On branch 001-label-backend-spec

Changes to be committed:
	new file:   src/main/java/com/label/common/shiro/BearerToken.java
	new file:   src/main/java/com/label/common/shiro/ShiroConfig.java
	new file:   src/main/java/com/label/common/shiro/TokenFilter.java
	new file:   src/main/java/com/label/common/shiro/TokenPrincipal.java
	new file:   src/main/java/com/label/common/shiro/UserRealm.java
	modified:   src/main/java/com/label/common/statemachine/DatasetStatus.java
	new file:   src/test/java/com/label/AbstractIntegrationTest.java
	new file:   src/test/java/com/label/unit/StateMachineTest.java
	new file:   src/test/resources/db/init.sql

src/main/java/com/label/common/shiro/BearerToken.java

@@ -0,0 +1,26 @@
+package com.label.common.shiro;
+
+import org.apache.shiro.authc.AuthenticationToken;
+
+/**
+ * Shiro AuthenticationToken wrapper for Bearer token strings.
+ */
+public class BearerToken implements AuthenticationToken {
+    private final String token;
+    private final TokenPrincipal principal;
+
+    public BearerToken(String token, TokenPrincipal principal) {
+        this.token = token;
+        this.principal = principal;
+    }
+
+    @Override
+    public Object getPrincipal() {
+        return principal;
+    }
+
+    @Override
+    public Object getCredentials() {
+        return token;
+    }
+}

src/main/java/com/label/common/shiro/ShiroConfig.java

@@ -0,0 +1,71 @@
+package com.label.common.shiro;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.label.common.redis.RedisService;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.realm.Realm;
+import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import jakarta.servlet.Filter;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Shiro security configuration.
+ *
+ * Filter chain:
+ *   /api/auth/login  → anon  (no auth required)
+ *   /api/auth/logout → tokenFilter
+ *   /api/**          → tokenFilter (all other API endpoints require auth)
+ *   /actuator/**     → anon  (health check)
+ *   /**              → anon  (default)
+ *
+ * NOTE: spring.mvc.pathmatch.matching-strategy=ant_path_matcher MUST be set
+ * in application.yml for Shiro to work correctly with Spring Boot 3.
+ */
+@Configuration
+public class ShiroConfig {
+
+    @Bean
+    public UserRealm userRealm(RedisService redisService) {
+        return new UserRealm(redisService);
+    }
+
+    @Bean
+    public SecurityManager securityManager(UserRealm userRealm) {
+        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
+        manager.setRealms(List.of(userRealm));
+        return manager;
+    }
+
+    @Bean
+    public TokenFilter tokenFilter(RedisService redisService, ObjectMapper objectMapper) {
+        return new TokenFilter(redisService, objectMapper);
+    }
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager,
+                                                          TokenFilter tokenFilter) {
+        ShiroFilterFactoryBean factory = new ShiroFilterFactoryBean();
+        factory.setSecurityManager(securityManager);
+
+        // Register custom filters
+        Map<String, Filter> filters = new LinkedHashMap<>();
+        filters.put("tokenFilter", tokenFilter);
+        factory.setFilters(filters);
+
+        // Filter chain definition (ORDER MATTERS - first match wins)
+        Map<String, String> filterChainDef = new LinkedHashMap<>();
+        filterChainDef.put("/api/auth/login", "anon");
+        filterChainDef.put("/actuator/**", "anon");
+        filterChainDef.put("/api/**", "tokenFilter");
+        filterChainDef.put("/**", "anon");
+        factory.setFilterChainDefinitionMap(filterChainDef);
+
+        return factory;
+    }
+}

