feat: add org admin SPA for models, roles and provider

Introduce admin-web (Skeleton/SvelteKit), Prisma models for provider connection / OrgModel / OrgRole, DB-backed runtime settings, and admin API routes so org admins can manage agent configuration end-to-end.
2026-07-11 12:33:56 +08:00
parent 461d2e89b0
commit 552c1c353e
50 changed files with 6986 additions and 151 deletions
@@ -0,0 +1,386 @@
+/**
+ * Org-scoped agent config: provider connection, enabled models, and role
+ * presets (ADR-0017 / ADR-0021).
+ *
+ * Roles and models are **data** (ADR-0017): admin/teacher-defined, persisted
+ * per organization. The runtime registry (`settings/runtime.ts`) reads these
+ * rows, falling back to env-based defaults when an org has none configured.
+ *
+ * Provider credential storage is a pilot placeholder: the spec leaves key/base
+ * URL encryption, rotation and resolver mechanism OPEN (secret-control-plane).
+ * BYOK tokens are stored as opaque strings here; platform-managed credentials
+ * are resolved from process env, not stored in this table.
+ */
+import type { PrismaClient } from "@prisma/client";
+import { Prisma } from "@prisma/client";
+import { assertSupportedRoleTools } from "../agent/roleTools.js";
+
+export interface ProviderConnectionRow {
+  readonly organizationId: string;
+  readonly providerId: string;
+  readonly mode: "BYOK" | "PLATFORM_MANAGED";
+  readonly baseUrl: string | null;
+  readonly hasAuthToken: boolean;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export async function getProviderConnection(
+  prisma: PrismaClient,
+  organizationId: string,
+): Promise<ProviderConnectionRow> {
+  const row = await prisma.organizationProviderConnection.findUnique({
+    where: { organizationId },
+  });
+  if (row === null) {
+    return {
+      organizationId,
+      providerId: "openrouter",
+      mode: "PLATFORM_MANAGED",
+      baseUrl: null,
+      hasAuthToken: false,
+      createdAt: "",
+      updatedAt: "",
+    };
+  }
+  return {
+    organizationId: row.organizationId,
+    providerId: row.providerId,
+    mode: row.mode,
+    baseUrl: row.baseUrl,
+    hasAuthToken: row.authToken !== null && row.authToken !== "",
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export async function upsertProviderConnection(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly providerId?: string | undefined;
+    readonly mode: "BYOK" | "PLATFORM_MANAGED";
+    readonly baseUrl?: string | null | undefined;
+    readonly authToken?: string | null | undefined;
+  },
+): Promise<ProviderConnectionRow> {
+  const providerId = input.providerId ?? "openrouter";
+  if (providerId.trim() === "") throw new Error("providerId is required");
+
+  const baseUrl =
+    input.baseUrl === undefined || input.baseUrl === null
+      ? null
+      : input.baseUrl.trim() === ""
+        ? null
+        : input.baseUrl.trim();
+
+  const authToken =
+    input.authToken === undefined || input.authToken === null
+      ? undefined
+      : input.authToken === ""
+        ? null
+        : input.authToken;
+
+  const row = await prisma.organizationProviderConnection.upsert({
+    where: { organizationId: input.organizationId },
+    create: {
+      organizationId: input.organizationId,
+      providerId,
+      mode: input.mode,
+      baseUrl,
+      ...(authToken !== undefined ? { authToken } : {}),
+    },
+    update: {
+      providerId,
+      mode: input.mode,
+      baseUrl,
+      ...(authToken !== undefined ? { authToken } : {}),
+    },
+  });
+  return {
+    organizationId: row.organizationId,
+    providerId: row.providerId,
+    mode: row.mode,
+    baseUrl: row.baseUrl,
+    hasAuthToken: row.authToken !== null && row.authToken !== "",
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export interface OrgModelRow {
+  readonly id: string;
+  readonly modelId: string;
+  readonly label: string;
+  readonly toolCapable: boolean;
+  readonly sortKey: string;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export async function listOrgModels(
+  prisma: PrismaClient,
+  organizationId: string,
+): Promise<readonly OrgModelRow[]> {
+  const rows = await prisma.orgModel.findMany({
+    where: { organizationId },
+    orderBy: [{ sortKey: "asc" }, { createdAt: "asc" }],
+  });
+  return rows.map(toModelRow);
