diff --git a/src/Infrastructure/Masa.Auth.EntityFrameworkCore.PostgreSql/Migrations/AuthDbContextModelSnapshot.cs b/src/Infrastructure/Masa.Auth.EntityFrameworkCore.PostgreSql/Migrations/AuthDbContextModelSnapshot.cs
index 6bb7617e..efeda0dd 100644
--- a/src/Infrastructure/Masa.Auth.EntityFrameworkCore.PostgreSql/Migrations/AuthDbContextModelSnapshot.cs
+++ b/src/Infrastructure/Masa.Auth.EntityFrameworkCore.PostgreSql/Migrations/AuthDbContextModelSnapshot.cs
@@ -1,6 +1,5 @@
 // <auto-generated />
 using System;
-using Masa.Auth.Domain.Subjects.Aggregates;
 using Masa.Auth.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Infrastructure;
@@ -2547,6 +2546,46 @@ protected override void BuildModel(ModelBuilder modelBuilder)
 
             modelBuilder.Entity("Masa.Auth.Domain.DynamicRoles.Aggregates.DynamicRole", b =>
                 {
+                    b.OwnsMany("Masa.Auth.Domain.DynamicRoles.Aggregates.DynamicRuleCondition", "Conditions", b1 =>
+                        {
+                            b1.Property<Guid>("Id")
+                                .ValueGeneratedOnAdd()
+                                .HasColumnType("uuid");
+
+                            b1.Property<int>("DataType")
+                                .HasColumnType("integer");
+
+                            b1.Property<Guid>("DynamicRoleId")
+                                .HasColumnType("uuid");
+
+                            b1.Property<string>("FieldName")
+                                .IsRequired()
+                                .HasMaxLength(128)
+                                .HasColumnType("character varying(128)");
+
+                            b1.Property<int>("LogicalOperator")
+                                .HasColumnType("integer");
+
+                            b1.Property<int>("OperatorType")
+                                .HasColumnType("integer");
+
+                            b1.Property<int>("Order")
+                                .HasColumnType("integer");
+
+                            b1.Property<string>("Value")
+                                .IsRequired()
+                                .HasColumnType("text");
+
+                            b1.HasKey("Id");
+
+                            b1.HasIndex("DynamicRoleId");
+
+                            b1.ToTable("DynamicRuleCondition", "auth");
+
+                            b1.WithOwner()
+                                .HasForeignKey("DynamicRoleId");
+                        });
+
                     b.OwnsMany("Masa.Auth.Domain.DynamicRoles.Aggregates.ControlPolicy", "ControlPolicies", b1 =>
                         {
                             b1.Property<Guid>("Id")
@@ -2652,46 +2691,6 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                             b1.Navigation("Resources");
                         });
 
-                    b.OwnsMany("Masa.Auth.Domain.DynamicRoles.Aggregates.DynamicRuleCondition", "Conditions", b1 =>
-                        {
-                            b1.Property<Guid>("Id")
-                                .ValueGeneratedOnAdd()
-                                .HasColumnType("uuid");
-
-                            b1.Property<int>("DataType")
-                                .HasColumnType("integer");
-
-                            b1.Property<Guid>("DynamicRoleId")
-                                .HasColumnType("uuid");
-
-                            b1.Property<string>("FieldName")
-                                .IsRequired()
-                                .HasMaxLength(128)
-                                .HasColumnType("character varying(128)");
-
-                            b1.Property<int>("LogicalOperator")
-                                .HasColumnType("integer");
-
-                            b1.Property<int>("OperatorType")
-                                .HasColumnType("integer");
-
-                            b1.Property<int>("Order")
-                                .HasColumnType("integer");
-
-                            b1.Property<string>("Value")
-                                .IsRequired()
-                                .HasColumnType("text");
-
-                            b1.HasKey("Id");
-
-                            b1.HasIndex("DynamicRoleId");
-
-                            b1.ToTable("DynamicRuleCondition", "auth");
-
-                            b1.WithOwner()
-                                .HasForeignKey("DynamicRoleId");
-                        });
-
                     b.Navigation("Conditions");
 
