@allbluecn/admin-app 0.1.0

package/src/server/serverFns/monitoring/get-health.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { performHealthCheck } from '@/server/observability'
+
+export const getHealthStatus = createServerFn({ method: 'GET' })
+  .handler(async () => {
+    await requireAdmin()
+
+    const current = await performHealthCheck()
+    const recent = await prisma.monitoringHealthSnapshot.findMany({
+      orderBy: { timestamp: 'desc' },
+      take: 50,
+    })
+
+    const dbStats = await prisma.monitoringRequestLog.aggregate({
+      _count: { _all: true },
+      _avg: { duration: true },
+      _min: { duration: true },
+      _max: { duration: true },
+    })
+
+    const errors = await prisma.monitoringErrorReport.aggregate({
+      _count: { _all: true },
+    })
+
+    return {
+      current,
+      recent,
+      requestStats: {
+        total: dbStats._count._all,
+        avgDuration: dbStats._avg.duration || 0,
+        minDuration: dbStats._min.duration || 0,
+        maxDuration: dbStats._max.duration || 0,
+      },
+      errorCount: errors._count._all,
+    }
+  })

package/src/server/serverFns/monitoring/get-metrics.ts

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { requireAdmin } from '@/server/auth-helpers'
+import { metrics } from '@/server/observability'
+import { prisma } from '@allbluecn/database'
+
+export const getMetrics = createServerFn({ method: 'GET' })
+  .handler(async () => {
+    await requireAdmin()
+
+    const memory = process.memoryUsage()
+    const allStats = metrics.getAllStats()
+
+    const snapshots = await prisma.monitoringMetricsSnapshot.findMany({
+      orderBy: { recordedAt: 'desc' },
+      take: 100,
+    })
+
+    return {
+      memory: {
+        rss: memory.rss,
+        heapTotal: memory.heapTotal,
+        heapUsed: memory.heapUsed,
+        external: memory.external,
+        arrayBuffers: memory.arrayBuffers,
+      },
+      current: allStats,
+      history: snapshots,
+    }
+  })

package/src/server/serverFns/monitoring/get-request-logs.ts

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+
+type GetRequestLogsInput = {
+  limit?: number
+  offset?: number
+  method?: string
+  status?: number
+  path?: string
+  excludeMonitoring?: boolean
+}
+
+const MONITORING_PREFIXES = [
+  '/api/observability/',
+  '/src/routes/',
+  '/node_modules/',
+]
+
+export const getRequestLogs = createServerFn({ method: 'GET' })
+  .validator((data: GetRequestLogsInput) => data)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+
+    const where: any = {}
+    if (data.method) where.method = data.method
+    if (data.status) where.status = data.status
+    if (data.path) where.path = { contains: data.path }
+    if (data.excludeMonitoring) {
+      where.NOT = MONITORING_PREFIXES.map((prefix) => ({
+        path: { startsWith: prefix },
+      }))
+    }
+
+    const limit = data.limit || 50
+    const offset = data.offset || 0
+
+    const [logs, total] = await Promise.all([
+      prisma.monitoringRequestLog.findMany({
+        where,
+        orderBy: { timestamp: 'desc' },
+        take: limit,
+        skip: offset,
+      }),
+      prisma.monitoringRequestLog.count({ where }),
+    ])
+
+    return { logs, total, limit, offset }
+  })

package/src/server/serverFns/monitoring/report-error.ts

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+
+type ReportErrorInput = {
+  errorName: string
+  errorMessage: string
+  stackTrace?: string
+  context?: Record<string, unknown>
+  source?: 'browser' | 'server'
+}
+
+export const reportClientError = createServerFn({ method: 'POST' })
+  .validator((data: ReportErrorInput) => data)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+
+    const key = `${data.errorName}:${data.errorMessage}`
+    await prisma.monitoringErrorReport.upsert({
+      where: { id: key },
+      create: {
+        id: key,
+        errorName: data.errorName,
+        errorMessage: data.errorMessage,
+        stackTrace: data.stackTrace || null,
+        count: 1,
+        firstSeen: new Date(),
+        lastSeen: new Date(),
+        context: (data.context as any) ?? { source: data.source || 'browser' },
+      },
+      update: {
+        count: { increment: 1 },
+        lastSeen: new Date(),
+      },
+    })
+
+    return { ok: true }
+  })