src/main/java/com/label/common/shiro/TokenFilter.java

@@ -0,0 +1,95 @@
+package com.label.common.shiro;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.label.common.context.CompanyContext;
+import com.label.common.redis.RedisKeyManager;
+import com.label.common.redis.RedisService;
+import com.label.common.result.Result;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.shiro.web.filter.PathMatchingFilter;
+import org.springframework.http.MediaType;
+
+import java.io.IOException;
+import java.util.Map;
+
+/**
+ * Shiro filter: parses "Authorization: Bearer {uuid}", validates against Redis,
+ * injects CompanyContext and Shiro subject principals.
+ *
+ * KEY DESIGN:
+ * - CompanyContext.clear() MUST be called in finally block to prevent thread pool leakage
+ * - Token lookup is from Redis Hash token:{uuid} → {userId, role, companyId, username}
+ * - 401 on missing/invalid token; filter continues for valid token
+ */
+@Slf4j
+@RequiredArgsConstructor
+public class TokenFilter extends PathMatchingFilter {
+
+    private final RedisService redisService;
+    private final ObjectMapper objectMapper;
+
+    @Override
+    protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
+        HttpServletRequest req = (HttpServletRequest) request;
+        HttpServletResponse resp = (HttpServletResponse) response;
+
+        String authHeader = req.getHeader("Authorization");
+        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
+            writeUnauthorized(resp, "缺少或无效的认证令牌");
+            return false;
+        }
+
+        String token = authHeader.substring(7).trim();
+        String tokenKey = RedisKeyManager.tokenKey(token);
+        Map<Object, Object> tokenData = redisService.hGetAll(tokenKey);
+
+        if (tokenData == null || tokenData.isEmpty()) {
+            writeUnauthorized(resp, "令牌已过期或不存在");
+            return false;
+        }
+
+        try {
+            Long userId = Long.parseLong(tokenData.get("userId").toString());
+            String role = tokenData.get("role").toString();
+            Long companyId = Long.parseLong(tokenData.get("companyId").toString());
+            String username = tokenData.get("username").toString();
+
+            // Inject company context (must be cleared in finally)
+            CompanyContext.set(companyId);
+
+            // Bind Shiro subject with token principal
+            TokenPrincipal principal = new TokenPrincipal(userId, role, companyId, username, token);
+            request.setAttribute("__token_principal__", principal);
+
+            return true;
+        } catch (Exception e) {
+            log.error("解析 Token 数据失败: {}", e.getMessage());
+            writeUnauthorized(resp, "令牌数据格式错误");
+            return false;
+        }
+    }
+
+    @Override
+    public void doFilterInternal(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws ServletException, IOException {
+        try {
+            super.doFilterInternal(request, response, chain);
+        } finally {
+            // CRITICAL: Always clear ThreadLocal to prevent leakage in thread pool
+            CompanyContext.clear();
+        }
+    }
+
+    private void writeUnauthorized(HttpServletResponse resp, String message) throws IOException {
+        resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+        resp.setContentType(MediaType.APPLICATION_JSON_VALUE + ";charset=UTF-8");
+        resp.getWriter().write(objectMapper.writeValueAsString(Result.failure("UNAUTHORIZED", message)));
+    }
+}

src/main/java/com/label/common/shiro/TokenPrincipal.java

