securityPolicyId,' '),p.sort,'','1',@now,@now
+SELECT NULL,@policyVersionId,p.title,p.name,'','','3','',p.permissions,'','','1','','0','0','','0','0','0','3',CONCAT('tr_',@imRootId,' tr_',@policyVersionId,' '),p.sort,'','1',@now,@now
 FROM (
  SELECT '策略详情' title,'imSecurityPolicyView' name,'/imSecurityPolicy/view' permissions,10 sort UNION ALL
  SELECT '保存草稿','imSecurityPolicySave','/imSecurityPolicy/save',20 UNION ALL
-  SELECT '发布策略','imSecurityPolicyPublish','/imSecurityPolicy/publish',30 UNION ALL
  SELECT '恢复默认','imSecurityPolicyRestoreDefault','/imSecurityPolicy/restoreDefault',40 UNION ALL
+  SELECT '登录锁定配置','imSecurityPolicyLoginLockoutConfig','/imSecurityPolicy/loginLockoutConfig',45 UNION ALL
  SELECT 'IP规则列表','imSecurityPolicyIpRuleList','/imSecurityPolicy/ipRuleList',50 UNION ALL
  SELECT 'IP规则编辑','imSecurityPolicyIpRuleEdit','/imSecurityPolicy/ipRuleEdit',60 UNION ALL
  SELECT 'IP规则删除','imSecurityPolicyIpRuleDelete','/imSecurityPolicy/ipRuleDelete',70
 ) p WHERE NOT EXISTS (SELECT 1 FROM `hg_admin_menu` m WHERE m.`name`=p.name);
+
+-- Existing installs: policy buttons move to the policy version page, IP rule buttons stay put.
+UPDATE `hg_admin_menu` SET `pid`=@policyVersionId, `updated_at`=@now
+WHERE `name` IN ('imSecurityPolicyView','imSecurityPolicySave','imSecurityPolicyPublish','imSecurityPolicyRestoreDefault','imSecurityPolicyLoginLockoutConfig');
+INSERT IGNORE INTO `hg_admin_role_menu` (`role_id`,`menu_id`)
+SELECT `role_id`, @policyVersionId FROM `hg_admin_role_menu`
+WHERE `menu_id` IN (SELECT `id` FROM `hg_admin_menu` WHERE `name` IN ('imSecurityPolicyView','imSecurityPolicySave','imSecurityPolicyPublish','imSecurityPolicyRestoreDefault','imSecurityPolicyLoginLockoutConfig'));
+
+-- Deprecate the publish button: policy save takes effect immediately (single-record model).
+UPDATE `hg_admin_menu` SET `status`=2, `hidden`=1, `updated_at`=@now WHERE `name`='imSecurityPolicyPublish';
+DELETE FROM `hg_admin_role_menu` WHERE `menu_id` IN (SELECT `id` FROM `hg_admin_menu` WHERE `name`='imSecurityPolicyPublish');
@@ -60,12 +60,36 @@ UPDATE `hg_admin_menu` SET `pid`=@auditId, `path`='task-dashboard/index', `level

 -- System and tenant settings.
 UPDATE `hg_admin_menu` SET `pid`=@settingsId, `title`='商户管理', `path`='tenant/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=10, `updated_at`=@now WHERE `name`='imTenantIndex';
-UPDATE `hg_admin_menu` SET `pid`=@settingsId, `path`='security-policy/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=20, `updated_at`=@now WHERE `name`='imSecurityPolicyIndex';
+UPDATE `hg_admin_menu` SET `pid`=@settingsId, `title`='IP黑白名单', `path`='security-policy/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=20, `updated_at`=@now WHERE `name`='imSecurityPolicyIndex';
 UPDATE `hg_admin_menu` SET `pid`=@settingsId, `path`='file-policy/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=30, `updated_at`=@now WHERE `name`='imFilePolicyIndex';
 UPDATE `hg_admin_menu` SET `pid`=@settingsId, `path`='external-config/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=50, `updated_at`=@now WHERE `name`='imExternalConfigIndex';
 UPDATE `hg_admin_menu` SET `pid`=@settingsId, `path`='notification/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=60, `updated_at`=@now WHERE `name`='imNotificationIndex';
 UPDATE `hg_admin_menu` SET `pid`=@settingsId, `path`='app-release/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=70, `updated_at`=@now WHERE `name`='imAppReleaseIndex';

+-- Policy version page: flattened strategy form moved out of the (now IP-focused) security policy page.
