forked from EduCraft/curriculum-project-hub
Merge branch 'admin-panel': org admin SPA and fleet deploy CI
Bring in the org-admin Svelte SPA, capacity policy surface, production SPA serving, project MANAGE fixes, and Gitea deploy of educraft/educraft-dev fleets.
This commit is contained in:
@@ -0,0 +1,126 @@
|
||||
name: deploy admin (hub fleet)
|
||||
|
||||
# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
|
||||
# onto the managed Alpha host. Two fleets share one machine and are separated by
|
||||
# the middle DNS label of each Silo's public URL:
|
||||
#
|
||||
# dev → https://<slug>.educraft-dev.paradigm-edu.net (every push + PR)
|
||||
# prod → https://<slug>.educraft.paradigm-edu.net (main + tags)
|
||||
#
|
||||
# Example prod tenant:
|
||||
# https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
|
||||
#
|
||||
# Required Gitea secret:
|
||||
# DEPLOY_SSH_KEY — private key for root@39.107.254.4
|
||||
#
|
||||
# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
|
||||
# DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
|
||||
# vars.ALLOW_EMPTY_FLEET=1 — green when the fleet has no silos yet
|
||||
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- "hub/**"
|
||||
- ".gitea/workflows/deploy-admin.yml"
|
||||
pull_request:
|
||||
paths:
|
||||
- "hub/**"
|
||||
- ".gitea/workflows/deploy-admin.yml"
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
fleet:
|
||||
description: "Which fleet to deploy (dev | prod | both)"
|
||||
required: true
|
||||
default: both
|
||||
allow_empty_fleet:
|
||||
description: "Succeed if no silo matches (1/0)"
|
||||
required: false
|
||||
default: "0"
|
||||
|
||||
concurrency:
|
||||
group: deploy-admin-host
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
deploy-dev:
|
||||
name: deploy fleet dev (educraft-dev)
|
||||
runs-on: ubuntu-latest
|
||||
if: >
|
||||
github.event_name == 'pull_request' ||
|
||||
(github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
|
||||
(github.event_name == 'workflow_dispatch' &&
|
||||
(github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
|
||||
- name: Install rsync + ssh
|
||||
run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Deploy Hub + admin SPA to educraft-dev fleet
|
||||
env:
|
||||
CPH_FLEET: dev
|
||||
PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
|
||||
PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
|
||||
PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
|
||||
ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
|
||||
DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
|
||||
echo "missing secret DEPLOY_SSH_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
key="$(mktemp)"
|
||||
trap 'rm -f "$key"' EXIT
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
|
||||
chmod 600 "$key"
|
||||
export PLATFORM_DEPLOY_SSH_KEY="$key"
|
||||
# Apply managed-host defaults when secrets are unset.
|
||||
export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
|
||||
export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
|
||||
export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
||||
export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
||||
bash hub/deploy/deploy_fleet_release.sh
|
||||
|
||||
deploy-prod:
|
||||
name: deploy fleet prod (educraft)
|
||||
runs-on: ubuntu-latest
|
||||
if: >
|
||||
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
|
||||
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
|
||||
(github.event_name == 'workflow_dispatch' &&
|
||||
(github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
|
||||
- name: Install rsync + ssh
|
||||
run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
|
||||
|
||||
- name: Deploy Hub + admin SPA to educraft fleet
|
||||
env:
|
||||
CPH_FLEET: prod
|
||||
PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
|
||||
PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
|
||||
PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
|
||||
ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
|
||||
DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
|
||||
echo "missing secret DEPLOY_SSH_KEY" >&2
|
||||
exit 1
|
||||
fi
|
||||
key="$(mktemp)"
|
||||
trap 'rm -f "$key"' EXIT
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
|
||||
chmod 600 "$key"
|
||||
export PLATFORM_DEPLOY_SSH_KEY="$key"
|
||||
export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
|
||||
export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
|
||||
export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
||||
export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
||||
bash hub/deploy/deploy_fleet_release.sh
|
||||
@@ -4,3 +4,7 @@ dist/
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
.secrets/
|
||||
admin-web/node_modules/
|
||||
admin-web/build/
|
||||
admin-web/.svelte-kit/
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
node_modules
|
||||
|
||||
# Output
|
||||
.output
|
||||
.vercel
|
||||
.netlify
|
||||
.wrangler
|
||||
/.svelte-kit
|
||||
/build
|
||||
|
||||
# OS
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# Env
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
!.env.test
|
||||
|
||||
# Vite
|
||||
vite.config.js.timestamp-*
|
||||
vite.config.ts.timestamp-*
|
||||
@@ -0,0 +1 @@
|
||||
engine-strict=true
|
||||
@@ -0,0 +1,4 @@
|
||||
build
|
||||
.svelte-kit
|
||||
node_modules
|
||||
package-lock.json
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
"useTabs": true,
|
||||
"singleQuote": true,
|
||||
"semi": true,
|
||||
"trailingComma": "all",
|
||||
"printWidth": 120,
|
||||
"plugins": ["prettier-plugin-svelte"],
|
||||
"overrides": [{ "files": "*.svelte", "options": { "parser": "svelte" } }]
|
||||
}
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
{
|
||||
"recommendations": ["svelte.svelte-vscode"]
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
# sv
|
||||
|
||||
Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
|
||||
|
||||
## Creating a project
|
||||
|
||||
If you're seeing this, you've probably already done this step. Congrats!
|
||||
|
||||
```sh
|
||||
# create a new project
|
||||
npx sv create my-app
|
||||
```
|
||||
|
||||
To recreate this project with the same configuration:
|
||||
|
||||
```sh
|
||||
# recreate this project
|
||||
npx sv@0.16.2 create --template minimal --types ts --install npm D:/Projects/curriculum-project-hub/hub/admin-web
|
||||
```
|
||||
|
||||
## Developing
|
||||
|
||||
Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
|
||||
|
||||
```sh
|
||||
npm run dev
|
||||
|
||||
# or start the server and open the app in a new browser tab
|
||||
npm run dev -- --open
|
||||
```
|
||||
|
||||
## Building
|
||||
|
||||
To create a production version of your app:
|
||||
|
||||
```sh
|
||||
npm run build
|
||||
```
|
||||
|
||||
You can preview the production build with `npm run preview`.
|
||||
|
||||
> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.
|
||||
Generated
+2641
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"name": "admin-web",
|
||||
"private": true,
|
||||
"version": "0.0.1",
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
"dev": "vite dev",
|
||||
"build": "vite build",
|
||||
"preview": "vite preview",
|
||||
"prepare": "svelte-kit sync || echo ''",
|
||||
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
||||
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
||||
"format": "prettier --write .",
|
||||
"format:check": "prettier --check ."
|
||||
},
|
||||
"devDependencies": {
|
||||
"@skeletonlabs/skeleton": "^4.15.2",
|
||||
"@skeletonlabs/skeleton-svelte": "^4.15.2",
|
||||
"@sveltejs/adapter-auto": "^7.0.1",
|
||||
"@sveltejs/adapter-static": "^3.0.10",
|
||||
"@sveltejs/kit": "^2.63.0",
|
||||
"@sveltejs/vite-plugin-svelte": "^7.1.2",
|
||||
"@tailwindcss/vite": "^4.3.2",
|
||||
"bits-ui": "^2.18.1",
|
||||
"prettier": "^3.9.5",
|
||||
"prettier-plugin-svelte": "^4.1.1",
|
||||
"svelte": "^5.56.1",
|
||||
"svelte-check": "^4.6.0",
|
||||
"tailwindcss": "^4.3.2",
|
||||
"typescript": "^6.0.3",
|
||||
"vite": "^8.0.16"
|
||||
}
|
||||
}
|
||||
Vendored
+13
@@ -0,0 +1,13 @@
|
||||
// See https://svelte.dev/docs/kit/types#app.d.ts
|
||||
// for information about these interfaces
|
||||
declare global {
|
||||
namespace App {
|
||||
// interface Error {}
|
||||
// interface Locals {}
|
||||
// interface PageData {}
|
||||
// interface PageState {}
|
||||
// interface Platform {}
|
||||
}
|
||||
}
|
||||
|
||||
export {};
|
||||
@@ -0,0 +1,27 @@
|
||||
<!doctype html>
|
||||
<html lang="zh-CN" data-theme="hamlindigo">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
<meta name="text-scale" content="scale" />
|
||||
<meta name="description" content="Curriculum Project Hub — 组织管理后台" />
|
||||
<link rel="icon" href="%sveltekit.assets%/favicon.svg" type="image/svg+xml" />
|
||||
<link rel="preconnect" href="https://fonts.googleapis.com" />
|
||||
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
|
||||
<link
|
||||
href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&family=Noto+Sans+SC:wght@400;500;600;700&display=swap"
|
||||
rel="stylesheet"
|
||||
/>
|
||||
<style>
|
||||
/* Fallback before CSS bundle: CJK-first industrial base */
|
||||
html {
|
||||
font-family: 'Noto Sans SC', 'PingFang SC', 'Microsoft YaHei', 'Inter', sans-serif;
|
||||
}
|
||||
</style>
|
||||
<title>CPH Admin</title>
|
||||
%sveltekit.head%
|
||||
</head>
|
||||
<body data-sveltekit-preload-data="hover">
|
||||
<div style="display: contents">%sveltekit.body%</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,345 @@
|
||||
/**
|
||||
* Thin API client for the org admin backend. Same-origin cookie auth.
|
||||
*/
|
||||
|
||||
export class ApiError extends Error {
|
||||
code: string;
|
||||
status: number;
|
||||
constructor(code: string, message: string, status: number) {
|
||||
super(message);
|
||||
this.name = 'ApiError';
|
||||
this.code = code;
|
||||
this.status = status;
|
||||
}
|
||||
}
|
||||
|
||||
async function request(method: string, url: string, body?: unknown): Promise<unknown> {
|
||||
const init: RequestInit = {
|
||||
method,
|
||||
credentials: 'same-origin',
|
||||
headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
|
||||
body: body !== undefined ? JSON.stringify(body) : undefined,
|
||||
};
|
||||
const res = await fetch(url, init);
|
||||
const text = await res.text();
|
||||
let data: unknown = null;
|
||||
if (text !== '') {
|
||||
try {
|
||||
data = JSON.parse(text);
|
||||
} catch {
|
||||
data = text;
|
||||
}
|
||||
}
|
||||
if (!res.ok) {
|
||||
const err = (data as { error?: { code?: string; message?: string } } | null)?.error;
|
||||
throw new ApiError(err?.code ?? 'http_error', err?.message ?? `HTTP ${res.status}`, res.status);
|
||||
}
|
||||
return data;
|
||||
}
|
||||
|
||||
const get = (u: string) => request('GET', u);
|
||||
const post = (u: string, b?: unknown) => request('POST', u, b);
|
||||
const put = (u: string, b?: unknown) => request('PUT', u, b);
|
||||
const patch = (u: string, b?: unknown) => request('PATCH', u, b);
|
||||
const del = (u: string) => request('DELETE', u);
|
||||
|
||||
const orgBase = (slug: string) => `/api/org/${encodeURIComponent(slug)}`;
|
||||
|
||||
// --- Types ---
|
||||
|
||||
export interface OrgMembership {
|
||||
id: string;
|
||||
slug: string;
|
||||
name: string;
|
||||
status: string;
|
||||
role: 'OWNER' | 'ADMIN' | 'MEMBER';
|
||||
}
|
||||
|
||||
export interface MeResponse {
|
||||
user: {
|
||||
id: string;
|
||||
feishuOpenId: string;
|
||||
displayName: string;
|
||||
avatarUrl: string | null;
|
||||
};
|
||||
organizations: OrgMembership[];
|
||||
}
|
||||
|
||||
export interface OrgMember {
|
||||
userId: string;
|
||||
feishuOpenId: string;
|
||||
displayName: string;
|
||||
avatarUrl: string | null;
|
||||
role: 'OWNER' | 'ADMIN' | 'MEMBER';
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface TeamRow {
|
||||
id: string;
|
||||
slug: string;
|
||||
name: string;
|
||||
description: string | null;
|
||||
memberCount: number;
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface TeamMemberRow {
|
||||
userId: string;
|
||||
feishuOpenId: string;
|
||||
displayName: string;
|
||||
createdAt: string;
|
||||
}
|
||||
|
||||
export interface ExplorerFolder {
|
||||
id: string;
|
||||
name: string;
|
||||
parentId: string | null;
|
||||
sortKey: string;
|
||||
projectCount: number;
|
||||
childFolderCount: number;
|
||||
}
|
||||
|
||||
export interface ExplorerProject {
|
||||
id: string;
|
||||
name: string;
|
||||
folderId: string | null;
|
||||
createdAt: string;
|
||||
binding: { chatId: string; createdAt: string } | null;
|
||||
}
|
||||
|
||||
export interface ExplorerData {
|
||||
folders: ExplorerFolder[];
|
||||
projects: ExplorerProject[];
|
||||
}
|
||||
|
||||
export interface ProjectDetail {
|
||||
id: string;
|
||||
name: string;
|
||||
folderId: string | null;
|
||||
folder: { id: string; name: string } | null;
|
||||
workspaceDir: string;
|
||||
createdAt: string;
|
||||
archivedAt: string | null;
|
||||
createdBy: { id: string; displayName: string; feishuOpenId: string } | null;
|
||||
binding: { chatId: string; createdAt: string } | null;
|
||||
actorIsOrgAdmin?: boolean;
|
||||
actorCanManageProject?: boolean;
|
||||
}
|
||||
|
||||
export interface TeamAccessEntry {
|
||||
grantId: string;
|
||||
projectId: string;
|
||||
organizationId: string;
|
||||
teamId: string;
|
||||
teamSlug: string;
|
||||
teamName: string;
|
||||
role: 'READ' | 'EDIT' | 'MANAGE';
|
||||
}
|
||||
|
||||
export interface SessionSummary {
|
||||
id: string;
|
||||
provider: string;
|
||||
roleId: string;
|
||||
model: string;
|
||||
title: string | null;
|
||||
runCount: number;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface ProviderConnectionRow {
|
||||
id: string;
|
||||
providerId: string;
|
||||
mode: 'BYOK' | 'PLATFORM_MANAGED';
|
||||
status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
|
||||
activeVersion: number | null;
|
||||
keyId: string | null;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface FeishuApplicationConnection {
|
||||
id: string;
|
||||
appFingerprint: string;
|
||||
status: 'DRAFT' | 'ACTIVE' | 'DISABLED';
|
||||
activeVersion: number | null;
|
||||
keyId: string | null;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
}
|
||||
|
||||
export interface UsageTotals {
|
||||
runCount: number;
|
||||
runsWithCost: number;
|
||||
runsWithoutCost: number;
|
||||
inputTokens: number;
|
||||
outputTokens: number;
|
||||
costUsd: number | null;
|
||||
}
|
||||
|
||||
export interface ProjectUsageRow extends UsageTotals {
|
||||
projectId: string;
|
||||
projectName: string;
|
||||
folderId: string | null;
|
||||
}
|
||||
|
||||
export interface UsageReport {
|
||||
from: string | null;
|
||||
to: string | null;
|
||||
projects: ProjectUsageRow[];
|
||||
totals: UsageTotals;
|
||||
}
|
||||
|
||||
export type CapacityDimension =
|
||||
| 'requestRate'
|
||||
| 'requestBodySize'
|
||||
| 'agentConcurrency'
|
||||
| 'admissionQueueLength'
|
||||
| 'admissionQueueWait'
|
||||
| 'fileSize'
|
||||
| 'attachmentCount'
|
||||
| 'archiveExpansion'
|
||||
| 'projectStorage'
|
||||
| 'organizationStorage'
|
||||
| 'memberCount'
|
||||
| 'projectCount'
|
||||
| 'teamCount'
|
||||
| 'folderCount'
|
||||
| 'sessionCount'
|
||||
| 'runWallTime'
|
||||
| 'runTurns'
|
||||
| 'runToolCalls'
|
||||
| 'toolWallTime'
|
||||
| 'runOutputSize'
|
||||
| 'processMemory'
|
||||
| 'processCpu'
|
||||
| 'processCount';
|
||||
|
||||
export interface CapacityDimensionRow {
|
||||
dimension: CapacityDimension;
|
||||
platformCeiling: number | null;
|
||||
organizationLimit: number | null;
|
||||
effective: number | null;
|
||||
}
|
||||
|
||||
export interface CapacityPolicyView {
|
||||
dimensions: CapacityDimensionRow[];
|
||||
}
|
||||
|
||||
// --- API ---
|
||||
|
||||
export const api = {
|
||||
me: () => get('/api/me') as Promise<MeResponse>,
|
||||
logout: () => post('/auth/logout'),
|
||||
|
||||
org: (slug: string) =>
|
||||
get(orgBase(slug)) as Promise<{
|
||||
organization: { id: string; slug: string; name: string; status: string };
|
||||
actorRole: string;
|
||||
}>,
|
||||
settings: (slug: string) => get(`${orgBase(slug)}/settings`) as Promise<{ membersCanCreateProjects: boolean }>,
|
||||
setSettings: (slug: string, body: { membersCanCreateProjects: boolean }) =>
|
||||
patch(`${orgBase(slug)}/settings`, body) as Promise<{ membersCanCreateProjects: boolean }>,
|
||||
|
||||
members: (slug: string) => get(`${orgBase(slug)}/members`) as Promise<{ members: OrgMember[] }>,
|
||||
addMember: (slug: string, body: { feishuOpenId: string; displayName?: string; role: string }) =>
|
||||
post(`${orgBase(slug)}/members`, body) as Promise<OrgMember>,
|
||||
setMemberRole: (slug: string, userId: string, role: string) => patch(`${orgBase(slug)}/members/${userId}`, { role }),
|
||||
revokeMember: (slug: string, userId: string) => post(`${orgBase(slug)}/members/${userId}/revoke`),
|
||||
|
||||
teams: (slug: string) => get(`${orgBase(slug)}/teams`) as Promise<{ teams: TeamRow[] }>,
|
||||
createTeam: (slug: string, body: { slug: string; name: string; description?: string }) =>
|
||||
post(`${orgBase(slug)}/teams`, body) as Promise<TeamRow>,
|
||||
updateTeam: (slug: string, teamId: string, body: { name?: string; description?: string | null }) =>
|
||||
patch(`${orgBase(slug)}/teams/${teamId}`, body) as Promise<TeamRow>,
|
||||
archiveTeam: (slug: string, teamId: string) => post(`${orgBase(slug)}/teams/${teamId}/archive`),
|
||||
teamMembers: (slug: string, teamId: string) =>
|
||||
get(`${orgBase(slug)}/teams/${teamId}/members`) as Promise<{ members: TeamMemberRow[] }>,
|
||||
addTeamMember: (slug: string, teamId: string, body: { userId?: string; feishuOpenId?: string }) =>
|
||||
post(`${orgBase(slug)}/teams/${teamId}/members`, body) as Promise<TeamMemberRow>,
|
||||
revokeTeamMember: (slug: string, teamId: string, userId: string) =>
|
||||
post(`${orgBase(slug)}/teams/${teamId}/members/${userId}/revoke`),
|
||||
|
||||
explorer: (slug: string) => get(`${orgBase(slug)}/explorer`) as Promise<ExplorerData>,
|
||||
myProjects: (slug: string) =>
|
||||
get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
|
||||
createFolder: (slug: string, body: { name: string; parentId?: string; sortKey?: string }) =>
|
||||
post(`${orgBase(slug)}/folders`, body) as Promise<{
|
||||
id: string;
|
||||
name: string;
|
||||
parentId: string | null;
|
||||
sortKey: string;
|
||||
}>,
|
||||
renameFolder: (slug: string, folderId: string, body: { name?: string; sortKey?: string; parentId?: string | null }) =>
|
||||
patch(`${orgBase(slug)}/folders/${folderId}`, body) as Promise<{
|
||||
id: string;
|
||||
name: string;
|
||||
parentId: string | null;
|
||||
sortKey: string;
|
||||
}>,
|
||||
archiveFolder: (slug: string, folderId: string) =>
|
||||
post(`${orgBase(slug)}/folders/${folderId}/archive`) as Promise<{ archived: true; folderId: string }>,
|
||||
createProject: (slug: string, body: { name: string; folderId?: string }) =>
|
||||
post(`${orgBase(slug)}/projects`, body) as Promise<{ id: string; name: string }>,
|
||||
project: (slug: string, projectId: string) => get(`${orgBase(slug)}/projects/${projectId}`) as Promise<ProjectDetail>,
|
||||
renameProject: (slug: string, projectId: string, name: string) =>
|
||||
patch(`${orgBase(slug)}/projects/${projectId}`, { name }),
|
||||
moveProject: (slug: string, projectId: string, folderId: string | null) =>
|
||||
patch(`${orgBase(slug)}/projects/${projectId}/folder`, { folderId }),
|
||||
archiveProject: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/archive`),
|
||||
archiveBinding: (slug: string, projectId: string) => post(`${orgBase(slug)}/projects/${projectId}/binding/archive`),
|
||||
|
||||
teamAccess: (slug: string, projectId: string) =>
|
||||
get(`${orgBase(slug)}/projects/${projectId}/team-access`) as Promise<{ access: TeamAccessEntry[] }>,
|
||||
grantTeamAccess: (slug: string, projectId: string, body: { teamId?: string; teamSlug?: string; role: string }) =>
|
||||
put(`${orgBase(slug)}/projects/${projectId}/team-access`, body) as Promise<TeamAccessEntry>,
|
||||
revokeTeamAccess: (slug: string, projectId: string, teamId: string) =>
|
||||
del(`${orgBase(slug)}/projects/${projectId}/team-access/${teamId}`),
|
||||
|
||||
sessions: (slug: string, projectId: string, limit?: number) =>
|
||||
get(`${orgBase(slug)}/projects/${projectId}/sessions${limit !== undefined ? `?limit=${limit}` : ''}`) as Promise<{
|
||||
sessions: SessionSummary[];
|
||||
}>,
|
||||
usage: (slug: string, params?: { from?: string; to?: string; folderId?: string }) => {
|
||||
const q = new URLSearchParams();
|
||||
if (params?.from) q.set('from', params.from);
|
||||
if (params?.to) q.set('to', params.to);
|
||||
if (params?.folderId) q.set('folderId', params.folderId);
|
||||
const qs = q.toString();
|
||||
return get(`${orgBase(slug)}/usage${qs ? `?${qs}` : ''}`) as Promise<UsageReport>;
|
||||
},
|
||||
|
||||
providerConnections: (slug: string) =>
|
||||
get(`${orgBase(slug)}/provider-connections`) as Promise<{ connections: ProviderConnectionRow[] }>,
|
||||
rotateProviderConnection: (
|
||||
slug: string,
|
||||
providerId: string,
|
||||
body: { baseUrl: string; authToken: string; anthropicApiKey?: string },
|
||||
) =>
|
||||
put(
|
||||
`${orgBase(slug)}/provider-connections/${encodeURIComponent(providerId)}`,
|
||||
body,
|
||||
) as Promise<ProviderConnectionRow>,
|
||||
|
||||
feishuApplication: (slug: string) =>
|
||||
get(`${orgBase(slug)}/feishu-application-connection`) as Promise<{
|
||||
connection: FeishuApplicationConnection | null;
|
||||
}>,
|
||||
rotateFeishuApplication: (
|
||||
slug: string,
|
||||
body: {
|
||||
appId: string;
|
||||
appSecret: string;
|
||||
botOpenId: string;
|
||||
verificationToken?: string;
|
||||
encryptKey?: string;
|
||||
},
|
||||
) => put(`${orgBase(slug)}/feishu-application-connection`, body) as Promise<FeishuApplicationConnection>,
|
||||
disableFeishuApplication: (slug: string) =>
|
||||
del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,
|
||||
|
||||
capacityPolicy: (slug: string) =>
|
||||
get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
|
||||
setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
|
||||
put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
|
||||
};
|
||||
@@ -0,0 +1 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.157 22.819c-10.4-14.885-30.94-19.297-45.792-9.835L22.282 29.608A29.92 29.92 0 0 0 8.764 49.65a31.5 31.5 0 0 0 3.108 20.231 30 30 0 0 0-4.477 11.183 31.9 31.9 0 0 0 5.448 24.116c10.402 14.887 30.942 19.297 45.791 9.835l26.083-16.624A29.92 29.92 0 0 0 98.235 78.35a31.53 31.53 0 0 0-3.105-20.232 30 30 0 0 0 4.474-11.182 31.88 31.88 0 0 0-5.447-24.116" style="fill:#ff3e00"/><path d="M45.817 106.582a20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.503 18 18 0 0 1 .624-2.435l.49-1.498 1.337.981a33.6 33.6 0 0 0 10.203 5.098l.97.294-.09.968a5.85 5.85 0 0 0 1.052 3.878 6.24 6.24 0 0 0 6.695 2.485 5.8 5.8 0 0 0 1.603-.704L69.27 76.28a5.43 5.43 0 0 0 2.45-3.631 5.8 5.8 0 0 0-.987-4.371 6.24 6.24 0 0 0-6.698-2.487 5.7 5.7 0 0 0-1.6.704l-9.953 6.345a19 19 0 0 1-5.296 2.326 20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.502 17.99 17.99 0 0 1 8.13-12.052l26.081-16.623a19 19 0 0 1 5.3-2.329 20.72 20.72 0 0 1 22.237 8.243 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-.624 2.435l-.49 1.498-1.337-.98a33.6 33.6 0 0 0-10.203-5.1l-.97-.294.09-.968a5.86 5.86 0 0 0-1.052-3.878 6.24 6.24 0 0 0-6.696-2.485 5.8 5.8 0 0 0-1.602.704L37.73 51.72a5.42 5.42 0 0 0-2.449 3.63 5.79 5.79 0 0 0 .986 4.372 6.24 6.24 0 0 0 6.698 2.486 5.8 5.8 0 0 0 1.602-.704l9.952-6.342a19 19 0 0 1 5.295-2.328 20.72 20.72 0 0 1 22.237 8.242 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-8.13 12.053l-26.081 16.622a19 19 0 0 1-5.3 2.328" style="fill:#fff"/></svg>
|
||||
|
After Width: | Height: | Size: 1.5 KiB |
@@ -0,0 +1,32 @@
|
||||
<script lang="ts">
|
||||
import { Checkbox } from 'bits-ui';
|
||||
import Icon from './Icon.svelte';
|
||||
|
||||
let {
|
||||
checked = $bindable(false),
|
||||
disabled = false,
|
||||
class: className = '',
|
||||
onchange,
|
||||
}: {
|
||||
checked?: boolean;
|
||||
disabled?: boolean;
|
||||
class?: string;
|
||||
onchange?: (checked: boolean) => void;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<Checkbox.Root
|
||||
class="saas-checkbox {className}"
|
||||
{disabled}
|
||||
{checked}
