diff --git a/.workbuddy/memory/2026-06-18.md b/.workbuddy/memory/2026-06-18.md
new file mode 100644
index 0000000..28da208
--- /dev/null
+++ b/.workbuddy/memory/2026-06-18.md
@@ -0,0 +1,11 @@
+# 2026-06-18 工作日志
+
+## AppConfigMapper.xml 添加关联查询
+
+**改动文件**: `src/main/java/com/gxwebsoft/websopy/mapper/AppConfigMapper.xml`
+
+- `selectByCategory` SQL 增加了 `INNER JOIN db_websopy.app_product`，关联条件：
+  - `ap.product_id = ac.app_id`
+  - `ap.tenant_id = #{tenantId}`
+- 目的：确保只返回该租户下有效产品的配置，防止 app_config 中的 app_id 指向非该租户的产品
+- Service 层和 Controller 层无需改动，不影响现有调用
diff --git a/src/main/java/com/gxwebsoft/websopy/mapper/AppConfigMapper.xml b/src/main/java/com/gxwebsoft/websopy/mapper/AppConfigMapper.xml
index 7ded385..8d8ef92 100644
--- a/src/main/java/com/gxwebsoft/websopy/mapper/AppConfigMapper.xml
+++ b/src/main/java/com/gxwebsoft/websopy/mapper/AppConfigMapper.xml
@@ -3,27 +3,31 @@
 <mapper namespace="com.gxwebsoft.websopy.mapper.AppConfigMapper">
 
     <!--
-        跨表查询 db_websopy.app_config
+        跨表查询 db_websopy.app_config，关联 app_product 校验产品有效性
         注意：
         1. 表名带库名前缀 db_websopy.app_config（该表在 db_websopy 库中）
         2. Mapper 方法已加 @InterceptorIgnore(tenantLine = "true")，
            TenantLineInnerInterceptor 不会自动追加 tenant_id 条件
         3. 手动传入 tenantId 参数精确匹配 app_config 自身的租户
+        4. INNER JOIN app_product，确保只返回该租户下有效产品（app_product.product_id = app_config.app_id）的配置
     -->
     <select id="selectByCategory" resultType="com.gxwebsoft.websopy.entity.AppConfig">
-        SELECT config_id   AS configId,
-               app_id      AS appId,
-               tenant_id   AS tenantId,
-               config_key  AS configKey,
-               config_value AS configValue,
-               config_type AS configType,
-               is_encrypted AS isEncrypted,
-               is_secret   AS isSecret,
-               description
-        FROM db_websopy.app_config
-        WHERE deleted = 0
-          AND tenant_id  = #{tenantId}
-          AND config_type = #{configType}
+        SELECT ac.config_id   AS configId,
+               ac.app_id      AS appId,
+               ac.tenant_id   AS tenantId,
+               ac.config_key  AS configKey,
+               ac.config_value AS configValue,
+               ac.config_type AS configType,
+               ac.is_encrypted AS isEncrypted,
+               ac.is_secret   AS isSecret,
+               ac.description
+        FROM db_websopy.app_config ac
+        INNER JOIN db_websopy.app_product ap
+            ON ap.product_id = ac.app_id
+            AND ap.tenant_id = #{tenantId}
+        WHERE ac.deleted = 0
+          AND ac.tenant_id  = #{tenantId}
+          AND ac.config_type = #{configType}
     </select>
 
 </mapper>