+INSERT INTO `hg_admin_menu` (`pid`,`title`,`name`,`path`,`icon`,`type`,`redirect`,`permissions`,`permission_name`,`component`,`always_show`,`active_menu`,`is_root`,`is_frame`,`frame_src`,`keep_alive`,`hidden`,`affix`,`level`,`tree`,`sort`,`remark`,`status`,`created_at`,`updated_at`)
+SELECT @settingsId,'安全策略','imPolicyVersionIndex','policy-version/index','','2','','/imSecurityPolicy/list','','/imPolicyVersion/index','1','imManager','0','0','','0','0','0','3',CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '),'25','','1',@now,@now
+WHERE @settingsId IS NOT NULL AND NOT EXISTS (SELECT 1 FROM `hg_admin_menu` WHERE `name` = 'imPolicyVersionIndex');
+SET @policyVersionId := (SELECT `id` FROM `hg_admin_menu` WHERE `name` = 'imPolicyVersionIndex' LIMIT 1);
+UPDATE `hg_admin_menu` SET `pid`=@settingsId, `title`='安全策略', `path`='policy-version/index', `level`=3, `tree`=CONCAT('tr_', @imRootId, ' tr_', @settingsId, ' '), `sort`=25, `updated_at`=@now WHERE `id`=@policyVersionId;
+
+-- Move policy buttons from the security policy page to the policy version page.
+UPDATE `hg_admin_menu` SET `pid`=@policyVersionId, `updated_at`=@now
+WHERE `name` IN ('imSecurityPolicyView','imSecurityPolicySave','imSecurityPolicyPublish','imSecurityPolicyRestoreDefault','imSecurityPolicyLoginLockoutConfig');
+
+-- Deprecate the publish button: policy save takes effect immediately (single-record model).
+UPDATE `hg_admin_menu` SET `status`=2, `hidden`=1, `updated_at`=@now WHERE `name`='imSecurityPolicyPublish';
+DELETE FROM `hg_admin_role_menu` WHERE `menu_id` IN (SELECT `id` FROM `hg_admin_menu` WHERE `name`='imSecurityPolicyPublish');
+
+-- Grant the policy version page to roles that already own any migrated policy button.
+INSERT INTO `hg_admin_role_menu` (`role_id`, `menu_id`)
+SELECT DISTINCT rm.`role_id`, @policyVersionId
+FROM `hg_admin_role_menu` rm
+JOIN `hg_admin_menu` btn ON btn.`id` = rm.`menu_id`
+LEFT JOIN `hg_admin_role_menu` existing ON existing.`role_id` = rm.`role_id` AND existing.`menu_id` = @policyVersionId
+WHERE btn.`name` IN ('imSecurityPolicyView','imSecurityPolicySave','imSecurityPolicyPublish','imSecurityPolicyRestoreDefault','imSecurityPolicyLoginLockoutConfig')
+  AND existing.`menu_id` IS NULL;
+
 -- Remove one-page wrapper directories after their page has been moved.