|
||||
onCheckedChange={(next) => {
|
||||
checked = next;
|
||||
onchange?.(next);
|
||||
}}
|
||||
>
|
||||
{#snippet children({ checked: isChecked })}
|
||||
{#if isChecked}
|
||||
<Icon name="check" class="h-3.5 w-3.5" />
|
||||
{/if}
|
||||
{/snippet}
|
||||
</Checkbox.Root>
|
||||
@@ -0,0 +1,32 @@
|
||||
<script lang="ts">
|
||||
import type { Snippet } from 'svelte';
|
||||
|
||||
let {
|
||||
title = '暂无数据',
|
||||
description,
|
||||
action,
|
||||
}: {
|
||||
title?: string;
|
||||
description?: string;
|
||||
action?: Snippet;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<div class="saas-empty">
|
||||
<div
|
||||
class="mb-1 flex h-12 w-12 items-center justify-center border border-surface-300 bg-surface-100 text-surface-600"
|
||||
>
|
||||
<svg class="h-6 w-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25H12" />
|
||||
</svg>
|
||||
</div>
|
||||
<p class="text-sm font-medium text-surface-900">{title}</p>
|
||||
{#if description}
|
||||
<p class="max-w-sm text-sm text-surface-600">{description}</p>
|
||||
{/if}
|
||||
{#if action}
|
||||
<div class="mt-2">
|
||||
{@render action()}
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
@@ -0,0 +1,26 @@
|
||||
<script lang="ts">
|
||||
let {
|
||||
message,
|
||||
onretry,
|
||||
}: {
|
||||
message: string;
|
||||
onretry?: () => void;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<div class="saas-card flex flex-wrap items-start gap-3 border-error-200 bg-error-50 p-4 text-error-700">
|
||||
<svg class="mt-0.5 h-5 w-5 shrink-0" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M12 9v3.75m9-.75a9 9 0 11-18 0 9 9 0 0118 0zm-9 3.75h.008v.008H12v-.008z"
|
||||
/>
|
||||
</svg>
|
||||
<div class="min-w-0 flex-1">
|
||||
<p class="text-sm font-medium">请求失败</p>
|
||||
<p class="mt-0.5 text-sm opacity-90">{message}</p>
|
||||
</div>
|
||||
{#if onretry}
|
||||
<button type="button" class="saas-btn-ghost text-sm" onclick={onretry}>重试</button>
|
||||
{/if}
|
||||
</div>
|
||||
@@ -0,0 +1,48 @@
|
||||
<script lang="ts">
|
||||
import type { ExplorerFolder } from '$lib/api';
|
||||
import Icon from './Icon.svelte';
|
||||
import FolderTree from './FolderTree.svelte';
|
||||
|
||||
let {
|
||||
folder,
|
||||
folders,
|
||||
projects,
|
||||
slug,
|
||||
}: {
|
||||
folder: ExplorerFolder;
|
||||
folders: ExplorerFolder[];
|
||||
projects: {
|
||||
id: string;
|
||||
name: string;
|
||||
folderId: string | null;
|
||||
createdAt: string;
|
||||
binding: { chatId: string } | null;
|
||||
}[];
|
||||
slug: string;
|
||||
} = $props();
|
||||
|
||||
let open = $state(true);
|
||||
</script>
|
||||
|
||||
<div>
|
||||
<button
|
||||
type="button"
|
||||
class="flex w-full items-center gap-2.5 px-3 py-2.5 text-left text-sm transition hover:bg-surface-100"
|
||||
onclick={() => (open = !open)}
|
||||
>
|
||||
<span class="w-3.5 text-center text-xs text-surface-600">{open ? '▾' : '▸'}</span>
|
||||
<span class="flex h-7 w-7 items-center justify-center border border-warning-300 bg-warning-50 text-warning-800">
|
||||
<Icon name="folder" class="h-4 w-4" />
|
||||
</span>
|
||||
<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{folder.name}</span>
|
||||
<span class="saas-badge-neutral">{folder.projectCount} 项目</span>
|
||||
{#if folder.childFolderCount > 0}
|
||||
<span class="saas-badge-neutral">{folder.childFolderCount} 子夹</span>
|
||||
{/if}
|
||||
</button>
|
||||
{#if open}
|
||||
<div class="ml-4 border-l border-surface-300 pl-2">
|
||||
<FolderTree {folders} {projects} parentId={folder.id} {slug} />
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
@@ -0,0 +1,49 @@
|
||||
<script lang="ts">
|
||||
import type { ExplorerFolder } from '$lib/api';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import Icon from './Icon.svelte';
|
||||
import FolderNode from './FolderNode.svelte';
|
||||
|
||||
let {
|
||||
folders,
|
||||
projects,
|
||||
parentId,
|
||||
slug,
|
||||
}: {
|
||||
folders: ExplorerFolder[];
|
||||
projects: {
|
||||
id: string;
|
||||
name: string;
|
||||
folderId: string | null;
|
||||
createdAt: string;
|
||||
binding: { chatId: string } | null;
|
||||
}[];
|
||||
parentId: string | null;
|
||||
slug: string;
|
||||
} = $props();
|
||||
|
||||
let childFolders = $derived(folders.filter((f) => f.parentId === parentId));
|
||||
let childProjects = $derived(projects.filter((p) => p.folderId === parentId));
|
||||
</script>
|
||||
|
||||
<div class="space-y-0.5">
|
||||
{#each childProjects as p (p.id)}
|
||||
<a
|
||||
href={`/admin/org/${slug}/projects/${p.id}`}
|
||||
class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
|
||||
>
|
||||
<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">
|
||||
<Icon name="file" class="h-4 w-4" />
|
||||
</span>
|
||||
<span class="min-w-0 flex-1 truncate font-medium text-surface-900">{p.name}</span>
|
||||
{#if p.binding}
|
||||
<span class="saas-badge-success">已绑定</span>
|
||||
{/if}
|
||||
<span class="hidden text-xs text-surface-600 sm:inline">{fmtDate(p.createdAt)}</span>
|
||||
</a>
|
||||
{/each}
|
||||
|
||||
{#each childFolders as f (f.id)}
|
||||
<FolderNode folder={f} {folders} {projects} {slug} />
|
||||
{/each}
|
||||
</div>
|
||||
@@ -0,0 +1,123 @@
|
||||
<script lang="ts">
|
||||
/** Inline nav icons for the admin shell. */
|
||||
let {
|
||||
name,
|
||||
class: className = 'h-4 w-4',
|
||||
}: {
|
||||
name:
|
||||
| 'overview'
|
||||
| 'members'
|
||||
| 'teams'
|
||||
| 'projects'
|
||||
| 'provider'
|
||||
| 'feishu'
|
||||
| 'menu'
|
||||
| 'logout'
|
||||
| 'org'
|
||||
| 'chevron'
|
||||
| 'folder'
|
||||
| 'file'
|
||||
| 'check';
|
||||
class?: string;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
{#if name === 'overview'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M3 12l9-9 9 9M5 10v9a1 1 0 001 1h3v-5h6v5h3a1 1 0 001-1v-9"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'members'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M15.75 7.5a3.75 3.75 0 11-7.5 0 3.75 3.75 0 017.5 0zM4.5 19.5a7.5 7.5 0 0115 0"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'teams'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M18 18.72a9.09 9.09 0 003.74-.72 9 9 0 00-5.07-5.95M15 11a4 4 0 10-8 0 4 4 0 008 0zM4.26 18a9 9 0 0115.48 0"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'projects'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'provider'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M13.19 8.688a4.5 4.5 0 016.364 6.364l-3.182 3.182a4.5 4.5 0 01-6.364-6.364"
|
||||
/>
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M10.81 15.312a4.5 4.5 0 01-6.364-6.364l3.182-3.182a4.5 4.5 0 016.364 6.364"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'feishu'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M4.5 8.25h15a8.25 8.25 0 01-8.25 8.25A8.25 8.25 0 014.5 8.25z"
|
||||
/>
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 11.25h.01M12 11.25h.01M15.75 11.25h.01" />
|
||||
</svg>
|
||||
{:else if name === 'menu'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6.75h16.5M3.75 12h16.5m-16.5 5.25h16.5" />
|
||||
</svg>
|
||||
{:else if name === 'logout'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6A2.25 2.25 0 005.25 5.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15M12 9l3 3m0 0l-3 3m3-3H6"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'org'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M3.75 21h16.5M4.5 3h15M5.25 3v18m13.5-18v18M9 6.75h1.5m-1.5 3h1.5m-1.5 3h1.5m3-6H15m-1.5 3H15m-1.5 3H15M9 21v-3.375c0-.621.504-1.125 1.125-1.125h3.75c.621 0 1.125.504 1.125 1.125V21"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'chevron'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 4.5l7.5 7.5-7.5 7.5" />
|
||||
</svg>
|
||||
{:else if name === 'folder'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M3.75 6.75A2.25 2.25 0 016 4.5h3.379c.6 0 1.175.238 1.6.66l.842.84c.424.423 1 .66 1.6.66H18A2.25 2.25 0 0120.25 9v8.25A2.25 2.25 0 0118 19.5H6a2.25 2.25 0 01-2.25-2.25V6.75z"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'file'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path
|
||||
stroke-linecap="round"
|
||||
stroke-linejoin="round"
|
||||
d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
|
||||
/>
|
||||
</svg>
|
||||
{:else if name === 'check'}
|
||||
<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
|
||||
</svg>
|
||||
{/if}
|
||||
@@ -0,0 +1,15 @@
|
||||
<script lang="ts">
|
||||
let { label = '加载中…' }: { label?: string } = $props();
|
||||
</script>
|
||||
|
||||
<div class="flex flex-col items-center justify-center gap-3 py-16 text-surface-600">
|
||||
<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
|
||||
<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
|
||||
<path
|
||||
class="opacity-90"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
|
||||
></path>
|
||||
</svg>
|
||||
<p class="text-sm">{label}</p>
|
||||
</div>
|
||||
@@ -0,0 +1,38 @@
|
||||
<script lang="ts">
|
||||
import type { Snippet } from 'svelte';
|
||||
import { Dialog } from 'bits-ui';
|
||||
|
||||
let {
|
||||
open = $bindable(false),
|
||||
title,
|
||||
children,
|
||||
onclose,
|
||||
}: {
|
||||
open?: boolean;
|
||||
title: string;
|
||||
children: Snippet;
|
||||
onclose?: () => void;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<Dialog.Root
|
||||
bind:open
|
||||
onOpenChange={(next) => {
|
||||
if (!next) onclose?.();
|
||||
}}
|
||||
>
|
||||
<Dialog.Portal>
|
||||
<Dialog.Overlay class="saas-modal-backdrop" />
|
||||
<Dialog.Content class="saas-modal">
|
||||
<div class="mb-4 flex items-start justify-between gap-3">
|
||||
<Dialog.Title class="text-lg font-semibold text-surface-900">{title}</Dialog.Title>
|
||||
<Dialog.Close class="saas-btn-ghost px-2! py-1! text-surface-600" aria-label="关闭">
|
||||
<svg class="h-5 w-5" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
|
||||
</svg>
|
||||
</Dialog.Close>
|
||||
</div>
|
||||
{@render children()}
|
||||
</Dialog.Content>
|
||||
</Dialog.Portal>
|
||||
</Dialog.Root>
|
||||
@@ -0,0 +1,27 @@
|
||||
<script lang="ts">
|
||||
import type { Snippet } from 'svelte';
|
||||
|
||||
let {
|
||||
title,
|
||||
description,
|
||||
actions,
|
||||
}: {
|
||||
title: string;
|
||||
description?: string;
|
||||
actions?: Snippet;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<div class="saas-toolbar">
|
||||
<div class="min-w-0">
|
||||
<h1 class="saas-page-title">{title}</h1>
|
||||
{#if description}
|
||||
<p class="saas-muted mt-1">{description}</p>
|
||||
{/if}
|
||||
</div>
|
||||
{#if actions}
|
||||
<div class="ml-auto flex flex-wrap items-center gap-2">
|
||||
{@render actions()}
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
@@ -0,0 +1,66 @@
|
||||
<script lang="ts">
|
||||
import { Select } from 'bits-ui';
|
||||
import Icon from './Icon.svelte';
|
||||
|
||||
export type SelectItem = { label: string; value: string; disabled?: boolean };
|
||||
|
||||
let {
|
||||
items,
|
||||
value = $bindable(''),
|
||||
class: className = '',
|
||||
disabled = false,
|
||||
placeholder = '请选择…',
|
||||
onchange,
|
||||
}: {
|
||||
items: SelectItem[];
|
||||
value?: string;
|
||||
class?: string;
|
||||
disabled?: boolean;
|
||||
placeholder?: string;
|
||||
onchange?: (value: string) => void;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<Select.Root
|
||||
type="single"
|
||||
{items}
|
||||
{disabled}
|
||||
{value}
|
||||
onValueChange={(next) => {
|
||||
value = next;
|
||||
onchange?.(next);
|
||||
}}
|
||||
>
|
||||
<Select.Trigger class="saas-select-trigger {className}" {disabled}>
|
||||
<span class="min-w-0 flex-1 truncate text-left">
|
||||
<Select.Value {placeholder} />
|
||||
</span>
|
||||
<svg
|
||||
class="ml-2 h-4 w-4 shrink-0 text-surface-600"
|
||||
viewBox="0 0 24 24"
|
||||
fill="none"
|
||||
stroke="currentColor"
|
||||
stroke-width="1.75"
|
||||
aria-hidden="true"
|
||||
>
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
|
||||
<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
|
||||
</svg>
|
||||
</Select.Trigger>
|
||||
<Select.Portal>
|
||||
<Select.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
|
||||
<Select.Viewport class="p-1">
|
||||
{#each items as item (item.value)}
|
||||
<Select.Item class="saas-select-item" value={item.value} label={item.label} disabled={item.disabled}>
|
||||
{#snippet children({ selected })}
|
||||
<span class="min-w-0 flex-1 truncate">{item.label}</span>
|
||||
{#if selected}
|
||||
<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
|
||||
{/if}
|
||||
{/snippet}
|
||||
</Select.Item>
|
||||
{/each}
|
||||
</Select.Viewport>
|
||||
</Select.Content>
|
||||
</Select.Portal>
|
||||
</Select.Root>
|
||||
@@ -0,0 +1,19 @@
|
||||
<script lang="ts">
|
||||
let {
|
||||
label,
|
||||
value,
|
||||
hint,
|
||||
}: {
|
||||
label: string;
|
||||
value: string;
|
||||
hint?: string;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<div class="saas-stat">
|
||||
<div class="saas-stat-label">{label}</div>
|
||||
<div class="saas-stat-value">{value}</div>
|
||||
{#if hint}
|
||||
<div class="saas-help">{hint}</div>
|
||||
{/if}
|
||||
</div>
|
||||
@@ -0,0 +1,27 @@
|
||||
<script lang="ts">
|
||||
import { Switch } from 'bits-ui';
|
||||
|
||||
let {
|
||||
checked = $bindable(false),
|
||||
disabled = false,
|
||||
class: className = '',
|
||||
onchange,
|
||||
}: {
|
||||
checked?: boolean;
|
||||
disabled?: boolean;
|
||||
class?: string;
|
||||
onchange?: (checked: boolean) => void;
|
||||
} = $props();
|
||||
</script>
|
||||
|
||||
<Switch.Root
|
||||
class="saas-switch {className}"
|
||||
{disabled}
|
||||
{checked}
|
||||
onCheckedChange={(next) => {
|
||||
checked = next;
|
||||
onchange?.(next);
|
||||
}}
|
||||
>
|
||||
<Switch.Thumb class="saas-switch-thumb" />
|
||||
</Switch.Root>
|
||||
@@ -0,0 +1,25 @@
|
||||
<script lang="ts">
|
||||
import { dismissToast, toasts } from '$lib/toast';
|
||||
|
||||
const kindClass: Record<string, string> = {
|
||||
info: 'border-surface-200 bg-surface-50 text-surface-800',
|
||||
success: 'border-success-200 bg-success-50 text-success-800',
|
||||
error: 'border-error-200 bg-error-50 text-error-800',
|
||||
};
|
||||
</script>
|
||||
|
||||
<div class="pointer-events-none fixed inset-x-0 top-0 z-100 flex flex-col items-end gap-2 p-4">
|
||||
{#each $toasts as t (t.id)}
|
||||
<div
|
||||
class="pointer-events-auto flex max-w-sm items-start gap-3 border px-4 py-3 text-sm shadow-[4px_4px_0_rgb(15_23_42/0.12)] {kindClass[
|
||||
t.kind
|
||||
] ?? kindClass.info}"
|
||||
role="status"
|
||||
>
|
||||
<p class="min-w-0 flex-1">{t.message}</p>
|
||||
<button type="button" class="opacity-60 hover:opacity-100" onclick={() => dismissToast(t.id)} aria-label="关闭">
|
||||
×
|
||||
</button>
|
||||
</div>
|
||||
{/each}
|
||||
</div>
|
||||
@@ -0,0 +1,39 @@
|
||||
export interface ToolOption {
|
||||
id: string;
|
||||
label: string;
|
||||
group: string;
|
||||
}
|
||||
|
||||
export const TOOL_OPTIONS: ToolOption[] = [
|
||||
{ id: 'read_file', label: '读取文件', group: '文件' },
|
||||
{ id: 'write_file', label: '写入文件', group: '文件' },
|
||||
{ id: 'list_files', label: '列目录', group: '文件' },
|
||||
{ id: 'search_files', label: '搜索', group: '文件' },
|
||||
{ id: 'bash', label: 'Bash 命令', group: 'Shell' },
|
||||
{ id: 'cph_check', label: 'cph check', group: 'CPH' },
|
||||
{ id: 'cph_build', label: 'cph build', group: 'CPH' },
|
||||
{ id: 'send_file', label: '发送文件（飞书）', group: '飞书' },
|
||||
{ id: 'feishu_read_context', label: '读飞书上下文', group: '飞书' },
|
||||
{ id: 'feishu_download_resource', label: '下载飞书资源', group: '飞书' },
|
||||
{ id: 'request_approval', label: '请求审批', group: '飞书' },
|
||||
];
|
||||
|
||||
/** 组织成员角色（接口枚举保持英文，界面用 orgRoleLabel） */
|
||||
export const ORG_ROLES = ['OWNER', 'ADMIN', 'MEMBER'] as const;
|
||||
export type OrgRole = (typeof ORG_ROLES)[number];
|
||||
|
||||
export const ORG_ROLE_LABELS: Record<OrgRole, string> = {
|
||||
OWNER: '所有者',
|
||||
ADMIN: '管理员',
|
||||
MEMBER: '成员',
|
||||
};
|
||||
|
||||
/** 项目团队授权角色（接口枚举保持英文，界面用 permissionRoleLabel） */
|
||||
export const PERMISSION_ROLES = ['READ', 'EDIT', 'MANAGE'] as const;
|
||||
export type PermissionRole = (typeof PERMISSION_ROLES)[number];
|
||||
|
||||
export const PERMISSION_ROLE_LABELS: Record<PermissionRole, string> = {
|
||||
READ: '只读',
|
||||
EDIT: '编辑',
|
||||
MANAGE: '管理',
|
||||
};
|
||||
@@ -0,0 +1,46 @@
|
||||
import { ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS, type OrgRole, type PermissionRole } from './constants';
|
||||
|
||||
export function fmtDate(iso: string): string {
|
||||
if (!iso) return '—';
|
||||
const d = new Date(iso);
|
||||
if (Number.isNaN(d.getTime())) return iso;
|
||||
return d.toLocaleString(undefined, {
|
||||
year: 'numeric',
|
||||
month: 'short',
|
||||
day: '2-digit',
|
||||
hour: '2-digit',
|
||||
minute: '2-digit',
|
||||
});
|
||||
}
|
||||
|
||||
export function fmtDateOnly(iso: string): string {
|
||||
if (!iso) return '—';
|
||||
const d = new Date(iso);
|
||||
if (Number.isNaN(d.getTime())) return iso;
|
||||
return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: '2-digit' });
|
||||
}
|
||||
|
||||
export function fmtCost(usd: number | null): string {
|
||||
if (usd === null) return '—';
|
||||
return `$${Number(usd).toFixed(4)}`;
|
||||
}
|
||||
|
||||
export function fmtNum(n: number): string {
|
||||
return n.toLocaleString();
|
||||
}
|
||||
|
||||
export function orgRoleLabel(role: string): string {
|
||||
const key = role.toUpperCase() as OrgRole;
|
||||
return ORG_ROLE_LABELS[key] ?? role;
|
||||
}
|
||||
|
||||
export function permissionRoleLabel(role: string): string {
|
||||
const key = role.toUpperCase() as PermissionRole;
|
||||
return PERMISSION_ROLE_LABELS[key] ?? role;
|
||||
}
|
||||
|
||||
export function providerModeLabel(mode: string): string {
|
||||
if (mode === 'BYOK') return '自带密钥';
|
||||
if (mode === 'PLATFORM_MANAGED') return '平台托管';
|
||||
return mode;
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
// place files you want to import through the `$lib` alias in this folder.
|
||||
@@ -0,0 +1,43 @@
|
||||
import { writable } from 'svelte/store';
|
||||
import { api, type MeResponse } from './api';
|
||||
|
||||
interface SessionState {
|
||||
loading: boolean;
|
||||
me: MeResponse | null;
|
||||
error: string | null;
|
||||
}
|
||||
|
||||
export const session = writable<SessionState>({
|
||||
loading: true,
|
||||
me: null,
|
||||
error: null,
|
||||
});
|
||||
|
||||
export async function loadSession(): Promise<void> {
|
||||
session.update((s) => ({ ...s, loading: true, error: null }));
|
||||
try {
|
||||
const me = await api.me();
|
||||
session.set({ loading: false, me, error: null });
|
||||
} catch (err) {
|
||||
const status = (err as { status?: number }).status;
|
||||
if (status === 401) {
|
||||
redirectToLogin();
|
||||
return;
|
||||
}
|
||||
session.set({
|
||||
loading: false,
|
||||
me: null,
|
||||
error: err instanceof Error ? err.message : String(err),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
export function redirectToLogin(): void {
|
||||
const ret = encodeURIComponent(window.location.pathname + window.location.hash);
|
||||
window.location.href = `/auth/feishu?returnTo=${ret}`;
|
||||
}
|
||||
|
||||
export async function logout(): Promise<void> {
|
||||
await api.logout();
|
||||
redirectToLogin();
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
import { writable } from 'svelte/store';
|
||||
|
||||
export type ToastKind = 'info' | 'success' | 'error';
|
||||
|
||||
export interface ToastItem {
|
||||
id: number;
|
||||
message: string;
|
||||
kind: ToastKind;
|
||||
}
|
||||
|
||||
let seq = 0;
|
||||
export const toasts = writable<ToastItem[]>([]);
|
||||
|
||||
export function pushToast(message: string, kind: ToastKind = 'info', ms = 3200): void {
|
||||
const id = ++seq;
|
||||
toasts.update((list) => [...list, { id, message, kind }]);
|
||||
if (ms > 0) {
|
||||
setTimeout(() => {
|
||||
toasts.update((list) => list.filter((t) => t.id !== id));
|
||||
}, ms);
|
||||
}
|
||||
}
|
||||
|
||||
export function dismissToast(id: number): void {
|
||||
toasts.update((list) => list.filter((t) => t.id !== id));
|
||||
}
|
||||
|
||||
export function toastSuccess(message: string): void {
|
||||
pushToast(message, 'success');
|
||||
}
|
||||
|
||||
export function toastError(message: string): void {
|
||||
pushToast(message, 'error', 5000);
|
||||
}
|
||||
@@ -0,0 +1,389 @@
|
||||
<script lang="ts">
|
||||
import '../routes/app.css';
|
||||
import { onMount } from 'svelte';
|
||||
import { goto } from '$app/navigation';
|
||||
import { page } from '$app/state';
|
||||
import { session, loadSession, logout, redirectToLogin } from '$lib/session';
|
||||
import type { OrgMembership } from '$lib/api';
|
||||
import { orgRoleLabel } from '$lib/format';
|
||||
import Icon from '$lib/components/Icon.svelte';
|
||||
import ToastHost from '$lib/components/ToastHost.svelte';
|
||||
import SelectField from '$lib/components/SelectField.svelte';
|
||||
|
||||
let { children } = $props();
|
||||
let mobileNavOpen = $state(false);
|
||||
let redirecting = $state(false);
|
||||
|
||||
onMount(() => {
|
||||
loadSession();
|
||||
});
|
||||
|
||||
const navItems = [
|
||||
{ key: 'overview', label: '概览', icon: 'overview' as const },
|
||||
{ key: 'members', label: '成员', icon: 'members' as const },
|
||||
{ key: 'teams', label: '团队', icon: 'teams' as const },
|
||||
{ key: 'projects', label: '项目', icon: 'projects' as const },
|
||||
{ key: 'capacity', label: '容量', icon: 'overview' as const },
|
||||
{ key: 'provider', label: '供应方', icon: 'provider' as const },
|
||||
{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
|
||||
];
|
||||
|
||||
function isAdmin(org: OrgMembership): boolean {
|
||||
const role = String(org.role ?? '').toUpperCase();
|
||||
return role === 'OWNER' || role === 'ADMIN';
|
||||
}
|
||||
|
||||
function orgSlugFromPath(): string | null {
|
||||
const parts = page.url.pathname.split('/').filter(Boolean);
|
||||
if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
|
||||
return decodeURIComponent(parts[2]);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function isOnProjectRoute(): boolean {
|
||||
const parts = page.url.pathname.split('/').filter(Boolean);
|
||||
return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
|
||||
}
|
||||
|
||||
function memberships(): OrgMembership[] {
|
||||
return $session.me?.organizations ?? [];
|
||||
}
|
||||
|
||||
function adminOrgs(): OrgMembership[] {
|
||||
return memberships().filter(isAdmin);
|
||||
}
|
||||
|
||||
function currentOrg(): OrgMembership | null {
|
||||
const slug = orgSlugFromPath();
|
||||
if (!slug) return null;
|
||||
return memberships().find((o) => o.slug === slug) ?? null;
|
||||
}
|
||||
|
||||
function pickHomeOrg(): OrgMembership | null {
|
||||
const admin = adminOrgs()[0];
|
||||
if (admin) return admin;
|
||||
return memberships()[0] ?? null;
|
||||
}
|
||||
|
||||
function activeKey(): string {
|
||||
const parts = page.url.pathname.split('/').filter(Boolean);
|
||||
if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
|
||||
return parts[3] ?? 'overview';
|
||||
}
|
||||
|
||||
function navHref(key: string): string {
|
||||
const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
|
||||
if (!slug) return '/';
|
||||
if (key === 'overview') return `/admin/org/${slug}`;
|
||||
return `/admin/org/${slug}/${key}`;
|
||||
}
|
||||
|
||||
function pageTitle(): string {
|
||||
const key = activeKey();
|
||||
if (key === 'overview' || key === '') return '概览';
|
||||
return navItems.find((i) => i.key === key)?.label ?? '管理后台';
|
||||
}
|
||||
|
||||
function switchOrg(nextSlug: string) {
|
||||
if (!nextSlug || nextSlug === currentOrg()?.slug) return;
|
||||
void goto(`/admin/org/${nextSlug}`);
|
||||
}
|
||||
|
||||
function handleLogout(e: Event) {
|
||||
e.preventDefault();
|
||||
logout();
|
||||
}
|
||||
|
||||
function orgSelectItems(list: OrgMembership[]) {
|
||||
return list.map((o) => ({
|
||||
value: o.slug,
|
||||
label: `${o.name} · ${orgRoleLabel(o.role)}`,
|
||||
}));
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
page.url.pathname;
|
||||
mobileNavOpen = false;
|
||||
});
|
||||
|
||||
$effect(() => {
|
||||
if ($session.loading || !$session.me) return;
|
||||
|
||||
const slug = orgSlugFromPath();
|
||||
const matched = slug ? memberships().find((o) => o.slug === slug) : null;
|
||||
|
||||
// Org admins: route to their first admin org if none matched as admin.