@@ -0,0 +1,18 @@
+package com.label.common.shiro;
+
+import lombok.AllArgsConstructor;
+import lombok.Getter;
+import java.io.Serializable;
+
+/**
+ * Shiro principal carrying the authenticated user's session data.
+ */
+@Getter
+@AllArgsConstructor
+public class TokenPrincipal implements Serializable {
+    private final Long userId;
+    private final String role;
+    private final Long companyId;
+    private final String username;
+    private final String token;
+}

src/main/java/com/label/common/shiro/UserRealm.java

@@ -0,0 +1,87 @@
+package com.label.common.shiro;
+
+import com.label.common.redis.RedisKeyManager;
+import com.label.common.redis.RedisService;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.shiro.authc.*;
+import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.authz.SimpleAuthorizationInfo;
+import org.apache.shiro.realm.AuthorizingRealm;
+import org.apache.shiro.subject.PrincipalCollection;
+
+/**
+ * Shiro Realm for role-based authorization using token-based authentication.
+ *
+ * Role hierarchy (addInheritedRoles):
+ *   ADMIN ⊃ REVIEWER ⊃ ANNOTATOR ⊃ UPLOADER
+ *
+ * Permission lookup order:
+ *   1. Redis user:perm:{userId} (TTL 5 min)
+ *   2. If miss: use role from TokenPrincipal
+ */
+@Slf4j
+@RequiredArgsConstructor
+public class UserRealm extends AuthorizingRealm {
+
+    private static final long PERM_CACHE_TTL = 300L; // 5 minutes
+
+    private final RedisService redisService;
+
+    @Override
+    public boolean supports(AuthenticationToken token) {
+        return token instanceof BearerToken;
+    }
+
+    @Override
+    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
+        // Token validation is done in TokenFilter; this realm only handles authorization
+        // For authentication, we trust the token that was validated by TokenFilter
+        return new SimpleAuthenticationInfo(token.getPrincipal(), token.getCredentials(), getName());
+    }
+
+    @Override
+    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+        TokenPrincipal principal = (TokenPrincipal) principals.getPrimaryPrincipal();
+        if (principal == null) {
+            return new SimpleAuthorizationInfo();
+        }
+
+        String role = getRoleFromCacheOrPrincipal(principal);
+        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
+        info.addRole(role);
+        addInheritedRoles(info, role);
+        return info;
+    }
+
+    private String getRoleFromCacheOrPrincipal(TokenPrincipal principal) {
+        String permKey = RedisKeyManager.userPermKey(principal.getUserId());
+        String cachedRole = redisService.get(permKey);
+        if (cachedRole != null && !cachedRole.isEmpty()) {
+            return cachedRole;
+        }
+        // Cache miss: use role from token, then refresh cache
+        String role = principal.getRole();
+        redisService.set(permKey, role, PERM_CACHE_TTL);
+        return role;
+    }
+
+    /**
+     * ADMIN inherits all roles: ADMIN ⊃ REVIEWER ⊃ ANNOTATOR ⊃ UPLOADER
+     */
+    private void addInheritedRoles(SimpleAuthorizationInfo info, String role) {
+        switch (role) {
+            case "ADMIN":
+                info.addRole("REVIEWER");
+                // fall through
+            case "REVIEWER":
+                info.addRole("ANNOTATOR");
+                // fall through
+            case "ANNOTATOR":
+                info.addRole("UPLOADER");
+                break;
+            default:
+                break;
+        }
+    }
+}