 UPDATE `hg_admin_menu` SET `status`=2, `hidden`=1, `updated_at`=@now
 WHERE `name` IN ('imUser', 'imGroup', 'imTenant', 'imRealname', 'imWorkOrder', 'imAuditLog', 'imOutbox');
@@ -76,7 +100,7 @@ JOIN `hg_admin_menu` page ON page.`id` = child.`pid`
 SET child.`level` = page.`level` + 1,
    child.`tree` = CONCAT(page.`tree`, 'tr_', page.`id`, ' '),
    child.`updated_at` = @now
-WHERE page.`pid` IN (@peopleId, @contentId, @auditId, @settingsId)
+WHERE (page.`pid` IN (@peopleId, @contentId, @auditId, @settingsId) OR page.`id` = @policyVersionId)
  AND child.`type` = 3;

 -- Give roles that already own pages in a section access to the new directory.
@@ -0,0 +1,60 @@
+-- 安全策略"去版本化"数据迁移：每租户收敛为一条 published 记录（幂等可重跑）
+-- 执行前已备份 im_security_policy / im_message_curfew_rules 全量至 /tmp/policy-backup-20260922.txt
+
+-- 1. 全局默认（tenant_id=0）不存在则插入 published 模板
+INSERT INTO `im_security_policy` (`tenant_id`,`policy_version`,`policy_name`,`publish_status`,`password_policy`,`login_rate_limit`,`sensitive_word_policy`,`file_review_policy`,`realname_policy`,`risk_challenge_policy`,`global_friend_enabled`,`friend_disabled_policy`,`message_curfew_enabled`,`remark`,`published_at`,`published_by`,`created_by`,`updated_by`)
+SELECT 0,1,'全局默认安全策略','published','{}','{"enabled":false}','{"scenes":{"user_nickname":true,"user_signature":true,"group_name":true,"group_nickname":true,"private_message":true,"group_message":true,"group_announcement":true},"risk_actions":{"high":"block","medium":"block","low":"audit_only","none":"allow"},"failure_mode":"allow","block_message":"内容不符合平台规范，请修改后重试"}','{}','{}','{}',1,'{"hide_profile":true,"block_qrcode":true,"block_group_member_entry":true,"blocked_entries":["search","profile_card","group_member","qrcode","invite_auto_add","recommendation"],"message":"当前时段暂不允许添加好友"}',0,'全局默认模板',NOW(3),1,1,1
+WHERE NOT EXISTS (SELECT 1 FROM (SELECT 1 FROM `im_security_policy` WHERE `tenant_id`=0 AND `publish_status`='published' AND `deleted_at` IS NULL) x);
+
+-- 2. 全局默认无宵禁规则则补一条默认规则模板
+INSERT INTO `im_message_curfew_rules` (`tenant_id`,`policy_id`,`rule_code`,`rule_name`,`date_type`,`custom_dates`,`weekdays`,`timezone`,`start_time`,`end_time`,`scope`,`whitelist_user_ids`,`whitelist_group_ids`,`message`,`status`,`sort`,`created_by`,`updated_by`)
+SELECT 0, p.`id`,'work_off_1','下班时段','weekday','[]','[1,2,3,4,5]','Asia/Shanghai','18:00','09:00','private_message','[]','[]','当前时段暂不能发送消息',1,10,1,1
+FROM `im_security_policy` p
+WHERE p.`tenant_id`=0 AND p.`publish_status`='published' AND p.`deleted_at` IS NULL
+  AND NOT EXISTS (SELECT 1 FROM (SELECT 1 FROM `im_message_curfew_rules` WHERE `policy_id`=p.`id` AND `deleted_at` IS NULL) y);
+
+-- 3. 无 published 的租户：将其最大版本 draft 提升为 published
+UPDATE `im_security_policy` sp
+JOIN (
+  SELECT `tenant_id`, MAX(`policy_version`) AS mv
+  FROM `im_security_policy`
