@oj-module/cli 0.1.21 → 0.2.2

package/templates/web/src/system/__client/api.ts

@@ -0,0 +1,358 @@
+/* eslint-disable */
+// 生成物：ojm api 从契约生成，勿手改（改动请改契约文件后重跑 ojm api）
+import { ContractApiError } from "@oj-module/runtime/contract/errors";
+import type { ScopedRequestLike } from "@oj-module/runtime/contract/errors";
+import type { ModuleContext } from "@oj-module/runtime";
+import type { z } from "@oj-module/runtime";
+import type { schemas } from "./api.schemas";
+
+/** oj 信封（AC-D16）：code=0 成功；非 0 时 HTTP status=code，由 toApiError 归一为 ContractApiError */
+interface OjEnvelope<T> { code: number, msg?: string, data?: T }
+
+let req: ScopedRequestLike | undefined;
+
+/** 线上 API 前缀（ojm api 从契约抽取，唯一真源，勿手改）：请求基址 + 前缀登记用 */
+export const API_PREFIX = "/system";
+
+/** 认领身份前缀（契约 apiPrefix，字面等于模块目录名）：跨模块认领护栏对比基准 */
+export const MODULE_PREFIX = "/system";
+
+/**
+ * 模块 entry 的 onInit 里一行创建（构造即 install）：完成 apiPrefix 登记 +
+ * scoped request 绑定，返回绑好前缀的端点函数集合。一模块一 client；
+ * 重复构造幂等安全（前缀重复登记同值、request 重绑同值）。
+ */
+export function createSystemClient(ctx: ModuleContext) {
+	// 跨模块认领护栏（DEV）：工厂知道自己该属于谁（MODULE_PREFIX = 契约 apiPrefix），
+	// ctx 又带 module.name——名实不符说明别的模块在替本模块创建 client，会共享 request
+	// 单槽、卸载互相耦合；跨模块需求应由本模块创建后经 provider 暴露。
+	// 注意对比基准是 MODULE_PREFIX（目录名）而非 API_PREFIX——D-M8 映射时线上前缀
+	// 属于别的命名空间，认领身份仍按目录名。
+	if (import.meta.env.DEV && ctx.module.name !== MODULE_PREFIX.slice(1)) {
+		console.warn(`[ojm-api] 模块 "${ctx.module.name}" 正在认领 ${MODULE_PREFIX} 的 client——跨模块认领会共享 request 单槽、卸载互相耦合；应由 "${MODULE_PREFIX.slice(1)}" 模块在自身 onInit 创建，跨模块需求经 provider 暴露。`);
+	}
+	ctx.register.apiPrefix(API_PREFIX);
+	bindRequest(ctx.utils.request);
+	return { systemLoginMethodsGet, systemOplogGet, systemPermissionsGet, systemRolesGet, systemRolesPost, systemRolesDelete, systemRolesBindingsPut, systemSettingsGet, systemSettingsPut, systemUsersGet, systemUsersPost, systemUsersForbiddenPut, systemUsersPasswordPut, systemUsersRolesPut };
+}
+
+/**
+ * @deprecated 请改用 createSystemClient(ctx)——工厂构造即完成
+ * 前缀登记 + request 绑定，不会出现「登记了前缀没绑 request」的半接线状态。
+ */
+export function bindRequest(r: ScopedRequestLike): void {
+	req = r;
+}
+
+function ensureReq(): ScopedRequestLike {
+	if (!req)
+		throw new ContractApiError(-1, "[ojm-api] 请求未绑定——请在模块 entry.ts 的 onInit 里调用 createSystemClient(ctx)（或 bindRequest(ctx.utils.request)）。");
+	return req;
+}
+
+/** ky HTTPError → ContractApiError（错误体为信封时取 code/msg）；契约违例与原错误原样透传 */
+async function toApiError(e: unknown): Promise<unknown> {
+	if (e instanceof ContractApiError)
+		return e;
+	// ky 2.x 构造 HTTPError 时已用 getReader() 消费掉原 response 体（res.clone().json() 按规范抛 TypeError，
+	// 体方法一律失效），解析好的错误体在公开字段 error.data——故读 error.data，勿改回 clone().json()。
+	const err = e as { data?: { code?: unknown, msg?: string }, response?: Response } | null;
+	const res = err?.response;
+	const d = err?.data;
+	if (res instanceof Response && d && typeof d.code === "number")
+		return new ContractApiError(d.code, d.msg ?? res.statusText);
+	return e;
+}
+
+export type SystemLoginMethodsGetData = z.infer<(typeof schemas)["systemLoginMethodsGet"]["data"]>;
+
+export async function systemLoginMethodsGet(): Promise<SystemLoginMethodsGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/login-methods`).json<OjEnvelope<SystemLoginMethodsGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemLoginMethodsGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemLoginMethodsGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemLoginMethodsGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemOplogGetQuery = z.input<(typeof schemas)["systemOplogGet"]["query"]>;
+export type SystemOplogGetData = z.infer<(typeof schemas)["systemOplogGet"]["data"]>;
+
+export async function systemOplogGet(query: SystemOplogGetQuery): Promise<SystemOplogGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/oplog`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemOplogGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemOplogGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemOplogGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemOplogGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemPermissionsGetData = z.infer<(typeof schemas)["systemPermissionsGet"]["data"]>;
+
+export async function systemPermissionsGet(): Promise<SystemPermissionsGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/permissions`).json<OjEnvelope<SystemPermissionsGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemPermissionsGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemPermissionsGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemPermissionsGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemRolesGetData = z.infer<(typeof schemas)["systemRolesGet"]["data"]>;
+
