<fix>[iam2]: add scim event schema

[ZStack-Robot]

Summary

• Add ScimEventVO to conf/db/upgrade/V5.5.28__schema.sql.
• This table stores generic SCIM event idempotency and resource-version state for the premium SCIM receiver.
• Companion premium MR: http://dev.zstack.io:9080/zstackio/premium/-/merge_requests/14279

Why

Premium SCIM receiver code registers org.zstack.iam2.scim.ScimEventVO, but the zstack 5.5.28 deploydb schema did not create the table. CI failed in IAM2ScimReceiverCase with:

Table 'zstack.ScimEventVO' doesn't exist

Verification

• mvn -pl plugin/kvm -am -DskipTests install passed.
• mvn -pl test-premium -Dtest=PremiumTestCaseStabilityTest -Dcases=org.zstack.test.integration.iam2.IAM2ScimReceiverCase -Dtimes=1 -DfailIfNoTests=false test reached and passed deploydb.sh; local run then stopped before case execution due to unrelated local premium classpath/aspect version mismatch.
• Confirmed table exists after deploydb:

SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='zstack' AND table_name='ScimEventVO';
-- 1

Notes

This MR should be merged before or together with the premium SCIM receiver MR so CI/runtime has the required table.

sync from gitlab !10170

[coderabbitai]

Warning

Review limit reached

@MatheMatrix, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 38 minutes and 12 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f1487117-a1b5-43bd-ad51-38c1cc8400d8

📥 Commits

Reviewing files that changed from the base of the PR and between 3c6de6a and 835378a.

📒 Files selected for processing (11)

• conf/db/upgrade/V5.5.28__schema.sql
• core/src/main/java/org/zstack/core/scim/ScimGlobalProperty.java
• core/src/main/java/org/zstack/core/scim/ScimService.java
• header/src/main/java/org/zstack/header/scim/ScimConstant.java
• header/src/main/java/org/zstack/header/scim/ScimEventVO.java
• header/src/main/java/org/zstack/header/scim/ScimException.java
• header/src/main/java/org/zstack/header/scim/ScimMemberRef.java
• header/src/main/java/org/zstack/header/scim/ScimOperation.java
• header/src/main/java/org/zstack/header/scim/ScimPayload.java
• header/src/main/java/org/zstack/header/scim/ScimResourceHandler.java
• header/src/main/java/org/zstack/header/scim/ScimResult.java

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

Could not fetch remote config from http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml: TimeoutError: The operation was aborted due to timeout

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Walkthrough

数据库迁移脚本在 zstack 库中新增 ScimEventVO 表，用于存储 SCIM 事件的应用状态跟踪。表包含事件标识、资源信息、操作类型、处理状态与时间戳字段，配以主键、唯一约束与查询索引。

Changes

SCIM 事件表

Layer / File(s)	Summary
ScimEventVO 表定义与索引 conf/db/upgrade/V5.5.28__schema.sql	新增表 ScimEventVO 用于持久化 SCIM 事件状态，包含 clientId、eventId、resourceType、resourceId、resourceVersion、operation、status 等字段；定义 uuid 主键与 (clientId, eventId) 唯一约束；添加 idxScimEventVOResourceVersion 复合索引用于按资源与版本高效查询。

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

一张表格现身海中央，
记录 SCIM 事件的流光，
主键唯一展风采，
索引飞快助查询，
兔子鼓掌庆迁移！🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题清晰指出了主要变更为添加 SCIM 事件模式，与变更集内容完全相符。
Description check	✅ Passed	描述详细说明了添加 ScimEventVO 表的目的、原因、验证步骤和相关的 premium MR，与变更内容密切相关。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/hanyu.liang/fix-4158@@2

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[zstack-robot-2]

Comment from yaohua.wu:

Review: MR !10170 — ZCF-4158

Background (preserved across rounds)

• Jira: 未关联 ZSTAC issue；变更源自 ZCF-4158（SCIM 事件应用状态，见 schema 注释），配套 premium!14295 / premium!14279
• Bug summary: 为 IAM2 增加通用 SCIM 事件接收 runtime：core 层做 Bearer 鉴权、HMAC-SHA256 签名校验、按 (clientId, eventId) 事件幂等去重、按 resourceVersion 防版本回退、敏感字段拒收、事件持久化；header 层只放协议契约（DTO/VO/handler 接口）；premium/iam2 做具体资源映射与 HTTP controller 接线。
• Intent & scope: 10 files、+520 行、除 V5.5.28__schema.sql 追加一张 ScimEventVO 表外全部为新文件。Target branch 5.5.28（未发布开发线）。
• Round 1 initial findings: 1 × P0, 2 × P1, 4 × P2, 4 × P3，集中在 ScimEventVO 实体基类选型与 ScimService 幂等原子性
• Suggested fix direction: 移除 ScimEventVO 对 ResourceVO 的继承（改平实体，对照 SessionVO 模式，DDL 无需改动）；事件记录改为 PENDING-first INSERT 抢锁模式（或按 key synchronized），一并解决并发双 apply 与 apply/record 非原子两个缺陷；趁协议未发布把 HMAC base 补全 method/resource 维度。