|
||||
const admins = adminOrgs();
|
||||
if (matched && isAdmin(matched)) {
|
||||
redirecting = false;
|
||||
return;
|
||||
}
|
||||
if (!matched && admins.length > 0) {
|
||||
const target = `/admin/org/${admins[0].slug}`;
|
||||
if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
|
||||
redirecting = true;
|
||||
void goto(target, { replaceState: true });
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Members (non-admin): project pages are open to project MANAGE holders;
|
||||
// the org overview and other admin-only surfaces are not for them.
|
||||
if (matched && !isAdmin(matched)) {
|
||||
redirecting = false;
|
||||
const parts = page.url.pathname.split('/').filter(Boolean);
|
||||
const onOverview = parts.length === 3; // /admin/org/:slug
|
||||
if (onOverview) {
|
||||
const target = `/admin/org/${matched.slug}/projects`;
|
||||
if (page.url.pathname !== target) {
|
||||
redirecting = true;
|
||||
void goto(target, { replaceState: true });
|
||||
}
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// No matched org and no admin orgs: route a member to their first org's
|
||||
// projects page so they can reach project MANAGE surfaces.
|
||||
if (!matched && memberships().length > 0) {
|
||||
const home = memberships()[0];
|
||||
const target = `/admin/org/${home.slug}/projects`;
|
||||
if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
|
||||
redirecting = true;
|
||||
void goto(target, { replaceState: true });
|
||||
}
|
||||
}
|
||||
});
|
||||
</script>
|
||||
|
||||
<ToastHost />
|
||||
|
||||
{#if $session.loading || redirecting}
|
||||
<div class="saas-status-panel">
|
||||
<div class="flex flex-col items-center gap-3 text-surface-600">
|
||||
<svg class="h-8 w-8 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
|
||||
<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
|
||||
<path
|
||||
class="opacity-90"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
|
||||
></path>
|
||||
</svg>
|
||||
<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
|
||||
</div>
|
||||
</div>
|
||||
{:else if $session.error}
|
||||
<div class="saas-status-panel">
|
||||
<div class="saas-status-card">
|
||||
<div
|
||||
class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
|
||||
>
|
||||
!
|
||||
</div>
|
||||
<h2 class="mb-1 text-lg font-semibold">无法连接到后端</h2>
|
||||
<p class="mb-5 text-sm text-surface-700">{$session.error}</p>
|
||||
<button class="saas-btn-primary" onclick={() => loadSession()}>重试</button>
|
||||
</div>
|
||||
</div>
|
||||
{:else if !$session.me}
|
||||
<div class="saas-status-panel">
|
||||
<div class="saas-status-card">
|
||||
<div
|
||||
class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
|
||||
>
|
||||
CPH
|
||||
</div>
|
||||
<h1 class="text-xl font-semibold">Curriculum Project Hub</h1>
|
||||
<p class="mt-2 mb-6 text-sm text-surface-700">登录以管理组织、项目、团队与模型供应。</p>
|
||||
<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
|
||||
</div>
|
||||
</div>
|
||||
{:else if currentOrg() && isAdmin(currentOrg()!)}
|
||||
{@const org = currentOrg()!}
|
||||
{@const me = $session.me!}
|
||||
<div class="saas-shell">
|
||||
{#if mobileNavOpen}
|
||||
<button
|
||||
type="button"
|
||||
class="fixed inset-0 z-40 bg-surface-950/40 md:hidden"
|
||||
aria-label="关闭导航"
|
||||
onclick={() => (mobileNavOpen = false)}
|
||||
></button>
|
||||
{/if}
|
||||
|
||||
<aside
|
||||
class="saas-sidebar fixed inset-y-0 left-0 z-50 transition-transform md:static md:translate-x-0
|
||||
{mobileNavOpen ? 'translate-x-0' : '-translate-x-full md:translate-x-0'}"
|
||||
>
|
||||
<div class="flex items-center gap-2.5 px-4 py-4">
|
||||
<div
|
||||
class="flex h-9 w-9 items-center justify-center border border-primary-700 bg-primary-600 text-xs font-bold tracking-wide text-white"
|
||||
>
|
||||
CPH
|
||||
</div>
|
||||
<div class="min-w-0">
|
||||
<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
|
||||
<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="px-3 pb-3">
|
||||
<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
|
||||
<Icon name="org" class="h-3.5 w-3.5" />
|
||||
组织
|
||||
</div>
|
||||
<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
|
||||
</div>
|
||||
|
||||
<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
|
||||
<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
|
||||
{#each navItems as item}
|
||||
{@const active =
|
||||
activeKey() === item.key || (item.key === 'overview' && (activeKey() === '' || activeKey() === 'overview'))}
|
||||
<a href={navHref(item.key)} class="saas-nav-item" data-active={active ? 'true' : 'false'}>
|
||||
<Icon name={item.icon} class="h-4 w-4 shrink-0 opacity-80" />
|
||||
<span>{item.label}</span>
|
||||
</a>
|
||||
{/each}
|
||||
</nav>
|
||||
|
||||
<div class="border-t border-surface-300 p-3">
|
||||
<div class="flex items-center gap-2.5 border border-surface-300 bg-surface-100 px-2.5 py-2">
|
||||
{#if me.user.avatarUrl}
|
||||
<img src={me.user.avatarUrl} alt="" class="h-8 w-8 object-cover" />
|
||||
{:else}
|
||||
<div
|
||||
class="flex h-8 w-8 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
|
||||
>
|
||||
{me.user.displayName.slice(0, 1)}
|
||||
</div>
|
||||
{/if}
|
||||
<div class="min-w-0 flex-1">
|
||||
<div class="truncate text-sm font-medium text-surface-900">{me.user.displayName}</div>
|
||||
<div class="truncate text-[11px] text-surface-600">{orgRoleLabel(org.role)}</div>
|
||||
</div>
|
||||
<button
|
||||
type="button"
|
||||
class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
|
||||
title="退出登录"
|
||||
onclick={handleLogout}
|
||||
>
|
||||
<Icon name="logout" class="h-4 w-4" />
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</aside>
|
||||
|
||||
<div class="saas-main">
|
||||
<header class="saas-topbar">
|
||||
<button
|
||||
type="button"
|
||||
class="saas-btn-ghost px-2! md:hidden"
|
||||
onclick={() => (mobileNavOpen = !mobileNavOpen)}
|
||||
aria-label="打开导航"
|
||||
>
|
||||
<Icon name="menu" class="h-5 w-5" />
|
||||
</button>
|
||||
<div class="min-w-0">
|
||||
<div class="flex items-center gap-1.5 text-xs text-surface-600">
|
||||
<span class="truncate">{org.name}</span>
|
||||
<span>/</span>
|
||||
<span class="truncate font-medium text-surface-900">{pageTitle()}</span>
|
||||
</div>
|
||||
</div>
|
||||
<div class="ml-auto hidden items-center gap-2 sm:flex">
|
||||
<span class="saas-badge-primary">{org.status}</span>
|
||||
<span class="saas-badge-neutral font-mono">/{org.slug}</span>
|
||||
</div>
|
||||
</header>
|
||||
<main class="saas-content">
|
||||
<div class="saas-content-inner">
|
||||
{@render children()}
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
</div>
|
||||
{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
|
||||
{@const org = currentOrg()!}
|
||||
{@const me = $session.me!}
|
||||
<div class="saas-shell">
|
||||
<div class="saas-main">
|
||||
<header class="saas-topbar">
|
||||
<a
|
||||
href={`/admin/org/${org.slug}/projects`}
|
||||
class="saas-btn-ghost px-2!"
|
||||
aria-label="返回项目列表"
|
||||
>
|
||||
<Icon name="menu" class="h-5 w-5" />
|
||||
</a>
|
||||
<div class="min-w-0">
|
||||
<div class="flex items-center gap-1.5 text-xs text-surface-600">
|
||||
<span class="truncate">{org.name}</span>
|
||||
<span>/</span>
|
||||
<span class="truncate font-medium text-surface-900">项目</span>
|
||||
</div>
|
||||
</div>
|
||||
<div class="ml-auto flex items-center gap-2">
|
||||
<span class="saas-badge-neutral font-mono">/{org.slug}</span>
|
||||
<button
|
||||
type="button"
|
||||
class="p-1.5 text-surface-600 transition hover:bg-surface-200 hover:text-error-700"
|
||||
title="退出登录"
|
||||
onclick={handleLogout}
|
||||
>
|
||||
<Icon name="logout" class="h-4 w-4" />
|
||||
</button>
|
||||
</div>
|
||||
</header>
|
||||
<main class="saas-content">
|
||||
<div class="saas-content-inner">
|
||||
{@render children()}
|
||||
</div>
|
||||
</main>
|
||||
</div>
|
||||
</div>
|
||||
{:else if currentOrg() && !isAdmin(currentOrg()!)}
|
||||
{@const denied = currentOrg()!}
|
||||
<div class="saas-status-panel">
|
||||
<div class="saas-status-card">
|
||||
<h2 class="mb-2 text-lg font-semibold">无权访问管理后台</h2>
|
||||
<p class="mb-3 text-sm text-surface-700">
|
||||
组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
|
||||
<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
|
||||
</p>
|
||||
<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
|
||||
{#if memberships().length > 1}
|
||||
<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
|
||||
<div class="mb-4">
|
||||
<SelectField items={orgSelectItems(memberships())} value={denied.slug} onchange={switchOrg} />
|
||||
</div>
|
||||
{/if}
|
||||
<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
|
||||
</div>
|
||||
</div>
|
||||
{:else if memberships().length > 0}
|
||||
{@const denied = pickHomeOrg()!}
|
||||
<div class="saas-status-panel">
|
||||
<div class="saas-status-card">
|
||||
<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
|
||||
<p class="mb-5 text-sm text-surface-700">
|
||||
即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
|
||||
</p>
|
||||
<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
|
||||
<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
|
||||
</div>
|
||||
</div>
|
||||
{:else}
|
||||
<div class="saas-status-panel">
|
||||
<div class="saas-status-card">
|
||||
<h2 class="mb-2 text-lg font-semibold">未加入组织</h2>
|
||||
<p class="mb-3 text-sm text-surface-700">飞书账号已登录，但当前账号尚未加入任何组织。</p>
|
||||
<p class="mb-5 text-left text-xs text-surface-600">
|
||||
open_id：
|
||||
<code class="break-all font-mono text-surface-600">{$session.me!.user.feishuOpenId}</code>
|
||||
</p>
|
||||
<button class="saas-btn-primary" onclick={handleLogout}>退出登录</button>
|
||||
</div>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,43 @@
|
||||
<script lang="ts">
|
||||
import { onMount } from 'svelte';
|
||||
import { goto } from '$app/navigation';
|
||||
import { session, redirectToLogin } from '$lib/session';
|
||||
|
||||
function homeForSession(): string | null {
|
||||
const me = $session.me;
|
||||
if (!me) return null;
|
||||
const admin = me.organizations.find((o) => {
|
||||
const r = String(o.role ?? '').toUpperCase();
|
||||
return r === 'OWNER' || r === 'ADMIN';
|
||||
});
|
||||
const target = admin ?? me.organizations[0];
|
||||
return target ? `/admin/org/${target.slug}` : null;
|
||||
}
|
||||
|
||||
onMount(() => {
|
||||
const unsub = session.subscribe((s) => {
|
||||
if (s.loading) return;
|
||||
if (!s.me) {
|
||||
redirectToLogin();
|
||||
return;
|
||||
}
|
||||
const dest = homeForSession();
|
||||
if (dest) void goto(dest, { replaceState: true });
|
||||
});
|
||||
return unsub;
|
||||
});
|
||||
</script>
|
||||
|
||||
<div class="saas-status-panel">
|
||||
<div class="flex flex-col items-center gap-3 text-surface-600">
|
||||
<svg class="h-7 w-7 animate-spin text-primary-500" viewBox="0 0 24 24" fill="none">
|
||||
<circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
|
||||
<path
|
||||
class="opacity-90"
|
||||
fill="currentColor"
|
||||
d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
|
||||
></path>
|
||||
</svg>
|
||||
<p class="text-sm">正在进入工作台…</p>
|
||||
</div>
|
||||
</div>
|
||||
@@ -0,0 +1,147 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type OrgMembership } from '$lib/api';
|
||||
import { session } from '$lib/session';
|
||||
import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import StatCard from '$lib/components/StatCard.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import SwitchControl from '$lib/components/SwitchControl.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
let orgSlug = $derived(page.params.slug ?? '');
|
||||
let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);
|
||||
|
||||
let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
|
||||
let usage = $state<Awaited<ReturnType<typeof api.usage>> | null>(null);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
let saving = $state(false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
[settings, usage] = await Promise.all([api.settings(orgSlug), api.usage(orgSlug)]);
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function setMembersCanCreate(next: boolean) {
|
||||
if (!settings || settings.membersCanCreateProjects === next) return;
|
||||
saving = true;
|
||||
const prev = settings.membersCanCreateProjects;
|
||||
settings.membersCanCreateProjects = next;
|
||||
try {
|
||||
await api.setSettings(orgSlug, { membersCanCreateProjects: next });
|
||||
toastSuccess(next ? '已允许成员自助建项' : '已关闭成员自助建项');
|
||||
} catch (err) {
|
||||
settings.membersCanCreateProjects = prev;
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
saving = false;
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (orgSlug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else if org && settings && usage}
|
||||
<PageHeader title={org.name} description="组织健康度、用量与生产策略一览。" />
|
||||
|
||||
<div class="mb-6 grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
|
||||
<div class="saas-card-pad sm:col-span-2 lg:col-span-1">
|
||||
<p class="saas-section-title mb-3">组织信息</p>
|
||||
<dl class="space-y-2.5 text-sm">
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">Slug</dt>
|
||||
<dd class="font-mono text-xs text-surface-800">/{org.slug}</dd>
|
||||
</div>
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">状态</dt>
|
||||
<dd><span class="saas-badge-success">{org.status}</span></dd>
|
||||
</div>
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">你的角色</dt>
|
||||
<dd><span class="saas-badge-primary">{orgRoleLabel(org.role)}</span></dd>
|
||||
</div>
|
||||
</dl>
|
||||
</div>
|
||||
|
||||
<div class="saas-card-pad sm:col-span-2">
|
||||
<p class="saas-section-title mb-1">项目自助创建策略</p>
|
||||
<p class="saas-muted mb-4">开启后，普通老师可在飞书群自助创建项目；关闭后仅所有者与管理员可建。</p>
|
||||
<div class="flex items-center gap-3 border border-surface-300 bg-surface-100 px-4 py-3">
|
||||
<SwitchControl checked={settings.membersCanCreateProjects} disabled={saving} onchange={setMembersCanCreate} />
|
||||
<div>
|
||||
<div class="text-sm font-medium text-surface-900">允许成员自助创建项目</div>
|
||||
<div class="text-xs text-surface-600">普通成员在飞书群中自助建项</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mb-4 flex items-end justify-between gap-3">
|
||||
<div>
|
||||
<h2 class="saas-section-title">用量概览</h2>
|
||||
<p class="saas-muted">全组织智能体运行汇总</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
|
||||
<StatCard label="运行总数" value={fmtNum(usage.totals.runCount)} />
|
||||
<StatCard label="有成本运行" value={fmtNum(usage.totals.runsWithCost)} />
|
||||
<StatCard label="无成本运行" value={fmtNum(usage.totals.runsWithoutCost)} />
|
||||
<StatCard label="输入 tokens" value={fmtNum(usage.totals.inputTokens)} />
|
||||
<StatCard label="输出 tokens" value={fmtNum(usage.totals.outputTokens)} />
|
||||
<StatCard label="成本 (USD)" value={fmtCost(usage.totals.costUsd)} />
|
||||
</div>
|
||||
|
||||
<div class="saas-card overflow-hidden">
|
||||
<div class="border-b border-surface-200 px-5 py-3">
|
||||
<h3 class="text-sm font-semibold text-surface-800">按项目用量</h3>
|
||||
</div>
|
||||
{#if usage.projects.length === 0}
|
||||
<div class="saas-empty">
|
||||
<p class="text-sm text-surface-600">暂无项目用量数据</p>
|
||||
</div>
|
||||
{:else}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>项目</th>
|
||||
<th>运行</th>
|
||||
<th>in / out tokens</th>
|
||||
<th>成本</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each usage.projects as p}
|
||||
<tr>
|
||||
<td class="font-medium">{p.projectName}</td>
|
||||
<td class="tabular-nums">{fmtNum(p.runCount)}</td>
|
||||
<td class="tabular-nums text-surface-600">{fmtNum(p.inputTokens)} / {fmtNum(p.outputTokens)}</td>
|
||||
<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
{:else}
|
||||
<div class="saas-empty">
|
||||
<p class="text-sm text-surface-600">组织数据不可用</p>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,310 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import EmptyState from '$lib/components/EmptyState.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
|
||||
// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
|
||||
const DIMENSION_LABELS: Record<CapacityDimension, string> = {
|
||||
requestRate: '请求速率',
|
||||
requestBodySize: '请求体大小',
|
||||
agentConcurrency: '并发数',
|
||||
admissionQueueLength: '队列长度',
|
||||
admissionQueueWait: '队列等待',
|
||||
fileSize: '单文件大小',
|
||||
attachmentCount: '附件数',
|
||||
archiveExpansion: '归档展开',
|
||||
projectStorage: '项目存储',
|
||||
organizationStorage: '组织存储',
|
||||
memberCount: '成员数',
|
||||
projectCount: '项目数',
|
||||
teamCount: '团队数',
|
||||
folderCount: '文件夹数',
|
||||
sessionCount: '会话数',
|
||||
runWallTime: '运行时长',
|
||||
runTurns: '对话轮次',
|
||||
runToolCalls: '工具调用数',
|
||||
toolWallTime: '工具执行时长',
|
||||
runOutputSize: '输出大小',
|
||||
processMemory: '内存',
|
||||
processCpu: 'CPU',
|
||||
processCount: '进程数',
|
||||
};
|
||||
|
||||
// Logical groupings for higher information density.
|
||||
const GROUPS: { title: string; dims: CapacityDimension[] }[] = [
|
||||
{ title: 'HTTP 接入', dims: ['requestRate', 'requestBodySize'] },
|
||||
{ title: '智能体运行', dims: ['agentConcurrency', 'runWallTime', 'runTurns', 'runToolCalls', 'toolWallTime', 'runOutputSize'] },
|
||||
{ title: '接纳队列', dims: ['admissionQueueLength', 'admissionQueueWait'] },
|
||||
{ title: '附件与存储', dims: ['fileSize', 'attachmentCount', 'archiveExpansion', 'projectStorage', 'organizationStorage'] },
|
||||
{ title: '组织配额', dims: ['memberCount', 'projectCount', 'teamCount', 'folderCount', 'sessionCount'] },
|
||||
{ title: '进程资源', dims: ['processMemory', 'processCpu', 'processCount'] },
|
||||
];
|
||||
|
||||
let view = $state<CapacityPolicyView | null>(null);
|
||||
let drafts = $state<Partial<Record<CapacityDimension, string | number>>>({});
|
||||
let loading = $state(true);
|
||||
let saving = $state(false);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
view = await api.capacityPolicy(slug);
|
||||
drafts = {};
|
||||
for (const row of view.dimensions) {
|
||||
drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
|
||||
}
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
function draftText(dim: CapacityDimension): string {
|
||||
const raw = drafts[dim];
|
||||
if (raw === undefined || raw === null) return '';
|
||||
return String(raw).trim();
|
||||
}
|
||||
|
||||
// Inline validation: surfaced as the user edits, not on submit. Returns null
|
||||
// when the draft is empty (means "use platform ceiling") or valid.
|
||||
function draftError(row: CapacityDimensionRow): string | null {
|
||||
const text = draftText(row.dimension);
|
||||
if (text === '') return null;
|
||||
const n = Number.parseInt(text, 10);
|
||||
if (!Number.isFinite(n) || n < 1) return '需为正整数';
|
||||
if (row.platformCeiling !== null && n > row.platformCeiling) return `不得超过 ${row.platformCeiling}`;
|
||||
return null;
|
||||
}
|
||||
|
||||
// Live effective value: min(platform ceiling, draft). Reflects the draft
|
||||
// before save so the user sees the outcome as they type.
