feat: enforce tenant content moderation

server/db/adapter.go

@@ -245,6 +245,7 @@ type TenantSecurityAuditAdapter interface {
 	TenantLoginFailureCreate(t.TenantID, *t.LoginFailureEvent) error
 	TenantLoginAuditClose(t.TenantID, string, time.Time) error
 	TenantMessageAdminApply(t.TenantID, *t.MessageAdminAction) error
+	TenantContentModerationLogCreate(t.TenantID, *t.ContentModerationLog) error
 }
 
 // TenantRoutedAdapter can return a tenant-specific adapter, e.g. for the

server/db/mysql/adapter.go

@@ -587,6 +587,8 @@ func createTenantRegistry(tx *sql.Tx, registryDB, businessDB string) error {
 			max_users         BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '0 means unlimited',
 			max_groups        BIGINT UNSIGNED NOT NULL DEFAULT 0 COMMENT '0 means unlimited',
 			max_group_members INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '0 means unlimited',
+			aliyun_moderation_enabled TINYINT(1) NOT NULL DEFAULT 0 COMMENT 'Enable Aliyun content moderation',
+			local_moderation_enabled  TINYINT(1) NOT NULL DEFAULT 0 COMMENT 'Enable local content moderation',
 			created_at        DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
 			created_by        BIGINT NOT NULL,
 			updated_at        DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),

server/db/mysql/admin_governance_schema.go

@@ -63,6 +63,18 @@ func ensureIMAdminGovernanceTables(exec sqlExecutor) error {
 			PRIMARY KEY(id), UNIQUE INDEX uk_im_user_ip_whitelist(user_id,ip_cidr),
 			INDEX idx_im_user_ip_whitelist_user(user_id,status), INDEX idx_im_user_ip_whitelist_deleted(deleted_at)
 		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,
+		`CREATE TABLE IF NOT EXISTS im_content_moderation_logs (
+			id BIGINT NOT NULL AUTO_INCREMENT, request_id VARCHAR(64) NOT NULL,
+			scene VARCHAR(32) NOT NULL, topic VARCHAR(96) NOT NULL DEFAULT '', seqid BIGINT,
+			actor_id BIGINT, provider VARCHAR(32) NOT NULL DEFAULT '', provider_request_id VARCHAR(96) NOT NULL DEFAULT '',
+			risk_level VARCHAR(16) NOT NULL DEFAULT 'none', risk_labels JSON, action VARCHAR(16) NOT NULL,
+			content_hash CHAR(64) NOT NULL, latency_ms BIGINT NOT NULL DEFAULT 0, error_code VARCHAR(64) NOT NULL DEFAULT '',
+			created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3), PRIMARY KEY(id),
+			UNIQUE INDEX uk_im_content_moderation_request(request_id),
+			INDEX idx_im_content_moderation_scene_time(scene,created_at DESC,id DESC),
+			INDEX idx_im_content_moderation_actor_time(actor_id,created_at DESC,id DESC),
+			INDEX idx_im_content_moderation_topic_seq(topic,seqid)
+		) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`,
 	}
 	for _, statement := range statements {
 		if _, err := exec.Exec(statement); err != nil {

server/db/mysql/tenant_security_audit.go

@@ -36,6 +36,30 @@ func (a *adapter) TenantLoginAuditCreate(id t.TenantID, event *t.LoginAuditEvent
 	return err
 }
 
+func (a *adapter) TenantContentModerationLogCreate(id t.TenantID, event *t.ContentModerationLog) error {
+	tenantAdp, err := a.routedTenantAdapter(id)
+	if err != nil || event == nil || strings.TrimSpace(event.RequestID) == "" {
+		return t.ErrMalformed
+	}
+	if tenantAdp != a {
+		return tenantAdp.TenantContentModerationLogCreate(id, event)
+	}
+	labels, err := json.Marshal(event.RiskLabels)
+	if err != nil {
+		return err
+	}
+	var actorID any
+	if !event.ActorID.IsZero() {
+		actorID = decodeUID(event.ActorID)
+	}
+	_, err = a.db.Exec(`INSERT INTO im_content_moderation_logs
+		(request_id,scene,topic,seqid,actor_id,provider,provider_request_id,risk_level,risk_labels,action,content_hash,latency_ms,error_code,created_at)
+		VALUES(?,?,?,?,?,?,?,?,CAST(? AS JSON),?,?,?,?,?)`, event.RequestID, event.Scene, event.Topic, event.SeqID, actorID,
+		event.Provider, event.ProviderRequestID, event.RiskLevel, string(labels), event.Action, event.ContentHash,
+		event.LatencyMS, event.ErrorCode, event.CreatedAt)
+	return err
+}
+
 func (a *adapter) TenantLoginFailureCreate(id t.TenantID, event *t.LoginFailureEvent) error {
 	tenantAdp, err := a.routedTenantAdapter(id)
 	if err != nil || event == nil {