feat: add deployable alpha silo

hub/src/org/members.ts

@@ -8,11 +8,13 @@
  * 4. ADMIN cannot modify OWNER memberships.
  */
 import type { OrganizationMemberRole, Prisma, PrismaClient } from "@prisma/client";
+import { upsertScopedFeishuIdentityInTransaction } from "../feishu/identityNamespace.js";
 import { lockActiveOrganization } from "./status.js";
 
 export interface OrgMemberRow {
   readonly userId: string;
-  readonly feishuOpenId: string;
+  readonly feishuOpenId: string | null;
+  readonly identityStatus: "SCOPED" | "UNLINKED";
   readonly displayName: string;
   readonly avatarUrl: string | null;
   readonly role: OrganizationMemberRole;
@@ -29,14 +31,24 @@ export async function listOrgMembers(
       role: true,
       createdAt: true,
       user: {
-        select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+        select: {
+          id: true,
+          displayName: true,
+          avatarUrl: true,
+          feishuIdentities: {
+            where: { connection: { organizationId } },
+            select: { openId: true },
+            take: 1,
+          },
+        },
       },
     },
     orderBy: [{ role: "asc" }, { createdAt: "asc" }],
   });
   return rows.map((row) => ({
     userId: row.user.id,
-    feishuOpenId: row.user.feishuOpenId,
+    feishuOpenId: row.user.feishuIdentities[0]?.openId ?? null,
+    identityStatus: row.user.feishuIdentities.length === 1 ? "SCOPED" : "UNLINKED",
     displayName: row.user.displayName,
     avatarUrl: row.user.avatarUrl,
     role: row.role,
@@ -57,39 +69,47 @@ export async function addOrgMember(
   const openId = requireNonEmpty(input.feishuOpenId, "feishuOpenId");
   assertCanAssignRole(input.actorRole, input.role, /* targetIsOwner */ false);
 
-  const { user, membership } = await prisma.$transaction(async (tx) => {
+  const { identity, membership } = await prisma.$transaction(async (tx) => {
     await lockActiveOrganization(tx, input.organizationId);
-    const user = await tx.user.upsert({
-      where: { feishuOpenId: openId },
-      create: {
-        feishuOpenId: openId,
-        displayName: input.displayName?.trim() || openId,
-      },
-      update: {
-        ...(input.displayName !== undefined && input.displayName.trim() !== ""
-          ? { displayName: input.displayName.trim() }
-          : {}),
+    const connection = await tx.organizationFeishuApplicationConnection.findUnique({
+      where: { organizationId: input.organizationId },
+      select: {
+        id: true,
+        status: true,
+        activeSecretVersion: { select: { connectionId: true, retiredAt: true } },
       },
     });
+    if (connection === null || connection.status !== "ACTIVE" || connection.activeSecretVersion === null ||
+        connection.activeSecretVersion.connectionId !== connection.id ||
+        connection.activeSecretVersion.retiredAt !== null) {
+      throw new Error("active Feishu Application Connection not found");
+    }
+    const identity = await upsertScopedFeishuIdentityInTransaction(tx, {
+      connectionId: connection.id,
+      expectedOrganizationId: input.organizationId,
+      openId,
+      displayName: input.displayName?.trim() || openId,
+    });
     const existing = await tx.organizationMembership.findFirst({
-      where: { organizationId: input.organizationId, userId: user.id, revokedAt: null },
+      where: { organizationId: input.organizationId, userId: identity.userId, revokedAt: null },
     });
-    if (existing !== null) throw new Error(`user ${user.id} is already an active member`);
+    if (existing !== null) throw new Error(`user ${identity.userId} is already an active member`);
     const membership = await tx.organizationMembership.create({
       data: {
         organizationId: input.organizationId,
-        userId: user.id,
+        userId: identity.userId,
         role: input.role,
       },
     });
-    return { user, membership };
+    return { identity, membership };
   });
 