package/src/server/serverFns/monitoring/reset.ts

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { requireAdmin } from '@/server/auth-helpers'
+import { metrics, resetErrors } from '@/server/observability'
+import { prisma } from '@allbluecn/database'
+
+type ResetInput = {
+  type: 'errors' | 'metrics' | 'request-logs' | 'health' | 'all'
+  days?: number
+}
+
+export const resetMonitoring = createServerFn({ method: 'POST' })
+  .validator((data: ResetInput) => data)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+
+    const cutoff = data.days ? new Date(Date.now() - data.days * 86400000) : null
+
+    if (data.type === 'errors' || data.type === 'all') {
+      resetErrors()
+      if (cutoff) {
+        await prisma.monitoringErrorReport.deleteMany({ where: { lastSeen: { lt: cutoff } } })
+      } else {
+        await prisma.monitoringErrorReport.deleteMany()
+      }
+    }
+
+    if (data.type === 'metrics' || data.type === 'all') {
+      metrics.reset()
+      if (cutoff) {
+        await prisma.monitoringMetricsSnapshot.deleteMany({ where: { recordedAt: { lt: cutoff } } })
+      } else {
+        await prisma.monitoringMetricsSnapshot.deleteMany()
+      }
+    }
+
+    if (data.type === 'request-logs' || data.type === 'all') {
+      if (cutoff) {
+        await prisma.monitoringRequestLog.deleteMany({ where: { timestamp: { lt: cutoff } } })
+      } else {
+        await prisma.monitoringRequestLog.deleteMany()
+      }
+    }
+
+    if (data.type === 'health' || data.type === 'all') {
+      if (cutoff) {
+        await prisma.monitoringHealthSnapshot.deleteMany({ where: { timestamp: { lt: cutoff } } })
+      } else {
+        await prisma.monitoringHealthSnapshot.deleteMany()
+      }
+    }
+
+    return { ok: true }
+  })