src/main/java/com/label/common/statemachine/DatasetStatus.java

@@ -7,7 +7,8 @@ public enum DatasetStatus {
     PENDING_REVIEW, APPROVED, REJECTED;
 
     public static final Map<DatasetStatus, Set<DatasetStatus>> TRANSITIONS = Map.of(
-        PENDING_REVIEW, Set.of(APPROVED, REJECTED)
+        PENDING_REVIEW, Set.of(APPROVED, REJECTED),
-        // APPROVED/REJECTED: terminal states
+        REJECTED,       Set.of(PENDING_REVIEW)  // 重新提交审核
+        // APPROVED: terminal state
     );
 }

src/test/java/com/label/AbstractIntegrationTest.java

@@ -0,0 +1,87 @@
+package com.label;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+import org.testcontainers.utility.DockerImageName;
+import org.testcontainers.utility.MountableFile;
+
+/**
+ * Base class for all integration tests.
+ *
+ * Starts real PostgreSQL 16 and Redis 7 containers (shared across test class instances).
+ * Executes sql/init.sql to initialize schema and seed data.
+ *
+ * DESIGN:
+ * - @Container with static fields → containers are shared across test methods (faster)
+ * - @DynamicPropertySource → overrides datasource/redis properties at runtime
+ * - @BeforeEach cleanData() → truncates business tables (not sys_company/sys_user) between tests
+ */
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+@Testcontainers
+public abstract class AbstractIntegrationTest {
+
+    @LocalServerPort
+    protected int port;
+
+    @Autowired
+    protected JdbcTemplate jdbcTemplate;
+
+    @SuppressWarnings("resource")
+    @Container
+    protected static final PostgreSQLContainer<?> postgres =
+            new PostgreSQLContainer<>(DockerImageName.parse("postgres:16-alpine"))
+                    .withDatabaseName("label_db")
+                    .withUsername("label")
+                    .withPassword("label_password")
+                    .withCopyFileToContainer(
+                            MountableFile.forClasspathResource("db/init.sql"),
+                            "/docker-entrypoint-initdb.d/init.sql");
+
+    @SuppressWarnings("resource")
+    @Container
+    protected static final GenericContainer<?> redis =
+            new GenericContainer<>(DockerImageName.parse("redis:7-alpine"))
+                    .withExposedPorts(6379)
+                    .withCommand("redis-server", "--requirepass", "test_redis_password");
+
+    @DynamicPropertySource
+    static void configureProperties(DynamicPropertyRegistry registry) {
+        registry.add("spring.datasource.url", postgres::getJdbcUrl);
+        registry.add("spring.datasource.username", postgres::getUsername);
+        registry.add("spring.datasource.password", postgres::getPassword);
+        registry.add("spring.data.redis.host", redis::getHost);
+        registry.add("spring.data.redis.port", () -> redis.getMappedPort(6379));
+        registry.add("spring.data.redis.password", () -> "test_redis_password");
+    }
+
+    /**
+     * Clean only business data between tests to keep schema intact.
+     * Keep sys_company and sys_user since init.sql seeds them.
+     */
+    @BeforeEach
+    void cleanData() {
+        jdbcTemplate.execute("TRUNCATE TABLE video_process_job, annotation_task_history, " +
+                "sys_operation_log, sys_config, export_batch, training_dataset, " +
+                "annotation_result, annotation_task, source_data RESTART IDENTITY CASCADE");
+        // Re-insert global sys_config entries that were truncated
+        jdbcTemplate.execute("INSERT INTO sys_config (company_id, config_key, config_value) VALUES " +
+                "(NULL, 'token_ttl_seconds', '7200'), " +
+                "(NULL, 'model_default', 'glm-4'), " +
+                "(NULL, 'video_frame_interval', '30') " +
+                "ON CONFLICT DO NOTHING");
+    }
+
+    /** Helper: get base URL for REST calls */
+    protected String baseUrl(String path) {
+        return "http://localhost:" + port + path;
+    }
+}