+  WHERE `deleted_at` IS NULL AND `publish_status`='draft'
+  GROUP BY `tenant_id`
+) t ON sp.`tenant_id`=t.`tenant_id` AND sp.`policy_version`=t.`mv` AND sp.`publish_status`='draft'
+SET sp.`publish_status`='published', sp.`published_at`=NOW(3), sp.`published_by`=1, sp.`updated_at`=NOW(3)
+WHERE sp.`deleted_at` IS NULL
+  AND NOT EXISTS (SELECT 1 FROM (SELECT 1 FROM `im_security_policy` x WHERE x.`tenant_id`=sp.`tenant_id` AND x.`publish_status`='published' AND x.`deleted_at` IS NULL) z);
+
+-- 4. 每租户仅保留版本最大的 published 记录，其余行软删
+UPDATE `im_security_policy` sp
+LEFT JOIN (
+  SELECT `tenant_id`, MAX(`policy_version`) AS mv
+  FROM `im_security_policy`
+  WHERE `deleted_at` IS NULL AND `publish_status`='published'
+  GROUP BY `tenant_id`
+) keep ON sp.`tenant_id`=keep.`tenant_id` AND sp.`policy_version`=keep.`mv` AND sp.`publish_status`='published'
+SET sp.`deleted_at`=NOW(3), sp.`deleted_by`=1
+WHERE sp.`deleted_at` IS NULL AND keep.`mv` IS NULL;
+
+-- 5. 宵禁规则孤儿软删（挂在不保留/已删策略下的规则）
+UPDATE `im_message_curfew_rules` r
+LEFT JOIN `im_security_policy` sp ON r.`policy_id`=sp.`id` AND sp.`deleted_at` IS NULL
+SET r.`deleted_at`=NOW(3), r.`deleted_by`=1
+WHERE r.`deleted_at` IS NULL AND sp.`id` IS NULL;
+
+-- 6. im_tenant_config 与保留记录对齐（版本 + 全局好友开关 + 宵禁开关）
+UPDATE `im_tenant_config` tc
+JOIN `im_security_policy` sp ON tc.`tenant_id`=sp.`tenant_id` AND sp.`publish_status`='published' AND sp.`deleted_at` IS NULL
+SET tc.`security_policy_version`=sp.`policy_version`,
+    tc.`global_friend_enabled`=sp.`global_friend_enabled`,
+    tc.`message_curfew_enabled`=sp.`message_curfew_enabled`
+WHERE tc.`security_policy_version`<>sp.`policy_version`
+   OR tc.`global_friend_enabled`<>sp.`global_friend_enabled`
+   OR tc.`message_curfew_enabled`<>sp.`message_curfew_enabled`;
+
+-- 7. 有策略但缺 im_tenant_config 行的租户补建配置行
+INSERT INTO `im_tenant_config` (`tenant_id`,`security_policy_version`,`global_friend_enabled`,`message_curfew_enabled`,`created_by`,`updated_by`)
+SELECT sp.`tenant_id`, sp.`policy_version`, sp.`global_friend_enabled`, sp.`message_curfew_enabled`, 1, 1
+FROM `im_security_policy` sp
+WHERE sp.`publish_status`='published' AND sp.`deleted_at` IS NULL AND sp.`tenant_id`>0
+  AND NOT EXISTS (SELECT 1 FROM (SELECT 1 FROM `im_tenant_config` tc WHERE tc.`tenant_id`=sp.`tenant_id`) w);
@@ -0,0 +1,115 @@
+-- IM 安全策略模板表迁移（幂等，可重复执行）
+-- 背景：全局默认策略从 im_security_policy.tenant_id=0 记录改为独立模板表 im_security_policy_template（单行）。
+-- 每次新增商户时从模板复制一份为商户初始策略，商户后续修改只改副本。
+
+-- 1. 建模板表（永远单行 id=1，平台级，宵禁规则以 JSON 数组存储）
+CREATE TABLE IF NOT EXISTS `im_security_policy_template` (
+  `id` bigint unsigned NOT NULL AUTO_INCREMENT,
+  `policy_name` varchar(100) NOT NULL DEFAULT '默认安全策略模板',
+  `password_policy` text,
+  `login_rate_limit` text,
+  `sensitive_word_policy` text,
+  `file_review_policy` text,
+  `realname_policy` text,
+  `risk_challenge_policy` text,