package/src/server/serverFns/permissions.ts

@@ -0,0 +1,214 @@
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { requireFeature } from '@/server/entitlements'
+import { getProService } from '@/server/pro-services'
+
+type SystemRolePreset = {
+  name: string
+  permissions: Record<string, 'admin' | 'write' | 'read' | 'none'>
+}
+
+function buildSystemRolePresets(): SystemRolePreset[] {
+  const R = 'admin'
+  const W = 'write'
+  const R2 = 'read'
+  const N = 'none'
+
+  const base: Record<string, 'admin' | 'write' | 'read' | 'none'> = {
+    'knowledge:read': R,
+    'knowledge:write': R,
+    'knowledge:delete': R,
+    'story:read': R,
+    'story:write': R,
+    'story:publish': R,
+    'story:delete': R,
+    'user:read': R,
+    'user:write': R,
+    'user:delete': R,
+    'setting:read': R,
+    'setting:write': R,
+    'billing:read': R,
+    'billing:write': R,
+  }
+
+  return [
+    { name: 'owner', permissions: { ...base } },
+    {
+      name: 'admin',
+      permissions: { ...base, 'user:delete': N, 'billing:write': N },
+    },
+    {
+      name: 'member',
+      permissions: {
+        ...base,
+        'knowledge:delete': N,
+        'story:publish': N,
+        'story:delete': N,
+        'user:read': N,
+        'user:write': N,
+        'user:delete': N,
+        'setting:write': N,
+        'billing:read': N,
+        'billing:write': N,
+      },
+    },
+    {
+      name: 'editor',
+      permissions: {
+        'knowledge:read': R2,
+        'knowledge:write': W,
+        'knowledge:delete': N,
+        'story:read': R2,
+        'story:write': W,
+        'story:publish': N,
+        'story:delete': N,
+        'user:read': N,
+        'user:write': N,
+        'user:delete': N,
+        'setting:read': N,
+        'setting:write': N,
+        'billing:read': N,
+        'billing:write': N,
+      },
+    },
+    {
+      name: 'viewer',
+      permissions: {
+        'knowledge:read': R2,
+        'knowledge:write': N,
+        'knowledge:delete': N,
+        'story:read': R2,
+        'story:write': N,
+        'story:publish': N,
+        'story:delete': N,
+        'user:read': N,
+        'user:write': N,
+        'user:delete': N,
+        'setting:read': N,
+        'setting:write': N,
+        'billing:read': N,
+        'billing:write': N,
+      },
+    },
+  ]
+}
+
+export const listRolesFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ workspaceId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+
+    const systemCount = await prisma.customRole.count({
+      where: { workspaceId: data.workspaceId, isSystem: true },
+    })
+    if (systemCount === 0 && getProService('permissions')) {
+      const presets = buildSystemRolePresets()
+      for (const preset of presets) {
+        await prisma.customRole.create({
+          data: {
+            workspaceId: data.workspaceId,
+            name: preset.name,
+            permissions: preset.permissions as never,
+            isSystem: true,
+          },
+        })
+      }
+      const admins = await prisma.user.findMany({
+        where: { role: 'ADMIN' },
+        select: { id: true },
+      })
+      const ownerRole = await prisma.customRole.findFirst({
+        where: { workspaceId: data.workspaceId, name: 'owner', isSystem: true },
+      })
+      if (ownerRole && admins.length > 0) {
+        await prisma.roleAssignment.createMany({
+          data: admins.map(({ id }: { id: string }) => ({ userId: id, roleId: ownerRole.id })),
+          skipDuplicates: true,
+        })
+      }
+    }
+
+    const [items, total] = await Promise.all([
+      prisma.customRole.findMany({
+        where: { workspaceId: data.workspaceId },
+        include: { _count: { select: { assignments: true } } },
+        orderBy: { createdAt: 'desc' },
+      }),
+      prisma.customRole.count({ where: { workspaceId: data.workspaceId } }),
+    ])
+    return { items, total, seeded: systemCount > 0 ? 'done' : 'pending' }
+  })
+
+export const createRoleFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      workspaceId: z.string(),
+      name: z.string(),
+      permissions: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null(), z.any()])).optional(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    return prisma.customRole.create({
+      data: {
+        workspaceId: data.workspaceId,
+        name: data.name,
+        permissions: (data.permissions ?? {}) as never,
+        isSystem: false,
+      },
+    })
+  })
+
+export const deleteRoleFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ roleId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    await prisma.customRole.delete({ where: { id: data.roleId } })
+    return { success: true }
+  })
+
+export const assignRoleFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ userId: z.string(), roleId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    await prisma.roleAssignment.create({ data: { userId: data.userId, roleId: data.roleId } })
+    return { ok: true }
+  })
+
+export const unassignRoleFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ assignmentId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    await prisma.roleAssignment.delete({ where: { id: data.assignmentId } })
+    return { ok: true }
+  })
+
+export const listRoleAssignmentsFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ roleId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    return prisma.roleAssignment.findMany({
+      where: { roleId: data.roleId },
+      include: { user: { select: { id: true, username: true, email: true } } },
+      orderBy: { createdAt: 'desc' },
+    })
+  })
+
+export const listWorkspacesFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async () => {
+    await requireAdmin()
+    await requireFeature(undefined, 'advancedPermissions')
+    return prisma.workspace.findMany({
+      select: { id: true, name: true },
+      orderBy: { name: 'asc' },
+    })
+  })