src/test/java/com/label/unit/StateMachineTest.java

@@ -0,0 +1,265 @@
+package com.label.unit;
+
+import com.label.common.exception.BusinessException;
+import com.label.common.statemachine.*;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.*;
+
+/**
+ * Unit tests for all state machine enums and StateValidator.
+ * No Spring context needed - pure unit tests.
+ */
+@DisplayName("状态机单元测试")
+class StateMachineTest {
+
+    // ===== SourceStatus =====
+    @Nested
+    @DisplayName("SourceStatus 状态机")
+    class SourceStatusTest {
+
+        @Test
+        @DisplayName("合法转换：PENDING → EXTRACTING（文本/图片直接提取）")
+        void pendingToExtracting() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.PENDING, SourceStatus.EXTRACTING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：PENDING → PREPROCESSING（视频上传）")
+        void pendingToPreprocessing() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.PENDING, SourceStatus.PREPROCESSING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：PREPROCESSING → PENDING（视频预处理完成）")
+        void preprocessingToPending() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.PREPROCESSING, SourceStatus.PENDING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：EXTRACTING → QA_REVIEW（提取审批通过）")
+        void extractingToQaReview() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.EXTRACTING, SourceStatus.QA_REVIEW)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：QA_REVIEW → APPROVED（QA 审批通过）")
+        void qaReviewToApproved() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.QA_REVIEW, SourceStatus.APPROVED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("非法转换：APPROVED → PENDING 抛出异常")
+        void approvedToPendingFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.APPROVED, SourceStatus.PENDING)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+
+        @Test
+        @DisplayName("非法转换：PENDING → APPROVED（跳过中间状态）抛出异常")
+        void pendingToApprovedFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(SourceStatus.TRANSITIONS, SourceStatus.PENDING, SourceStatus.APPROVED)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+    }
+
+    // ===== TaskStatus =====
+    @Nested
+    @DisplayName("TaskStatus 状态机")
+    class TaskStatusTest {
+
+        @Test
+        @DisplayName("合法转换：UNCLAIMED → IN_PROGRESS（领取）")
+        void unclaimedToInProgress() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.UNCLAIMED, TaskStatus.IN_PROGRESS)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：IN_PROGRESS → SUBMITTED（提交）")
+        void inProgressToSubmitted() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.IN_PROGRESS, TaskStatus.SUBMITTED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：IN_PROGRESS → UNCLAIMED（放弃）")
+        void inProgressToUnclaimed() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.IN_PROGRESS, TaskStatus.UNCLAIMED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：IN_PROGRESS → IN_PROGRESS（ADMIN 强制转移，持有人变更）")
+        void inProgressToInProgress() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.IN_PROGRESS, TaskStatus.IN_PROGRESS)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：SUBMITTED → APPROVED（审批通过）")
+        void submittedToApproved() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.SUBMITTED, TaskStatus.APPROVED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：SUBMITTED → REJECTED（审批驳回）")
+        void submittedToRejected() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.SUBMITTED, TaskStatus.REJECTED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：REJECTED → IN_PROGRESS（标注员重领）")
+        void rejectedToInProgress() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.REJECTED, TaskStatus.IN_PROGRESS)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("非法转换：APPROVED → IN_PROGRESS 抛出异常")
+        void approvedToInProgressFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.APPROVED, TaskStatus.IN_PROGRESS)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+
+        @Test
+        @DisplayName("非法转换：UNCLAIMED → SUBMITTED（跳过 IN_PROGRESS）抛出异常")
+        void unclaimedToSubmittedFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(TaskStatus.TRANSITIONS, TaskStatus.UNCLAIMED, TaskStatus.SUBMITTED)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+    }
+
+    // ===== DatasetStatus =====
+    @Nested
+    @DisplayName("DatasetStatus 状态机")
+    class DatasetStatusTest {
+
+        @Test
+        @DisplayName("合法转换：PENDING_REVIEW → APPROVED")
+        void pendingReviewToApproved() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(DatasetStatus.TRANSITIONS, DatasetStatus.PENDING_REVIEW, DatasetStatus.APPROVED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：PENDING_REVIEW → REJECTED")
+        void pendingReviewToRejected() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(DatasetStatus.TRANSITIONS, DatasetStatus.PENDING_REVIEW, DatasetStatus.REJECTED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：REJECTED → PENDING_REVIEW（重新提交）")
+        void rejectedToPendingReview() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(DatasetStatus.TRANSITIONS, DatasetStatus.REJECTED, DatasetStatus.PENDING_REVIEW)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("非法转换：APPROVED → REJECTED 抛出异常")
+        void approvedToRejectedFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(DatasetStatus.TRANSITIONS, DatasetStatus.APPROVED, DatasetStatus.REJECTED)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+    }
+
+    // ===== VideoJobStatus =====
+    @Nested
+    @DisplayName("VideoJobStatus 状态机")
+    class VideoJobStatusTest {
+
+        @Test
+        @DisplayName("合法转换：PENDING → RUNNING")
+        void pendingToRunning() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.PENDING, VideoJobStatus.RUNNING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：RUNNING → SUCCESS")
+        void runningToSuccess() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.RUNNING, VideoJobStatus.SUCCESS)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：RUNNING → RETRYING（失败且未超重试次数）")
+        void runningToRetrying() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.RUNNING, VideoJobStatus.RETRYING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：RUNNING → FAILED（失败且超过最大重试）")
+        void runningToFailed() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.RUNNING, VideoJobStatus.FAILED)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("合法转换：RETRYING → RUNNING（AI 重试）")
+        void retryingToRunning() {
+            assertThatCode(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.RETRYING, VideoJobStatus.RUNNING)
+            ).doesNotThrowAnyException();
+        }
+
+        @Test
+        @DisplayName("非法转换：FAILED → PENDING 不在状态机内（ADMIN 手动触发，不走 StateValidator）")
+        void failedToPendingNotInStateMachine() {
+            // FAILED → PENDING is intentionally NOT in TRANSITIONS (ADMIN manual reset via special API)
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.FAILED, VideoJobStatus.PENDING)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+
+        @Test
+        @DisplayName("非法转换：SUCCESS → RUNNING 抛出异常")
+        void successToRunningFails() {
+            assertThatThrownBy(() ->
+                StateValidator.assertTransition(VideoJobStatus.TRANSITIONS, VideoJobStatus.SUCCESS, VideoJobStatus.RUNNING)
+            ).isInstanceOf(BusinessException.class)
+             .extracting("code").isEqualTo("INVALID_STATE_TRANSITION");
+        }
+    }
+}

