<fix>[iam2]: add scim event schema

[ZStack-Robot]

Summary

• Add ScimEventVO to conf/db/upgrade/V5.5.28__schema.sql.
• This table stores generic SCIM event idempotency and resource-version state for the premium SCIM receiver.
• Companion premium MR: http://dev.zstack.io:9080/zstackio/premium/-/merge_requests/14279

Why

Premium SCIM receiver code registers org.zstack.iam2.scim.ScimEventVO, but the zstack 5.5.28 deploydb schema did not create the table. CI failed in IAM2ScimReceiverCase with:

Table 'zstack.ScimEventVO' doesn't exist

Verification

• mvn -pl plugin/kvm -am -DskipTests install passed.
• mvn -pl test-premium -Dtest=PremiumTestCaseStabilityTest -Dcases=org.zstack.test.integration.iam2.IAM2ScimReceiverCase -Dtimes=1 -DfailIfNoTests=false test reached and passed deploydb.sh; local run then stopped before case execution due to unrelated local premium classpath/aspect version mismatch.
• Confirmed table exists after deploydb:

SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='zstack' AND table_name='ScimEventVO';
-- 1

Notes

This MR should be merged before or together with the premium SCIM receiver MR so CI/runtime has the required table.

sync from gitlab !10170

[coderabbitai]

Warning

Review limit reached

@MatheMatrix, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 hours, 48 minutes, and 25 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml (via .coderabbit.yaml)

Review profile: CHILL

Plan: Pro

Run ID: 1d79435a-f608-47c3-b048-861d5e1106e4

📥 Commits

Reviewing files that changed from the base of the PR and between 3c6de6a and 9418fbe.

📒 Files selected for processing (11)

• conf/db/upgrade/V5.5.28__schema.sql
• core/src/main/java/org/zstack/core/scim/ScimGlobalConfig.java
• core/src/main/java/org/zstack/core/scim/ScimService.java
• header/src/main/java/org/zstack/header/scim/ScimConstant.java
• header/src/main/java/org/zstack/header/scim/ScimEventVO.java
• header/src/main/java/org/zstack/header/scim/ScimException.java
• header/src/main/java/org/zstack/header/scim/ScimMemberRef.java
• header/src/main/java/org/zstack/header/scim/ScimOperation.java
• header/src/main/java/org/zstack/header/scim/ScimPayload.java
• header/src/main/java/org/zstack/header/scim/ScimResourceHandler.java
• header/src/main/java/org/zstack/header/scim/ScimResult.java

Walkthrough

数据库迁移脚本在 zstack 库中新增 ScimEventVO 表，用于存储 SCIM 事件的应用状态跟踪。表包含事件标识、资源信息、操作类型、处理状态与时间戳字段，配以主键、唯一约束与查询索引。

Changes

SCIM 事件表

Layer / File(s)	Summary
ScimEventVO 表定义与索引 conf/db/upgrade/V5.5.28__schema.sql	新增表 ScimEventVO 用于持久化 SCIM 事件状态，包含 clientId、eventId、resourceType、resourceId、resourceVersion、operation、status 等字段；定义 uuid 主键与 (clientId, eventId) 唯一约束；添加 idxScimEventVOResourceVersion 复合索引用于按资源与版本高效查询。

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

一张表格现身海中央，
记录 SCIM 事件的流光，
主键唯一展风采，
索引飞快助查询，
兔子鼓掌庆迁移！🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题清晰指出了主要变更为添加 SCIM 事件模式，与变更集内容完全相符。
Description check	✅ Passed	描述详细说明了添加 ScimEventVO 表的目的、原因、验证步骤和相关的 premium MR，与变更内容密切相关。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/hanyu.liang/fix-4158@@2

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[zstack-robot-2]

Comment from yaohua.wu:

Review: MR !10170 — ZCF-4158

Background (preserved across rounds)

• Jira: 未关联 ZSTAC issue；变更源自 ZCF-4158（SCIM 事件应用状态，见 schema 注释），配套 premium!14295 / premium!14279
• Bug summary: 为 IAM2 增加通用 SCIM 事件接收 runtime：core 层做 Bearer 鉴权、HMAC-SHA256 签名校验、按 (clientId, eventId) 事件幂等去重、按 resourceVersion 防版本回退、敏感字段拒收、事件持久化；header 层只放协议契约（DTO/VO/handler 接口）；premium/iam2 做具体资源映射与 HTTP controller 接线。
• Intent & scope: 10 files、+520 行、除 V5.5.28__schema.sql 追加一张 ScimEventVO 表外全部为新文件。Target branch 5.5.28（未发布开发线）。
• Round 1 initial findings: 1 × P0, 2 × P1, 4 × P2, 4 × P3，集中在 ScimEventVO 实体基类选型与 ScimService 幂等原子性
• Suggested fix direction: 移除 ScimEventVO 对 ResourceVO 的继承（改平实体，对照 SessionVO 模式，DDL 无需改动）；事件记录改为 PENDING-first INSERT 抢锁模式（或按 key synchronized），一并解决并发双 apply 与 apply/record 非原子两个缺陷；趁协议未发布把 HMAC base 补全 method/resource 维度。