+  `global_friend_enabled` tinyint NOT NULL DEFAULT 1,
+  `friend_disabled_policy` text,
+  `message_curfew_enabled` tinyint NOT NULL DEFAULT 0,
+  `curfew_rules` text COMMENT '宵禁规则JSON数组',
+  `remark` varchar(255) DEFAULT '',
+  `created_at` datetime DEFAULT NULL,
+  `created_by` bigint DEFAULT 0,
+  `updated_at` datetime DEFAULT NULL,
+  `updated_by` bigint DEFAULT 0,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci COMMENT='IM安全策略模板（新建商户初始策略来源）';
+
+-- 2. 从 tenant_id=0 published 记录迁入模板字段（仅当模板表为空）
+INSERT INTO `im_security_policy_template`
+  (`policy_name`, `password_policy`, `login_rate_limit`, `sensitive_word_policy`, `file_review_policy`, `realname_policy`, `risk_challenge_policy`, `global_friend_enabled`, `friend_disabled_policy`, `message_curfew_enabled`, `curfew_rules`, `remark`, `created_at`, `created_by`)
+SELECT
+  IFNULL(sp.policy_name, '默认安全策略模板'),
+  IFNULL(CAST(sp.password_policy AS CHAR), '{}'),
+  IFNULL(CAST(sp.login_rate_limit AS CHAR), '{"enabled":false}'),
+  IFNULL(CAST(sp.sensitive_word_policy AS CHAR), '{}'),
+  IFNULL(CAST(sp.file_review_policy AS CHAR), '{}'),
+  IFNULL(CAST(sp.realname_policy AS CHAR), '{}'),
+  IFNULL(CAST(sp.risk_challenge_policy AS CHAR), '{}'),
+  IFNULL(sp.global_friend_enabled, 1),
+  IFNULL(CAST(sp.friend_disabled_policy AS CHAR), '{}'),
+  IFNULL(sp.message_curfew_enabled, 0),
+  '[]',
+  '由全局默认策略迁移',
+  NOW(), 0
+FROM (SELECT 1) dummy
+LEFT JOIN `im_security_policy` sp ON sp.tenant_id = 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
+WHERE (SELECT COUNT(*) FROM `im_security_policy_template`) = 0
+ORDER BY sp.policy_version DESC
+LIMIT 1;
+
+-- 3. 模板宵禁规则：从 tenant_id=0 记录的宵禁规则聚合为 JSON（仅当模板 curfew_rules 为空数组）
+UPDATE `im_security_policy_template` t
+SET t.curfew_rules = (
+  SELECT COALESCE(JSON_ARRAYAGG(JSON_OBJECT(
+    'ruleCode', r.rule_code, 'ruleName', r.rule_name, 'dateType', r.date_type,
+    'customDates', CAST(r.custom_dates AS JSON), 'weekdays', CAST(r.weekdays AS JSON),
+    'timezone', r.timezone,
+    'startTime', TIME_FORMAT(r.start_time, '%H:%i'), 'endTime', TIME_FORMAT(r.end_time, '%H:%i'),
+    'scope', r.scope,
+    'whitelistUserIds', CAST(r.whitelist_user_ids AS JSON), 'whitelistGroupIds', CAST(r.whitelist_group_ids AS JSON),
+    'message', r.message, 'status', r.status, 'sort', r.sort
+  )), JSON_ARRAY())
+  FROM `im_message_curfew_rules` r
+  WHERE r.tenant_id = 0 AND r.deleted_at IS NULL
+    AND r.policy_id = (SELECT sp.id FROM `im_security_policy` sp WHERE sp.tenant_id = 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL ORDER BY sp.policy_version DESC LIMIT 1)
+)
+WHERE (t.curfew_rules IS NULL OR JSON_LENGTH(t.curfew_rules) = 0);
+
+-- 4. 存量商户补齐：tenant_id>0 且无 published 记录的商户，从模板复制策略行（version=1, published）
+INSERT INTO `im_security_policy`