src/test/resources/db/init.sql

@@ -0,0 +1,332 @@
+-- label_backend init.sql
+-- PostgreSQL 14+
+-- 按依赖顺序建全部 11 张表：
+--   sys_company → sys_user → source_data → annotation_task → annotation_result
+--   → training_dataset → export_batch → sys_config → sys_operation_log
+--   → annotation_task_history → video_process_job
+-- 含所有索引及初始配置数据
+
+-- ============================================================
+-- 扩展
+-- ============================================================
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- ============================================================
+-- 1. sys_company（租户）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS sys_company (
+    id           BIGSERIAL    PRIMARY KEY,
+    company_name VARCHAR(100) NOT NULL,
+    company_code VARCHAR(50)  NOT NULL,
+    status       VARCHAR(10)  NOT NULL DEFAULT 'ACTIVE',  -- ACTIVE / DISABLED
+    created_at   TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMP    NOT NULL DEFAULT NOW(),
+    CONSTRAINT uk_sys_company_name UNIQUE (company_name),
+    CONSTRAINT uk_sys_company_code UNIQUE (company_code)
+);
+
+-- ============================================================
+-- 2. sys_user（用户）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS sys_user (
+    id            BIGSERIAL    PRIMARY KEY,
+    company_id    BIGINT       NOT NULL REFERENCES sys_company(id),
+    username      VARCHAR(50)  NOT NULL,
+    password_hash VARCHAR(255) NOT NULL,  -- BCrypt, strength >= 10
+    real_name     VARCHAR(50),
+    role          VARCHAR(20)  NOT NULL,  -- UPLOADER / ANNOTATOR / REVIEWER / ADMIN
+    status        VARCHAR(10)  NOT NULL DEFAULT 'ACTIVE',  -- ACTIVE / DISABLED
+    created_at    TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMP    NOT NULL DEFAULT NOW(),
+    CONSTRAINT uk_sys_user_company_username UNIQUE (company_id, username)
+);
+
+CREATE INDEX IF NOT EXISTS idx_sys_user_company_id
+    ON sys_user (company_id);
+
+-- ============================================================
+-- 3. source_data（原始资料）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS source_data (
+    id               BIGSERIAL    PRIMARY KEY,
+    company_id       BIGINT       NOT NULL REFERENCES sys_company(id),
+    uploader_id      BIGINT       REFERENCES sys_user(id),
+    data_type        VARCHAR(20)  NOT NULL,  -- TEXT / IMAGE / VIDEO
+    file_path        VARCHAR(500) NOT NULL,  -- RustFS object path
+    file_name        VARCHAR(255) NOT NULL,
+    file_size        BIGINT,
+    bucket_name      VARCHAR(100) NOT NULL,
+    parent_source_id BIGINT       REFERENCES source_data(id),  -- 视频帧 / 文本片段
+    status           VARCHAR(20)  NOT NULL DEFAULT 'PENDING',
+    -- PENDING / PREPROCESSING / EXTRACTING / QA_REVIEW / APPROVED
+    reject_reason    TEXT,  -- 保留字段（当前无 REJECTED 状态）
+    created_at       TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMP    NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_source_data_company_id
+    ON source_data (company_id);
+CREATE INDEX IF NOT EXISTS idx_source_data_company_status
+    ON source_data (company_id, status);
+CREATE INDEX IF NOT EXISTS idx_source_data_parent_source_id
+    ON source_data (parent_source_id);
+
+-- ============================================================
+-- 4. annotation_task（标注任务）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS annotation_task (
+    id           BIGSERIAL   PRIMARY KEY,
+    company_id   BIGINT      NOT NULL REFERENCES sys_company(id),
+    source_id    BIGINT      NOT NULL REFERENCES source_data(id),
+    task_type    VARCHAR(30) NOT NULL,  -- EXTRACTION / QA_GENERATION
+    status       VARCHAR(20) NOT NULL DEFAULT 'UNCLAIMED',
+    -- UNCLAIMED / IN_PROGRESS / SUBMITTED / APPROVED / REJECTED
+    claimed_by   BIGINT      REFERENCES sys_user(id),
+    claimed_at   TIMESTAMP,
+    submitted_at TIMESTAMP,
+    completed_at TIMESTAMP,
+    is_final     BOOLEAN     NOT NULL DEFAULT FALSE,  -- true 即 APPROVED 且无需再审
+    ai_model     VARCHAR(50),
+    reject_reason TEXT,
+    created_at   TIMESTAMP   NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMP   NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_annotation_task_company_status
+    ON annotation_task (company_id, status);
+CREATE INDEX IF NOT EXISTS idx_annotation_task_source_id
+    ON annotation_task (source_id);
+CREATE INDEX IF NOT EXISTS idx_annotation_task_claimed_by
+    ON annotation_task (claimed_by);
+
+-- ============================================================
+-- 5. annotation_result（标注结果，JSONB）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS annotation_result (