+export async function systemRolesGet(): Promise<SystemRolesGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/roles`).json<OjEnvelope<SystemRolesGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemRolesGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemRolesGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemRolesGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemRolesPostBody = z.input<(typeof schemas)["systemRolesPost"]["body"]>;
+export type SystemRolesPostData = z.infer<(typeof schemas)["systemRolesPost"]["data"]>;
+
+export async function systemRolesPost(body: SystemRolesPostBody): Promise<SystemRolesPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`system/roles`, { json: body }).json<OjEnvelope<SystemRolesPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemRolesPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemRolesPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemRolesPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemRolesDeleteQuery = z.input<(typeof schemas)["systemRolesDelete"]["query"]>;
+
+export async function systemRolesDelete(query: SystemRolesDeleteQuery): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.delete(`system/roles`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemRolesBindingsPutQuery = z.input<(typeof schemas)["systemRolesBindingsPut"]["query"]>;
+export type SystemRolesBindingsPutBody = z.input<(typeof schemas)["systemRolesBindingsPut"]["body"]>;
+
+export async function systemRolesBindingsPut(input: { query: SystemRolesBindingsPutQuery, body: SystemRolesBindingsPutBody }): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/roles/bindings`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemSettingsGetData = z.infer<(typeof schemas)["systemSettingsGet"]["data"]>;
+
+export async function systemSettingsGet(): Promise<SystemSettingsGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/settings`).json<OjEnvelope<SystemSettingsGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemSettingsGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemSettingsGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemSettingsGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemSettingsPutBody = z.input<(typeof schemas)["systemSettingsPut"]["body"]>;
+
+export async function systemSettingsPut(body: SystemSettingsPutBody): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/settings`, { json: body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersGetData = z.infer<(typeof schemas)["systemUsersGet"]["data"]>;
+
+export async function systemUsersGet(): Promise<SystemUsersGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/users`).json<OjEnvelope<SystemUsersGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemUsersGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersPostBody = z.input<(typeof schemas)["systemUsersPost"]["body"]>;
+export type SystemUsersPostData = z.infer<(typeof schemas)["systemUsersPost"]["data"]>;
+
+export async function systemUsersPost(body: SystemUsersPostBody): Promise<SystemUsersPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`system/users`, { json: body }).json<OjEnvelope<SystemUsersPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemUsersPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersForbiddenPutQuery = z.input<(typeof schemas)["systemUsersForbiddenPut"]["query"]>;
+export type SystemUsersForbiddenPutBody = z.input<(typeof schemas)["systemUsersForbiddenPut"]["body"]>;
+
+export async function systemUsersForbiddenPut(input: { query: SystemUsersForbiddenPutQuery, body: SystemUsersForbiddenPutBody }): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/users/forbidden`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersPasswordPutQuery = z.input<(typeof schemas)["systemUsersPasswordPut"]["query"]>;
+export type SystemUsersPasswordPutBody = z.input<(typeof schemas)["systemUsersPasswordPut"]["body"]>;
+
+export async function systemUsersPasswordPut(input: { query: SystemUsersPasswordPutQuery, body: SystemUsersPasswordPutBody }): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/users/password`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersRolesPutQuery = z.input<(typeof schemas)["systemUsersRolesPut"]["query"]>;
+export type SystemUsersRolesPutBody = z.input<(typeof schemas)["systemUsersRolesPut"]["body"]>;
+
+export async function systemUsersRolesPut(input: { query: SystemUsersRolesPutQuery, body: SystemUsersRolesPutBody }): Promise<unknown> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/users/roles`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<unknown>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as unknown;
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}

