fix shared database account sequence initialization

docs/IM-前后端对接文档.md

@@ -322,8 +322,8 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
 | 租户握手 `hi` | `{"hi":{"id":"hi-1","ver":"0.25","ua":"Tinodios/1","platf":"ios","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"ver":"0.25","tenant":{"code":"default","name":"Default Tenant"},"maxMessageSize":4194304,"maxFileUploadSize":33554432,"maxSubscriberCount":128}}}` |
 | 账号密码登录 | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
 | Token 登录 | `{"login":{"id":"login-2","scheme":"token","secret":"上次登录返回的 token 原文"}}` | `{"ctrl":{"id":"login-2","code":200,"text":"ok","params":{"user":"usr...","authlvl":"auth","token":"new_token...","expires":"2026-09-03T09:00:00Z"}}}` |
-| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
+| 邀请码注册 | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-1","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
-| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
+| 手机号注册 | `{"acc":{"id":"acc-2","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}],"desc":{"public":{"fn":"alice"}}}}` | `{"ctrl":{"id":"acc-2","code":200,"text":"ok","params":{"user":"usr...","username":"alice","authlvl":"auth","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
 | 登录失败 | `{"login":{"id":"login-bad","scheme":"basic","secret":"base64(alice:wrong)"}}` | `{"ctrl":{"id":"login-bad","code":401,"text":"authentication failed","params":{"reason":"AUTH_FAILED"}}}` |
 | 租户不匹配 | `{"login":{"id":"login-tenant","scheme":"token","secret":"其他租户 token"}}` | `{"ctrl":{"id":"login-tenant","code":403,"text":"tenant mismatch","params":{"reason":"TENANT_MISMATCH"}}}` |
 
@@ -617,7 +617,7 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
 | --- | --- | --- |
 | `GET /v0/channels?apikey={api_key}` | WebSocket Upgrade 后首帧 `{"hi":{"id":"hi-1","ver":"0.25","ua":"ios/1.0","lang":"zh-CN","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"text":"created","params":{"tenant":{"code":"default","name":"Default Tenant"},"ver":"0.25","maxMessageSize":4194304}}}` |
 | WebSocket `login basic` | `{"login":{"id":"login-1","scheme":"basic","secret":"base64(username:password)"}}` | `{"ctrl":{"id":"login-1","code":200,"params":{"user":"usr...","token":"token...","expires":"2026-09-03T09:00:00Z","authlvl":"auth"}}}` |
-| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
+| WebSocket `acc new` | `{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"15500000000","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"15500000000","resp":"verification_token","params":{"challenge_id":"chg_123"}}]}}` | `{"ctrl":{"id":"acc-1","code":200,"params":{"user":"usr...","username":"alice","token":"token...","expires":"2026-09-03T09:00:00Z"}}}` |
 | `POST /v0/channels/lp` | Long Polling 首包 `{"hi":{"id":"hi-1","ver":"0.25","tenant":"default"}}` | `{"ctrl":{"id":"hi-1","code":201,"params":{"sid":"lp_sid_123"}}}` |
 | `POST /v0/file/u/` | Multipart 文件；Header `X-MeetingIM-Auth: token <base64_token>`；业务表单可带 `purpose=chat_file&topic=grp...` | `{"ctrl":{"code":200,"params":{"url":"/v0/file/s/file123","name":"a.pdf","size":1024,"mime":"application/pdf"}}}` |
 | `GET /v0/file/s/{file_id}` | Header `X-MeetingIM-Auth: token <base64_token>`，可带 `Range: bytes=0-` | 对象存储模式下鉴权通过后返回 302 到短期签名 URL；客户端跟随 Location 获取文件 |
@@ -876,19 +876,19 @@ X-MeetingIM-APIKey: <预置的普通 API Key>
 用户名方式：
 
 ```json
-{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}}
+{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"AbCdE","params":{"challenge_id":"challenge-id"}}]}}
 ```
 
 手机号验证方式：
 
 ```json
-{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
+{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"alice","phone":"138...","registration_type":1,"secret":"base64(alice:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
 ```
 
 仅手机号注册方式：
 
 ```json
-{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
+{"acc":{"id":"acc-1","user":"new","scheme":"basic","username":"","phone":"138...","registration_type":1,"secret":"base64(+86138...:password)","login":true,"cred":[{"meth":"tel","val":"138...","resp":"verification_token","params":{"challenge_id":"challenge-id"}}]}}
 ```
 - 成功：返回新 `user`、最终 `username` 和登录 Token；客户端保存 `params.token`，随后执行 `sub me` 和会话恢复。创建用户前原子校验 `im_tenant_config.max_users`，超限返回 `TENANT_USER_QUOTA_EXCEEDED`。
 - 安全：用户名、手机号分别在租户内唯一；验证码票据单次消费，邀请码在有效期内可重复使用；密码按服务端策略校验并使用强哈希保存。

docs/IM-数据库变更汇总.sql

@@ -1031,5 +1031,51 @@ INSERT INTO tinode.im_feedback_config(id, categories, max_length, attachment_pol
 VALUES (1, '["bug","suggestion","complaint","other"]', 1000, '{"max_files":5,"purpose":"feedback"}', 1, '仅在你同意时上传脱敏诊断信息。')
 ON DUPLICATE KEY UPDATE updated_at = updated_at;
 