---

P0 — Critical

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	header/.../scim/ScimEventVO.java:14	事件日志实体继承 ResourceVO（JOINED 继承），每条 SCIM 事件向全局 ResourceVO 表永久插入一行垃圾数据	移除 extends ResourceVO，直接声明 @Id @Column private String uuid（对照 SessionVO 模式），现有 DDL 不需要改	architecture (+4 persona 命中关联列名问题)	0.97

详细说明 #1：ResourceVO 是 @Entity + @Inheritance(JOINED)（不是 MappedSuperclass）。每次 dbf.persist(ScimEventVO) 会触发 ResourceVO.@PrePersist，向全局 ResourceVO 表插入一行（resourceType="ScimEventVO"，resourceName=null）——即每条事件 2 个 INSERT，且 ResourceVO 表（被资源清单 / 权限 / tag 等大量查询路径扫描）随 SCIM 事件量无界膨胀，且本 MR 无任何事件清理机制。代码库中运行时记录类实体（SessionVO、TaskProgressVO）均不继承 ResourceVO，也没有任何 *EventVO/*RecordVO 继承它的先例。发布后再改需要数据迁移（清理 ResourceVO 残留行），现在改成本约等于零，应在合并前修正。 附带问题：子表列 resourceType（存 SCIM 资源类型）与继承属性 resourceType（@PrePersist 写入类名，存 ResourceVO 表）同名不同义，裸 SQL join 两表时极易混淆——这也是 scimResourceType 字段被迫改名的根因，去掉继承后字段可直接叫 resourceType。

P1 — High

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:57-71	幂等检查与副作用非原子（TOCTOU）：同 eventId 并发投递时 applyResource 执行两次，后到的 recordEvent 撞 ukScimEventVOClientEvent 唯一约束，未捕获异常以 500 返回	按 clientId+eventId 维度 synchronized 串行化（SCIM 事件低频，锁最小原则），或改为 PENDING-first：先 persist(status=PENDING) 抢唯一约束、catch 冲突返回 duplicate、成功后再 applyResource、最后置 APPLIED	correctness, robustness, craftsmanship, adversarial, architecture	1.00
2	core/.../scim/ScimService.java:69-70	applyResource 成功但 recordEvent 失败时（约束冲突 / DB 抖动），资源已变更但事件未记录；下次投递重过幂等检查再次 apply	与 #1 同根：PENDING→APPLIED 两段式可一并解决；或把事件记录与资源变更纳入同一事务边界	correctness, robustness	1.00

详细说明：DatabaseFacadeImpl 的 persist 路径只有 @DeadlockAutoRestart（仅兜死锁），不兜唯一约束冲突，且 doPersist 为 REQUIRES_NEW 独立事务，与 applyResource 的事务天然不共界。触发序列（#1）：ZCF 超时重发 → 两线程同时过 findEvent == null → 双双执行 applyResource（IAM2 状态变更两次）→ 一个 recordEvent 成功、另一个抛 DataIntegrityViolation → sender 收 500 继续重试。版本守卫同样存在 check-apply 窗口：V2/V1 乱序并发时旧版本可能后写覆盖新版本。注意若 premium 的 applyResource 实现本身严格幂等（upsert 语义），实际损害可降级为 500 噪声，但 core 作为通用 runtime 不应依赖这个隐式约定。

P2 — Moderate

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:120	HMAC base 只覆盖 clientId+eventId+resourceVersion+body，HTTP method、resourceType、path 中的 resourceId 均不在签名内：链路无 TLS 时，截获的合法签名请求可改 method/路径重放到不同资源（pathResourceId 优先于 payload id 生效）	base 串加入 method + 原始 resourceType + pathResourceId（需 ZCF 发送端同步修改；协议未发布，现在是改 base 的最后窗口）	orchestrator-adversarial（单源，需作者确认部署链路假设）	0.80
2	core/.../scim/ScimService.java:43,89	eventId/clientId/resourceId 无长度校验：eventId>255 时非严格 sql_mode 下静默截断（重放时全长查询 miss → 再次 apply 后撞唯一约束），严格模式下首次 persist 直接 500（但资源已 apply）——两种模式下幂等语义都被破坏	requiredHeader/optionalHeader 增加长度上限校验（eventId/resourceId ≤255、clientId ≤128），超限返回 400	adversarial	0.90
3	header/.../scim/ScimResourceHandler.java:6	applyResource(String operation, ...) 直接传 HTTP 动词字符串（"POST"/"PUT"/"DELETE"），传输层细节泄漏进 header 契约层	header 定义 ScimOperation 枚举（CREATE/UPDATE/PATCH/DELETE），core 负责 method→枚举映射	architecture	0.92
4	header/.../scim/ScimPayload.java:9	35 个扁平 public 字段、11 对 *Id/*Uuid 成对冗余，resourceId 解析优先级（path > uuid > id > externalId）埋在 service 逻辑里无契约文档	类级 Javadoc 写明各字段解析优先级与成对字段语义，或收敛为单一规范 id、provider 差异在 handler 侧映射	craftsmanship	0.80