+}
+
+export async function createOrgModel(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly modelId: string;
+    readonly label: string;
+    readonly toolCapable?: boolean | undefined;
+    readonly sortKey?: string | undefined;
+  },
+): Promise<OrgModelRow> {
+  const modelId = requireNonEmpty(input.modelId, "modelId");
+  const label = requireNonEmpty(input.label, "label");
+  const existing = await prisma.orgModel.findUnique({
+    where: { organizationId_modelId: { organizationId: input.organizationId, modelId } },
+    select: { id: true },
+  });
+  if (existing !== null) {
+    throw new Error(`model already exists: ${modelId}`);
+  }
+  const row = await prisma.orgModel.create({
+    data: {
+      organizationId: input.organizationId,
+      modelId,
+      label,
+      ...(input.toolCapable !== undefined ? { toolCapable: input.toolCapable } : {}),
+      ...(input.sortKey !== undefined ? { sortKey: input.sortKey } : {}),
+    },
+  });
+  return toModelRow(row);
+}
+
+export async function updateOrgModel(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly id: string;
+    readonly label?: string | undefined;
+    readonly toolCapable?: boolean | undefined;
+    readonly sortKey?: string | undefined;
+    readonly modelId?: string | undefined;
+  },
+): Promise<OrgModelRow> {
+  const row = await prisma.orgModel.findUnique({ where: { id: input.id } });
+  if (row === null || row.organizationId !== input.organizationId) {
+    throw new Error(`model not found: ${input.id}`);
+  }
+  const updated = await prisma.orgModel.update({
+    where: { id: row.id },
+    data: {
+      ...(input.label !== undefined ? { label: requireNonEmpty(input.label, "label") } : {}),
+      ...(input.toolCapable !== undefined ? { toolCapable: input.toolCapable } : {}),
+      ...(input.sortKey !== undefined ? { sortKey: input.sortKey } : {}),
+      ...(input.modelId !== undefined
+        ? { modelId: requireNonEmpty(input.modelId, "modelId") }
+        : {}),
+    },
+  });
+  return toModelRow(updated);
+}
+
+export async function deleteOrgModel(
+  prisma: PrismaClient,
+  input: { readonly organizationId: string; readonly id: string },
+): Promise<{ readonly deleted: true; readonly id: string }> {
+  const row = await prisma.orgModel.findUnique({ where: { id: input.id } });
+  if (row === null || row.organizationId !== input.organizationId) {
+    throw new Error(`model not found: ${input.id}`);
+  }
+  await prisma.orgModel.delete({ where: { id: row.id } });
+  return { deleted: true as const, id: row.id };
+}
+
+export interface OrgRoleRow {
+  readonly id: string;
+  readonly roleId: string;
+  readonly label: string;
+  readonly defaultModelId: string | null;
+  readonly systemPrompt: string | null;
+  readonly tools: readonly string[] | null;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+}
+
+export async function listOrgRoles(
+  prisma: PrismaClient,
+  organizationId: string,
+): Promise<readonly OrgRoleRow[]> {
+  const rows = await prisma.orgRole.findMany({
+    where: { organizationId },
+    orderBy: [{ roleId: "asc" }],
+  });
+  return rows.map(toRoleRow);
+}
+
+export async function createOrgRole(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly roleId: string;
+    readonly label: string;
+    readonly defaultModelId?: string | null | undefined;
+    readonly systemPrompt?: string | null | undefined;
+    readonly tools?: readonly string[] | null | undefined;
+  },
+): Promise<OrgRoleRow> {
+  const roleId = requireNonEmpty(input.roleId, "roleId");
+  const label = requireNonEmpty(input.label, "label");
+  const existing = await prisma.orgRole.findUnique({
+    where: { organizationId_roleId: { organizationId: input.organizationId, roleId } },
+    select: { id: true },
+  });
+  if (existing !== null) {
+    throw new Error(`role already exists: ${roleId}`);
+  }
+  const tools = normalizeTools(input.tools);
+  const row = await prisma.orgRole.create({
+    data: {
+      organizationId: input.organizationId,
+      roleId,
+      label,
+      ...(input.defaultModelId !== undefined && input.defaultModelId !== null
+        ? { defaultModelId: input.defaultModelId }
+        : {}),
+      ...(input.defaultModelId === null ? { defaultModelId: null } : {}),