|
||||
function liveEffective(row: CapacityDimensionRow): number | null {
|
||||
if (row.platformCeiling === null) return null;
|
||||
const text = draftText(row.dimension);
|
||||
if (text === '') return row.platformCeiling;
|
||||
const n = Number.parseInt(text, 10);
|
||||
if (!Number.isFinite(n) || n < 1) return row.platformCeiling;
|
||||
return Math.min(row.platformCeiling, n);
|
||||
}
|
||||
|
||||
function isLowered(row: CapacityDimensionRow): boolean {
|
||||
const eff = liveEffective(row);
|
||||
return eff !== null && eff < row.platformCeiling!;
|
||||
}
|
||||
|
||||
const hasErrors = $derived(
|
||||
view?.dimensions.some((row) => draftError(row) !== null) ?? false,
|
||||
);
|
||||
|
||||
async function save() {
|
||||
if (!view || hasErrors) return;
|
||||
saving = true;
|
||||
const limits: Partial<Record<CapacityDimension, number | null>> = {};
|
||||
for (const row of view.dimensions) {
|
||||
const text = draftText(row.dimension);
|
||||
limits[row.dimension] = text === '' ? null : Number.parseInt(text, 10);
|
||||
}
|
||||
try {
|
||||
view = await api.setCapacityPolicy(slug, { limits });
|
||||
drafts = {};
|
||||
for (const row of view.dimensions) {
|
||||
drafts[row.dimension] = row.organizationLimit === null ? '' : String(row.organizationLimit);
|
||||
}
|
||||
toastSuccess('容量策略已保存');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
saving = false;
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
<PageHeader
|
||||
title="容量策略"
|
||||
description="平台上限不可突破。组织可在此设更低限制，未设置时按平台上限执行。"
|
||||
>
|
||||
{#snippet actions()}
|
||||
<button class="saas-btn-primary" disabled={saving || !view || hasErrors} onclick={save}>
|
||||
{saving ? '保存中…' : '保存'}
|
||||
</button>
|
||||
{/snippet}
|
||||
</PageHeader>
|
||||
|
||||
<p class="saas-muted mb-6">
|
||||
未配置平台上限的维度暂不可设置组织限制。输入框留空即沿用平台上限。
|
||||
</p>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else if view}
|
||||
{#if view.dimensions.length === 0}
|
||||
<EmptyState title="暂无容量维度" description="容量维度由平台定义。" />
|
||||
{:else}
|
||||
{@const policy = view}
|
||||
<div class="grid gap-4 md:grid-cols-2">
|
||||
{#each GROUPS as group}
|
||||
{@const rows = group.dims
|
||||
.map((d) => policy.dimensions.find((r) => r.dimension === d))
|
||||
.filter((r): r is CapacityDimensionRow => r !== undefined)}
|
||||
{#if rows.length > 0}
|
||||
<section class="saas-card">
|
||||
<header class="group-header">
|
||||
<h3 class="group-title">{group.title}</h3>
|
||||
<span class="group-count">{rows.length} 项</span>
|
||||
</header>
|
||||
<div class="dim-list">
|
||||
{#each rows as row (row.dimension)}
|
||||
{@const err = draftError(row)}
|
||||
{@const eff = liveEffective(row)}
|
||||
{@const lowered = isLowered(row)}
|
||||
{@const disabled = row.platformCeiling === null}
|
||||
<div class="dim-row" class:dim-row-error={err !== null}>
|
||||
<div class="dim-label">{DIMENSION_LABELS[row.dimension] ?? row.dimension}</div>
|
||||
<div class="dim-ceiling">
|
||||
{#if disabled}
|
||||
<span class="text-surface-400">未配置</span>
|
||||
{:else}
|
||||
<span class="tabular-nums">平台 ≤ {row.platformCeiling}</span>
|
||||
{/if}
|
||||
</div>
|
||||
<input
|
||||
class="saas-input dim-input"
|
||||
type="number"
|
||||
placeholder="用平台值"
|
||||
disabled={disabled}
|
||||
bind:value={drafts[row.dimension]}
|
||||
/>
|
||||
<div class="dim-effective">
|
||||
{#if eff === null}
|
||||
<span class="text-surface-400">—</span>
|
||||
{:else if lowered}
|
||||
<span class="saas-badge saas-badge-primary tabular-nums">有效 {eff}</span>
|
||||
{:else}
|
||||
<span class="saas-badge saas-badge-neutral tabular-nums">有效 {eff}</span>
|
||||
{/if}
|
||||
</div>
|
||||
{#if err !== null}
|
||||
<div class="dim-error">{err}</div>
|
||||
{/if}
|
||||
</div>
|
||||
{/each}
|
||||
</div>
|
||||
</section>
|
||||
{/if}
|
||||
{/each}
|
||||
</div>
|
||||
{/if}
|
||||
{:else}
|
||||
<EmptyState title="容量数据不可用" description="无法加载容量策略。" />
|
||||
{/if}
|
||||
|
||||
<style>
|
||||
.group-header {
|
||||
display: flex;
|
||||
align-items: baseline;
|
||||
justify-content: space-between;
|
||||
padding: 0.5rem 0.75rem;
|
||||
border-bottom: 1px solid var(--color-surface-200);
|
||||
background: var(--color-surface-100);
|
||||
}
|
||||
.group-title {
|
||||
font-size: 0.8125rem;
|
||||
font-weight: 600;
|
||||
color: var(--color-surface-800);
|
||||
letter-spacing: 0.02em;
|
||||
}
|
||||
.group-count {
|
||||
font-size: 0.6875rem;
|
||||
color: var(--color-surface-500);
|
||||
}
|
||||
.dim-list {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
}
|
||||
.dim-row {
|
||||
display: grid;
|
||||
grid-template-columns: minmax(5rem, 1fr) auto minmax(7rem, 8.5rem) 6.5rem;
|
||||
align-items: center;
|
||||
gap: 0.5rem;
|
||||
padding: 0.4rem 0.75rem;
|
||||
border-bottom: 1px solid var(--color-surface-100);
|
||||
}
|
||||
.dim-row:last-child {
|
||||
border-bottom: none;
|
||||
}
|
||||
.dim-row-error {
|
||||
background: color-mix(in oklab, var(--color-error-100) 40%, transparent);
|
||||
}
|
||||
.dim-label {
|
||||
font-size: 0.8125rem;
|
||||
font-weight: 500;
|
||||
color: var(--color-surface-900);
|
||||
white-space: nowrap;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
}
|
||||
.dim-ceiling {
|
||||
font-size: 0.6875rem;
|
||||
color: var(--color-surface-500);
|
||||
white-space: nowrap;
|
||||
}
|
||||
.dim-input {
|
||||
padding: 0.25rem 0.5rem;
|
||||
font-size: 0.8125rem;
|
||||
text-align: right;
|
||||
}
|
||||
.dim-effective {
|
||||
display: flex;
|
||||
justify-content: flex-end;
|
||||
}
|
||||
.dim-effective > .saas-badge {
|
||||
width: 100%;
|
||||
justify-content: center;
|
||||
}
|
||||
.dim-error {
|
||||
grid-column: 1 / -1;
|
||||
font-size: 0.6875rem;
|
||||
color: var(--color-error-700);
|
||||
padding-bottom: 0.2rem;
|
||||
}
|
||||
@media (max-width: 480px) {
|
||||
.dim-row {
|
||||
grid-template-columns: 1fr 5rem;
|
||||
grid-template-rows: auto auto auto;
|
||||
row-gap: 0.25rem;
|
||||
}
|
||||
.dim-label {
|
||||
grid-column: 1;
|
||||
}
|
||||
.dim-ceiling {
|
||||
grid-column: 2;
|
||||
text-align: right;
|
||||
}
|
||||
.dim-input {
|
||||
grid-column: 1 / -1;
|
||||
}
|
||||
.dim-effective {
|
||||
grid-column: 1 / -1;
|
||||
justify-content: flex-start;
|
||||
}
|
||||
.dim-effective > .saas-badge {
|
||||
width: auto;
|
||||
justify-content: flex-start;
|
||||
}
|
||||
}
|
||||
</style>
|
||||
@@ -0,0 +1,176 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type FeishuApplicationConnection } from '$lib/api';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import { Label } from 'bits-ui';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
|
||||
let connection = $state<FeishuApplicationConnection | null>(null);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let appId = $state('');
|
||||
let appSecret = $state('');
|
||||
let botOpenId = $state('');
|
||||
let verificationToken = $state('');
|
||||
let encryptKey = $state('');
|
||||
let saving = $state(false);
|
||||
let disabling = $state(false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
const res = await api.feishuApplication(slug);
|
||||
connection = res.connection;
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
function resetForm() {
|
||||
appId = '';
|
||||
appSecret = '';
|
||||
botOpenId = '';
|
||||
verificationToken = '';
|
||||
encryptKey = '';
|
||||
}
|
||||
|
||||
async function save() {
|
||||
const id = appId.trim();
|
||||
const secret = appSecret.trim();
|
||||
const bot = botOpenId.trim();
|
||||
if (id === '' || secret === '' || bot === '') {
|
||||
toastError('App ID、App Secret、Bot Open ID 均为必填');
|
||||
return;
|
||||
}
|
||||
saving = true;
|
||||
const body: {
|
||||
appId: string;
|
||||
appSecret: string;
|
||||
botOpenId: string;
|
||||
verificationToken?: string;
|
||||
encryptKey?: string;
|
||||
} = { appId: id, appSecret: secret, botOpenId: bot };
|
||||
const vt = verificationToken.trim();
|
||||
if (vt !== '') body.verificationToken = vt;
|
||||
const ek = encryptKey.trim();
|
||||
if (ek !== '') body.encryptKey = ek;
|
||||
try {
|
||||
connection = await api.rotateFeishuApplication(slug, body);
|
||||
resetForm();
|
||||
toastSuccess('飞书应用凭据已保存');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
saving = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function disable() {
|
||||
if (!connection) return;
|
||||
if (!confirm('停用后该组织将无法收发飞书消息，确定停用？')) return;
|
||||
disabling = true;
|
||||
try {
|
||||
connection = await api.disableFeishuApplication(slug);
|
||||
toastSuccess('已停用飞书应用连接');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
disabling = false;
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
<PageHeader
|
||||
title="飞书应用"
|
||||
description="本组织绑定的飞书应用凭据（ADR-0021：组织与应用 1:1）。凭据按组织隔离、版本化信封存储，缺失或校验失败即 fail-closed。"
|
||||
/>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else}
|
||||
{#if connection}
|
||||
<div class="saas-card-pad mb-6">
|
||||
<p class="saas-section-title mb-3">当前连接</p>
|
||||
<dl class="space-y-2.5 text-sm">
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">状态</dt>
|
||||
<dd><span class="saas-badge-success">{connection.status}</span></dd>
|
||||
</div>
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">App 指纹</dt>
|
||||
<dd class="font-mono text-xs text-surface-800">{connection.appFingerprint}</dd>
|
||||
</div>
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">版本</dt>
|
||||
<dd class="tabular-nums">{connection.activeVersion ?? '—'}</dd>
|
||||
</div>
|
||||
<div class="flex items-center justify-between gap-3">
|
||||
<dt class="text-surface-700">更新于</dt>
|
||||
<dd class="text-surface-600">{fmtDate(connection.updatedAt)}</dd>
|
||||
</div>
|
||||
</dl>
|
||||
{#if connection.status !== 'DISABLED'}
|
||||
<div class="mt-5 flex items-center justify-end gap-3 border-t border-surface-100 pt-4">
|
||||
<button class="saas-btn-ghost" onclick={disable} disabled={disabling}>
|
||||
{disabling ? '停用中…' : '停用连接'}
|
||||
</button>
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
{:else}
|
||||
<div class="saas-card-pad mb-6">
|
||||
<p class="text-sm text-surface-700">本组织尚未绑定飞书应用。填写下方凭据以创建连接。</p>
|
||||
</div>
|
||||
{/if}
|
||||
|
||||
<div class="saas-card-pad">
|
||||
<h3 class="saas-section-title mb-1">{connection ? '轮换凭据' : '创建连接'}</h3>
|
||||
<p class="saas-muted mb-4">
|
||||
密钥仅写入新版本，旧版本归档。{#if connection}App ID 不可变更，须与现有应用一致。{/if}
|
||||
</p>
|
||||
<div class="grid gap-5">
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="app-id">App ID</Label.Root>
|
||||
<input id="app-id" class="saas-input font-mono text-sm" bind:value={appId} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="app-secret">App Secret</Label.Root>
|
||||
<input id="app-secret" class="saas-input" type="password" bind:value={appSecret} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="bot-open-id">Bot Open ID</Label.Root>
|
||||
<input id="bot-open-id" class="saas-input font-mono text-sm" bind:value={botOpenId} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="verification-token">Verification Token（可选）</Label.Root>
|
||||
<input id="verification-token" class="saas-input" type="password" bind:value={verificationToken} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="encrypt-key">Encrypt Key（可选）</Label.Root>
|
||||
<input id="encrypt-key" class="saas-input" type="password" bind:value={encryptKey} />
|
||||
</div>
|
||||
</div>
|
||||
<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
|
||||
<div class="flex-1"></div>
|
||||
<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
|
||||
<button class="saas-btn-primary" onclick={save} disabled={saving}>
|
||||
{saving ? '保存中…' : '保存'}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,164 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type OrgMember } from '$lib/api';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import EmptyState from '$lib/components/EmptyState.svelte';
|
||||
import SelectField from '$lib/components/SelectField.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
|
||||
const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');
|
||||
|
||||
let members = $state<OrgMember[]>([]);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let newOpenId = $state('');
|
||||
let newName = $state('');
|
||||
let newRole = $state<string>('MEMBER');
|
||||
let adding = $state(false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
const res = await api.members(slug);
|
||||
members = res.members;
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function addMember() {
|
||||
if (!newOpenId.trim()) return;
|
||||
adding = true;
|
||||
try {
|
||||
const m = await api.addMember(slug, {
|
||||
feishuOpenId: newOpenId.trim(),
|
||||
role: newRole,
|
||||
...(newName.trim() ? { displayName: newName.trim() } : {}),
|
||||
});
|
||||
members = [...members, m].sort((a, b) => a.role.localeCompare(b.role) || a.createdAt.localeCompare(b.createdAt));
|
||||
newOpenId = '';
|
||||
newName = '';
|
||||
toastSuccess('成员已添加');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
adding = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function changeRole(m: OrgMember, role: string) {
|
||||
try {
|
||||
await api.setMemberRole(slug, m.userId, role);
|
||||
await load();
|
||||
toastSuccess('角色已更新');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function revoke(m: OrgMember) {
|
||||
if (!confirm(`移除成员 ${m.displayName} 出本组织?`)) return;
|
||||
try {
|
||||
await api.revokeMember(slug, m.userId);
|
||||
await load();
|
||||
toastSuccess('成员已移除');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
<PageHeader title="成员与权限" description="管理组织角色：所有者与管理员可访问本后台，成员不可。" />
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else}
|
||||
<div class="saas-card-pad mb-6">
|
||||
<h2 class="saas-section-title mb-4">添加成员</h2>
|
||||
<div class="grid gap-3 md:grid-cols-[1.2fr_1fr_12rem_auto]">
|
||||
<input class="saas-input" placeholder="飞书 open_id" bind:value={newOpenId} />
|
||||
<input class="saas-input" placeholder="显示名（可选）" bind:value={newName} />
|
||||
<SelectField items={roleItems} bind:value={newRole} />
|
||||
<button class="saas-btn-primary" onclick={addMember} disabled={adding}>
|
||||
{adding ? '添加中…' : '添加成员'}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="saas-card overflow-hidden">
|
||||
<div class="flex items-center justify-between border-b border-surface-200 px-5 py-3">
|
||||
<h2 class="text-sm font-semibold">成员列表</h2>
|
||||
<span class="saas-badge-neutral">{members.length}</span>
|
||||
</div>
|
||||
{#if members.length === 0}
|
||||
<EmptyState title="暂无成员" description="使用上方表单按飞书 open_id 添加成员。" />
|
||||
{:else}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>用户</th>
|
||||
<th>open_id</th>
|
||||
<th>组织角色</th>
|
||||
<th>加入时间</th>
|
||||
<th></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each members as m}
|
||||
<tr>
|
||||
<td>
|
||||
<div class="flex items-center gap-2.5">
|
||||
{#if m.avatarUrl}
|
||||
<img src={m.avatarUrl} alt="" class="h-7 w-7 border border-surface-300 object-cover" />
|
||||
{:else}
|
||||
<div
|
||||
class="flex h-7 w-7 items-center justify-center border border-primary-300 bg-primary-100 text-xs font-semibold text-primary-800"
|
||||
>
|
||||
{m.displayName.slice(0, 1)}
|
||||
</div>
|
||||
{/if}
|
||||
<span class="font-medium">{m.displayName}</span>
|
||||
</div>
|
||||
</td>
|
||||
<td class="font-mono text-xs text-surface-700">{m.feishuOpenId}</td>
|
||||
<td class="min-w-36">
|
||||
<SelectField
|
||||
items={roleItems}
|
||||
value={m.role}
|
||||
onchange={(role) => {
|
||||
if (role !== m.role) changeRole(m, role);
|
||||
}}
|
||||
/>
|
||||
</td>
|
||||
<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
|
||||
<td class="text-right">
|
||||
<button class="saas-btn-danger py-1! text-sm" onclick={() => revoke(m)}>移除</button>
|
||||
</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{/if}
|
||||
<p class="border-t border-surface-300 px-5 py-3 text-xs text-surface-600">
|
||||
组织角色控制后台访问；项目级权限由「项目」页团队授权（{permHint}）决定。
|
||||
</p>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,205 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
|
||||
import { session } from '$lib/session';
|
||||
import FolderTree from '$lib/components/FolderTree.svelte';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import EmptyState from '$lib/components/EmptyState.svelte';
|
||||
import { Label } from 'bits-ui';
|
||||
import Modal from '$lib/components/Modal.svelte';
|
||||
import SelectField from '$lib/components/SelectField.svelte';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
const org = $derived(
|
||||
($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null,
|
||||
);
|
||||
const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));
|
||||
|
||||
let data = $state<ExplorerData | null>(null);
|
||||
let myProjects = $state<ExplorerProject[] | null>(null);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let showFolderModal = $state(false);
|
||||
let folderName = $state('');
|
||||
let folderParent = $state('');
|
||||
|
||||
let showProjectModal = $state(false);
|
||||
let projectName = $state('');
|
||||
let projectFolder = $state('');
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
if (isAdmin) {
|
||||
data = await api.explorer(slug);
|
||||
myProjects = null;
|
||||
} else {
|
||||
myProjects = (await api.myProjects(slug)).projects;
|
||||
data = null;
|
||||
}
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function createFolder() {
|
||||
if (!folderName.trim()) return;
|
||||
try {
|
||||
await api.createFolder(slug, {
|
||||
name: folderName.trim(),
|
||||
...(folderParent ? { parentId: folderParent } : {}),
|
||||
});
|
||||
folderName = '';
|
||||
folderParent = '';
|
||||
showFolderModal = false;
|
||||
await load();
|
||||
toastSuccess('文件夹已创建');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function createProject() {
|
||||
if (!projectName.trim()) return;
|
||||
try {
|
||||
const res = await api.createProject(slug, {
|
||||
name: projectName.trim(),
|
||||
...(projectFolder ? { folderId: projectFolder } : {}),
|
||||
});
|
||||
projectName = '';
|
||||
projectFolder = '';
|
||||
showProjectModal = false;
|
||||
window.location.href = `/admin/org/${slug}/projects/${res.id}`;
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
function folderPath(f: ExplorerFolder): string {
|
||||
if (!data) return f.name;
|
||||
const parts: string[] = [f.name];
|
||||
let cur: ExplorerFolder | undefined = f;
|
||||
while (cur?.parentId) {
|
||||
const parent = data.folders.find((x) => x.id === cur!.parentId);
|
||||
if (!parent) break;
|
||||
parts.unshift(parent.name);
|
||||
cur = parent;
|
||||
}
|
||||
return parts.join(' / ');
|
||||
}
|
||||
|
||||
function folderItems() {
|
||||
if (!data) return [{ value: '', label: '（根）' }];
|
||||
return [{ value: '', label: '（根）' }, ...data.folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug && org) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else if isAdmin && data}
|
||||
<PageHeader title="项目" description="文件夹是透明组织节点；项目是权限边界。">
|
||||
{#snippet actions()}
|
||||
<button class="saas-btn-secondary" onclick={() => (showFolderModal = true)}>新建文件夹</button>
|
||||
<button class="saas-btn-primary" onclick={() => (showProjectModal = true)}>新建项目</button>
|
||||
{/snippet}
|
||||
</PageHeader>
|
||||
|
||||
<div class="saas-card p-2 sm:p-3">
|
||||
{#if data.projects.filter((p) => !p.folderId).length === 0 && data.folders.filter((f) => !f.parentId).length === 0}
|
||||
<EmptyState title="暂无项目" description="新建文件夹或项目，开始组织你的教研资产。" />
|
||||
{:else}
|
||||
<FolderTree folders={data.folders} projects={data.projects} parentId={null} {slug} />
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
<Modal bind:open={showFolderModal} title="新建文件夹">
|
||||
<Label.Root class="saas-label" for="folder-name">名称</Label.Root>
|
||||
<input
|
||||
id="folder-name"
|
||||
class="saas-input mb-4"
|
||||
bind:value={folderName}
|
||||
onkeydown={(e) => {
|
||||
if (e.key === 'Enter') createFolder();
|
||||
}}
|
||||
/>
|
||||
{#if data && data.folders.length > 0}
|
||||
<p class="saas-label">父文件夹（可选）</p>
|
||||
<div class="mb-4">
|
||||
<SelectField items={folderItems()} bind:value={folderParent} />
|
||||
</div>
|
||||
{/if}
|
||||
<div class="flex justify-end gap-2">
|
||||
<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
|
||||
<button class="saas-btn-primary" onclick={createFolder}>创建</button>
|
||||
</div>
|
||||
</Modal>
|
||||
|
||||
<Modal bind:open={showProjectModal} title="新建项目">
|
||||
<Label.Root class="saas-label" for="project-name">项目名</Label.Root>
|
||||
<input
|
||||
id="project-name"
|
||||
class="saas-input mb-4"
|
||||
bind:value={projectName}
|
||||
onkeydown={(e) => {
|
||||
if (e.key === 'Enter') createProject();
|
||||
}}
|
||||
/>
|
||||
{#if data && data.folders.length > 0}
|
||||
<p class="saas-label">文件夹（可选）</p>
|
||||
<div class="mb-4">
|
||||
<SelectField items={folderItems()} bind:value={projectFolder} />
|
||||
</div>
|
||||
{/if}
|
||||
<div class="flex justify-end gap-2">
|
||||
<button class="saas-btn-ghost" onclick={() => (showProjectModal = false)}>取消</button>
|
||||
<button class="saas-btn-primary" onclick={createProject}>创建</button>
|
||||
</div>
|
||||
</Modal>
|
||||
{:else if myProjects !== null}
|
||||
<PageHeader title="我的项目" description="你拥有访问授权的项目。">
|
||||
{#snippet actions()}
|
||||
<span class="saas-badge-neutral">仅显示已授权项目</span>
|
||||
{/snippet}
|
||||
</PageHeader>
|
||||
|
||||
<div class="saas-card overflow-hidden">
|
||||
{#if myProjects.length === 0}
|
||||
<EmptyState title="暂无可访问项目" description="当团队被授予项目访问权限时，项目会出现在这里。" />
|
||||
{:else}
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>项目</th>
|
||||
<th>飞书群</th>
|
||||
<th>创建时间</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each myProjects as p}
|
||||
<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
|
||||
<td class="font-medium">{p.name}</td>
|
||||
<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
|
||||
<td class="text-surface-700">{fmtDate(p.createdAt)}</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
</div>
|
||||
{:else}
|
||||
<EmptyState title="项目数据不可用" description="无法加载项目列表。" />
|
||||
{/if}
|
||||
@@ -0,0 +1,304 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import {
|
||||
api,
|
||||
type ProjectDetail,
|
||||
type TeamAccessEntry,
|
||||
type TeamRow,
|
||||
type SessionSummary,
|
||||
type ExplorerData,
|
||||
} from '$lib/api';
|
||||
import { fmtDate, permissionRoleLabel } from '$lib/format';
|
||||
import { PERMISSION_ROLES, PERMISSION_ROLE_LABELS } from '$lib/constants';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import EmptyState from '$lib/components/EmptyState.svelte';
|
||||
import SelectField from '$lib/components/SelectField.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
const projectId = $derived(page.params.projectId ?? '');
|
||||
const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
|
||||
const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
|
||||
|
||||
let proj = $state<ProjectDetail | null>(null);
|
||||
let access = $state<TeamAccessEntry[]>([]);
|
||||
let sessions = $state<SessionSummary[]>([]);
|
||||
let teams = $state<TeamRow[]>([]);
|
||||
let explorer = $state<ExplorerData | null>(null);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let grantTeam = $state('');
|
||||
let grantRole = $state<string>('EDIT');
|
||||
let moveFolder = $state('');
|
||||
|
||||
const actorIsOrgAdmin = $derived(proj?.actorIsOrgAdmin ?? false);
|
||||
const actorCanManage = $derived(proj?.actorCanManageProject ?? false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
// Project detail + team-access list are gated to project read/oversight.
|
||||
const [p, a] = await Promise.all([api.project(slug, projectId), api.teamAccess(slug, projectId)]);
|
||||
proj = p;
|
||||
access = a.access;
|
||||
// Team list is needed for grant UI whenever the actor has project MANAGE
|
||||
// (org admin or member). Sessions/explorer stay org-admin oversight only.