+-- ============================================================
+-- Shared database runtime fixes for meeting_im.
+-- These are required after moving default/system tenants into the shared DB.
+-- ============================================================
+
+CREATE TABLE IF NOT EXISTS meeting_im.im_user_account_sequences (
+  tenant_id  BIGINT NOT NULL,
+  id         TINYINT UNSIGNED NOT NULL,
+  next_value INT UNSIGNED NOT NULL,
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (tenant_id, id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+
+ALTER TABLE meeting_im.im_user_account_sequences
+  DROP PRIMARY KEY,
+  ADD PRIMARY KEY (tenant_id, id);
+
+INSERT INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value)
+SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
+FROM meeting_im.im_users
+WHERE tenant_id > 0
+GROUP BY tenant_id
+ON DUPLICATE KEY UPDATE
+  next_value = GREATEST(next_value, VALUES(next_value));
+
+INSERT IGNORE INTO meeting_im.im_user_account_sequences(tenant_id, id, next_value)
+SELECT id, 1, 999
+FROM hotgo.im_tenant
+WHERE state = 1;
+
+CREATE TABLE IF NOT EXISTS meeting_im.im_login_lockouts (
+  id                BIGINT NOT NULL,
+  user_id           BIGINT,
+  account_hash      CHAR(64) NOT NULL,
+  failed_attempts   INT NOT NULL DEFAULT 0,
+  window_started_at DATETIME(3),
+  locked_until      DATETIME(3),
+  last_attempt_at   DATETIME(3),
+  created_at        DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  updated_at        DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (id),
+  UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
+  INDEX idx_im_login_lockouts_user (user_id),
+  INDEX idx_im_login_lockouts_locked (locked_until)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+
 -- Current MySQL adapter schema version expected by server/db/mysql/adapter.go.
 UPDATE tinode.im_kvmeta SET `value` = 123 WHERE `key` = 'version';

docs/sql/IM-共库运行态缺口修复SQL.sql

@@ -0,0 +1,47 @@
+-- MySQL 8.0. Runtime fixes for the shared meeting_im database.
+-- Execute with a privileged account that can read hotgo.im_tenant.
+
+CREATE TABLE IF NOT EXISTS im_user_account_sequences (
+    tenant_id BIGINT NOT NULL,
+    id TINYINT UNSIGNED NOT NULL,
+    next_value INT UNSIGNED NOT NULL,
+    updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
+        ON UPDATE CURRENT_TIMESTAMP(3),
+    PRIMARY KEY (tenant_id, id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+
+-- If this table was created by the older independent-database script, its
+-- primary key may still be only (id). Shared DB must key by tenant_id too.
+ALTER TABLE im_user_account_sequences
+    DROP PRIMARY KEY,
+    ADD PRIMARY KEY (tenant_id, id);
+
+INSERT INTO im_user_account_sequences (tenant_id, id, next_value)
+SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
+FROM im_users
+WHERE tenant_id > 0
+GROUP BY tenant_id
+ON DUPLICATE KEY UPDATE
+    next_value = GREATEST(next_value, VALUES(next_value));
+
+INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value)
+SELECT id, 1, 999
+FROM hotgo.im_tenant
+WHERE state = 1;
+
+CREATE TABLE IF NOT EXISTS im_login_lockouts (
+    id BIGINT NOT NULL,
+    user_id BIGINT NULL,
+    account_hash CHAR(64) NOT NULL,
+    failed_attempts INT NOT NULL DEFAULT 0,
+    window_started_at DATETIME(3) NULL,
+    locked_until DATETIME(3) NULL,
+    last_attempt_at DATETIME(3) NULL,
+    created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
+        ON UPDATE CURRENT_TIMESTAMP(3),
+    PRIMARY KEY (id),
+    UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
+    INDEX idx_im_login_lockouts_user (user_id),
+    INDEX idx_im_login_lockouts_locked (locked_until)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;

docs/sql/IM-后台消息与登录审计SQL.sql

@@ -59,6 +59,22 @@ CREATE TABLE IF NOT EXISTS im_login_failure_logs (
     INDEX idx_im_login_failure_request (request_id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
 
+CREATE TABLE IF NOT EXISTS im_login_lockouts (
+    id BIGINT NOT NULL,
+    user_id BIGINT NULL,
+    account_hash CHAR(64) NOT NULL,
+    failed_attempts INT NOT NULL DEFAULT 0,
+    window_started_at DATETIME(3) NULL,
+    locked_until DATETIME(3) NULL,
+    last_attempt_at DATETIME(3) NULL,
+    created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+    PRIMARY KEY (id),
+    UNIQUE INDEX uk_im_login_lockouts_account (account_hash),
+    INDEX idx_im_login_lockouts_user (user_id),
+    INDEX idx_im_login_lockouts_locked (locked_until)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+
 CREATE TABLE IF NOT EXISTS im_message_admin_actions (
     id BIGINT NOT NULL AUTO_INCREMENT,
     action_id VARCHAR(96) NOT NULL,