---

P0 — Critical

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	header/.../scim/ScimEventVO.java:14	事件日志实体继承 ResourceVO（JOINED 继承），每条 SCIM 事件向全局 ResourceVO 表永久插入一行垃圾数据	移除 extends ResourceVO，直接声明 @Id @Column private String uuid（对照 SessionVO 模式），现有 DDL 不需要改	architecture (+4 persona 命中关联列名问题)	0.97

详细说明 #1：ResourceVO 是 @Entity + @Inheritance(JOINED)（不是 MappedSuperclass）。每次 dbf.persist(ScimEventVO) 会触发 ResourceVO.@PrePersist，向全局 ResourceVO 表插入一行（resourceType="ScimEventVO"，resourceName=null）——即每条事件 2 个 INSERT，且 ResourceVO 表（被资源清单 / 权限 / tag 等大量查询路径扫描）随 SCIM 事件量无界膨胀，且本 MR 无任何事件清理机制。代码库中运行时记录类实体（SessionVO、TaskProgressVO）均不继承 ResourceVO，也没有任何 *EventVO/*RecordVO 继承它的先例。发布后再改需要数据迁移（清理 ResourceVO 残留行），现在改成本约等于零，应在合并前修正。 附带问题：子表列 resourceType（存 SCIM 资源类型）与继承属性 resourceType（@PrePersist 写入类名，存 ResourceVO 表）同名不同义，裸 SQL join 两表时极易混淆——这也是 scimResourceType 字段被迫改名的根因，去掉继承后字段可直接叫 resourceType。

P1 — High

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:57-71	幂等检查与副作用非原子（TOCTOU）：同 eventId 并发投递时 applyResource 执行两次，后到的 recordEvent 撞 ukScimEventVOClientEvent 唯一约束，未捕获异常以 500 返回	按 clientId+eventId 维度 synchronized 串行化（SCIM 事件低频，锁最小原则），或改为 PENDING-first：先 persist(status=PENDING) 抢唯一约束、catch 冲突返回 duplicate、成功后再 applyResource、最后置 APPLIED	correctness, robustness, craftsmanship, adversarial, architecture	1.00
2	core/.../scim/ScimService.java:69-70	applyResource 成功但 recordEvent 失败时（约束冲突 / DB 抖动），资源已变更但事件未记录；下次投递重过幂等检查再次 apply	与 #1 同根：PENDING→APPLIED 两段式可一并解决；或把事件记录与资源变更纳入同一事务边界	correctness, robustness	1.00

详细说明：DatabaseFacadeImpl 的 persist 路径只有 @DeadlockAutoRestart（仅兜死锁），不兜唯一约束冲突，且 doPersist 为 REQUIRES_NEW 独立事务，与 applyResource 的事务天然不共界。触发序列（#1）：ZCF 超时重发 → 两线程同时过 findEvent == null → 双双执行 applyResource（IAM2 状态变更两次）→ 一个 recordEvent 成功、另一个抛 DataIntegrityViolation → sender 收 500 继续重试。版本守卫同样存在 check-apply 窗口：V2/V1 乱序并发时旧版本可能后写覆盖新版本。注意若 premium 的 applyResource 实现本身严格幂等（upsert 语义），实际损害可降级为 500 噪声，但 core 作为通用 runtime 不应依赖这个隐式约定。

P2 — Moderate

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:120	HMAC base 只覆盖 clientId+eventId+resourceVersion+body，HTTP method、resourceType、path 中的 resourceId 均不在签名内：链路无 TLS 时，截获的合法签名请求可改 method/路径重放到不同资源（pathResourceId 优先于 payload id 生效）	base 串加入 method + 原始 resourceType + pathResourceId（需 ZCF 发送端同步修改；协议未发布，现在是改 base 的最后窗口）	orchestrator-adversarial（单源，需作者确认部署链路假设）	0.80
2	core/.../scim/ScimService.java:43,89	eventId/clientId/resourceId 无长度校验：eventId>255 时非严格 sql_mode 下静默截断（重放时全长查询 miss → 再次 apply 后撞唯一约束），严格模式下首次 persist 直接 500（但资源已 apply）——两种模式下幂等语义都被破坏	requiredHeader/optionalHeader 增加长度上限校验（eventId/resourceId ≤255、clientId ≤128），超限返回 400	adversarial	0.90
3	header/.../scim/ScimResourceHandler.java:6	applyResource(String operation, ...) 直接传 HTTP 动词字符串（"POST"/"PUT"/"DELETE"），传输层细节泄漏进 header 契约层	header 定义 ScimOperation 枚举（CREATE/UPDATE/PATCH/DELETE），core 负责 method→枚举映射	architecture	0.92
4	header/.../scim/ScimPayload.java:9	35 个扁平 public 字段、11 对 *Id/*Uuid 成对冗余，resourceId 解析优先级（path > uuid > id > externalId）埋在 service 逻辑里无契约文档	类级 Javadoc 写明各字段解析优先级与成对字段语义，或收敛为单一规范 id、provider 差异在 handler 侧映射	craftsmanship	0.80