+    id          BIGSERIAL NOT NULL,
+    task_id     BIGINT    NOT NULL REFERENCES annotation_task(id),
+    company_id  BIGINT    NOT NULL REFERENCES sys_company(id),
+    result_json JSONB     NOT NULL DEFAULT '[]'::jsonb,  -- 整体替换语义
+    created_at  TIMESTAMP NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMP NOT NULL DEFAULT NOW(),
+    CONSTRAINT pk_annotation_result PRIMARY KEY (id),
+    CONSTRAINT uk_annotation_result_task_id UNIQUE (task_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_annotation_result_task_id
+    ON annotation_result (task_id);
+CREATE INDEX IF NOT EXISTS idx_annotation_result_company_id
+    ON annotation_result (company_id);
+
+-- ============================================================
+-- 6. training_dataset（训练数据集）
+--    export_batch_id FK 在 export_batch 建完后补加
+-- ============================================================
+CREATE TABLE IF NOT EXISTS training_dataset (
+    id               BIGSERIAL   PRIMARY KEY,
+    company_id       BIGINT      NOT NULL REFERENCES sys_company(id),
+    task_id          BIGINT      NOT NULL REFERENCES annotation_task(id),
+    source_id        BIGINT      NOT NULL REFERENCES source_data(id),
+    sample_type      VARCHAR(20) NOT NULL,  -- TEXT / IMAGE / VIDEO_FRAME
+    glm_format_json  JSONB       NOT NULL,  -- GLM fine-tune 格式
+    status           VARCHAR(20) NOT NULL DEFAULT 'PENDING_REVIEW',
+    -- PENDING_REVIEW / APPROVED / REJECTED
+    export_batch_id  BIGINT,               -- 导出后填写，FK 在下方补加
+    exported_at      TIMESTAMP,
+    created_at       TIMESTAMP   NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMP   NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_training_dataset_company_status
+    ON training_dataset (company_id, status);
+CREATE INDEX IF NOT EXISTS idx_training_dataset_task_id
+    ON training_dataset (task_id);
+
+-- ============================================================
+-- 7. export_batch（导出批次）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS export_batch (
+    id                BIGSERIAL    PRIMARY KEY,
+    company_id        BIGINT       NOT NULL REFERENCES sys_company(id),
+    batch_uuid        UUID         NOT NULL DEFAULT gen_random_uuid(),
+    sample_count      INT          NOT NULL DEFAULT 0,
+    dataset_file_path VARCHAR(500),          -- 导出 JSONL 的 RustFS 路径
+    glm_job_id        VARCHAR(100),          -- GLM fine-tune 任务 ID
+    finetune_status   VARCHAR(20)  NOT NULL DEFAULT 'NOT_STARTED',
+    -- NOT_STARTED / RUNNING / COMPLETED / FAILED
+    created_at        TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at        TIMESTAMP    NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_export_batch_company_id
+    ON export_batch (company_id);
+
+-- 补加 training_dataset.export_batch_id FK
+ALTER TABLE training_dataset
+    ADD CONSTRAINT fk_training_dataset_export_batch
+    FOREIGN KEY (export_batch_id) REFERENCES export_batch(id)
+    NOT VALID;  -- 允许已有 NULL 行，不强制回溯校验
+
+-- ============================================================
+-- 8. sys_config（系统配置）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS sys_config (
+    id           BIGSERIAL    PRIMARY KEY,
+    company_id   BIGINT       REFERENCES sys_company(id),  -- NULL = 全局默认
+    config_key   VARCHAR(100) NOT NULL,
+    config_value TEXT         NOT NULL,
+    description  VARCHAR(255),
+    created_at   TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMP    NOT NULL DEFAULT NOW()
+);
+
+-- 公司级配置唯一索引
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_config_company_key
+    ON sys_config (company_id, config_key)
+    WHERE company_id IS NOT NULL;
+
+-- 全局配置唯一索引
+CREATE UNIQUE INDEX IF NOT EXISTS uk_sys_config_global_key
+    ON sys_config (config_key)
+    WHERE company_id IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_sys_config_company_key
+    ON sys_config (company_id, config_key);
+
+-- ============================================================
+-- 9. sys_operation_log（操作日志，仅追加）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS sys_operation_log (
+    id             BIGSERIAL   PRIMARY KEY,
+    company_id     BIGINT      NOT NULL REFERENCES sys_company(id),
+    operator_id    BIGINT      REFERENCES sys_user(id),
+    operation_type VARCHAR(50) NOT NULL,  -- 例如 EXTRACTION_APPROVE / USER_LOGIN
+    target_id      BIGINT,
+    target_type    VARCHAR(50),
+    detail         JSONB,
+    result         VARCHAR(10),           -- SUCCESS / FAILURE
+    error_message  TEXT,
+    operated_at    TIMESTAMP   NOT NULL DEFAULT NOW()
+    -- 无 updated_at（仅追加表，永不更新）
+);
+