+  (`tenant_id`, `policy_version`, `policy_name`, `publish_status`, `password_policy`, `login_rate_limit`, `sensitive_word_policy`, `file_review_policy`, `realname_policy`, `risk_challenge_policy`, `global_friend_enabled`, `friend_disabled_policy`, `message_curfew_enabled`, `remark`, `published_at`, `published_by`, `created_at`, `created_by`, `updated_at`, `updated_by`)
+SELECT
+  tt.id, 1, t.policy_name, 'published',
+  t.password_policy, t.login_rate_limit, t.sensitive_word_policy, t.file_review_policy, t.realname_policy, t.risk_challenge_policy,
+  t.global_friend_enabled, t.friend_disabled_policy, t.message_curfew_enabled,
+  '由默认模板补齐', NOW(), 0, NOW(), 0, NOW(), 0
+FROM `im_tenant` tt
+JOIN `im_security_policy_template` t ON t.id = (SELECT MIN(x.id) FROM `im_security_policy_template` x)
+WHERE tt.id > 0 AND tt.state = 1
+  AND NOT EXISTS (
+    SELECT 1 FROM `im_security_policy` sp
+    WHERE sp.tenant_id = tt.id AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
+  );
+
+-- 5. 存量商户补齐宵禁规则：从模板 JSON 展开（仅对当前无任何宵禁规则的商户策略，已有配置的商户不覆盖）
+INSERT INTO `im_message_curfew_rules`
+  (`tenant_id`, `policy_id`, `rule_code`, `rule_name`, `date_type`, `custom_dates`, `weekdays`, `timezone`, `start_time`, `end_time`, `scope`, `whitelist_user_ids`, `whitelist_group_ids`, `message`, `status`, `sort`, `created_at`, `created_by`, `updated_at`, `updated_by`)
+SELECT
+  sp.tenant_id, sp.id,
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.ruleCode')),
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.ruleName')),
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.dateType')),
+  JSON_EXTRACT(jt.r, '$.customDates'),
+  JSON_EXTRACT(jt.r, '$.weekdays'),
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.timezone')),
+  STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.startTime')), '%H:%i'),
+  STR_TO_DATE(JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.endTime')), '%H:%i'),
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.scope')),
+  JSON_EXTRACT(jt.r, '$.whitelistUserIds'),
+  JSON_EXTRACT(jt.r, '$.whitelistGroupIds'),
+  JSON_UNQUOTE(JSON_EXTRACT(jt.r, '$.message')),
+  CAST(JSON_EXTRACT(jt.r, '$.status') AS SIGNED),
+  CAST(JSON_EXTRACT(jt.r, '$.sort') AS SIGNED),
+  NOW(), 0, NOW(), 0
+FROM `im_security_policy` sp
+JOIN `im_security_policy_template` tpl
+JOIN JSON_TABLE(tpl.curfew_rules, '$[*]' COLUMNS (r JSON PATH '$')) jt
+WHERE tpl.id = (SELECT MIN(x.id) FROM `im_security_policy_template` x)
+  AND sp.tenant_id > 0 AND sp.publish_status = 'published' AND sp.deleted_at IS NULL
+  AND NOT EXISTS (SELECT 1 FROM `im_message_curfew_rules` r WHERE r.policy_id = sp.id AND r.deleted_at IS NULL);
+
+-- 6. 软删 tenant_id=0 的策略记录与其宵禁规则（模板化后不再使用，保留软删可回溯）
+UPDATE `im_security_policy` SET deleted_at = NOW(), deleted_by = 0
+WHERE tenant_id = 0 AND deleted_at IS NULL;
+UPDATE `im_message_curfew_rules` SET deleted_at = NOW(), deleted_by = 0
+WHERE tenant_id = 0 AND deleted_at IS NULL;