docs/sql/IM-用户账号编号序列表SQL.sql

@@ -1,15 +1,29 @@
--- 在每个租户业务库执行。用于并发安全地生成 im_users.account_no。
+-- 在 meeting_im 共库执行。用于并发安全地生成每个租户的 im_users.account_no。
 CREATE TABLE IF NOT EXISTS im_user_account_sequences (
+    tenant_id BIGINT NOT NULL,
     id TINYINT UNSIGNED NOT NULL,
     next_value INT UNSIGNED NOT NULL,
     updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3)
         ON UPDATE CURRENT_TIMESTAMP(3),
-    PRIMARY KEY (id)
+    PRIMARY KEY (tenant_id, id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
 
--- 兼容已有用户数据，从当前最大账号编号继续递增，账号编号最小为 1000。
+-- 如果历史脚本已经创建过单库版 PRIMARY KEY(id)，需要先改成共库主键。
-INSERT INTO im_user_account_sequences (id, next_value)
+ALTER TABLE im_user_account_sequences
-SELECT 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
+    DROP PRIMARY KEY,
+    ADD PRIMARY KEY (tenant_id, id);
+
+-- 兼容已有用户数据，从每个租户当前最大账号编号继续递增，账号编号最小为 1000。
+INSERT INTO im_user_account_sequences (tenant_id, id, next_value)
+SELECT tenant_id, 1, GREATEST(COALESCE(MAX(account_no), 999), 999)
 FROM im_users
+WHERE tenant_id > 0
+GROUP BY tenant_id
 ON DUPLICATE KEY UPDATE
     next_value = GREATEST(next_value, VALUES(next_value));
+
+-- 如果当前租户暂时还没有用户，也要先塞一行，否则新注册无法生成账号编号。
+INSERT IGNORE INTO im_user_account_sequences (tenant_id, id, next_value)
+SELECT id, 1, 999
+FROM hotgo.im_tenant
+WHERE state = 1;

server/db/mysql/adapter.go

@@ -1351,6 +1351,10 @@ func nextUserAccountNo(ctx context.Context, tx *sqlx.Tx) (uint32, bool, error) {
 		return 0, false, nil
 	}
 
+	if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(id,next_value)
+		SELECT 1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0`); err != nil {
+		return 0, true, err
+	}
 	if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences
 		SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE account_no>0))
 		WHERE id=1`); err != nil {

server/db/mysql/tenant_adapter.go

@@ -446,6 +446,11 @@ func nextTenantUserAccountNo(ctx context.Context, tx *sqlx.Tx, tenantID t.Tenant
 	if columns == 0 {
 		return 0, false, nil
 	}
+	if _, err := tx.ExecContext(ctx, `INSERT IGNORE INTO im_user_account_sequences(tenant_id,id,next_value)
+		SELECT ?,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0`,
+		tenantID, tenantID); err != nil {
+		return 0, true, err
+	}
 	if _, err := tx.ExecContext(ctx, `UPDATE im_user_account_sequences
 		SET next_value=GREATEST(next_value,(SELECT GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users WHERE tenant_id=? AND account_no>0))
 		WHERE tenant_id=? AND id=1`, tenantID, tenantID); err != nil {

server/db/mysql/user_identity_schema.go

@@ -189,7 +189,7 @@ func ensureUserIdentitySchema(db *sqlx.DB) error {
 	if _, err = conn.ExecContext(ctx, "ALTER TABLE im_users MODIFY COLUMN username VARCHAR(32) NOT NULL"); err != nil {
 		return err
 	}
-	if err = ensureUserAccountSequence(ctx, conn); err != nil {
+	if err = ensureUserAccountSequence(ctx, conn, usersScoped); err != nil {
 		return err
 	}
 	if err = migrateBasicAuthSchema(ctx, conn, usersScoped); err != nil {
@@ -213,11 +213,24 @@ func ensureUserIdentitySchema(db *sqlx.DB) error {
 	return nil
 }
 
-func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn) error {
+func ensureUserAccountSequence(ctx context.Context, conn *sqlx.Conn, scoped bool) error {
 	exists, err := identityColumnExists(ctx, conn, "im_users", "account_no")
 	if err != nil || !exists {
 		return err
 	}
+	if scoped {
+		if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences(
+			tenant_id BIGINT NOT NULL,id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL,
+			updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
+			PRIMARY KEY(tenant_id,id)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci`); err != nil {
+			return err
+		}
+		_, err = conn.ExecContext(ctx, `INSERT INTO im_user_account_sequences(tenant_id,id,next_value)
+			SELECT tenant_id,1,GREATEST(COALESCE(MAX(account_no),999),999) FROM im_users
+			WHERE tenant_id>0 GROUP BY tenant_id
+			ON DUPLICATE KEY UPDATE next_value=GREATEST(next_value,VALUES(next_value))`)
+		return err
+	}
 	if _, err = conn.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS im_user_account_sequences(
 		id TINYINT UNSIGNED NOT NULL,next_value INT UNSIGNED NOT NULL,
 		updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),