|
||||
const needTeams = p.actorIsOrgAdmin === true || p.actorCanManageProject === true;
|
||||
const [s, t, e] = await Promise.all([
|
||||
p.actorIsOrgAdmin ? api.sessions(slug, projectId) : Promise.resolve({ sessions: [] as SessionSummary[] }),
|
||||
needTeams ? api.teams(slug) : Promise.resolve({ teams: [] as TeamRow[] }),
|
||||
p.actorIsOrgAdmin ? api.explorer(slug) : Promise.resolve(null as ExplorerData | null),
|
||||
]);
|
||||
sessions = s.sessions;
|
||||
teams = t.teams;
|
||||
explorer = e;
|
||||
if (p.actorIsOrgAdmin) {
|
||||
moveFolder = p.folderId ?? '';
|
||||
}
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function rename() {
|
||||
if (!proj) return;
|
||||
const name = prompt('新名称', proj.name);
|
||||
if (!name) return;
|
||||
try {
|
||||
await api.renameProject(slug, projectId, name);
|
||||
await load();
|
||||
toastSuccess('已重命名');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function archiveBinding() {
|
||||
if (!confirm('解绑当前飞书群? 用户将无法通过该群触发智能体。')) return;
|
||||
try {
|
||||
await api.archiveBinding(slug, projectId);
|
||||
await load();
|
||||
toastSuccess('已解绑飞书群');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function archiveProject() {
|
||||
if (!confirm(`归档项目 ${proj?.name}?`)) return;
|
||||
try {
|
||||
await api.archiveProject(slug, projectId);
|
||||
window.location.href = `/admin/org/${slug}/projects`;
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function move() {
|
||||
try {
|
||||
await api.moveProject(slug, projectId, moveFolder || null);
|
||||
await load();
|
||||
toastSuccess('已移动');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function grant() {
|
||||
if (!grantTeam) return;
|
||||
try {
|
||||
await api.grantTeamAccess(slug, projectId, { teamId: grantTeam, role: grantRole });
|
||||
grantTeam = '';
|
||||
await load();
|
||||
toastSuccess('已授权');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function revoke(t: TeamAccessEntry) {
|
||||
if (!confirm(`撤销 ${t.teamName} 对此项目的授权?`)) return;
|
||||
try {
|
||||
await api.revokeTeamAccess(slug, projectId, t.teamId);
|
||||
await load();
|
||||
toastSuccess('已撤销授权');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
function folderItems() {
|
||||
const items = [{ value: '', label: '（根）' }];
|
||||
if (!explorer) return items;
|
||||
return [...items, ...explorer.folders.map((f) => ({ value: f.id, label: f.name }))];
|
||||
}
|
||||
|
||||
function teamItems() {
|
||||
return [{ value: '', label: '选择团队…' }, ...teams.map((t) => ({ value: t.id, label: `${t.name}（${t.slug}）` }))];
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug && projectId) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else if proj}
|
||||
<div class="mb-2">
|
||||
<a
|
||||
href={`/admin/org/${slug}/projects`}
|
||||
class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
|
||||
>
|
||||
← 返回项目列表
|
||||
</a>
|
||||
</div>
|
||||
|
||||
{@const detail = proj}
|
||||
<PageHeader title={detail.name} description={`项目是权限边界；通过团队授予 ${roleChain}。`}>
|
||||
{#snippet actions()}
|
||||
{#if actorIsOrgAdmin}
|
||||
<button class="saas-btn-secondary py-1.5! text-sm" onclick={rename}>重命名</button>
|
||||
{#if detail.binding}
|
||||
<button class="saas-btn-secondary py-1.5! text-sm" onclick={archiveBinding}>解绑飞书群</button>
|
||||
{/if}
|
||||
<button class="saas-btn-danger py-1.5! text-sm" onclick={archiveProject}>归档</button>
|
||||
{/if}
|
||||
{/snippet}
|
||||
</PageHeader>
|
||||
|
||||
<div class="saas-card-pad mb-6">
|
||||
<dl class="grid gap-x-8 gap-y-3 text-sm sm:grid-cols-2">
|
||||
<div>
|
||||
<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">工作区路径</dt>
|
||||
<dd class="mt-0.5 break-all font-mono text-xs text-surface-700">{proj.workspaceDir}</dd>
|
||||
</div>
|
||||
<div>
|
||||
<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建者</dt>
|
||||
<dd class="mt-0.5 text-surface-800">
|
||||
{proj.createdBy ? `${proj.createdBy.displayName} (${proj.createdBy.feishuOpenId})` : '—'}
|
||||
</dd>
|
||||
</div>
|
||||
<div>
|
||||
<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">文件夹</dt>
|
||||
<dd class="mt-0.5 text-surface-800">{proj.folder ? proj.folder.name : '（根）'}</dd>
|
||||
</div>
|
||||
<div>
|
||||
<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">飞书群</dt>
|
||||
<dd class="mt-0.5 text-surface-800">
|
||||
{#if proj.binding}
|
||||
<span class="saas-badge-success mr-1">已绑定</span>
|
||||
<span class="font-mono text-xs">群 {proj.binding.chatId}</span>
|
||||
<span class="text-surface-600"> · {fmtDate(proj.binding.createdAt)}</span>
|
||||
{:else}
|
||||
<span class="saas-badge-neutral">未绑定</span>
|
||||
{/if}
|
||||
</dd>
|
||||
</div>
|
||||
<div>
|
||||
<dt class="text-xs font-medium uppercase tracking-wide text-surface-600">创建时间</dt>
|
||||
<dd class="mt-0.5 text-surface-800">{fmtDate(proj.createdAt)}</dd>
|
||||
</div>
|
||||
</dl>
|
||||
|
||||
{#if explorer}
|
||||
<div class="mt-5 flex flex-wrap items-end gap-2 border-t border-surface-100 pt-4">
|
||||
<div class="min-w-48 flex-1">
|
||||
<p class="saas-label">移动到文件夹</p>
|
||||
<SelectField items={folderItems()} bind:value={moveFolder} />
|
||||
</div>
|
||||
<button class="saas-btn-secondary" onclick={move}>移动</button>
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
<div class="saas-card-pad mb-6">
|
||||
<h3 class="saas-section-title mb-1">团队授权</h3>
|
||||
<p class="saas-muted mb-4">通过团队授权项目访问。一项目可授多团队，一团队可访问多项目。</p>
|
||||
|
||||
{#if actorCanManage}
|
||||
<div class="mb-4 grid gap-2 sm:grid-cols-[1fr_10rem_auto]">
|
||||
<SelectField items={teamItems()} bind:value={grantTeam} />
|
||||
<SelectField items={roleItems} bind:value={grantRole} />
|
||||
<button class="saas-btn-primary" onclick={grant}>授权</button>
|
||||
</div>
|
||||
{:else}
|
||||
<p class="mb-4 text-xs text-surface-600">需要项目 MANAGE 授权才能增删团队访问。</p>
|
||||
{/if}
|
||||
|
||||
{#if access.length === 0}
|
||||
<EmptyState title="暂无团队授权" description="选择团队并授予角色以开放项目访问。" />
|
||||
{:else}
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>团队</th>
|
||||
<th>标识</th>
|
||||
<th>角色</th>
|
||||
<th></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each access as g}
|
||||
<tr>
|
||||
<td class="font-medium">{g.teamName}</td>
|
||||
<td class="font-mono text-xs">/{g.teamSlug}</td>
|
||||
<td><span class="saas-badge-primary">{permissionRoleLabel(g.role)}</span></td>
|
||||
<td class="text-right">
|
||||
{#if actorCanManage}
|
||||
<button class="saas-btn-danger py-1! text-xs" onclick={() => revoke(g)}>撤销</button>
|
||||
{:else}
|
||||
<span class="text-xs text-surface-500">—</span>
|
||||
{/if}
|
||||
</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
{#if actorIsOrgAdmin}
|
||||
<div class="saas-card overflow-hidden">
|
||||
<div class="border-b border-surface-200 px-5 py-3">
|
||||
<h3 class="text-sm font-semibold">智能体会话</h3>
|
||||
</div>
|
||||
{#if sessions.length === 0}
|
||||
<EmptyState title="暂无会话" description="飞书侧触发智能体后会显示在此。" />
|
||||
{:else}
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>供应方 / 角色</th>
|
||||
<th>模型</th>
|
||||
<th>运行次数</th>
|
||||
<th>更新</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each sessions as s}
|
||||
<tr>
|
||||
<td class="font-mono text-xs">{s.provider} / {s.roleId}</td>
|
||||
<td class="font-mono text-xs">{s.model}</td>
|
||||
<td class="tabular-nums">{s.runCount}</td>
|
||||
<td class="text-surface-700">{fmtDate(s.updatedAt)}</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
</div>
|
||||
{/if}
|
||||
{:else}
|
||||
<div class="saas-empty">
|
||||
<p class="text-sm text-surface-600">项目数据不可用</p>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,169 @@
|
||||
<script lang="ts">
|
||||
import { page } from '$app/state';
|
||||
import { api, type ProviderConnectionRow } from '$lib/api';
|
||||
import { fmtDate, providerModeLabel } from '$lib/format';
|
||||
import { Label } from 'bits-ui';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
|
||||
let connections = $state<ProviderConnectionRow[]>([]);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let providerId = $state('');
|
||||
let baseUrl = $state('');
|
||||
let authToken = $state('');
|
||||
let anthropicApiKey = $state('');
|
||||
let saving = $state(false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
const res = await api.providerConnections(slug);
|
||||
connections = res.connections;
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
function startRotate(row: ProviderConnectionRow) {
|
||||
providerId = row.providerId;
|
||||
baseUrl = '';
|
||||
authToken = '';
|
||||
anthropicApiKey = '';
|
||||
}
|
||||
|
||||
function resetForm() {
|
||||
providerId = '';
|
||||
baseUrl = '';
|
||||
authToken = '';
|
||||
anthropicApiKey = '';
|
||||
}
|
||||
|
||||
async function save() {
|
||||
const id = providerId.trim();
|
||||
if (id === '') {
|
||||
toastError('请填写供应方 ID');
|
||||
return;
|
||||
}
|
||||
const url = baseUrl.trim();
|
||||
const token = authToken.trim();
|
||||
if (url === '' || token === '') {
|
||||
toastError('接口地址与访问令牌均为必填');
|
||||
return;
|
||||
}
|
||||
saving = true;
|
||||
const body: { baseUrl: string; authToken: string; anthropicApiKey?: string } = {
|
||||
baseUrl: url,
|
||||
authToken: token,
|
||||
};
|
||||
const key = anthropicApiKey.trim();
|
||||
if (key !== '') body.anthropicApiKey = key;
|
||||
try {
|
||||
await api.rotateProviderConnection(slug, id, body);
|
||||
toastSuccess('凭据已轮换');
|
||||
resetForm();
|
||||
await load();
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
saving = false;
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
<PageHeader
|
||||
title="模型供应方"
|
||||
description="本组织的模型供应方连接。BYOK 由组织所有者/管理员轮换；平台托管连接由平台管理员配置。凭据按组织隔离，缺失或校验失败即拒绝运行（fail-closed）。"
|
||||
/>
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else}
|
||||
<div class="saas-card overflow-hidden mb-6">
|
||||
<div class="border-b border-surface-200 px-5 py-3">
|
||||
<h3 class="text-sm font-semibold text-surface-800">连接</h3>
|
||||
</div>
|
||||
{#if connections.length === 0}
|
||||
<div class="saas-empty"><p class="text-sm text-surface-600">尚无供应方连接</p></div>
|
||||
{:else}
|
||||
<div class="overflow-x-auto">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>供应方</th>
|
||||
<th>凭据模式</th>
|
||||
<th>状态</th>
|
||||
<th>版本</th>
|
||||
<th>更新于</th>
|
||||
<th></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each connections as row}
|
||||
<tr>
|
||||
<td class="font-mono text-sm">{row.providerId}</td>
|
||||
<td>{providerModeLabel(row.mode)}</td>
|
||||
<td>{row.status}</td>
|
||||
<td class="tabular-nums">{row.activeVersion ?? '—'}</td>
|
||||
<td class="text-surface-600">{fmtDate(row.updatedAt)}</td>
|
||||
<td>
|
||||
{#if row.mode === 'BYOK'}
|
||||
<button class="saas-btn-ghost px-2! py-1! text-xs" onclick={() => startRotate(row)}>轮换</button>
|
||||
{:else}
|
||||
<span class="text-xs text-surface-500">平台管理</span>
|
||||
{/if}
|
||||
</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
{/if}
|
||||
</div>
|
||||
|
||||
<div class="saas-card-pad">
|
||||
<h3 class="saas-section-title mb-1">轮换 BYOK 凭据</h3>
|
||||
<p class="saas-muted mb-4">
|
||||
密钥仅写入新版本，旧版本归档；保存时需重新填写接口地址与访问令牌。平台托管连接不在此处管理。
|
||||
</p>
|
||||
<div class="grid gap-5">
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="provider-id">供应方 ID</Label.Root>
|
||||
<input id="provider-id" class="saas-input font-mono text-sm" bind:value={providerId} placeholder="openrouter" />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="base-url">接口地址</Label.Root>
|
||||
<input id="base-url" class="saas-input" placeholder="https://openrouter.ai/api" bind:value={baseUrl} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="auth-token">访问令牌</Label.Root>
|
||||
<input id="auth-token" class="saas-input" type="password" bind:value={authToken} />
|
||||
</div>
|
||||
<div>
|
||||
<Label.Root class="saas-label" for="anthropic-key">Anthropic API Key（可选）</Label.Root>
|
||||
<input id="anthropic-key" class="saas-input" type="password" bind:value={anthropicApiKey} />
|
||||
</div>
|
||||
</div>
|
||||
<div class="mt-6 flex items-center gap-3 border-t border-surface-100 pt-4">
|
||||
<div class="flex-1"></div>
|
||||
<button class="saas-btn-ghost" onclick={resetForm} disabled={saving}>清空</button>
|
||||
<button class="saas-btn-primary" onclick={save} disabled={saving}>
|
||||
{saving ? '保存中…' : '保存'}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
{/if}
|
||||
@@ -0,0 +1,233 @@
|
||||
<script lang="ts">
|
||||
import { Collapsible } from 'bits-ui';
|
||||
import { page } from '$app/state';
|
||||
import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
|
||||
import { fmtDate } from '$lib/format';
|
||||
import PageHeader from '$lib/components/PageHeader.svelte';
|
||||
import LoadingState from '$lib/components/LoadingState.svelte';
|
||||
import ErrorBanner from '$lib/components/ErrorBanner.svelte';
|
||||
import EmptyState from '$lib/components/EmptyState.svelte';
|
||||
import { toastError, toastSuccess } from '$lib/toast';
|
||||
|
||||
const slug = $derived(page.params.slug ?? '');
|
||||
|
||||
let teams = $state<TeamRow[]>([]);
|
||||
let loading = $state(true);
|
||||
let error = $state<string | null>(null);
|
||||
|
||||
let newSlug = $state('');
|
||||
let newName = $state('');
|
||||
let newDesc = $state('');
|
||||
let adding = $state(false);
|
||||
|
||||
let expandedId = $state<string | null>(null);
|
||||
let teamMembers = $state<TeamMemberRow[]>([]);
|
||||
let memberInput = $state('');
|
||||
let loadingMembers = $state(false);
|
||||
|
||||
async function load() {
|
||||
loading = true;
|
||||
error = null;
|
||||
try {
|
||||
const res = await api.teams(slug);
|
||||
teams = res.teams;
|
||||
} catch (err) {
|
||||
error = err instanceof Error ? err.message : String(err);
|
||||
} finally {
|
||||
loading = false;
|
||||
}
|
||||
}
|
||||
|
||||
const SLUG_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
|
||||
|
||||
async function createTeam() {
|
||||
if (!newSlug.trim() || !newName.trim()) return;
|
||||
const teamSlug = newSlug.trim().toLowerCase();
|
||||
if (!SLUG_RE.test(teamSlug)) {
|
||||
toastError('标识须为小写字母数字，可用连字符连接');
|
||||
return;
|
||||
}
|
||||
adding = true;
|
||||
try {
|
||||
await api.createTeam(slug, {
|
||||
slug: teamSlug,
|
||||
name: newName.trim(),
|
||||
...(newDesc.trim() ? { description: newDesc.trim() } : {}),
|
||||
});
|
||||
newSlug = '';
|
||||
newName = '';
|
||||
newDesc = '';
|
||||
await load();
|
||||
toastSuccess('团队已创建');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
adding = false;
|
||||
}
|
||||
}
|
||||
|
||||
async function archiveTeam(t: TeamRow) {
|
||||
if (!confirm(`归档团队 ${t.name}? 归档后该团队不再解析为项目授权主体。`)) return;
|
||||
try {
|
||||
await api.archiveTeam(slug, t.id);
|
||||
if (expandedId === t.id) expandedId = null;
|
||||
await load();
|
||||
toastSuccess('团队已归档');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function openMembers(t: TeamRow) {
|
||||
if (expandedId === t.id) return;
|
||||
expandedId = t.id;
|
||||
loadingMembers = true;
|
||||
memberInput = '';
|
||||
try {
|
||||
const res = await api.teamMembers(slug, t.id);
|
||||
teamMembers = res.members;
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
} finally {
|
||||
loadingMembers = false;
|
||||
}
|
||||
}
|
||||
|
||||
function onExpandChange(t: TeamRow, open: boolean) {
|
||||
if (open) void openMembers(t);
|
||||
else if (expandedId === t.id) expandedId = null;
|
||||
}
|
||||
|
||||
async function addMember(t: TeamRow) {
|
||||
if (!memberInput.trim()) return;
|
||||
const v = memberInput.trim();
|
||||
try {
|
||||
await api.addTeamMember(slug, t.id, v.startsWith('ou') ? { feishuOpenId: v } : { userId: v });
|
||||
memberInput = '';
|
||||
const res = await api.teamMembers(slug, t.id);
|
||||
teamMembers = res.members;
|
||||
await load();
|
||||
toastSuccess('已加入团队');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
async function revokeMember(t: TeamRow, m: TeamMemberRow) {
|
||||
if (!confirm(`将 ${m.displayName} 移出团队 ${t.name}?`)) return;
|
||||
try {
|
||||
await api.revokeTeamMember(slug, t.id, m.userId);
|
||||
const res = await api.teamMembers(slug, t.id);
|
||||
teamMembers = res.members;
|
||||
await load();
|
||||
toastSuccess('已移出团队');
|
||||
} catch (err) {
|
||||
toastError(err instanceof Error ? err.message : String(err));
|
||||
}
|
||||
}
|
||||
|
||||
$effect(() => {
|
||||
if (slug) load();
|
||||
});
|
||||
</script>
|
||||
|
||||
<PageHeader title="团队" description="团队是项目授权主体，可被授予只读、编辑或管理权限。" />
|
||||
|
||||
{#if loading}
|
||||
<LoadingState />
|
||||
{:else if error}
|
||||
<ErrorBanner message={error} onretry={load} />
|
||||
{:else}
|
||||
<div class="saas-card-pad mb-6">
|
||||
<h2 class="saas-section-title mb-4">新建团队</h2>
|
||||
<div class="grid gap-3 md:grid-cols-[1fr_1fr_1.2fr_auto]">
|
||||
<input class="saas-input" placeholder="标识（如 math-g7）" bind:value={newSlug} />
|
||||
<input class="saas-input" placeholder="名称" bind:value={newName} />
|
||||
<input class="saas-input" placeholder="描述（可选）" bind:value={newDesc} />
|
||||
<button class="saas-btn-primary" onclick={createTeam} disabled={adding}>新建</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
{#if teams.length === 0}
|
||||
<div class="saas-card">
|
||||
<EmptyState title="暂无团队" description="创建团队后，可在项目页授权项目访问。" />
|
||||
</div>
|
||||
{:else}
|
||||
<div class="space-y-3">
|
||||
{#each teams as t (t.id)}
|
||||
<Collapsible.Root
|
||||
class="saas-card p-5"
|
||||
open={expandedId === t.id}
|
||||
onOpenChange={(open) => onExpandChange(t, open)}
|
||||
>
|
||||
<div class="flex flex-wrap items-center gap-2.5">
|
||||
<span class="text-base font-semibold text-surface-900">{t.name}</span>
|
||||
<span class="font-mono text-xs text-surface-600">/{t.slug}</span>
|
||||
<span class="saas-badge-neutral">{t.memberCount} 成员</span>
|
||||
<div class="ml-auto flex flex-wrap gap-2">
|
||||
<Collapsible.Trigger class="saas-btn-secondary py-1.5! text-sm">
|
||||
{expandedId === t.id ? '收起' : '管理成员'}
|
||||
</Collapsible.Trigger>
|
||||
<button type="button" class="saas-btn-danger py-1.5! text-sm" onclick={() => archiveTeam(t)}>
|
||||
归档
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
{#if t.description}
|
||||
<p class="mt-1.5 text-sm text-surface-700">{t.description}</p>
|
||||
{/if}
|
||||
<p class="mt-1 text-xs text-surface-600">创建于 {fmtDate(t.createdAt)}</p>
|
||||
|
||||
<Collapsible.Content>
|
||||
<div class="mt-4 border-t border-surface-200 pt-4">
|
||||
{#if loadingMembers && expandedId === t.id}
|
||||
<p class="text-sm text-surface-600">加载中…</p>
|
||||
{:else if expandedId === t.id}
|
||||
<div class="mb-4 flex gap-2">
|
||||
<input
|
||||
class="saas-input"
|
||||
placeholder="飞书 open_id 或用户 id"
|
||||
bind:value={memberInput}
|
||||
onkeydown={(e) => {
|
||||
if (e.key === 'Enter') addMember(t);
|
||||
}}
|
||||
/>
|
||||
<button class="saas-btn-secondary shrink-0" onclick={() => addMember(t)}>加入</button>
|
||||
</div>
|
||||
{#if teamMembers.length === 0}
|
||||
<p class="py-3 text-center text-sm text-surface-600">团队暂无成员</p>
|
||||
{:else}
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>成员</th>
|
||||
<th>open_id</th>
|
||||
<th>加入时间</th>
|
||||
<th></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{#each teamMembers as m}
|
||||
<tr>
|
||||
<td class="font-medium">{m.displayName}</td>
|
||||
<td class="font-mono text-xs">{m.feishuOpenId}</td>
|
||||
<td class="text-surface-700">{fmtDate(m.createdAt)}</td>
|
||||
<td class="text-right">
|
||||
<button class="saas-btn-danger py-1! text-xs" onclick={() => revokeMember(t, m)}>
|
||||
移除
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
{/each}
|
||||
</tbody>
|
||||
</table>
|
||||
{/if}
|
||||
{/if}
|
||||
</div>
|
||||
</Collapsible.Content>
|
||||
</Collapsible.Root>
|
||||
{/each}
|
||||
</div>
|
||||
{/if}
|
||||
<p class="mt-4 text-xs text-surface-600">归档团队会同步撤销其活跃的项目授权。</p>
|
||||
{/if}
|
||||
@@ -0,0 +1,692 @@
|
||||
@import 'tailwindcss';
|
||||
|
||||
@import '@skeletonlabs/skeleton';
|
||||
@import '@skeletonlabs/skeleton/themes/hamlindigo';
|
||||
|
||||
@source './**/*.{html,js,svelte,ts}';
|
||||
@source '../lib/**/*.{html,js,svelte,ts}';
|
||||
|
||||
/* Flat industrial: zero radius, higher-contrast surfaces, CJK-first type */
|
||||
@theme {
|
||||
--font-sans:
|
||||
'Noto Sans SC', 'PingFang SC', 'Hiragino Sans GB', 'Microsoft YaHei', 'Inter', ui-sans-serif, system-ui,
|
||||
-apple-system, 'Segoe UI', sans-serif;
|
||||
--font-mono: 'JetBrains Mono', ui-monospace, 'SF Mono', Menlo, Consolas, monospace;
|
||||
|
||||
--radius-none: 0;
|
||||
--radius-sm: 0;
|
||||
--radius-md: 0;
|
||||
--radius-lg: 0;
|
||||
--radius-xl: 0;
|
||||
--radius-2xl: 0;
|
||||
--radius-3xl: 0;
|
||||
--radius-full: 0;
|
||||
--radius: 0;
|
||||
}
|
||||
|
||||
@layer base {
|
||||
html {
|
||||
height: 100%;
|
||||
-webkit-font-smoothing: antialiased;
|
||||
-moz-osx-font-smoothing: grayscale;
|
||||
text-rendering: optimizeLegibility;
|
||||
font-feature-settings:
|
||||
'kern' 1,
|
||||
'liga' 1;
|
||||
/* Prefer readable CJK metrics over Latin optical sizing */
|
||||
text-size-adjust: 100%;
|
||||
}
|
||||
|
||||
body {
|
||||
min-height: 100%;
|
||||
font-family: var(--font-sans);
|
||||
font-size: 15px;
|
||||
line-height: 1.7;
|
||||
letter-spacing: 0.01em;
|
||||
/* Slightly cooler industrial surface */
|
||||
background: var(--color-surface-100);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
font-variant-east-asian: proportional-width;
|
||||
}
|
||||
|
||||
/* CJK headings: no negative tracking, breathing line-height */
|
||||
h1,
|
||||
h2,
|
||||
h3,
|
||||
h4,
|
||||
h5,
|
||||
h6 {
|
||||
font-weight: 600;
|
||||
line-height: 1.45;
|
||||
letter-spacing: 0;
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
p {
|
||||
line-height: 1.75;
|
||||
}
|
||||
|
||||
/* Harder focus ring for industrial UI */
|
||||
:focus-visible {
|
||||
outline: 2px solid var(--color-primary-600);
|
||||
outline-offset: 2px;
|
||||
}
|
||||
|
||||
::selection {
|
||||
background: color-mix(in oklab, var(--color-primary-600) 35%, transparent);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
/* Tables: high-contrast grid, flat */
|
||||
table.data-table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.6;
|
||||
}
|
||||
|
||||
table.data-table thead th {
|
||||
padding: 0.625rem 0.75rem;
|
||||
text-align: left;
|
||||
font-weight: 600;
|
||||
color: var(--color-surface-700);
|
||||
background: var(--color-surface-100);
|
||||
border-bottom: 1px solid var(--color-surface-300);
|
||||
white-space: nowrap;
|
||||
letter-spacing: 0.02em;
|
||||
}
|
||||
|
||||
table.data-table tbody td {
|
||||
padding: 0.75rem;
|
||||
border-bottom: 1px solid var(--color-surface-200);
|
||||
vertical-align: middle;
|
||||
color: var(--color-surface-900);
|
||||
}
|
||||
|
||||
table.data-table tbody tr:hover td {
|
||||
background: var(--color-surface-100);
|
||||
}
|
||||
|
||||
table.data-table tbody tr:last-child td {
|
||||
border-bottom: none;
|
||||
}
|
||||
}
|
||||
|
||||
@layer components {
|
||||
.saas-card {
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-50);
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
.saas-card-pad {
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-50);
|
||||
box-shadow: none;
|
||||
padding: 1.25rem;
|
||||
}
|
||||
|
||||
.saas-page-title {
|
||||
font-size: 1.375rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 700;
|
||||
letter-spacing: 0;
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
.saas-section-title {
|
||||
font-size: 1rem;
|
||||
line-height: 1.5;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0;
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
.saas-muted {
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.65;
|
||||
color: var(--color-surface-700);
|
||||
}
|
||||
|
||||
.saas-label {
|
||||
display: block;
|
||||
margin-bottom: 0.375rem;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.5;
|
||||
font-weight: 600;
|
||||
color: var(--color-surface-800);
|
||||
}
|
||||
|
||||
.saas-help {
|
||||
margin-top: 0.375rem;
|
||||
font-size: 0.8125rem;
|
||||
line-height: 1.6;
|
||||
color: var(--color-surface-600);
|
||||
}
|
||||
|
||||
.saas-toolbar {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
align-items: center;
|
||||
gap: 0.75rem;
|
||||
margin-bottom: 1.5rem;
|
||||
}
|
||||
|
||||
.saas-stat {
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-50);
|
||||
padding: 1rem;
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
.saas-stat-label {
|
||||
font-size: 0.75rem;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0.04em;
|
||||
text-transform: uppercase;
|
||||
color: var(--color-surface-600);
|
||||
}
|
||||
|
||||
.saas-stat-value {
|
||||
margin-top: 0.25rem;
|
||||
font-size: 1.5rem;
|
||||
line-height: 1.3;
|
||||
font-weight: 700;
|
||||
font-variant-numeric: tabular-nums;
|
||||
letter-spacing: 0;
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
.saas-empty {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 0.5rem;
|
||||
padding: 3rem 1rem;
|
||||
text-align: center;
|
||||
line-height: 1.7;
|
||||
}
|
||||
|
||||
.saas-shell {
|
||||
display: flex;
|
||||
height: 100vh;
|
||||
overflow: hidden;
|
||||
background: var(--color-surface-100);
|
||||
}
|
||||
|
||||
.saas-sidebar {
|
||||
display: flex;
|
||||
width: 16rem;
|
||||
flex-shrink: 0;
|
||||
flex-direction: column;
|
||||
border-right: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-50);
|
||||
}
|
||||
|
||||
.saas-main {
|
||||
display: flex;
|
||||
min-width: 0;
|
||||
flex: 1;
|
||||
flex-direction: column;
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
.saas-topbar {
|
||||
display: flex;
|
||||
height: 3.5rem;
|
||||
flex-shrink: 0;
|
||||
align-items: center;
|
||||
gap: 0.75rem;
|
||||
border-bottom: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-50);
|
||||
padding: 0 1.5rem;
|
||||
/* flat: no glass */
|
||||
backdrop-filter: none;
|
||||
}
|
||||
|
||||
.saas-content {
|
||||
flex: 1;
|
||||
overflow-y: auto;
|
||||
}
|
||||
|
||||
.saas-content-inner {
|
||||
margin-inline: auto;
|
||||
width: 100%;
|
||||
max-width: 72rem;
|
||||
padding: 1.5rem;
|
||||
}
|
||||
|
||||
@media (min-width: 768px) {
|
||||
.saas-content-inner {
|
||||
padding: 2rem;
|
||||
}
|
||||
}
|
||||
|
||||
.saas-nav-item {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 0.75rem;
|
||||
border-radius: 0;
|
||||
padding: 0.5rem 0.75rem;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.5;
|
||||
font-weight: 500;
|
||||
color: var(--color-surface-700);
|
||||
border-left: 2px solid transparent;
|
||||
transition:
|
||||
color 0.1s,
|
||||
background-color 0.1s,
|
||||
border-color 0.1s;
|
||||
}
|
||||
|
||||
.saas-nav-item:hover {
|
||||
background: var(--color-surface-100);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
.saas-nav-item[data-active='true'] {
|
||||
background: var(--color-primary-50, var(--color-primary-100));
|
||||
color: var(--color-primary-800);
|
||||
border-left-color: var(--color-primary-600);
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.saas-badge {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
letter-spacing: 0.02em;
|
||||
}
|
||||
|
||||
.saas-badge-neutral {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
border: 1px solid var(--color-surface-300);
|
||||
background: var(--color-surface-100);
|
||||
color: var(--color-surface-800);
|
||||
}
|
||||
|
||||
.saas-badge-primary {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
border: 1px solid var(--color-primary-300);
|
||||
background: var(--color-primary-100);
|
||||
color: var(--color-primary-800);
|
||||
}
|
||||
|
||||
.saas-badge-success {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
border: 1px solid var(--color-success-300);
|
||||
background: var(--color-success-100);
|
||||
color: var(--color-success-800);
|
||||
}
|
||||
|
||||