package/templates/web/src/system/entry.ts

@@ -0,0 +1,90 @@
+import type { AppRouteRecordRaw } from "@oj-module/runtime";
+
+import { SettingOutlined } from "@ant-design/icons";
+import { defineModule } from "@oj-module/runtime";
+
+import { createElement, lazy } from "react";
+
+import { createSystemClient } from "./__client/api";
+
+const Users = lazy(() => import("./pages/users"));
+const UserRoles = lazy(() => import("./pages/users/roles"));
+const Roles = lazy(() => import("./pages/roles"));
+const Oplog = lazy(() => import("./pages/oplog"));
+const Settings = lazy(() => import("./pages/settings"));
+const LoginMethods = lazy(() => import("./pages/login-methods"));
+
+const routes: AppRouteRecordRaw[] = [
+	{
+		path: "/system",
+		handle: {
+			icon: createElement(SettingOutlined),
+			title: "system:menu.system",
+			order: 100,
+			layout: "container",
+		},
+		children: [
+			{
+				path: "/system/users",
+				Component: Users,
+				handle: { title: "system:menu.users" },
+			},
+			{
+				// 成员资格（superadmin 入口从用户管理页进入，菜单不出现）
+				path: "/system/users/:uid/roles",
+				Component: UserRoles,
+				handle: { title: "system:menu.userRoles", hideInMenu: true },
+			},
+			{
+				path: "/system/roles",
+				Component: Roles,
+				handle: { title: "system:menu.roles" },
+			},
+			{
+				path: "/system/oplog",
+				Component: Oplog,
+				handle: { title: "system:menu.oplog" },
+			},
+			{
+				path: "/system/settings",
+				Component: Settings,
+				handle: { title: "system:menu.settings" },
+			},
+			{
+				path: "/system/login-methods",
+				Component: LoginMethods,
+				handle: { title: "system:menu.loginMethods" },
+			},
+		],
+	},
+];
+
+/**
+ * system 模块：框架管理面（用户/成员资格/角色权限/操作日志/站点设置/登录方式），
+ * 数据源为 oj 后端 /api/system/*（模板 api 模块）。__client 不随模板分发——
+ * init 后 `oj openapi -o openapi.json` + `ojm api` 生成（生成前本文件 ts 报红属预期，
+ * devkit manual §2.2）。
+ */
+export default defineModule({
+	name: "system",
+	description: "系统管理模块（框架管理面）",
+	version: "0.1.0",
+	peerRuntime: ">=0.0.0",
+	// 路由级门禁（B16）：非系统管理员不注入 /system 路由、菜单不可见；
+	// API 级 403 由 assertSystemAdmin + service 层硬 enforcement 兜底。
+	// 角色口径对齐后端 assertSystemAdmin（access.ts:90）——superadmin **或**
+	// admin 均可；seed 的 admin 账号只有 superadmin，写 ["admin"] 会把它自己挡在门外。
+	config: { requiredRoles: ["admin", "superadmin"] },
+	routes,
+	i18n: {
+		"zh-CN": () => import("./locales/zh-CN.json"),
+		"en-US": () => import("./locales/en-US.json"),
+	},
+	lifecycle: {
+		async onInit(ctx) {
+			// 构造即接线：登记 /system 前缀 + 绑定 scoped request（D11 前缀收敛），
+			// 页面直接 import 生成的端点函数（模块级单槽 req 已由本调用绑定）。
+			createSystemClient(ctx);
+		},
+	},
+});