+CREATE INDEX IF NOT EXISTS idx_sys_operation_log_company_operated_at
+    ON sys_operation_log (company_id, operated_at);
+CREATE INDEX IF NOT EXISTS idx_sys_operation_log_operator_id
+    ON sys_operation_log (operator_id);
+
+-- ============================================================
+-- 10. annotation_task_history（任务状态历史，仅追加）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS annotation_task_history (
+    id            BIGSERIAL   PRIMARY KEY,
+    task_id       BIGINT      NOT NULL REFERENCES annotation_task(id),
+    company_id    BIGINT      NOT NULL REFERENCES sys_company(id),
+    from_status   VARCHAR(20),
+    to_status     VARCHAR(20) NOT NULL,
+    operator_id   BIGINT      REFERENCES sys_user(id),
+    operator_role VARCHAR(20),
+    comment       TEXT,
+    created_at    TIMESTAMP   NOT NULL DEFAULT NOW()
+    -- 无 updated_at（仅追加表，永不更新）
+);
+
+CREATE INDEX IF NOT EXISTS idx_annotation_task_history_task_id
+    ON annotation_task_history (task_id);
+CREATE INDEX IF NOT EXISTS idx_annotation_task_history_company_id
+    ON annotation_task_history (company_id);
+
+-- ============================================================
+-- 11. video_process_job（视频处理作业）
+-- ============================================================
+CREATE TABLE IF NOT EXISTS video_process_job (
+    id            BIGSERIAL    PRIMARY KEY,
+    company_id    BIGINT       NOT NULL REFERENCES sys_company(id),
+    source_id     BIGINT       NOT NULL REFERENCES source_data(id),
+    job_type      VARCHAR(30)  NOT NULL,  -- FRAME_EXTRACT / VIDEO_TO_TEXT
+    status        VARCHAR(20)  NOT NULL DEFAULT 'PENDING',
+    -- PENDING / RUNNING / SUCCESS / FAILED / RETRYING
+    params        JSONB,                  -- 例如 {"frameInterval": 30, "mode": "FRAME"}
+    output_path   VARCHAR(500),           -- 完成后的 RustFS 输出路径
+    retry_count   INT          NOT NULL DEFAULT 0,
+    max_retries   INT          NOT NULL DEFAULT 3,
+    error_message TEXT,
+    started_at    TIMESTAMP,
+    completed_at  TIMESTAMP,
+    created_at    TIMESTAMP    NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMP    NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_video_process_job_company_id
+    ON video_process_job (company_id);
+CREATE INDEX IF NOT EXISTS idx_video_process_job_source_id
+    ON video_process_job (source_id);
+CREATE INDEX IF NOT EXISTS idx_video_process_job_status
+    ON video_process_job (status);
+
+-- ============================================================
+-- 初始数据
+-- ============================================================
+
+-- 1. 演示公司
+INSERT INTO sys_company (company_name, company_code, status)
+VALUES ('演示公司', 'DEMO', 'ACTIVE')
+ON CONFLICT DO NOTHING;
+
+-- 2. 初始用户（BCrypt strength=10）
+--    admin     / admin123
+--    reviewer01/ review123
+--    annotator01/annot123
+--    uploader01 / upload123
+INSERT INTO sys_user (company_id, username, password_hash, real_name, role, status)
+SELECT
+    c.id,
+    u.username,
+    u.password_hash,
+    u.real_name,
+    u.role,
+    'ACTIVE'
+FROM sys_company c
+CROSS JOIN (VALUES
+    ('admin',
+     '$2a$10$B8iR5z43URiNPm.eut3JvufIPBuvGx5ZZmqyUqE1A1WdbZppX5bmi',
+     '管理员',
+     'ADMIN'),
+    ('reviewer01',
+     '$2a$10$euOJZRfUtYNW7WHpfW1Ciee5b3rjkYFe3yQHT/uCQWrYVc0XQcukm',
+     '审核员01',
+     'REVIEWER'),
+    ('annotator01',
+     '$2a$10$8UKwHPNASauKMTrqosR0Reg1X1gkFzFlGa/HBwNLXUELaj4e/zcqu',
+     '标注员01',
+     'ANNOTATOR'),
+    ('uploader01',
+     '$2a$10$o2d7jsT31vyxIJHUo50mUefoZLLvGqft97zaL9OQCjRxn9ie1H/1O',
+     '上传员01',
+     'UPLOADER')
+) AS u(username, password_hash, real_name, role)
+WHERE c.company_code = 'DEMO'
+ON CONFLICT (company_id, username) DO NOTHING;
+
+-- 3. 全局系统配置
+INSERT INTO sys_config (company_id, config_key, config_value, description)
+VALUES
+    (NULL, 'token_ttl_seconds',    '7200',
+     '会话凭证有效期（秒）'),
+    (NULL, 'model_default',        'glm-4',
+     'AI 辅助默认模型'),
+    (NULL, 'video_frame_interval', '30',
+     '视频帧提取间隔（帧数）'),
+    (NULL, 'prompt_extract_text',
+     '请提取以下文本中的主语-谓语-宾语三元组，以JSON数组格式返回，每个元素包含subject、predicate、object、sourceText、startOffset、endOffset字段。',
+     '文本三元组提取 Prompt 模板'),
+    (NULL, 'prompt_extract_image',
+     '请提取图片中的实体关系四元组，以JSON数组格式返回，每个元素包含subject、relation、object、modifier、confidence字段。',
+     '图片四元组提取 Prompt 模板'),
+    (NULL, 'prompt_qa_gen_text',
+     '根据以下文本三元组生成高质量问答对，以JSON数组格式返回，每个元素包含question、answer、difficulty字段。',
+     '文本问答生成 Prompt 模板'),
+    (NULL, 'prompt_qa_gen_image',
+     '根据以下图片四元组生成高质量问答对，以JSON数组格式返回，每个元素包含question、answer、imageRef、difficulty字段。',
+     '图片问答生成 Prompt 模板')
+ON CONFLICT DO NOTHING;