   return {
-    userId: user.id,
-    feishuOpenId: user.feishuOpenId,
-    displayName: user.displayName,
-    avatarUrl: user.avatarUrl,
+    userId: identity.userId,
+    feishuOpenId: identity.openId,
+    identityStatus: "SCOPED",
+    displayName: identity.displayName,
+    avatarUrl: identity.avatarUrl,
     role: membership.role,
     createdAt: membership.createdAt.toISOString(),
   };
@@ -118,7 +138,16 @@ export async function setOrgMemberRole(
         role: true,
         createdAt: true,
         user: {
-          select: { id: true, feishuOpenId: true, displayName: true, avatarUrl: true },
+          select: {
+            id: true,
+            displayName: true,
+            avatarUrl: true,
+            feishuIdentities: {
+              where: { connection: { organizationId: input.organizationId } },
+              select: { openId: true },
+              take: 1,
+            },
+          },
         },
       },
     });
@@ -139,7 +168,8 @@ export async function setOrgMemberRole(
 
     return {
       userId: membership.user.id,
-      feishuOpenId: membership.user.feishuOpenId,
+      feishuOpenId: membership.user.feishuIdentities[0]?.openId ?? null,
+      identityStatus: membership.user.feishuIdentities.length === 1 ? "SCOPED" : "UNLINKED",
       displayName: membership.user.displayName,
       avatarUrl: membership.user.avatarUrl,
       role: updated.role,

hub/src/org/teams.ts

@@ -168,16 +168,30 @@ export async function listTeamMembers(
     where: { teamId: input.teamId, revokedAt: null },
     select: {
       createdAt: true,
-      user: { select: { id: true, feishuOpenId: true, displayName: true } },
+      user: {
+        select: {
+          id: true,
+          feishuOpenId: true,
+          displayName: true,
+          feishuIdentities: {
+            where: { connection: { organizationId: input.organizationId } },
+            select: { openId: true },
+            take: 1,
+          },
+        },
+      },
     },
     orderBy: { createdAt: "asc" },
   });
-  return rows.map((row) => ({
-    userId: row.user.id,
-    feishuOpenId: row.user.feishuOpenId,
-    displayName: row.user.displayName,
-    createdAt: row.createdAt.toISOString(),
-  }));
+  return rows.map((row) => {
+    const identity = row.user.feishuIdentities[0];
+    return {
+      userId: row.user.id,
+      feishuOpenId: identity?.openId ?? row.user.feishuOpenId,
+      displayName: row.user.displayName,
+      createdAt: row.createdAt.toISOString(),
+    };
+  });
 }
 
 export async function addTeamMember(
@@ -244,23 +258,44 @@ export async function revokeTeamMember(
 
 async function resolveUser(
   prisma: PrismaClient | Prisma.TransactionClient,
-  input: { readonly userId?: string | undefined; readonly feishuOpenId?: string | undefined },
+  input: {
+    readonly organizationId: string;
+    readonly userId?: string | undefined;
+    readonly feishuOpenId?: string | undefined;
+  },
 ): Promise<{ readonly id: string; readonly feishuOpenId: string; readonly displayName: string }> {
   if (input.userId !== undefined && input.userId !== "") {
     const user = await prisma.user.findUnique({
       where: { id: input.userId },
-      select: { id: true, feishuOpenId: true, displayName: true },
+      select: {
+        id: true,
+        feishuOpenId: true,
+        displayName: true,
+        feishuIdentities: {
+          where: { connection: { organizationId: input.organizationId } },
+          select: { openId: true },
+          take: 1,
+        },
+      },
     });
     if (user === null) throw new Error(`user not found: ${input.userId}`);
-    return user;
+    const identity = user.feishuIdentities[0];
+    return {
+      id: user.id,
+      feishuOpenId: identity?.openId ?? user.feishuOpenId,
+      displayName: user.displayName,
+    };
   }
   if (input.feishuOpenId !== undefined && input.feishuOpenId !== "") {
-    const user = await prisma.user.findUnique({
-      where: { feishuOpenId: input.feishuOpenId },
-      select: { id: true, feishuOpenId: true, displayName: true },
+    const identity = await prisma.feishuUserIdentity.findFirst({
+      where: {
+        openId: input.feishuOpenId,
+        connection: { organizationId: input.organizationId, status: "ACTIVE" },
+      },
+      select: { openId: true, user: { select: { id: true, displayName: true } } },
     });
-    if (user === null) throw new Error(`user not found: ${input.feishuOpenId}`);
-    return user;
+    if (identity === null) throw new Error(`user not found in organization: ${input.feishuOpenId}`);
+    return { id: identity.user.id, feishuOpenId: identity.openId, displayName: identity.user.displayName };
   }
   throw new Error("userId or feishuOpenId is required");
 }