                     b.Navigation("ControlPolicies");
diff --git a/src/Infrastructure/Masa.Auth.EntityFrameworkCore/AuthDbContext.cs b/src/Infrastructure/Masa.Auth.EntityFrameworkCore/AuthDbContext.cs
index 1c61e55a..b1f4c304 100644
--- a/src/Infrastructure/Masa.Auth.EntityFrameworkCore/AuthDbContext.cs
+++ b/src/Infrastructure/Masa.Auth.EntityFrameworkCore/AuthDbContext.cs
@@ -15,6 +15,8 @@ public AuthDbContext(MasaDbContextOptions<AuthDbContext> options) : base(options
     protected override void OnConfiguring(MasaDbContextOptionsBuilder optionsBuilder)
         => optionsBuilder.DbContextOptionsBuilder
         //.LogTo(Console.WriteLine, LogLevel.Warning)
+        .ConfigureWarnings(w => w.Ignore(
+            Microsoft.EntityFrameworkCore.Diagnostics.RelationalEventId.PendingModelChangesWarning))
         .EnableSensitiveDataLogging()
         .EnableDetailedErrors();
 
diff --git a/src/Services/Masa.Auth.Service.Admin/Infrastructure/Ldap/LdapAuthenticateHelper.cs b/src/Services/Masa.Auth.Service.Admin/Infrastructure/Ldap/LdapAuthenticateHelper.cs
index 7675cba7..667d96dc 100644
--- a/src/Services/Masa.Auth.Service.Admin/Infrastructure/Ldap/LdapAuthenticateHelper.cs
+++ b/src/Services/Masa.Auth.Service.Admin/Infrastructure/Ldap/LdapAuthenticateHelper.cs
@@ -17,12 +17,12 @@ public static class LdapAuthenticateHelper
     /// <summary>
     /// LDAP result code: invalidCredentials (RFC 4511).
     /// </summary>
-    const int LdapInvalidCredentials = 49;
+    const int LDAP_INVALID_CREDENTIALS = 49;
 
     /// <summary>
     /// Connect timeout for LDAP connect-test / save validation (milliseconds).
     /// </summary>
-    const int ConnectionTimeoutMs = 10_000;
+    const int CONNECTION_TIMEOUT_MS = 10_000;
 
     public static async Task AuthenticateOrThrowAsync(LdapDetailDto ldapDetailDto)
     {
@@ -31,7 +31,7 @@ public static async Task AuthenticateOrThrowAsync(LdapDetailDto ldapDetailDto)
         using var connection = new LdapConnection
         {
             SecureSocketLayer = ldapDetailDto.IsLdaps,
-            ConnectionTimeout = ConnectionTimeoutMs
+            ConnectionTimeout = CONNECTION_TIMEOUT_MS
         };
 
         // Stage 1: TCP / TLS connect — address、port、LDAP vs LDAPS
@@ -39,7 +39,7 @@ public static async Task AuthenticateOrThrowAsync(LdapDetailDto ldapDetailDto)
         {
             await connection.ConnectAsync(ldapDetailDto.ServerAddress, ldapDetailDto.ServerPort);
         }
-        catch (Exception ex)
+        catch (Exception)
         {
             // TCP 已经连通，此时失败发生在 LDAP 明文协议或 TLS 握手阶段。
             // 不再把它误报为“地址/端口不可达”。
@@ -51,7 +51,7 @@ public static async Task AuthenticateOrThrowAsync(LdapDetailDto ldapDetailDto)
         {
             await connection.BindAsync(ldapDetailDto.RootUserDn, ldapDetailDto.RootUserPassword);
         }
-        catch (LdapException ex) when (ex.ResultCode == LdapInvalidCredentials)
+        catch (LdapException ex) when (ex.ResultCode == LDAP_INVALID_CREDENTIALS)
         {
             throw new UserFriendlyException(errorCode: UserFriendlyExceptionCodes.LDAP_CREDENTIALS_INVALID);
         }
@@ -69,7 +69,7 @@ public static async Task AuthenticateOrThrowAsync(LdapDetailDto ldapDetailDto)
 
     static async Task EnsureTcpConnectionAsync(LdapDetailDto ldapDetailDto)
     {
-        using var timeout = new CancellationTokenSource(TimeSpan.FromMilliseconds(ConnectionTimeoutMs));
+        using var timeout = new CancellationTokenSource(TimeSpan.FromMilliseconds(CONNECTION_TIMEOUT_MS));
         using var tcpClient = new TcpClient();
 
         try