P3 — Low

#	File:Line	Issue	Fix	Reviewer(s)	Conf
1	core/.../scim/ScimService.java:154,185	事件状态机只实现一半：status 只写 APPLIED、findEvent 不按 status 过滤、errorMessage 全仓库零写入。premium 将来若写入 FAILED 行，该 eventId 将被当 duplicate 永久吞掉、无法重试	findEvent 加 status = APPLIED 过滤；或提供显式 recordFailedEvent(...) 把失败记录契约做完整；确不使用则删除 errorMessage 列	robustness	0.85
2	core/.../scim/ScimService.java:102	resourceVersion 接受 ≤0（含 Long.MIN_VALUE），首个事件可落库负版本	parse 后校验 resourceVersion > 0，否则 400	adversarial	0.85
3	header/.../scim/ScimEventVO.java:38	@PreUpdate 写 JVM 时钟，与框架惯例（置 null 交给 DB 的 ON UPDATE CURRENT_TIMESTAMP，见 VmPriorityConfigVO）不一致，存在 JVM/DB 时钟偏差风险（当前 insert-only，实际影响为零，纯 pattern 一致性）	preUpdate() 改为 lastOpDate = null	robustness	0.85
4	core/.../scim/ScimService.java:193-236	isBlank/firstNotBlank/hex 为通用工具的私有重复实现；hex 用 String.format("%02x") 循环，处于每请求签名热路径	isBlank/firstNotBlank 用 commons-lang StringUtils；hex 换查表实现或既有 utils	craftsmanship	0.78

Coverage

• 高信号（多 persona 独立命中）：3 条（P0-1 为 5/5、P1-1 为 5/5、P1-2 为 2/5）
• Pipeline 统计：5 persona 共 37 条 raw findings → 去重合并 19 条 → 逐条独立语义 verifier 核验后 3 条 contradicted 丢弃、2 条降级 → 终审 11 条发布
• 终审抑制（避免误报）：-- ZCF-4158 schema 注释（V5.5.22 已有 5 处同类，项目惯例）；uuid UNIQUE + PRIMARY KEY 双声明（zstack 建表标准模式）；"JPA column collision 导致启动失败"（JOINED 继承下父子列位于不同表，无 MappingException，混淆问题已并入 P0-1）；token/secret 迁移 GlobalConfig 的建议（会使 secret 可经 query API 读取，比问题更糟）；enable 开关建议（token 默认空即事实默认关闭）
• Upstream freshness：本地 merge-base 与 MR base_sha 一致，upstream/5.5.28 无领先提交，merge_status: can_be_merged ✓
• Residual risks：核心幂等/事务行为依赖 premium 侧 applyResource 实现（premium!14295），本仓库内无法验证其幂等性
• Testing gaps：本 MR 自身零测试；验证完全依赖 premium 的 IAM2ScimReceiverCase。建议补 core 侧针对并发同 eventId、乱序 version、超长 header 的单测

Verdict: REVISION_REQUIRED

1 条 P0 需在合并前修复（ScimEventVO 基类选型，发布后修复需数据迁移、当前修复零成本）；2 条 P1（幂等原子性）建议与 P0 一并处理，PENDING-first 模式可同时解决三条。

---

🤖 Robot Reviewer

[ZStack-Robot]

Comment from hanyu.liang:

已按本轮 review 处理并推送到 fix-4158@@2：

• P0：ScimEventVO 已改为普通实体，自持 @Id uuid，不再继承 ResourceVO，避免每条事件污染全局 ResourceVO。
• P1：事件处理改为 PENDING-first，先持久化事件再执行资源写入；同时加 GLock(clientId + resourceType + resourceId)，覆盖同资源并发、乱序版本和重复投递窗口。
• P2：HMAC base 已补齐 method/resourceType/pathResourceId，header 长度和正数 resourceVersion 已校验，ScimResourceHandler 改为 ScimOperation enum，ScimPayload 补了字段契约说明。
• P3：事件状态补齐 PENDING/APPLIED/FAILED，失败会记录 errorMessage，@PreUpdate 改为 lastOpDate = null，hex 改为查表实现。

配套也已同步：premium!14295 使用 ScimOperation 并更新测试签名，zcf!512 的 ZIAM sender 使用新的签名 base。

验证：

• mvn -pl header -DskipTests clean install
• mvn -pl core -DskipTests clean install
• mvn -pl iam2 -DskipTests clean install
• mvn -pl test-premium -DskipTests test-compile
• mvn -pl test-premium -Dtest=IAM2ScimReceiverCase -DfailIfNoTests=false test
• go test ./internal/ziam/syncer