P3 — Low

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:154,185	事件状态机只实现一半：status 只写 APPLIED、findEvent 不按 status 过滤、errorMessage 全仓库零写入。premium 将来若写入 FAILED 行，该 eventId 将被当 duplicate 永久吞掉、无法重试	findEvent 加 status = APPLIED 过滤；或提供显式 recordFailedEvent(...) 把失败记录契约做完整；确不使用则删除 errorMessage 列	robustness	0.85
2	core/.../scim/ScimService.java:102	resourceVersion 接受 ≤0（含 Long.MIN_VALUE），首个事件可落库负版本	parse 后校验 resourceVersion > 0，否则 400	adversarial	0.85
3	header/.../scim/ScimEventVO.java:38	@PreUpdate 写 JVM 时钟，与框架惯例（置 null 交给 DB 的 ON UPDATE CURRENT_TIMESTAMP，见 VmPriorityConfigVO）不一致，存在 JVM/DB 时钟偏差风险（当前 insert-only，实际影响为零，纯 pattern 一致性）	preUpdate() 改为 lastOpDate = null	robustness	0.85
4	core/.../scim/ScimService.java:193-236	isBlank/firstNotBlank/hex 为通用工具的私有重复实现；hex 用 String.format("%02x") 循环，处于每请求签名热路径	isBlank/firstNotBlank 用 commons-lang StringUtils；hex 换查表实现或既有 utils	craftsmanship	0.78

Coverage

• 高信号（多 persona 独立命中）：3 条（P0-1 为 5/5、P1-1 为 5/5、P1-2 为 2/5）
• Pipeline 统计：5 persona 共 37 条 raw findings → 去重合并 19 条 → 逐条独立语义 verifier 核验后 3 条 contradicted 丢弃、2 条降级 → 终审 11 条发布
• 终审抑制（避免误报）：-- ZCF-4158 schema 注释（V5.5.22 已有 5 处同类，项目惯例）；uuid UNIQUE + PRIMARY KEY 双声明（zstack 建表标准模式）；"JPA column collision 导致启动失败"（JOINED 继承下父子列位于不同表，无 MappingException，混淆问题已并入 P0-1）；token/secret 迁移 GlobalConfig 的建议（会使 secret 可经 query API 读取，比问题更糟）；enable 开关建议（token 默认空即事实默认关闭）
• Upstream freshness：本地 merge-base 与 MR base_sha 一致，upstream/5.5.28 无领先提交，merge_status: can_be_merged ✓
• Residual risks：核心幂等/事务行为依赖 premium 侧 applyResource 实现（premium!14295），本仓库内无法验证其幂等性
• Testing gaps：本 MR 自身零测试；验证完全依赖 premium 的 IAM2ScimReceiverCase。建议补 core 侧针对并发同 eventId、乱序 version、超长 header 的单测

Verdict: REVISION_REQUIRED

1 条 P0 需在合并前修复（ScimEventVO 基类选型，发布后修复需数据迁移、当前修复零成本）；2 条 P1（幂等原子性）建议与 P0 一并处理，PENDING-first 模式可同时解决三条。

---

🤖 Robot Reviewer

[ZStack-Robot]

Comment from hanyu.liang:

已按本轮 review 处理并推送到 fix-4158@@2：

• P0：ScimEventVO 已改为普通实体，自持 @Id uuid，不再继承 ResourceVO，避免每条事件污染全局 ResourceVO。
• P1：事件处理改为 PENDING-first，先持久化事件再执行资源写入；同时加 GLock(clientId + resourceType + resourceId)，覆盖同资源并发、乱序版本和重复投递窗口。
• P2：HMAC base 已补齐 method/resourceType/pathResourceId，header 长度和正数 resourceVersion 已校验，ScimResourceHandler 改为 ScimOperation enum，ScimPayload 补了字段契约说明。
• P3：事件状态补齐 PENDING/APPLIED/FAILED，失败会记录 errorMessage，@PreUpdate 改为 lastOpDate = null，hex 改为查表实现。

配套也已同步：premium!14295 使用 ScimOperation 并更新测试签名，zcf!512 的 ZIAM sender 使用新的签名 base。

验证：

• mvn -pl header -DskipTests clean install
• mvn -pl core -DskipTests clean install
• mvn -pl iam2 -DskipTests clean install
• mvn -pl test-premium -DskipTests test-compile
• mvn -pl test-premium -Dtest=IAM2ScimReceiverCase -DfailIfNoTests=false test
• go test ./internal/ziam/syncer