.saas-badge-warning {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
border: 1px solid var(--color-warning-300);
|
||||
background: var(--color-warning-100);
|
||||
color: var(--color-warning-900);
|
||||
}
|
||||
|
||||
.saas-badge-error {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.125rem 0.5rem;
|
||||
font-size: 0.75rem;
|
||||
line-height: 1.4;
|
||||
font-weight: 600;
|
||||
border: 1px solid var(--color-error-300);
|
||||
background: var(--color-error-100);
|
||||
color: var(--color-error-800);
|
||||
}
|
||||
|
||||
.saas-input,
|
||||
.saas-select,
|
||||
.saas-textarea {
|
||||
width: 100%;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
background: var(--color-surface-50);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
padding: 0.5rem 0.75rem;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.5;
|
||||
outline: none;
|
||||
transition:
|
||||
border-color 0.1s,
|
||||
box-shadow 0.1s;
|
||||
}
|
||||
|
||||
.saas-input::placeholder,
|
||||
.saas-textarea::placeholder {
|
||||
color: var(--color-surface-500);
|
||||
}
|
||||
|
||||
.saas-input:focus,
|
||||
.saas-select:focus,
|
||||
.saas-textarea:focus {
|
||||
border-color: var(--color-primary-600);
|
||||
box-shadow: inset 0 0 0 1px var(--color-primary-600);
|
||||
}
|
||||
|
||||
.saas-textarea {
|
||||
font-family: var(--font-mono);
|
||||
line-height: 1.55;
|
||||
resize: vertical;
|
||||
}
|
||||
|
||||
.saas-select-trigger {
|
||||
display: inline-flex;
|
||||
width: 100%;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
background: var(--color-surface-50);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
padding: 0.5rem 0.75rem;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.5;
|
||||
outline: none;
|
||||
transition:
|
||||
border-color 0.1s,
|
||||
box-shadow 0.1s;
|
||||
cursor: pointer;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.saas-select-trigger:focus-visible,
|
||||
.saas-select-trigger[data-state='open'] {
|
||||
border-color: var(--color-primary-600);
|
||||
box-shadow: inset 0 0 0 1px var(--color-primary-600);
|
||||
}
|
||||
|
||||
.saas-select-trigger:disabled,
|
||||
.saas-select-trigger[data-disabled] {
|
||||
cursor: not-allowed;
|
||||
opacity: 0.55;
|
||||
}
|
||||
|
||||
.saas-select-trigger [data-placeholder] {
|
||||
color: var(--color-surface-500);
|
||||
}
|
||||
|
||||
.saas-select-content {
|
||||
z-index: 70;
|
||||
max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
|
||||
width: var(--bits-select-anchor-width);
|
||||
min-width: var(--bits-select-anchor-width);
|
||||
overflow: hidden;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
background: var(--color-surface-50);
|
||||
box-shadow: 4px 4px 0 rgb(15 23 42 / 0.12);
|
||||
outline: none;
|
||||
}
|
||||
|
||||
.saas-select-item {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
padding: 0.45rem 0.65rem;
|
||||
font-size: 0.875rem;
|
||||
line-height: 1.5;
|
||||
color: var(--color-surface-900);
|
||||
cursor: pointer;
|
||||
outline: none;
|
||||
user-select: none;
|
||||
}
|
||||
|
||||
.saas-select-item[data-highlighted] {
|
||||
background: var(--color-primary-100);
|
||||
color: var(--color-primary-900);
|
||||
}
|
||||
|
||||
.saas-select-item[data-selected] {
|
||||
color: var(--color-primary-900);
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.saas-select-item[data-disabled] {
|
||||
cursor: not-allowed;
|
||||
opacity: 0.45;
|
||||
}
|
||||
|
||||
.saas-btn-primary,
|
||||
.saas-btn-secondary,
|
||||
.saas-btn-ghost,
|
||||
.saas-btn-danger {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
gap: 0.375rem;
|
||||
border-radius: 0;
|
||||
padding: 0.5rem 0.875rem;
|
||||
font-size: 0.875rem;
|
||||
font-weight: 600;
|
||||
line-height: 1.4;
|
||||
letter-spacing: 0.01em;
|
||||
border: 1px solid transparent;
|
||||
cursor: pointer;
|
||||
transition:
|
||||
background-color 0.1s,
|
||||
color 0.1s,
|
||||
border-color 0.1s,
|
||||
opacity 0.1s;
|
||||
}
|
||||
|
||||
.saas-btn-primary:disabled,
|
||||
.saas-btn-secondary:disabled,
|
||||
.saas-btn-ghost:disabled,
|
||||
.saas-btn-danger:disabled {
|
||||
opacity: 0.55;
|
||||
cursor: not-allowed;
|
||||
}
|
||||
|
||||
.saas-btn-primary {
|
||||
background: var(--color-primary-600);
|
||||
border-color: var(--color-primary-700);
|
||||
color: var(--color-primary-contrast-500, white);
|
||||
}
|
||||
|
||||
.saas-btn-primary:hover:not(:disabled) {
|
||||
background: var(--color-primary-700);
|
||||
border-color: var(--color-primary-800);
|
||||
}
|
||||
|
||||
.saas-btn-secondary {
|
||||
background: var(--color-surface-100);
|
||||
border-color: var(--color-surface-400);
|
||||
color: var(--color-surface-900);
|
||||
}
|
||||
|
||||
.saas-btn-secondary:hover:not(:disabled) {
|
||||
background: var(--color-surface-200);
|
||||
border-color: var(--color-surface-500);
|
||||
}
|
||||
|
||||
.saas-btn-ghost {
|
||||
background: transparent;
|
||||
border-color: transparent;
|
||||
color: var(--color-surface-800);
|
||||
}
|
||||
|
||||
.saas-btn-ghost:hover:not(:disabled) {
|
||||
background: var(--color-surface-200);
|
||||
color: var(--color-surface-950, var(--color-surface-900));
|
||||
}
|
||||
|
||||
.saas-btn-danger {
|
||||
background: var(--color-error-100);
|
||||
border-color: var(--color-error-400);
|
||||
color: var(--color-error-800);
|
||||
}
|
||||
|
||||
.saas-btn-danger:hover:not(:disabled) {
|
||||
background: var(--color-error-200);
|
||||
border-color: var(--color-error-500);
|
||||
}
|
||||
|
||||
.saas-checkbox {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
width: 1.1rem;
|
||||
height: 1.1rem;
|
||||
flex-shrink: 0;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-500);
|
||||
background: var(--color-surface-50);
|
||||
color: white;
|
||||
cursor: pointer;
|
||||
transition:
|
||||
background 0.1s,
|
||||
border-color 0.1s;
|
||||
}
|
||||
|
||||
.saas-checkbox[data-state='checked'] {
|
||||
background: var(--color-primary-700);
|
||||
border-color: var(--color-primary-700);
|
||||
}
|
||||
|
||||
.saas-checkbox:focus-visible {
|
||||
outline: none;
|
||||
box-shadow:
|
||||
0 0 0 2px var(--color-surface-50),
|
||||
0 0 0 4px var(--color-primary-600);
|
||||
}
|
||||
|
||||
.saas-checkbox[data-disabled] {
|
||||
cursor: not-allowed;
|
||||
opacity: 0.5;
|
||||
}
|
||||
|
||||
/* Square industrial switch (no pill) */
|
||||
.saas-switch {
|
||||
position: relative;
|
||||
display: inline-flex;
|
||||
width: 2.5rem;
|
||||
height: 1.35rem;
|
||||
flex-shrink: 0;
|
||||
align-items: center;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-500);
|
||||
background: var(--color-surface-300);
|
||||
padding: 0.125rem;
|
||||
cursor: pointer;
|
||||
transition:
|
||||
background 0.1s,
|
||||
border-color 0.1s;
|
||||
}
|
||||
|
||||
.saas-switch[data-state='checked'] {
|
||||
background: var(--color-primary-600);
|
||||
border-color: var(--color-primary-700);
|
||||
}
|
||||
|
||||
.saas-switch:focus-visible {
|
||||
outline: none;
|
||||
box-shadow:
|
||||
0 0 0 2px var(--color-surface-50),
|
||||
0 0 0 4px var(--color-primary-600);
|
||||
}
|
||||
|
||||
.saas-switch[data-disabled] {
|
||||
cursor: not-allowed;
|
||||
opacity: 0.5;
|
||||
}
|
||||
|
||||
.saas-switch-thumb {
|
||||
display: block;
|
||||
width: 1rem;
|
||||
height: 1rem;
|
||||
border-radius: 0;
|
||||
background: white;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
box-shadow: none;
|
||||
transition: transform 0.1s;
|
||||
transform: translateX(0);
|
||||
}
|
||||
|
||||
.saas-switch[data-state='checked'] .saas-switch-thumb,
|
||||
.saas-switch-thumb[data-state='checked'] {
|
||||
transform: translateX(1.1rem);
|
||||
border-color: var(--color-primary-800);
|
||||
}
|
||||
|
||||
.saas-modal-backdrop {
|
||||
position: fixed;
|
||||
inset: 0;
|
||||
z-index: 50;
|
||||
background: rgb(2 6 23 / 0.55);
|
||||
backdrop-filter: none;
|
||||
}
|
||||
|
||||
.saas-modal {
|
||||
position: fixed;
|
||||
left: 50%;
|
||||
top: 50%;
|
||||
z-index: 51;
|
||||
width: calc(100% - 2rem);
|
||||
max-width: 28rem;
|
||||
transform: translate(-50%, -50%);
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
background: var(--color-surface-50);
|
||||
padding: 1.5rem;
|
||||
box-shadow: 6px 6px 0 rgb(15 23 42 / 0.15);
|
||||
outline: none;
|
||||
}
|
||||
|
||||
.saas-status-panel {
|
||||
display: flex;
|
||||
min-height: 100vh;
|
||||
flex-direction: column;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
background: var(--color-surface-100);
|
||||
padding: 1rem;
|
||||
}
|
||||
|
||||
.saas-status-card {
|
||||
width: 100%;
|
||||
max-width: 28rem;
|
||||
border-radius: 0;
|
||||
border: 1px solid var(--color-surface-400);
|
||||
background: var(--color-surface-50);
|
||||
padding: 2rem;
|
||||
text-align: center;
|
||||
box-shadow: 4px 4px 0 rgb(15 23 42 / 0.1);
|
||||
line-height: 1.7;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
|
||||
<rect width="32" height="32" rx="8" fill="#4F46E5"/>
|
||||
<path d="M8 10.5h7.5a3.5 3.5 0 0 1 0 7H11v4H8v-11Zm3 4.5h4.5a1.5 1.5 0 0 0 0-3H11v3Z" fill="white"/>
|
||||
<path d="M20.5 21.5c1.93 0 3.5-1.34 3.5-3s-1.57-3-3.5-3S17 16.84 17 18.5s1.57 3 3.5 3Z" fill="white" opacity=".9"/>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 353 B |
@@ -0,0 +1,3 @@
|
||||
# allow crawling everything by default
|
||||
User-agent: *
|
||||
Disallow:
|
||||
@@ -0,0 +1,18 @@
|
||||
import adapter from '@sveltejs/adapter-static';
|
||||
import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
|
||||
|
||||
/** @type {import('@sveltejs/kit').Config} */
|
||||
const config = {
|
||||
preprocess: vitePreprocess(),
|
||||
kit: {
|
||||
adapter: adapter({
|
||||
pages: 'build',
|
||||
assets: 'build',
|
||||
fallback: 'index.html',
|
||||
precompress: false,
|
||||
strict: false,
|
||||
}),
|
||||
},
|
||||
};
|
||||
|
||||
export default config;
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"extends": "./.svelte-kit/tsconfig.json",
|
||||
"compilerOptions": {
|
||||
"rewriteRelativeImportExtensions": true,
|
||||
"allowJs": true,
|
||||
"checkJs": true,
|
||||
"esModuleInterop": true,
|
||||
"forceConsistentCasingInFileNames": true,
|
||||
"resolveJsonModule": true,
|
||||
"skipLibCheck": true,
|
||||
"sourceMap": true,
|
||||
"strict": true,
|
||||
"moduleResolution": "bundler"
|
||||
}
|
||||
// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
|
||||
// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
|
||||
//
|
||||
// To make changes to top-level options such as include and exclude, we recommend extending
|
||||
// the generated config; see https://svelte.dev/docs/kit/configuration#typescript
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
import { sveltekit } from '@sveltejs/kit/vite';
|
||||
import tailwindcss from '@tailwindcss/vite';
|
||||
import { defineConfig } from 'vite';
|
||||
|
||||
export default defineConfig({
|
||||
plugins: [tailwindcss(), sveltekit()],
|
||||
server: {
|
||||
proxy: {
|
||||
'/api': 'http://127.0.0.1:8788',
|
||||
'/auth': 'http://127.0.0.1:8788',
|
||||
},
|
||||
},
|
||||
});
|
||||
@@ -11,6 +11,32 @@ See [NEW_SILO_RUNBOOK.md](NEW_SILO_RUNBOOK.md). The remainder of this document
|
||||
describes the individual installer and maintenance primitives used by the
|
||||
generated bundle.
|
||||
|
||||
## CI: roll Hub + admin SPA by fleet (`educraft` / `educraft-dev`)
|
||||
|
||||
`.gitea/workflows/deploy-admin.yml` deploys Hub releases (including the org-admin
|
||||
SPA) to the managed Alpha host via `deploy_fleet_release.sh`. Fleets share the
|
||||
host and are selected by the middle DNS label of `HUB_PUBLIC_BASE_URL`:
|
||||
|
||||
| Fleet | Domain | CI trigger |
|
||||
|-------|--------|------------|
|
||||
| **dev** | `https://<slug>.educraft-dev.paradigm-edu.net` | every push + PR (paths under `hub/`) |
|
||||
| **prod** | `https://<slug>.educraft.paradigm-edu.net` | push to `main` + tags |
|
||||
|
||||
Example prod tenant:
|
||||
`https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100`.
|
||||
|
||||
Required Gitea secret: `DEPLOY_SSH_KEY` (private key for `root@39.107.254.4`).
|
||||
Optional: `DEPLOY_HOST` / `DEPLOY_USER` / `DEPLOY_SSH_PORT` / `DEPLOY_BASE`.
|
||||
Set repository var `ALLOW_EMPTY_FLEET=1` until the first silo exists for a fleet.
|
||||
|
||||
Local dry-run against the host:
|
||||
|
||||
```sh
|
||||
CPH_FLEET=dev \
|
||||
PLATFORM_DEPLOY_SSH_KEY=$HOME/.ssh/id_ed25519 \
|
||||
bash hub/deploy/deploy_fleet_release.sh
|
||||
```
|
||||
|
||||
The supervised alpha runs one Organization per named Silo. The supported host
|
||||
has systemd, PostgreSQL, Node.js 24+, `pg_isready`, `runuser`, `setpriv`,
|
||||
bubblewrap, `socat`, `pg_dump`, `tar`, `sha256sum`, and a compatible `cph`.
|
||||
|
||||
Executable
+222
@@ -0,0 +1,222 @@
|
||||
#!/usr/bin/env bash
|
||||
# Publish one immutable Hub release (tsc + admin-web SPA) to the managed host,
|
||||
# then repoint every Silo in the chosen fleet to that release and restart it.
|
||||
#
|
||||
# Fleet is selected by the middle DNS label of each Silo's HUB_PUBLIC_BASE_URL:
|
||||
#
|
||||
# prod → https://<slug>.educraft.paradigm-edu.net
|
||||
# dev → https://<slug>.educraft-dev.paradigm-edu.net
|
||||
#
|
||||
# Example tenant (prod):
|
||||
# https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
|
||||
#
|
||||
# Configure (CI secrets / env):
|
||||
# CPH_FLEET required: dev | prod
|
||||
# PLATFORM_DEPLOY_HOST default 39.107.254.4
|
||||
# PLATFORM_DEPLOY_USER default root
|
||||
# PLATFORM_DEPLOY_SSH_KEY required (path to private key)
|
||||
# PLATFORM_DEPLOY_PORT default 22
|
||||
# PLATFORM_DEPLOY_BASE default /srv/curriculum-project-hub
|
||||
# PLATFORM_DEPLOY_RELEASE default git HEAD (must be safe for paths)
|
||||
# ALLOW_EMPTY_FLEET optional: if 1, succeed when no silo matches
|
||||
#
|
||||
# This is a code-roll for existing silos. It does not create databases, domains,
|
||||
# or Feishu apps — use new_silo.sh / apply_new_silo.sh for that.
|
||||
set -euo pipefail
|
||||
|
||||
FLEET="${CPH_FLEET:?CPH_FLEET required (dev|prod)}"
|
||||
case "$FLEET" in
|
||||
dev) FLEET_DOMAIN_SUFFIX="educraft-dev.paradigm-edu.net" ;;
|
||||
prod) FLEET_DOMAIN_SUFFIX="educraft.paradigm-edu.net" ;;
|
||||
*)
|
||||
echo "CPH_FLEET must be dev or prod, got: $FLEET" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
|
||||
DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
|
||||
PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
||||
SSH_KEY="${PLATFORM_DEPLOY_SSH_KEY:?PLATFORM_DEPLOY_SSH_KEY required}"
|
||||
BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||||
RELEASE_ID="${PLATFORM_DEPLOY_RELEASE:-$(git -C "$REPO_ROOT" rev-parse --verify HEAD)}"
|
||||
[[ "$RELEASE_ID" =~ ^[A-Za-z0-9._-]+$ ]] || {
|
||||
echo "invalid PLATFORM_DEPLOY_RELEASE: $RELEASE_ID" >&2
|
||||
exit 1
|
||||
}
|
||||
ALLOW_EMPTY_FLEET="${ALLOW_EMPTY_FLEET:-0}"
|
||||
|
||||
HUB_DIR="$BASE/releases/$RELEASE_ID/hub"
|
||||
RELEASE_DIR="$BASE/releases/$RELEASE_ID"
|
||||
SSH_OPTS=(-i "$SSH_KEY" -p "$PORT" -o BatchMode=yes -o StrictHostKeyChecking=accept-new)
|
||||
|
||||
echo "[fleet] fleet=$FLEET domain=*.$FLEET_DOMAIN_SUFFIX host=$DEPLOY_USER@$HOST release=$RELEASE_ID"
|
||||
|
||||
# --- 1. Publish immutable release (shared; flock so parallel fleet jobs do not race) ---
|
||||
release_ready=false
|
||||
if ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "test -f '$RELEASE_DIR/.complete'"; then
|
||||
release_ready=true
|
||||
echo "[fleet] release already complete: $RELEASE_DIR"
|
||||
fi
|
||||
|
||||
if [ "$release_ready" = false ]; then
|
||||
# Drop a prior incomplete tree for this release id (failed CI leave leftovers).
|
||||
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
|
||||
set -euo pipefail
|
||||
flock /var/lock/cph-hub-release-publish bash -c '
|
||||
set -euo pipefail
|
||||
if [ -f "$RELEASE_DIR/.complete" ]; then
|
||||
exit 0
|
||||
fi
|
||||
if [ -e "$RELEASE_DIR" ]; then
|
||||
echo "[fleet] removing incomplete release: $RELEASE_DIR"
|
||||
rm -rf "$RELEASE_DIR"
|
||||
fi
|
||||
mkdir -p "$HUB_DIR"
|
||||
'
|
||||
REMOTE
|
||||
|
||||
echo "[fleet] rsync hub → $HUB_DIR"
|
||||
rsync -az --delete \
|
||||
--exclude node_modules --exclude dist --exclude .env \
|
||||
--exclude admin-web/node_modules --exclude admin-web/build --exclude admin-web/.svelte-kit \
|
||||
-e "ssh ${SSH_OPTS[*]}" \
|
||||
"$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
|
||||
|
||||
echo "[fleet] npm ci + build (tsc + admin-web SPA)"
|
||||
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" bash -s <<REMOTE
|
||||
set -euo pipefail
|
||||
flock /var/lock/cph-hub-release-publish bash -c '
|
||||
set -euo pipefail
|
||||
if [ -f "$RELEASE_DIR/.complete" ]; then
|
||||
echo "[fleet] release completed by another job"
|
||||
exit 0
|
||||
fi
|
||||
cd "$HUB_DIR"
|
||||
npm ci
|
||||
npm ci --prefix admin-web
|
||||
npm run audit:production
|
||||
npm run build
|
||||
test -f admin-web/build/index.html
|
||||
touch "$RELEASE_DIR/.complete"
|
||||
'
|
||||
REMOTE
|
||||
fi
|
||||
|
||||
# --- 2. Discover silos in this fleet and roll them onto the release ---
|
||||
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
|
||||
env BASE="$BASE" HUB_DIR="$HUB_DIR" FLEET="$FLEET" \
|
||||
FLEET_DOMAIN_SUFFIX="$FLEET_DOMAIN_SUFFIX" ALLOW_EMPTY_FLEET="$ALLOW_EMPTY_FLEET" \
|
||||
bash -s <<'REMOTE'
|
||||
set -euo pipefail
|
||||
|
||||
fleet_match() {
|
||||
local public_url="$1"
|
||||
local host="${public_url#https://}"
|
||||
host="${host#http://}"
|
||||
host="${host%%/*}"
|
||||
host="${host%%:*}"
|
||||
case "$FLEET" in
|
||||
prod)
|
||||
[[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]] || return 1
|
||||
# Avoid matching educraft-dev when suffix is educraft.…
|
||||
[[ "$host" != *.educraft-dev.paradigm-edu.net && "$host" != educraft-dev.paradigm-edu.net ]] || return 1
|
||||
return 0
|
||||
;;
|
||||
dev)
|
||||
[[ "$host" == *."$FLEET_DOMAIN_SUFFIX" || "$host" == "$FLEET_DOMAIN_SUFFIX" ]]
|
||||
return
|
||||
;;
|
||||
*)
|
||||
return 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
env_value() {
|
||||
local file="$1"
|
||||
local key="$2"
|
||||
# Do not source secrets — only read the KEY=value line.
|
||||
local line
|
||||
line="$(grep -E "^${key}=" "$file" | tail -n1 || true)"
|
||||
printf '%s' "${line#"${key}="}"
|
||||
}
|
||||
|
||||
matched=0
|
||||
shopt -s nullglob
|
||||
for env_file in "$BASE"/.secrets/*/platform.env; do
|
||||
instance_id="$(basename "$(dirname "$env_file")")"
|
||||
public_url="$(env_value "$env_file" HUB_PUBLIC_BASE_URL)"
|
||||
if [ -z "$public_url" ]; then
|
||||
echo "[fleet] skip $instance_id: HUB_PUBLIC_BASE_URL empty"
|
||||
continue
|
||||
fi
|
||||
if ! fleet_match "$public_url"; then
|
||||
echo "[fleet] skip $instance_id: $public_url (not $FLEET)"
|
||||
continue
|
||||
fi
|
||||
|
||||
port="$(env_value "$env_file" PORT)"
|
||||
workspace="$(env_value "$env_file" HUB_PROJECT_WORKSPACE_ROOT)"
|
||||
unit="cph-hub-${instance_id}.service"
|
||||
if [ ! -f "/etc/systemd/system/$unit" ]; then
|
||||
echo "[fleet] skip $instance_id: unit missing ($unit)" >&2
|
||||
continue
|
||||
fi
|
||||
|
||||
# Prefer unit file ceilings (MemoryMax=16G) over systemctl's byte form.
|
||||
memory_max="$(sed -n 's/^MemoryMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
|
||||
cpu_quota="$(sed -n 's/^CPUQuota=//p' "/etc/systemd/system/$unit" | tail -n1)"
|
||||
tasks_max="$(sed -n 's/^TasksMax=//p' "/etc/systemd/system/$unit" | tail -n1)"
|
||||
|
||||
if [ -z "$port" ] || [ -z "$workspace" ] || [ -z "$memory_max" ] || [ -z "$cpu_quota" ] || [ -z "$tasks_max" ]; then
|
||||
echo "[fleet] error: $instance_id missing PORT/workspace/ceilings (port=$port workspace=$workspace memory=$memory_max cpu=$cpu_quota tasks=$tasks_max)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[fleet] roll $instance_id → $HUB_DIR ($public_url port=$port)"
|
||||
BASE="$BASE" \
|
||||
HUB_DIR="$HUB_DIR" \
|
||||
INSTANCE_ID="$instance_id" \
|
||||
WORKSPACE_ROOT="$workspace" \
|
||||
PORT="$port" \
|
||||
MEMORY_MAX="$memory_max" \
|
||||
CPU_QUOTA="$cpu_quota" \
|
||||
TASKS_MAX="$tasks_max" \
|
||||
bash "$HUB_DIR/deploy/install_service.sh"
|
||||
|
||||
systemctl restart "$unit"
|
||||
systemctl is-active --quiet "$unit"
|
||||
|
||||
health="http://127.0.0.1:${port}/api/healthz"
|
||||
ok=false
|
||||
for _ in $(seq 1 45); do
|
||||
if curl --fail --silent "$health" >/dev/null 2>&1; then
|
||||
ok=true
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
if [ "$ok" != true ]; then
|
||||
curl --fail --silent --show-error "$health" >/dev/null
|
||||
fi
|
||||
echo "[fleet] healthy $instance_id ($health)"
|
||||
matched=$((matched + 1))
|
||||
done
|
||||
|
||||
if [ "$matched" -eq 0 ]; then
|
||||
msg="[fleet] no silos matched *.$FLEET_DOMAIN_SUFFIX under $BASE/.secrets"
|
||||
if [ "$ALLOW_EMPTY_FLEET" = "1" ]; then
|
||||
echo "$msg (ALLOW_EMPTY_FLEET=1)"
|
||||
exit 0
|
||||
fi
|
||||
echo "$msg" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "[fleet] rolled $matched silo(s) on $FLEET"
|
||||
REMOTE
|
||||
|
||||
echo "[fleet] done fleet=$FLEET release=$RELEASE_ID hub=$HUB_DIR"
|
||||
@@ -60,9 +60,10 @@ if [ "$release_ready" = false ]; then
|
||||
-e "ssh ${SSH_OPTS[*]}" \
|
||||
"$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
|
||||
|
||||
# 2. Install deps, audit and build, then atomically mark the release complete.
|
||||
# 2. Install deps (hub + admin-web), audit hub prod, build tsc + SPA, mark complete.
|
||||
# `npm run build` → tsc then admin:build → admin-web/build for registerStaticSpa.
|
||||
ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" \
|
||||
"cd '$HUB_DIR' && npm ci && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
|
||||
"cd '$HUB_DIR' && npm ci && npm ci --prefix admin-web && npm run audit:production && npm run build && touch '$RELEASE_DIR/.complete'"
|
||||
fi
|
||||
|
||||
# 3. Ensure the service is installed (idempotent), then restart.
|
||||
|
||||
Generated
+31
-48
@@ -131,9 +131,6 @@
|
||||
"cpu": [
|
||||
"arm64"
|
||||
],
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "SEE LICENSE IN LICENSE.md",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -147,9 +144,6 @@
|
||||
"cpu": [
|
||||
"arm64"
|
||||
],
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "SEE LICENSE IN LICENSE.md",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -163,9 +157,6 @@
|
||||
"cpu": [
|
||||
"x64"
|
||||
],
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "SEE LICENSE IN LICENSE.md",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -179,9 +170,6 @@
|
||||
"cpu": [
|
||||
"x64"
|
||||
],
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "SEE LICENSE IN LICENSE.md",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -247,24 +235,26 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@emnapi/core": {
|
||||
"version": "1.11.1",
|
||||
"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
|
||||
"integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
|
||||
"version": "1.11.2",
|
||||
"resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
|
||||
"integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"@emnapi/wasi-threads": "1.2.2",
|
||||
"tslib": "^2.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@emnapi/runtime": {
|
||||
"version": "1.11.1",
|
||||
"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
|
||||
"integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
|
||||
"version": "1.11.2",
|
||||
"resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
|
||||
"integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"peer": true,
|
||||
"dependencies": {
|
||||
"tslib": "^2.4.0"
|
||||
}
|
||||
@@ -1199,9 +1189,6 @@
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1219,9 +1206,6 @@
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1239,9 +1223,6 @@
|
||||
"ppc64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1259,9 +1240,6 @@
|
||||
"s390x"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1279,9 +1257,6 @@
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1299,9 +1274,6 @@
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -1347,6 +1319,29 @@
|
||||
"node": "^20.19.0 || >=22.12.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
|
||||
"version": "1.11.1",
|
||||
"resolved": "https://registry.npmmirror.com/@emnapi/core/-/core-1.11.1.tgz",
|
||||
"integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"dependencies": {
|
||||
"@emnapi/wasi-threads": "1.2.2",
|
||||
"tslib": "^2.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
|
||||
"version": "1.11.1",
|
||||
"resolved": "https://registry.npmmirror.com/@emnapi/runtime/-/runtime-1.11.1.tgz",
|
||||
"integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"optional": true,
|
||||
"dependencies": {
|
||||
"tslib": "^2.4.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@rolldown/binding-win32-arm64-msvc": {
|
||||
"version": "1.1.4",
|
||||
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.4.tgz",
|
||||
@@ -3157,9 +3152,6 @@
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MPL-2.0",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -3181,9 +3173,6 @@
|
||||
"arm64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "MPL-2.0",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -3205,9 +3194,6 @@
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"glibc"
|
||||
],
|
||||
"license": "MPL-2.0",
|
||||
"optional": true,
|
||||
"os": [
|
||||
@@ -3229,9 +3215,6 @@
|
||||
"x64"
|
||||
],
|
||||
"dev": true,
|
||||
"libc": [
|
||||
"musl"
|
||||
],
|
||||
"license": "MPL-2.0",
|
||||
"optional": true,
|
||||
"os": [
|
||||
|
||||
+6
-4
@@ -30,19 +30,21 @@
|
||||
"description": "Curriculum Project Hub — org-scoped Feishu collaboration and confined Agent runtime. Aligns to spec/System through ADR-0024.",
|
||||
"scripts": {
|
||||
"dev": "npm run prisma:migrate && tsx watch src/server.ts",
|
||||
"build": "tsc -p tsconfig.json",
|
||||
"build": "tsc -p tsconfig.json && npm run admin:build",
|
||||
"start": "npm run prisma:migrate && node dist/server.js",
|
||||
"check": "tsc -p tsconfig.json --noEmit",
|
||||
"audit:production": "npm audit --omit=dev --audit-level=high",
|
||||
"prisma:generate": "prisma generate --schema prisma/schema.prisma",
|
||||
"prisma:validate": "DATABASE_URL=${DATABASE_URL:-postgresql://stub:stub@127.0.0.1:5432/stub} prisma validate --schema prisma/schema.prisma",
|
||||
"prisma:migrate": "DATABASE_URL=${DATABASE_URL:-postgresql://paradigm:paradigm@127.0.0.1:5432/paradigm} prisma migrate deploy --schema prisma/schema.prisma",
|
||||
"prisma:validate": "prisma validate --schema prisma/schema.prisma",
|
||||
"prisma:migrate": "prisma migrate deploy --schema prisma/schema.prisma",
|
||||
"secrets:rotate-kek": "node dist/deployment/rotate-secret-kek.js",
|
||||
"agent-config": "node dist/deployment/agent-config-cli.js",
|
||||
"silo:bootstrap": "node dist/deployment/bootstrap-silo-cli.js",
|
||||
"silo:restore-preflight": "node dist/deployment/restore-preflight.js",
|
||||
"deploy": "bash deploy/deploy_platform.sh",
|
||||
"test": "vitest run",
|
||||
"test:watch": "vitest"
|
||||
"test:watch": "vitest",
|
||||
"admin:dev": "npm run dev --prefix admin-web",
|
||||
"admin:build": "npm run build --prefix admin-web"
|
||||
}
|
||||
}
|
||||
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
-- ADR-0023 rejected the legacy `PlatformRoleAssignment` / `PlatformRole`{ADMIN,TEACHER}
|
||||
-- model: the platform administration control plane is a separate identity/session/
|
||||
-- audit surface (see `Spec.System.PlatformAdministration`), intentionally not built
|
||||
-- in alpha (ADR-0025, `hub/deploy/README.md`). The legacy table has no runtime
|
||||
-- reader — no guard, route, or service queries it for an authorization decision —
|
||||
-- and ADR-0023 requires it to be migrated/replaced before the platform panel ships.