+      ...(input.systemPrompt !== undefined && input.systemPrompt !== null
+        ? { systemPrompt: input.systemPrompt }
+        : {}),
+      ...(input.systemPrompt === null ? { systemPrompt: null } : {}),
+      ...(tools !== undefined ? { tools: tools ?? Prisma.DbNull } : {}),
+    },
+  });
+  return toRoleRow(row);
+}
+
+export async function updateOrgRole(
+  prisma: PrismaClient,
+  input: {
+    readonly organizationId: string;
+    readonly id: string;
+    readonly label?: string | undefined;
+    readonly defaultModelId?: string | null | undefined;
+    readonly systemPrompt?: string | null | undefined;
+    readonly tools?: readonly string[] | null | undefined;
+    readonly roleId?: string | undefined;
+  },
+): Promise<OrgRoleRow> {
+  const row = await prisma.orgRole.findUnique({ where: { id: input.id } });
+  if (row === null || row.organizationId !== input.organizationId) {
+    throw new Error(`role not found: ${input.id}`);
+  }
+  const tools = normalizeTools(input.tools);
+  const updated = await prisma.orgRole.update({
+    where: { id: row.id },
+    data: {
+      ...(input.label !== undefined ? { label: requireNonEmpty(input.label, "label") } : {}),
+      ...(input.defaultModelId !== undefined && input.defaultModelId !== null
+        ? { defaultModelId: input.defaultModelId }
+        : {}),
+      ...(input.defaultModelId === null ? { defaultModelId: null } : {}),
+      ...(input.systemPrompt !== undefined && input.systemPrompt !== null
+        ? { systemPrompt: input.systemPrompt }
+        : {}),
+      ...(input.systemPrompt === null ? { systemPrompt: null } : {}),
+      ...(tools !== undefined ? { tools: tools ?? Prisma.DbNull } : {}),
+      ...(input.roleId !== undefined ? { roleId: requireNonEmpty(input.roleId, "roleId") } : {}),
+    },
+  });
+  return toRoleRow(updated);
+}
+
+export async function deleteOrgRole(
+  prisma: PrismaClient,
+  input: { readonly organizationId: string; readonly id: string },
+): Promise<{ readonly deleted: true; readonly id: string }> {
+  const row = await prisma.orgRole.findUnique({ where: { id: input.id } });
+  if (row === null || row.organizationId !== input.organizationId) {
+    throw new Error(`role not found: ${input.id}`);
+  }
+  await prisma.orgRole.delete({ where: { id: row.id } });
+  return { deleted: true as const, id: row.id };
+}
+
+function toModelRow(
+  row: {
+    readonly id: string;
+    readonly modelId: string;
+    readonly label: string;
+    readonly toolCapable: boolean;
+    readonly sortKey: string;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+  },
+): OrgModelRow {
+  return {
+    id: row.id,
+    modelId: row.modelId,
+    label: row.label,
+    toolCapable: row.toolCapable,
+    sortKey: row.sortKey,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+function toRoleRow(
+  row: {
+    readonly id: string;
+    readonly roleId: string;
+    readonly label: string;
+    readonly defaultModelId: string | null;
+    readonly systemPrompt: string | null;
+    readonly tools: unknown;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+  },
+): OrgRoleRow {
+  return {
+    id: row.id,
+    roleId: row.roleId,
+    label: row.label,
+    defaultModelId: row.defaultModelId,
+    systemPrompt: row.systemPrompt,
+    tools: parseTools(row.tools),
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+/**
+ * Normalize a tools input into a value safe for prisma `tools` (Json?) column.
+ * - `undefined` ⇒ omit (leave unchanged): returns `undefined`.
+ * - `null` ⇒ unrestricted role (SQL NULL): returns `null`.
+ * - array ⇒ validated against the supported role tool set (fails fast).
+ */
+function normalizeTools(
+  tools: readonly string[] | null | undefined,
+): readonly string[] | null | undefined {
+  if (tools === undefined) return undefined;
+  if (tools === null) return null;
+  const list = [...tools];
+  assertSupportedRoleTools(list);
+  return list;
+}
+
+function parseTools(tools: unknown): readonly string[] | null {
+  if (tools === null) return null;
+  if (!Array.isArray(tools)) return null;
+  return tools.filter((t): t is string => typeof t === "string");
+}
+
+function requireNonEmpty(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (trimmed === "") throw new Error(`${label} is required`);
+  return trimmed;
+}