feat: show application ownership and scoped console management

internal/storage/mysql/event_subscriptions.go

@@ -28,10 +28,16 @@ const subscriptionColumns = `id,queue_id,credential_id,name,revision,enabled,fil
 
 func readSubscription(ctx context.Context, tx *sql.Tx, t auth.Token, p auth.Permissions, id core.ID, lock bool) (events.Subscription, error) {
 	q := `SELECT ` + subscriptionColumns + ` FROM orbit_subscriptions WHERE namespace_id=? AND id=? AND credential_id=? AND queue_id IS NOT NULL`
+	args := []any{t.NamespaceID, id, t.CredentialID}
+	if t.Console != nil {
+		// 调用方已在同一事务 authenticate；管理员可管理应用内已有订阅，SDK 仍绑定原凭据。
+		q = `SELECT ` + subscriptionColumns + ` FROM orbit_subscriptions WHERE namespace_id=? AND id=? AND queue_id IS NOT NULL`
+		args = []any{t.NamespaceID, id}
+	}
 	if lock {
 		q += ` FOR UPDATE`
 	}
-	out, err := scanSubscription(tx.QueryRowContext(ctx, q, t.NamespaceID, id, t.CredentialID))
+	out, err := scanSubscription(tx.QueryRowContext(ctx, q, args...))
 	if errors.Is(err, sql.ErrNoRows) {
 		return out, fault.NotFound
 	}