|
||||
-- Drop the table, the `User.platformRoles` relation, and the enum.
|
||||
|
||||
-- DropForeignKey
|
||||
ALTER TABLE "PlatformRoleAssignment" DROP CONSTRAINT "PlatformRoleAssignment_userId_fkey";
|
||||
|
||||
-- DropIndex
|
||||
DROP INDEX IF EXISTS "PlatformRoleAssignment_userId_revokedAt_idx";
|
||||
DROP INDEX IF EXISTS "PlatformRoleAssignment_role_revokedAt_idx";
|
||||
|
||||
-- DropTable
|
||||
DROP TABLE IF EXISTS "PlatformRoleAssignment";
|
||||
|
||||
-- DropEnum
|
||||
DROP TYPE IF EXISTS "PlatformRole";
|
||||
@@ -0,0 +1,18 @@
|
||||
-- ADR-0022 layered capacity policy. Org admins may set per-dimension lower
|
||||
-- `organizationLimit` overrides; platform ceilings come from deployment config
|
||||
-- (see `src/capacity/ceilings.ts`). `limits` is a JSON map of
|
||||
-- CapacityDimension → number (only the set dimensions); service enforces
|
||||
-- `LayeredLimit.Valid` (org limit ≤ platform ceiling).
|
||||
|
||||
-- CreateTable
|
||||
CREATE TABLE "OrganizationCapacityPolicy" (
|
||||
"organizationId" TEXT NOT NULL,
|
||||
"limits" JSONB NOT NULL,
|
||||
"createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
||||
"updatedAt" TIMESTAMP(3) NOT NULL,
|
||||
|
||||
CONSTRAINT "OrganizationCapacityPolicy_pkey" PRIMARY KEY ("organizationId")
|
||||
);
|
||||
|
||||
-- AddForeignKey
|
||||
ALTER TABLE "OrganizationCapacityPolicy" ADD CONSTRAINT "OrganizationCapacityPolicy_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
|
||||
+21
-25
@@ -37,6 +37,7 @@ model Organization {
|
||||
|
||||
memberships OrganizationMembership[]
|
||||
projectSettings OrganizationProjectSettings?
|
||||
capacityPolicy OrganizationCapacityPolicy?
|
||||
folders Folder[]
|
||||
projects Project[]
|
||||
teams Team[]
|
||||
@@ -58,8 +59,9 @@ enum OrganizationStatus {
|
||||
ARCHIVED
|
||||
}
|
||||
|
||||
/// Org-scoped platform role. Distinct from project PermissionRole and from
|
||||
/// global PlatformRoleAssignment, which is reserved for SaaS/platform control.
|
||||
/// Org-scoped membership role. Distinct from project PermissionRole and from
|
||||
/// the platform administrator surface (ADR-0023 / Spec.System.PlatformAdministration),
|
||||
/// which is a separate control plane not modeled in alpha (ADR-0025).
|
||||
model OrganizationMembership {
|
||||
id String @id @default(cuid())
|
||||
organizationId String
|
||||
@@ -159,6 +161,20 @@ model OrganizationProjectSettings {
|
||||
organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
|
||||
}
|
||||
|
||||
/// ADR-0022 layered capacity policy. Org admins may set per-dimension lower
|
||||
/// limits; `limits` is a JSON map of CapacityDimension → number (only the set
|
||||
/// ones). Each set value must be ≤ the platform ceiling for that dimension
|
||||
/// (validated in service; spec `LayeredLimit.Valid`). Dimensions with no entry
|
||||
/// fall back to the platform ceiling (`LayeredLimit.effective`).
|
||||
model OrganizationCapacityPolicy {
|
||||
organizationId String @id
|
||||
limits Json
|
||||
createdAt DateTime @default(now())
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
|
||||
}
|
||||
|
||||
/// A person known to the Hub. `feishuOpenId` remains a legacy compatibility
|
||||
/// key; new customer-app identities live in FeishuUserIdentity and store a
|
||||
/// connection-scoped opaque USER principal here instead of a raw open_id.
|
||||
@@ -170,7 +186,6 @@ model User {
|
||||
createdAt DateTime @default(now())
|
||||
updatedAt DateTime @updatedAt
|
||||
|
||||
platformRoles PlatformRoleAssignment[]
|
||||
organizationMemberships OrganizationMembership[]
|
||||
createdProjects Project[] @relation("projectCreator")
|
||||
requestedRuns AgentRun[] @relation("runRequester")
|
||||
@@ -311,26 +326,6 @@ model ProviderCredentialVersion {
|
||||
@@index([createdByUserId])
|
||||
}
|
||||
|
||||
/// Platform-level role (admin/teacher). Distinct from ADR-0004 PermissionRole.
|
||||
/// `admin` is the only override path for force-release (spec RequiresAdmin).
|
||||
model PlatformRoleAssignment {
|
||||
id String @id @default(cuid())
|
||||
userId String
|
||||
role PlatformRole
|
||||
createdAt DateTime @default(now())
|
||||
revokedAt DateTime?
|
||||
|
||||
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@index([userId, revokedAt])
|
||||
@@index([role, revokedAt])
|
||||
}
|
||||
|
||||
enum PlatformRole {
|
||||
ADMIN
|
||||
TEACHER
|
||||
}
|
||||
|
||||
/// ADR-0019: typed principals for permission grants and actor resolution.
|
||||
/// USER and Feishu external principals use connection-scoped opaque ids, never
|
||||
/// raw provider-local ids; TEAM uses Hub Team.id.
|
||||
@@ -647,8 +642,9 @@ model ProjectAgentLock {
|
||||
// --- Permission grants & settings (ADR-0004) ----------------------------
|
||||
|
||||
/// ADR-0004 PermissionRole: read ⊂ edit ⊂ manage (capability lattice).
|
||||
/// Distinct from PlatformRole. Force-release is admin-only, outside this
|
||||
/// lattice (spec RequiresAdmin).
|
||||
/// Force-release is platform-admin-only, outside this lattice (spec
|
||||
/// RequiresAdmin); platform admin is a separate control plane (ADR-0023),
|
||||
/// not modeled in alpha (ADR-0025).
|
||||
enum PermissionRole {
|
||||
READ
|
||||
EDIT
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
/**
|
||||
* Local dev bootstrap for an Alpha Silo on Windows / non-systemd hosts.
|
||||
*
|
||||
* The production bootstrap-silo CLI is Linux-only (requires root uid 0,
|
||||
* systemctl, root-owned files). This script calls the same
|
||||
* `bootstrapAlphaSilo` invariants directly, sourcing credentials from the
|
||||
* local `.env` and the dev keyring. Idempotent: re-running is a no-op once
|
||||
* the Silo Organization exists.
|
||||
*
|
||||
* Usage: npx tsx scripts/dev-bootstrap-silo.ts
|
||||
*/
|
||||
import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { bootstrapAlphaSilo } from "../src/deployment/bootstrap-silo.js";
|
||||
import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
|
||||
|
||||
function requiredEnv(name: string): string {
|
||||
const v = process.env[name]?.trim();
|
||||
if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
|
||||
return v;
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const databaseUrl = requiredEnv("DATABASE_URL");
|
||||
const keyring = await loadLocalSecretKeyring();
|
||||
const secrets = new LocalSecretEnvelope(keyring);
|
||||
const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
|
||||
|
||||
const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
|
||||
const feishuAppId = requiredEnv("FEISHU_APP_ID");
|
||||
const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
|
||||
const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
|
||||
const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
|
||||
const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
|
||||
const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
|
||||
|
||||
try {
|
||||
const result = await bootstrapAlphaSilo(
|
||||
prisma,
|
||||
secrets,
|
||||
{
|
||||
organization: {
|
||||
id: organizationId,
|
||||
slug: "local-dev",
|
||||
name: "Local Dev Silo",
|
||||
},
|
||||
owner: {
|
||||
openId: feishuBotOpenId,
|
||||
displayName: "Local Dev Owner",
|
||||
},
|
||||
feishu: {
|
||||
appId: feishuAppId,
|
||||
appSecret: feishuAppSecret,
|
||||
botOpenId: feishuBotOpenId,
|
||||
},
|
||||
provider: {
|
||||
providerId: "openrouter",
|
||||
baseUrl: providerBaseUrl,
|
||||
authToken: providerAuthToken,
|
||||
...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
|
||||
},
|
||||
},
|
||||
// Skip live network probes in local dev — Feishu/OpenRouter reachability
|
||||
// is not required to seed the encrypted envelope rows.
|
||||
{ feishu: async () => {}, provider: async () => {} },
|
||||
);
|
||||
console.log("bootstrap result:", JSON.stringify(result, null, 2));
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error: unknown) => {
|
||||
console.error("[dev-bootstrap-silo] failed:", error instanceof Error ? error.message : String(error));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
@@ -0,0 +1,84 @@
|
||||
/**
|
||||
* Local dev seed for an existing Organization that predates the ADR-0024
|
||||
* secret-envelope plane (e.g. the legacy `org_default` from the tenant-root
|
||||
* migration). Creates ACTIVE Feishu Application + Provider (BYOK openrouter)
|
||||
* connections with encrypted envelopes, using the local dev keyring.
|
||||
*
|
||||
* Idempotent: re-running rotates a new secret version if the connection
|
||||
* already exists.
|
||||
*
|
||||
* Usage: npx tsx scripts/dev-seed-connections.ts
|
||||
*/
|
||||
import "dotenv/config";
|
||||
import { PrismaClient } from "@prisma/client";
|
||||
import { FeishuApplicationConnectionService } from "../src/connections/feishuApplicationConnections.js";
|
||||
import { ProviderConnectionService } from "../src/connections/providerConnections.js";
|
||||
import { loadLocalSecretKeyring, LocalSecretEnvelope } from "../src/security/secretEnvelope.js";
|
||||
|
||||
function requiredEnv(name: string): string {
|
||||
const v = process.env[name]?.trim();
|
||||
if (v === undefined || v === "") throw new Error(`missing required env: ${name}`);
|
||||
return v;
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
const databaseUrl = requiredEnv("DATABASE_URL");
|
||||
const organizationId = requiredEnv("HUB_SILO_ORGANIZATION_ID");
|
||||
const keyring = await loadLocalSecretKeyring();
|
||||
const secrets = new LocalSecretEnvelope(keyring);
|
||||
const prisma = new PrismaClient({ datasources: { db: { url: databaseUrl } }, log: [] });
|
||||
|
||||
const feishuAppId = requiredEnv("FEISHU_APP_ID");
|
||||
const feishuAppSecret = requiredEnv("FEISHU_APP_SECRET");
|
||||
const feishuBotOpenId = requiredEnv("FEISHU_BOT_OPEN_ID");
|
||||
const providerAuthToken = requiredEnv("ANTHROPIC_AUTH_TOKEN");
|
||||
const providerBaseUrl = process.env["ANTHROPIC_BASE_URL"]?.trim() || "https://openrouter.ai/api";
|
||||
const anthropicApiKey = process.env["ANTHROPIC_API_KEY"]?.trim() || "";
|
||||
|
||||
// Pick an existing active OWNER/ADMIN as the actor for the audit rows.
|
||||
const actor = await prisma.organizationMembership.findFirst({
|
||||
where: { organizationId, role: { in: ["OWNER", "ADMIN"] }, revokedAt: null },
|
||||
select: { userId: true },
|
||||
});
|
||||
if (actor === null) throw new Error(`no active OWNER/ADMIN membership on ${organizationId}; seed a member first`);
|
||||
const actorUserId = actor.userId;
|
||||
console.log("actor:", actorUserId);
|
||||
|
||||
try {
|
||||
const feishuService = new FeishuApplicationConnectionService(
|
||||
prisma,
|
||||
secrets,
|
||||
async () => {}, // skip live Feishu probe in local dev
|
||||
);
|
||||
const feishuResult = await feishuService.rotateCustomerApplication({
|
||||
organizationId,
|
||||
actorUserId,
|
||||
appId: feishuAppId,
|
||||
appSecret: feishuAppSecret,
|
||||
botOpenId: feishuBotOpenId,
|
||||
});
|
||||
console.log("feishu connection:", JSON.stringify(feishuResult, null, 2));
|
||||
|
||||
const providerService = new ProviderConnectionService(
|
||||
prisma,
|
||||
secrets,
|
||||
async () => {}, // skip live OpenRouter probe in local dev
|
||||
);
|
||||
const providerResult = await providerService.rotateByok({
|
||||
organizationId,
|
||||
actorUserId,
|
||||
providerId: "openrouter",
|
||||
baseUrl: providerBaseUrl,
|
||||
authToken: providerAuthToken,
|
||||
...(anthropicApiKey !== "" ? { anthropicApiKey } : {}),
|
||||
});
|
||||
console.log("provider connection:", JSON.stringify(providerResult, null, 2));
|
||||
} finally {
|
||||
await prisma.$disconnect();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((error: unknown) => {
|
||||
console.error("[dev-seed-connections] failed:", error instanceof Error ? error.message : String(error));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
@@ -10,8 +10,10 @@ import {
|
||||
verifySession,
|
||||
type SessionPayload,
|
||||
} from "./session.js";
|
||||
import { createPermissionAuthorizer, type AuthorizationAction } from "../../permissions/authorizer.js";
|
||||
|
||||
export const ORG_ADMIN_ROLES: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN"];
|
||||
const ANY_ORG_ROLE: readonly OrganizationMemberRole[] = ["OWNER", "ADMIN", "MEMBER"];
|
||||
|
||||
export interface AuthContext {
|
||||
readonly session: SessionPayload;
|
||||
@@ -175,3 +177,55 @@ export async function sendError(
|
||||
): Promise<void> {
|
||||
await reply.status(statusCode).send({ error: { code, message } });
|
||||
}
|
||||
|
||||
export interface ProjectAuthContext extends OrgAuthContext {
|
||||
readonly projectId: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve an org member (any role) viewing/mutating a project in their org, then
|
||||
* enforce project-level permission via the PermissionGrant authorizer.
|
||||
*
|
||||
* `allowOrgAdminOversight=true` lets org OWNER/ADMIN through without a project
|
||||
* grant — reserved for *read* oversight (listing/viewing). Mutations that the
|
||||
* spec pins to project `manage` (e.g. `collaborator.manage`) must pass
|
||||
* `allowOrgAdminOversight=false`: org role alone is not a project authorization
|
||||
* root (spec `Permission.lean` / ADR-0004; the only out-of-role override is
|
||||
* platform-admin force-release `RequiresAdmin`, not org admin).
|
||||
*/
|
||||
export async function requireProjectPermission(
|
||||
request: FastifyRequest,
|
||||
reply: FastifyReply,
|
||||
deps: GuardDeps,
|
||||
options: {
|
||||
readonly orgSlug: string;
|
||||
readonly projectId: string;
|
||||
readonly action: AuthorizationAction;
|
||||
readonly allowOrgAdminOversight: boolean;
|
||||
},
|
||||
): Promise<ProjectAuthContext | null> {
|
||||
const auth = await requireOrgRole(request, reply, deps, {
|
||||
orgSlug: options.orgSlug,
|
||||
roles: ANY_ORG_ROLE,
|
||||
});
|
||||
if (auth === null) return null;
|
||||
await requireOrgProject(deps, auth.organization.id, options.projectId);
|
||||
if (options.allowOrgAdminOversight && ORG_ADMIN_ROLES.includes(auth.membershipRole)) {
|
||||
return { ...auth, projectId: options.projectId };
|
||||
}
|
||||
const decision = await createPermissionAuthorizer(deps.prisma).can({
|
||||
actor: { feishuOpenId: auth.feishuOpenId },
|
||||
action: options.action,
|
||||
resource: { type: "PROJECT", id: options.projectId },
|
||||
});
|
||||
if (!decision.allowed) {
|
||||
await sendError(
|
||||
reply,
|
||||
403,
|
||||
"forbidden",
|
||||
`project ${options.projectId} requires ${decision.requiredRole} (${options.action}): ${decision.reason}`,
|
||||
);
|
||||
return null;
|
||||
}
|
||||
return { ...auth, projectId: options.projectId };
|
||||
}
|
||||
|
||||
@@ -35,9 +35,11 @@ export async function handleRouteError(reply: FastifyReply, err: unknown): Promi
|
||||
await sendError(reply, mapped.statusCode, mapped.code, mapped.message);
|
||||
return;
|
||||
}
|
||||
reply.log.error({ err }, "unmapped route error");
|
||||
await sendError(reply, 500, "internal_error", "internal error");
|
||||
return;
|
||||
}
|
||||
reply.log.error({ err }, "unmapped route error");
|
||||
await sendError(reply, 500, "internal_error", "internal error");
|
||||
}
|
||||
|
||||
@@ -71,7 +73,8 @@ function mapDomainError(message: string): { statusCode: number; code: string; me
|
||||
lower.includes("is required") ||
|
||||
lower.includes("already") ||
|
||||
lower.includes("invalid") ||
|
||||
lower.includes("accepts only")
|
||||
lower.includes("accepts only") ||
|
||||
lower.includes("must be")
|
||||
) {
|
||||
return { statusCode: 400, code: "bad_request", message };
|
||||
}
|
||||
|
||||
@@ -1,11 +1,12 @@
|
||||
/**
|
||||
* Registers org-admin HTTP surface: auth, org APIs, (later) static SPA.
|
||||
* Registers org-admin HTTP surface: auth, org APIs, and the static SPA shell.
|
||||
*/
|
||||
import cookie from "@fastify/cookie";
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
import { registerAuthRoutes } from "./routes/authRoutes.js";
|
||||
import { registerOrgRoutes } from "./routes/orgRoutes.js";
|
||||
import { registerStaticSpa } from "./static.js";
|
||||
import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
|
||||
import type { ProviderReadinessProbe } from "../connections/providerReadiness.js";
|
||||
import type { FeishuReadinessProbe } from "../connections/feishuReadiness.js";
|
||||
@@ -62,4 +63,7 @@ export async function registerAdminPlugin(
|
||||
? { feishuConnectionReadinessProbe: config.feishuConnectionReadinessProbe }
|
||||
: {}),
|
||||
});
|
||||
|
||||
// After API + /admin/login so SPA fallback does not shadow auth routes.
|
||||
await registerStaticSpa(app);
|
||||
}
|
||||
|
||||
@@ -5,7 +5,7 @@ import {
|
||||
listProjectTeamAccess,
|
||||
revokeTeamProjectAccess,
|
||||
} from "../../permissions/projectTeamAccess.js";
|
||||
import { requireOrgProject, requireOrgRole, type GuardDeps } from "../auth/guards.js";
|
||||
import { requireProjectPermission, type GuardDeps } from "../auth/guards.js";
|
||||
import { handleRouteError } from "../errors.js";
|
||||
|
||||
const ROLES: readonly PermissionRole[] = ["READ", "EDIT", "MANAGE"];
|
||||
@@ -19,9 +19,13 @@ export async function registerAccessRoutes(
|
||||
app.get("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
const auth = await requireProjectPermission(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
projectId,
|
||||
action: "project.read",
|
||||
allowOrgAdminOversight: true,
|
||||
});
|
||||
if (auth === null) return;
|
||||
await requireOrgProject(guardDeps, auth.organization.id, projectId);
|
||||
return { access: await listProjectTeamAccess(config.prisma, projectId) };
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
@@ -31,9 +35,13 @@ export async function registerAccessRoutes(
|
||||
app.put("/api/org/:orgSlug/projects/:projectId/team-access", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
const auth = await requireProjectPermission(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
projectId,
|
||||
action: "collaborator.manage",
|
||||
allowOrgAdminOversight: false,
|
||||
});
|
||||
if (auth === null) return;
|
||||
await requireOrgProject(guardDeps, auth.organization.id, projectId);
|
||||
const body = request.body as {
|
||||
teamId?: unknown;
|
||||
teamSlug?: unknown;
|
||||
@@ -67,9 +75,13 @@ export async function registerAccessRoutes(
|
||||
projectId: string;
|
||||
teamId: string;
|
||||
};
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
const auth = await requireProjectPermission(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
projectId,
|
||||
action: "collaborator.manage",
|
||||
allowOrgAdminOversight: false,
|
||||
});
|
||||
if (auth === null) return;
|
||||
await requireOrgProject(guardDeps, auth.organization.id, projectId);
|
||||
const count = await revokeTeamProjectAccess(config.prisma, { projectId, teamId });
|
||||
return { revoked: count };
|
||||
} catch (err) {
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
/**
|
||||
* Org-admin capacity policy routes (ADR-0022).
|
||||
*/
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
import { getCapacityPolicy, setCapacityPolicy } from "../../org/capacityPolicy.js";
|
||||
import { isCapacityDimension } from "../../capacity/dimensions.js";
|
||||
import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
|
||||
import { handleRouteError } from "../errors.js";
|
||||
|
||||
export async function registerCapacityRoutes(
|
||||
app: FastifyInstance,
|
||||
config: { readonly prisma: PrismaClient; readonly sessionSecret: string },
|
||||
): Promise<void> {
|
||||
const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
|
||||
|
||||
app.get("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
return await getCapacityPolicy(config.prisma, auth.organization.id);
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.put("/api/org/:orgSlug/capacity-policy", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as { limits?: unknown };
|
||||
if (body?.limits === null || typeof body.limits !== "object") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "limits object is required" },
|
||||
});
|
||||
}
|
||||
const limits: Record<string, number | null> = {};
|
||||
for (const [key, value] of Object.entries(body.limits as Record<string, unknown>)) {
|
||||
if (!isCapacityDimension(key)) {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: `unknown capacity dimension: ${key}` },
|
||||
});
|
||||
}
|
||||
if (value === null) {
|
||||
limits[key] = null;
|
||||
} else if (typeof value === "number" && Number.isFinite(value)) {
|
||||
limits[key] = value;
|
||||
} else {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: `limit for ${key} must be a number or null` },
|
||||
});
|
||||
}
|
||||
}
|
||||
return await setCapacityPolicy(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
limits,
|
||||
});
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
}
|
||||
@@ -10,13 +10,15 @@ import {
|
||||
createOrgFolder,
|
||||
createOrgProject,
|
||||
getOrgProjectDetail,
|
||||
listMyProjects,
|
||||
listOrgExplorer,
|
||||
moveOrgProjectToFolder,
|
||||
renameFolder,
|
||||
renameProject,
|
||||
} from "../../org/explorer.js";
|
||||
import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
|
||||
import { requireOrgRole, requireProjectPermission, ORG_ADMIN_ROLES, type GuardDeps } from "../auth/guards.js";
|
||||
import { handleRouteError } from "../errors.js";
|
||||
import { createPermissionAuthorizer } from "../../permissions/authorizer.js";
|
||||
|
||||
export interface ExplorerRouteConfig {
|
||||
readonly prisma: PrismaClient;
|
||||
@@ -41,6 +43,24 @@ export async function registerExplorerRoutes(
|
||||
}
|
||||
});
|
||||
|
||||
app.get("/api/org/:orgSlug/my-projects", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
roles: ["OWNER", "ADMIN", "MEMBER"],
|
||||
});
|
||||
if (auth === null) return;
|
||||
const projects = await listMyProjects(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
actorFeishuOpenId: auth.feishuOpenId,
|
||||
});
|
||||
return { projects };
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
});
|
||||
|
||||
app.post("/api/org/:orgSlug/folders", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
@@ -144,12 +164,27 @@ export async function registerExplorerRoutes(
|
||||
app.get("/api/org/:orgSlug/projects/:projectId", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug, projectId } = request.params as { orgSlug: string; projectId: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
const auth = await requireProjectPermission(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
projectId,
|
||||
action: "project.read",
|
||||
allowOrgAdminOversight: true,
|
||||
});
|
||||
if (auth === null) return;
|
||||
return await getOrgProjectDetail(config.prisma, {
|
||||
const detail = await getOrgProjectDetail(config.prisma, {
|
||||
organizationId: auth.organization.id,
|
||||
projectId,
|
||||
});
|
||||
const manageDecision = await createPermissionAuthorizer(config.prisma).can({
|
||||
actor: { feishuOpenId: auth.feishuOpenId },
|
||||
action: "collaborator.manage",
|
||||
resource: { type: "PROJECT", id: projectId },
|
||||
});
|
||||
return {
|
||||
...detail,
|
||||
actorIsOrgAdmin: ORG_ADMIN_ROLES.includes(auth.membershipRole),
|
||||
actorCanManageProject: manageDecision.allowed,
|
||||
};
|
||||
} catch (err) {
|
||||
return handleRouteError(reply, err);
|
||||
}
|
||||
|
||||
@@ -15,6 +15,7 @@ import { registerMembersRoutes } from "./membersRoutes.js";
|
||||
import { registerSessionsAndUsageRoutes } from "./sessionsRoutes.js";
|
||||
import { registerTeamsRoutes } from "./teamsRoutes.js";
|
||||
import { registerProviderConnectionRoutes } from "./providerConnectionRoutes.js";
|
||||
import { registerCapacityRoutes } from "./capacityRoutes.js";
|
||||
import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
|
||||
import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
|
||||
import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
|
||||
@@ -105,6 +106,10 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
|
||||
prisma: config.prisma,
|
||||
sessionSecret: config.sessionSecret,
|
||||
});
|
||||
await registerCapacityRoutes(app, {
|
||||
prisma: config.prisma,
|
||||
sessionSecret: config.sessionSecret,
|
||||
});
|
||||
await registerSessionsAndUsageRoutes(app, {
|
||||
prisma: config.prisma,
|
||||
sessionSecret: config.sessionSecret,
|
||||
|
||||
@@ -18,10 +18,16 @@ export async function registerTeamsRoutes(
|
||||
): Promise<void> {
|
||||
const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
|
||||
|
||||
// Read-only listing is open to any active org member so project MANAGE
|
||||
// holders can pick a team when granting TEAM→PROJECT access (ADR-0004).
