feat: add deployable alpha silo

hub/src/org/members.ts

@@ -8,11 +8,13 @@
  * 4. ADMIN cannot modify OWNER memberships.
  */
 import type { OrganizationMemberRole, Prisma, PrismaClient } from "@prisma/client";
+import { upsertScopedFeishuIdentityInTransaction } from "../feishu/identityNamespace.js";
 import { lockActiveOrganization } from "./status.js";
 
 export interface OrgMemberRow {
   readonly userId: string;
-  readonly feishuOpenId: string;
+  readonly feishuOpenId: string | null;
+  readonly identityStatus: "SCOPED" | "UNLINKED";
   readonly displayName: string;
   readonly avatarUrl: string | null;
   readonly role: OrganizationMemberRole;
@@ -29,14 +31,24 @@ export async function listOrgMembers(
       role: true,
       createdAt: true,
       user: {
-        select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+        select: {
+          id: true,
+          displayName: true,
+          avatarUrl: true,
+          feishuIdentities: {
+            where: { connection: { organizationId } },
+            select: { openId: true },
+            take: 1,
+          },
+        },
       },
     },
     orderBy: [{ role: "asc" }, { createdAt: "asc" }],
   });
   return rows.map((row) => ({
     userId: row.user.id,
-    feishuOpenId: row.user.feishuOpenId,
+    feishuOpenId: row.user.feishuIdentities[0]?.openId ?? null,
+    identityStatus: row.user.feishuIdentities.length === 1 ? "SCOPED" : "UNLINKED",
     displayName: row.user.displayName,
     avatarUrl: row.user.avatarUrl,
     role: row.role,
@@ -57,39 +69,47 @@ export async function addOrgMember(
   const openId = requireNonEmpty(input.feishuOpenId, "feishuOpenId");
   assertCanAssignRole(input.actorRole, input.role, /* targetIsOwner */ false);
 
-  const { user, membership } = await prisma.$transaction(async (tx) => {
+  const { identity, membership } = await prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
-    const user = await tx.user.upsert({
-      where: { feishuOpenId: openId },
-      create: {
-        feishuOpenId: openId,
-        displayName: input.displayName?.trim() || openId,
-      },
-      update: {
-        ...(input.displayName !== undefined && input.displayName.trim() !== ""
-          ? { displayName: input.displayName.trim() }
-          : {}),
+    const connection = await tx.organizationFeishuApplicationConnection.findUnique({
+      where: { organizationId: input.organizationId },
+      select: {
+        id: true,
+        status: true,
+        activeSecretVersion: { select: { connectionId: true, retiredAt: true } },
       },
     });
+    if (connection === null || connection.status !== "ACTIVE" || connection.activeSecretVersion === null ||
+        connection.activeSecretVersion.connectionId !== connection.id ||
+        connection.activeSecretVersion.retiredAt !== null) {
+      throw new Error("active Feishu Application Connection not found");
+    }
+    const identity = await upsertScopedFeishuIdentityInTransaction(tx, {
+      connectionId: connection.id,
+      expectedOrganizationId: input.organizationId,
+      openId,
+      displayName: input.displayName?.trim() || openId,
+    });
     const existing = await tx.organizationMembership.findFirst({
-      where: { organizationId: input.organizationId, userId: user.id, revokedAt: null },
+      where: { organizationId: input.organizationId, userId: identity.userId, revokedAt: null },
     });
-    if (existing !== null) throw new Error(`user ${user.id} is already an active member`);
+    if (existing !== null) throw new Error(`user ${identity.userId} is already an active member`);
     const membership = await tx.organizationMembership.create({
       data: {
         organizationId: input.organizationId,
-        userId: user.id,
+        userId: identity.userId,
         role: input.role,
       },
     });
-    return { user, membership };
+    return { identity, membership };
   });
 
   return {
-    userId: user.id,
-    feishuOpenId: user.feishuOpenId,
-    displayName: user.displayName,
-    avatarUrl: user.avatarUrl,
+    userId: identity.userId,
+    feishuOpenId: identity.openId,
+    identityStatus: "SCOPED",
+    displayName: identity.displayName,
+    avatarUrl: identity.avatarUrl,
     role: membership.role,
     createdAt: membership.createdAt.toISOString(),
   };
@@ -118,7 +138,16 @@ export async function setOrgMemberRole(
         role: true,
         createdAt: true,
         user: {
-          select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+          select: {
+            id: true,
+            displayName: true,
+            avatarUrl: true,
+            feishuIdentities: {
+              where: { connection: { organizationId: input.organizationId } },
+              select: { openId: true },
+              take: 1,
+            },
+          },
         },
       },
     });
@@ -139,7 +168,8 @@ export async function setOrgMemberRole(
 
     return {
       userId: membership.user.id,
-      feishuOpenId: membership.user.feishuOpenId,
+      feishuOpenId: membership.user.feishuIdentities[0]?.openId ?? null,
+      identityStatus: membership.user.feishuIdentities.length === 1 ? "SCOPED" : "UNLINKED",
       displayName: membership.user.displayName,
       avatarUrl: membership.user.avatarUrl,
       role: updated.role,