package/src/server/serverFns/sentry/config.ts

@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+
+export type SentryConfig = {
+  dsn: string
+  org: string
+  project: string
+  authToken: string
+}
+
+export const getSentryConfig = createServerFn({ method: 'GET' })
+  .handler(async () => {
+    await requireAdmin()
+
+    const settings = await prisma.systemSetting.findMany({
+      where: { category: 'sentry' },
+    })
+
+    const map = new Map(settings.map((s) => [s.key, s.value]))
+
+    return {
+      dsn: map.get('dsn') || '',
+      org: map.get('org') || '',
+      project: map.get('project') || '',
+      authToken: map.get('auth_token') || '',
+    } satisfies SentryConfig
+  })
+
+export const saveSentryConfig = createServerFn({ method: 'POST' })
+  .validator((data: SentryConfig) => data)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+
+    const entries: { key: string; value: string; category: string; desc: string }[] = [
+      { key: 'dsn', value: data.dsn, category: 'sentry', desc: 'Sentry DSN（客户端/服务端共用）' },
+      { key: 'org', value: data.org, category: 'sentry', desc: 'Sentry 组织 slug' },
+      { key: 'project', value: data.project, category: 'sentry', desc: 'Sentry 项目 slug' },
+      { key: 'auth_token', value: data.authToken, category: 'sentry', desc: 'Sentry Auth Token（源码映射上传用）' },
+    ]
+
+    for (const entry of entries) {
+      await prisma.systemSetting.upsert({
+        where: { key: entry.key },
+        create: entry,
+        update: { value: entry.value },
+      })
+    }
+
+    return { ok: true }
+  })
+
+export const reconfigureSentryServer = createServerFn({ method: 'POST' })
+  .validator((data: { dsn: string }) => data)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+
+    if (!data.dsn) {
+      return { ok: false, error: 'DSN 为空，跳过服务端 Sentry 初始化' }
+    }
+
+    const Sentry = await import('@sentry/tanstackstart-react')
+    Sentry.init({
+      dsn: data.dsn,
+      environment: process.env.SENTRY_ENVIRONMENT || process.env.NODE_ENV,
+      tracesSampleRate: 1.0,
+      enableLogs: true,
+    })
+
+    return { ok: true }
+  })

package/src/server/serverFns/sso-config.ts

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { requireFeature } from '@/server/entitlements'
+
+export const listSsoProvidersFn = createServerFn({ method: 'GET' })
+  .validator(z.object({ workspaceId: z.string().optional() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'sso')
+    const where: any = data.workspaceId ? { workspaceId: data.workspaceId } : {}
+    const [items, total] = await Promise.all([
+      prisma.ssoProvider.findMany({
+        where,
+        include: { _count: { select: { mappings: true } } },
+        orderBy: { createdAt: 'desc' },
+      }),
+      prisma.ssoProvider.count({ where }),
+    ])
+    return { items, total }
+  })
+
+export const createSsoProviderFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      workspaceId: z.string(),
+      type: z.string(),
+      name: z.string(),
+      config: z.record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.null(), z.any()])).optional(),
+      domain: z.string().optional(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'sso')
+    return prisma.ssoProvider.create({
+      data: {
+        workspaceId: data.workspaceId,
+        type: data.type,
+        name: data.name,
+        config: (data.config ?? {}) as never,
+        domain: data.domain,
+      },
+    })
+  })
+
+export const deleteSsoProviderFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ providerId: z.string() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'sso')
+    await prisma.ssoProvider.delete({ where: { id: data.providerId } })
+    return { success: true }
+  })
+
+export const toggleSsoProviderFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ providerId: z.string(), enabled: z.boolean() }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await requireFeature(undefined, 'sso')
+    return prisma.ssoProvider.update({
+      where: { id: data.providerId },
+      data: { enabled: data.enabled },
+    })
+  })