|
||||
// Mutations below stay org-admin only.
|
||||
app.get("/api/org/:orgSlug/teams", async (request, reply) => {
|
||||
try {
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, {
|
||||
orgSlug,
|
||||
roles: ["OWNER", "ADMIN", "MEMBER"],
|
||||
});
|
||||
if (auth === null) return;
|
||||
return { teams: await listOrgTeams(config.prisma, auth.organization.id) };
|
||||
} catch (err) {
|
||||
@@ -34,7 +40,7 @@ export async function registerTeamsRoutes(
|
||||
const { orgSlug } = request.params as { orgSlug: string };
|
||||
const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
|
||||
if (auth === null) return;
|
||||
const body = request.body as { slug?: unknown; name?: unknown; description?: unknown };
|
||||
const body = (request.body ?? {}) as { slug?: unknown; name?: unknown; description?: unknown };
|
||||
if (typeof body.slug !== "string" || typeof body.name !== "string") {
|
||||
return reply.status(400).send({
|
||||
error: { code: "bad_request", message: "slug and name are required" },
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
/**
|
||||
* Serves the org-admin SPA (built by SvelteKit via `admin-web/build/`) and
|
||||
* the SPA index fallback for client-side routes under `/admin/*`.
|
||||
*
|
||||
* The SvelteKit project lives in `hub/admin-web/`. Run `npm run build` there
|
||||
* to produce the static output in `admin-web/build/`. In development, use
|
||||
* `npm run dev` in `admin-web/` which proxies `/api` and `/auth` to the Hub.
|
||||
*
|
||||
* Override the UI directory with `CPH_ADMIN_UI_DIR` env if needed.
|
||||
*/
|
||||
import { readFile } from "node:fs/promises";
|
||||
import { existsSync } from "node:fs";
|
||||
import { fileURLToPath } from "node:url";
|
||||
import { dirname, extname, join, resolve as resolvePath } from "node:path";
|
||||
import type { FastifyInstance } from "fastify";
|
||||
|
||||
const MIME: Record<string, string> = {
|
||||
".html": "text/html; charset=utf-8",
|
||||
".js": "text/javascript; charset=utf-8",
|
||||
".mjs": "text/javascript; charset=utf-8",
|
||||
".css": "text/css; charset=utf-8",
|
||||
".svg": "image/svg+xml",
|
||||
".ico": "image/x-icon",
|
||||
".png": "image/png",
|
||||
".jpg": "image/jpeg",
|
||||
".woff": "font/woff",
|
||||
".woff2": "font/woff2",
|
||||
".json": "application/json; charset=utf-8",
|
||||
".txt": "text/plain; charset=utf-8",
|
||||
};
|
||||
|
||||
function resolveUiDir(): string {
|
||||
const override = process.env["CPH_ADMIN_UI_DIR"];
|
||||
if (override && override.trim() !== "") return resolvePath(override);
|
||||
const here = dirname(fileURLToPath(import.meta.url));
|
||||
return resolvePath(join(here, "..", "..", "admin-web", "build"));
|
||||
}
|
||||
|
||||
export async function registerStaticSpa(app: FastifyInstance): Promise<void> {
|
||||
const uiDir = resolveUiDir();
|
||||
if (!existsSync(join(uiDir, "index.html"))) {
|
||||
app.log.warn(
|
||||
{ uiDir },
|
||||
"admin-web/build not found; SPA shell disabled. Run `npm run build` in admin-web/ to enable. Org admin APIs remain fully functional.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
const indexHtml = await readFile(join(uiDir, "index.html"), "utf8");
|
||||
|
||||
// SvelteKit static assets (_app/*, favicon, etc.)
|
||||
app.get("/_app/*", async (request, reply) => {
|
||||
const rel = (request.params as { "*": string })["*"];
|
||||
const safe = rel.split("/").filter((p) => p !== ".." && p !== "").join("/");
|
||||
try {
|
||||
const buf = await readFile(join(uiDir, "_app", safe));
|
||||
const mime = MIME[extname(safe)] ?? "application/octet-stream";
|
||||
return reply.type(mime).send(buf);
|
||||
} catch {
|
||||
return reply.status(404).send({ error: { code: "not_found", message: "asset not found" } });
|
||||
}
|
||||
});
|
||||
|
||||
// Other top-level static assets (favicon.svg, robots.txt, etc.)
|
||||
app.get("/favicon.svg", async (_request, reply) => {
|
||||
try {
|
||||
const buf = await readFile(join(uiDir, "favicon.svg"));
|
||||
return reply.type("image/svg+xml").send(buf);
|
||||
} catch {
|
||||
return reply.status(404).send();
|
||||
}
|
||||
});
|
||||
|
||||
// SPA client-side route fallback. Auth registers `/admin/login` first so it
|
||||
// takes precedence; everything else under /admin/* serves the index so
|
||||
// SvelteKit's client-side router can resolve the view.
|
||||
app.get("/admin", async (_request, reply) => {
|
||||
return reply.type("text/html; charset=utf-8").send(indexHtml);
|
||||
});
|
||||
app.get("/admin/*", async (_request, reply) => {
|
||||
return reply.type("text/html; charset=utf-8").send(indexHtml);
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
/**
|
||||
* ADR-0022 platform ceilings (spec `LayeredLimit.platformCeiling`).
|
||||
*
|
||||
* Platform ceilings are the unbreakable upper bounds; org policy may only
|
||||
* configure lower limits (see `LayeredLimit.Valid`). Exact numeric values are
|
||||
* `OPEN` per spec and calibrated by capacity testing — this module is the
|
||||
* single place to wire them.
|
||||
*
|
||||
* Seven dimensions are sourced from existing runtime env vars
|
||||
* (`HUB_HTTP_BODY_LIMIT_BYTES`, `HUB_MAX_FILES_PER_MESSAGE`, `HUB_MAX_FILE_BYTES`,
|
||||
* `HUB_HTTP_REQUESTS_PER_MINUTE`, `HUB_AGENT_MAX_CONCURRENT_RUNS`,
|
||||
* `HUB_AGENT_MAX_RUN_SECONDS`, `HUB_AGENT_MAX_TURNS`). The remaining dimensions
|
||||
* are sourced from `HUB_CEILING_<DIMENSION>` env vars; until those are set the
|
||||
* dimension has no configured ceiling and the policy UI surfaces it as
|
||||
* "未配置" (cannot enforce a limit without a ceiling).
|
||||
*/
|
||||
import type { CapacityDimension } from "./dimensions.js";
|
||||
|
||||
function positiveIntEnv(name: string): number | undefined {
|
||||
const raw = process.env[name];
|
||||
if (raw === undefined || raw === "") return undefined;
|
||||
const n = Number.parseInt(raw, 10);
|
||||
return Number.isFinite(n) && n > 0 ? n : undefined;
|
||||
}
|
||||
|
||||
const ENV_BACKED_CEILINGS: Partial<Record<CapacityDimension, string>> = {
|
||||
requestBodySize: "HUB_HTTP_BODY_LIMIT_BYTES",
|
||||
attachmentCount: "HUB_MAX_FILES_PER_MESSAGE",
|
||||
fileSize: "HUB_MAX_FILE_BYTES",
|
||||
requestRate: "HUB_HTTP_REQUESTS_PER_MINUTE",
|
||||
agentConcurrency: "HUB_AGENT_MAX_CONCURRENT_RUNS",
|
||||
runWallTime: "HUB_AGENT_MAX_RUN_SECONDS",
|
||||
runTurns: "HUB_AGENT_MAX_TURNS",
|
||||
};
|
||||
|
||||
const CEILING_DIMENSIONS: readonly CapacityDimension[] = [
|
||||
"requestRate",
|
||||
"requestBodySize",
|
||||
"agentConcurrency",
|
||||
"admissionQueueLength",
|
||||
"admissionQueueWait",
|
||||
"fileSize",
|
||||
"attachmentCount",
|
||||
"archiveExpansion",
|
||||
"projectStorage",
|
||||
"organizationStorage",
|
||||
"memberCount",
|
||||
"projectCount",
|
||||
"teamCount",
|
||||
"folderCount",
|
||||
"sessionCount",
|
||||
"runWallTime",
|
||||
"runTurns",
|
||||
"runToolCalls",
|
||||
"toolWallTime",
|
||||
"runOutputSize",
|
||||
"processMemory",
|
||||
"processCpu",
|
||||
"processCount",
|
||||
];
|
||||
|
||||
function envNameFor(dimension: CapacityDimension): string {
|
||||
return ENV_BACKED_CEILINGS[dimension] ?? `HUB_CEILING_${dimension.toUpperCase()}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the configured platform ceilings (only the dimensions currently
|
||||
* wired via env). Unconfigured dimensions are absent — callers must surface
|
||||
* them, not assume unlimited (spec `LayeredLimit` forbids unlimited ceilings).
|
||||
*/
|
||||
export function readPlatformCeilings(): Partial<Record<CapacityDimension, number>> {
|
||||
const ceilings: Partial<Record<CapacityDimension, number>> = {};
|
||||
for (const dimension of CEILING_DIMENSIONS) {
|
||||
const value = positiveIntEnv(envNameFor(dimension));
|
||||
if (value !== undefined) ceilings[dimension] = value;
|
||||
}
|
||||
return ceilings;
|
||||
}
|
||||
@@ -0,0 +1,63 @@
|
||||
/**
|
||||
* ADR-0022 capacity dimensions (spec `Spec.System.Capacity.CapacityDimension`).
|
||||
* The 23 PINNED dimensions; exact numeric ceilings are `OPEN` and calibrated by
|
||||
* capacity testing. This module is the single source of the dimension set shared
|
||||
* by the platform-ceiling config and the org capacity-policy service.
|
||||
*/
|
||||
export const CAPACITY_DIMENSIONS = [
|
||||
"requestRate",
|
||||
"requestBodySize",
|
||||
"agentConcurrency",
|
||||
"admissionQueueLength",
|
||||
"admissionQueueWait",
|
||||
"fileSize",
|
||||
"attachmentCount",
|
||||
"archiveExpansion",
|
||||
"projectStorage",
|
||||
"organizationStorage",
|
||||
"memberCount",
|
||||
"projectCount",
|
||||
"teamCount",
|
||||
"folderCount",
|
||||
"sessionCount",
|
||||
"runWallTime",
|
||||
"runTurns",
|
||||
"runToolCalls",
|
||||
"toolWallTime",
|
||||
"runOutputSize",
|
||||
"processMemory",
|
||||
"processCpu",
|
||||
"processCount",
|
||||
] as const;
|
||||
|
||||
export type CapacityDimension = (typeof CAPACITY_DIMENSIONS)[number];
|
||||
|
||||
export const CAPACITY_DIMENSION_LABELS: Record<CapacityDimension, string> = {
|
||||
requestRate: "HTTP 请求速率",
|
||||
requestBodySize: "请求体大小",
|
||||
agentConcurrency: "智能体并发",
|
||||
admissionQueueLength: "接纳队列长度",
|
||||
admissionQueueWait: "接纳队列等待",
|
||||
fileSize: "单文件大小",
|
||||
attachmentCount: "每消息附件数",
|
||||
archiveExpansion: "归档展开",
|
||||
projectStorage: "项目存储",
|
||||
organizationStorage: "组织存储",
|
||||
memberCount: "成员数",
|
||||
projectCount: "项目数",
|
||||
teamCount: "团队数",
|
||||
folderCount: "文件夹数",
|
||||
sessionCount: "会话数",
|
||||
runWallTime: "单次运行墙钟",
|
||||
runTurns: "单次运行轮次",
|
||||
runToolCalls: "单次运行工具调用",
|
||||
toolWallTime: "工具墙钟",
|
||||
runOutputSize: "运行输出大小",
|
||||
processMemory: "进程内存",
|
||||
processCpu: "进程 CPU",
|
||||
processCount: "进程数",
|
||||
};
|
||||
|
||||
export function isCapacityDimension(value: string): value is CapacityDimension {
|
||||
return (CAPACITY_DIMENSIONS as readonly string[]).includes(value);
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
/**
|
||||
* Org capacity policy service (ADR-0022 / spec `Spec.System.Capacity`).
|
||||
*
|
||||
* Stores per-Organization lower `organizationLimit` overrides per
|
||||
* `CapacityDimension`. Enforces `LayeredLimit.Valid`: a set limit must be ≤ the
|
||||
* platform ceiling for that dimension. `LayeredLimit.effective` (min of the two)
|
||||
* is the value capacity admission should use; dimensions with no org override
|
||||
* fall back to the platform ceiling.
|
||||
*/
|
||||
import type { PrismaClient } from "@prisma/client";
|
||||
import { CAPACITY_DIMENSIONS, isCapacityDimension, type CapacityDimension } from "../capacity/dimensions.js";
|
||||
import { readPlatformCeilings } from "../capacity/ceilings.js";
|
||||
import { lockActiveOrganization } from "./status.js";
|
||||
|
||||
export interface CapacityPolicyView {
|
||||
/** Per-dimension: platform ceiling (absent if not configured) + org limit. */
|
||||
readonly dimensions: ReadonlyArray<{
|
||||
readonly dimension: CapacityDimension;
|
||||
readonly platformCeiling: number | null;
|
||||
readonly organizationLimit: number | null;
|
||||
readonly effective: number | null;
|
||||
}>;
|
||||
}
|
||||
|
||||
export async function getCapacityPolicy(
|
||||
prisma: PrismaClient,
|
||||
organizationId: string,
|
||||
): Promise<CapacityPolicyView> {
|
||||
const row = await prisma.organizationCapacityPolicy.findUnique({
|
||||
where: { organizationId },
|
||||
select: { limits: true },
|
||||
});
|
||||
const orgLimits = parseLimits(row?.limits);
|
||||
const ceilings = readPlatformCeilings();
|
||||
const dimensions = CAPACITY_DIMENSIONS.map((dimension) => {
|
||||
const platformCeiling = ceilings[dimension] ?? null;
|
||||
const organizationLimit = orgLimits[dimension] ?? null;
|
||||
const effective = effectiveLimit(platformCeiling, organizationLimit);
|
||||
return { dimension, platformCeiling, organizationLimit, effective };
|
||||
});
|
||||
return { dimensions };
|
||||
}
|
||||
|
||||
export async function setCapacityPolicy(
|
||||
prisma: PrismaClient,
|
||||
input: {
|
||||
readonly organizationId: string;
|
||||
/** Partial map of dimension → limit. null/absent clears a dimension. */
|
||||
readonly limits: Partial<Record<CapacityDimension, number | null>>;
|
||||
},
|
||||
): Promise<CapacityPolicyView> {
|
||||
const ceilings = readPlatformCeilings();
|
||||
const cleaned: Record<string, number> = {};
|
||||
for (const [dimension, value] of Object.entries(input.limits)) {
|
||||
if (!isCapacityDimension(dimension)) {
|
||||
throw new Error(`unknown capacity dimension: ${dimension}`);
|
||||
}
|
||||
if (value === null || value === undefined) continue;
|
||||
if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {
|
||||
throw new Error(`limit for ${dimension} must be a positive integer`);
|
||||
}
|
||||
const ceiling = ceilings[dimension];
|
||||
if (ceiling === undefined) {
|
||||
throw new Error(
|
||||
`platform ceiling for ${dimension} is not configured; cannot set an organization limit (spec LayeredLimit.Valid)`,
|
||||
);
|
||||
}
|
||||
if (value > ceiling) {
|
||||
throw new Error(
|
||||
`organization limit ${value} for ${dimension} exceeds platform ceiling ${ceiling} (spec LayeredLimit.Valid)`,
|
||||
);
|
||||
}
|
||||
cleaned[dimension] = value;
|
||||
}
|
||||
|
||||
await prisma.$transaction(async (tx) => {
|
||||
await lockActiveOrganization(tx, input.organizationId);
|
||||
await tx.organizationCapacityPolicy.upsert({
|
||||
where: { organizationId: input.organizationId },
|
||||
create: { organizationId: input.organizationId, limits: cleaned },
|
||||
update: { limits: cleaned },
|
||||
});
|
||||
});
|
||||
return getCapacityPolicy(prisma, input.organizationId);
|
||||
}
|
||||
|
||||
function effectiveLimit(platformCeiling: number | null, organizationLimit: number | null): number | null {
|
||||
if (platformCeiling === null) return null;
|
||||
if (organizationLimit === null) return platformCeiling;
|
||||
return Math.min(platformCeiling, organizationLimit);
|
||||
}
|
||||
|
||||
function parseLimits(raw: unknown): Partial<Record<CapacityDimension, number>> {
|
||||
if (raw === null || typeof raw !== "object") return {};
|
||||
const result: Partial<Record<CapacityDimension, number>> = {};
|
||||
for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {
|
||||
if (isCapacityDimension(key) && typeof value === "number" && Number.isFinite(value)) {
|
||||
result[key] = value;
|
||||
}
|
||||
}
|
||||
return result;
|
||||
}
|
||||
@@ -12,6 +12,7 @@ import {
|
||||
moveProjectToFolder,
|
||||
} from "../projectOnboarding.js";
|
||||
import { lockActiveOrganization } from "./status.js";
|
||||
import { PrismaPrincipalResolver } from "../permissions/principals.js";
|
||||
|
||||
export interface ExplorerFolderNode {
|
||||
readonly id: string;
|
||||
@@ -335,6 +336,64 @@ export async function archiveOrgProjectChatBinding(
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Projects an org member can see via their resolved principals' READ+ grants
|
||||
* (spec `PermissionGrant` / ADR-0004). Used by the member-facing project list
|
||||
* — org-admin oversight uses `listOrgExplorer` instead.
|
||||
*/
|
||||
export async function listMyProjects(
|
||||
prisma: PrismaClient,
|
||||
input: { readonly organizationId: string; readonly actorFeishuOpenId: string },
|
||||
): Promise<readonly ExplorerProjectNode[]> {
|
||||
const resolver = new PrismaPrincipalResolver(prisma);
|
||||
const resolution = await resolver.resolveActor(
|
||||
{ feishuOpenId: input.actorFeishuOpenId },
|
||||
{ organizationId: input.organizationId },
|
||||
);
|
||||
// Match exact (type, id) pairs — independent IN filters form a cartesian
|
||||
// product and can attribute another principal's grants to this actor.
|
||||
if (resolution.principals.length === 0) return [];
|
||||
const grants = await prisma.permissionGrant.findMany({
|
||||
where: {
|
||||
resourceType: "PROJECT",
|
||||
revokedAt: null,
|
||||
OR: resolution.principals.map((p) => ({
|
||||
principalType: p.type,
|
||||
principalId: p.id,
|
||||
})),
|
||||
},
|
||||
select: { resourceId: true },
|
||||
distinct: ["resourceId"],
|
||||
});
|
||||
const projectIds = grants.map((g) => g.resourceId);
|
||||
if (projectIds.length === 0) return [];
|
||||
const projects = await prisma.project.findMany({
|
||||
where: { id: { in: projectIds }, organizationId: input.organizationId, archivedAt: null },
|
||||
select: {
|
||||
id: true,
|
||||
name: true,
|
||||
folderId: true,
|
||||
createdAt: true,
|
||||
groupBindings: {
|
||||
where: { archivedAt: null },
|
||||
select: { chatId: true, createdAt: true },
|
||||
take: 1,
|
||||
},
|
||||
},
|
||||
orderBy: { name: "asc" },
|
||||
});
|
||||
return projects.map((p) => {
|
||||
const binding = p.groupBindings[0];
|
||||
return {
|
||||
id: p.id,
|
||||
name: p.name,
|
||||
folderId: p.folderId,
|
||||
createdAt: p.createdAt.toISOString(),
|
||||
binding: binding === undefined ? null : { chatId: binding.chatId, createdAt: binding.createdAt.toISOString() },
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
async function requireActiveFolder(
|
||||
prisma: PrismaClient | Prisma.TransactionClient,
|
||||
folderId: string,
|
||||
|
||||
+8
-23
@@ -1,8 +1,9 @@
|
||||
/**
|
||||
* Hub team lifecycle for org admin (ADR-0019 / ADR-0021).
|
||||
*
|
||||
* Archiving a team soft-archives the team row and revokes active TEAM→PROJECT
|
||||
* grants that use this team as principal (product pin).
|
||||
* Archiving a team soft-archives the team row. Active TEAM→PROJECT grants and
|
||||
* memberships are left in place as dead rows: principal resolution refuses
|
||||
* archived teams (see `permissions/principals.ts`), so they confer no access.
|
||||
*/
|
||||
import type { Prisma, PrismaClient } from "@prisma/client";
|
||||
import { lockActiveOrganization } from "./status.js";
|
||||
@@ -125,37 +126,21 @@ export async function updateTeam(
|
||||
}
|
||||
|
||||
/**
|
||||
* Soft-archive team and revoke its active project grants (TEAM principal).
|
||||
* Soft-archive team. Active grants/memberships are not cascade-revoked; the
|
||||
* archived flag alone makes the team's principal unresolvable (no access).
|
||||
*/
|
||||
export async function archiveTeam(
|
||||
prisma: PrismaClient,
|
||||
input: { readonly organizationId: string; readonly teamId: string },
|
||||
): Promise<{ readonly archived: true; readonly teamId: string; readonly revokedGrants: number }> {
|
||||
): Promise<{ readonly archived: true; readonly teamId: string }> {
|
||||
return prisma.$transaction(async (tx) => {
|
||||
await lockActiveOrganization(tx, input.organizationId);
|
||||
const team = await requireActiveTeam(tx, input.teamId, input.organizationId);
|
||||
const now = new Date();
|
||||
await tx.team.update({
|
||||
where: { id: team.id },
|
||||
data: { archivedAt: now },
|
||||
data: { archivedAt: new Date() },
|
||||
});
|
||||
await tx.teamMembership.updateMany({
|
||||
where: { teamId: team.id, revokedAt: null },
|
||||
data: { revokedAt: now },
|
||||
});
|
||||
const grants = await tx.permissionGrant.updateMany({
|
||||
where: {
|
||||
principalType: "TEAM",
|
||||
principalId: team.id,
|
||||
revokedAt: null,
|
||||
},
|
||||
data: { revokedAt: now },
|
||||
});
|
||||
return {
|
||||
archived: true as const,
|
||||
teamId: team.id,
|
||||
revokedGrants: grants.count,
|
||||
};
|
||||
return { archived: true as const, teamId: team.id };
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -71,7 +71,6 @@ export async function syncExternalPrincipalMemberships(
|
||||
create: {
|
||||
feishuOpenId: item.feishuOpenId,
|
||||
displayName: item.displayName,
|
||||
platformRoles: { create: { role: "TEACHER" } },
|
||||
organizationMemberships: { create: { organizationId: input.organizationId, role: "MEMBER" } },
|
||||
},
|
||||
});
|
||||
|
||||
@@ -131,9 +131,8 @@ export async function listProjectTeamAccess(
|
||||
where: {
|
||||
organizationId: project.organizationId,
|
||||
id: { in: grants.map((grant) => grant.principalId) },
|
||||
archivedAt: null,
|
||||
},
|
||||
select: { id: true, slug: true, name: true },
|
||||
select: { id: true, slug: true, name: true, archivedAt: true },
|
||||
});
|
||||
const teamsById = new Map(teams.map((team) => [team.id, team]));
|
||||
const missing = grants.filter((grant) => !teamsById.has(grant.principalId));
|
||||
@@ -143,7 +142,9 @@ export async function listProjectTeamAccess(
|
||||
);
|
||||
}
|
||||
|
||||
return grants.map((grant) => entryFromGrant({
|
||||
return grants
|
||||
.filter((grant) => teamsById.get(grant.principalId)?.archivedAt === null)
|
||||
.map((grant) => entryFromGrant({
|
||||
grantId: grant.id,
|
||||
projectId: project.id,
|
||||
organizationId: project.organizationId,
|
||||
|
||||
@@ -129,6 +129,18 @@ describe("admin members + teams API", () => {
|
||||
workspaceDir: "/tmp/p1",
|
||||
},
|
||||
});
|
||||
// Team-access grant/revoke is gated to project MANAGE (no org-admin bypass).
|
||||
// Seed the owner with a MANAGE grant on p1 so the org-owner flow still works.
|
||||
await prisma.permissionGrant.create({
|
||||
data: {
|
||||
resourceType: "PROJECT",
|
||||
resourceId: "p1",
|
||||
principalType: "USER",
|
||||
principalId: "ou_owner",
|
||||
role: "MANAGE",
|
||||
createdByUserId: "u-owner",
|
||||
},
|
||||
});
|
||||
|
||||
const app = await buildApp();
|
||||
try {
|
||||
@@ -176,7 +188,7 @@ describe("admin members + teams API", () => {
|
||||
});
|
||||
expect(archive.statusCode).toBe(200);
|
||||
expect(archive.json()).toEqual(
|
||||
expect.objectContaining({ archived: true, revokedGrants: 1 }),
|
||||
expect.objectContaining({ archived: true, teamId: team.id }),
|
||||
);
|
||||
|
||||
const after = await app.inject({
|
||||
|
||||
@@ -400,7 +400,6 @@ export async function seedProject(
|
||||
id: "u_" + projectId,
|
||||
feishuOpenId: principal,
|
||||
displayName: "Test User",
|
||||
platformRoles: { create: { role: "TEACHER" } },
|
||||
organizationMemberships: { create: { organizationId: DEFAULT_ORG_ID, role: "MEMBER" } },
|
||||
permissionGrants: {
|
||||
create: {
|
||||
|
||||
Reference in New Issue
Block a user