package/templates/web/src/system/locales/en-US.json

@@ -0,0 +1,98 @@
+{
+	"menu": {
+		"system": "System",
+		"users": "Users",
+		"userRoles": "Membership",
+		"roles": "Roles & Permissions",
+		"oplog": "Audit Log",
+		"settings": "Site Settings",
+		"loginMethods": "Login Methods"
+	},
+	"common": {
+		"confirm": "Confirm",
+		"cancel": "Cancel",
+		"save": "Save",
+		"saved": "Saved",
+		"search": "Search",
+		"reset": "Reset",
+		"create": "Create"
+	},
+	"users": {
+		"create": "Create User",
+		"resetPwd": "Reset Password",
+		"forbidden": "Forbidden",
+		"createOk": "User created: password change required on first login",
+		"firstLoginHint": "Must change on first login",
+		"membership": "Membership",
+		"pwdPlaceholder": "At least 6 characters",
+		"columns": {
+			"username": "Username",
+			"displayName": "Display Name",
+			"email": "Email",
+			"roles": "Roles",
+			"status": "Status",
+			"actions": "Actions"
+		}
+	},
+	"userRoles": {
+		"title": "Membership",
+		"saved": "Roles updated",
+		"none": "(no roles)"
+	},
+	"rolesPage": {
+		"tabRoles": "Roles",
+		"tabPerms": "Permissions",
+		"builtin": "Built-in",
+		"deprecated": "Deprecated",
+		"holders": "Holders",
+		"permissions": "Bound Permissions",
+		"titleKey": "Title Key",
+		"readonlyHint": "Read-only view: roles and bindings are managed by solution tooling (upsertSolutionPerms)"
+	},
+	"oplog": {
+		"filterAction": "Action",
+		"filterUsername": "Username (prefix)",
+		"filterModule": "Module",
+		"filterLimit": "Limit",
+		"truncated": "Results truncated by limit; narrow your filters",
+		"columns": {
+			"time": "Time",
+			"username": "Username",
+			"action": "Action",
+			"module": "Module",
+			"target": "Target",
+			"detail": "Detail",
+			"level": "Level"
+		}
+	},
+	"settingsPage": {
+		"secretHint": "Secret items cannot be edited online",
+		"saved": "Settings saved"
+	},
+	"loginMethodsPage": {
+		"title": "Enabled login methods",
+		"methodLocal": "Local password",
+		"methodLdap": "LDAP",
+		"methodSso": "SSO"
+	},
+	"err": {
+		"forbidden": "Forbidden",
+		"selfAction": "You cannot perform this action on yourself",
+		"pwdTooShort": "Password must be at least 6 characters",
+		"usernameExists": "Username already exists",
+		"usernameReserved": "This username prefix is reserved for external identity sources",
+		"mustChange": {
+			"title": "Password change required",
+			"hint": "This account must change its password before admin features become available.",
+			"go": "Change password now"
+		}
+	},
+	"setting": {
+		"site_title": "Site Title",
+		"ldap_enabled": "Enable LDAP login",
+		"sso_enabled": "Enable SSO login",
+		"ldap_base_dn": "LDAP Base DN",
+		"ldap_uid_attr": "LDAP UID Attribute",
+		"ldap_email_attr": "LDAP Email Attribute"
+	}
+}

package/templates/web/src/system/locales/zh-CN.json

@@ -0,0 +1,98 @@
+{
+	"menu": {
+		"system": "系统管理",
+		"users": "用户管理",
+		"userRoles": "成员资格",
+		"roles": "角色权限",
+		"oplog": "操作日志",
+		"settings": "站点设置",
+		"loginMethods": "登录方式"
+	},
+	"common": {
+		"confirm": "确认",
+		"cancel": "取消",
+		"save": "保存",
+		"saved": "已保存",
+		"search": "查询",
+		"reset": "重置",
+		"create": "新建"
+	},
+	"users": {
+		"create": "建号",
+		"resetPwd": "重置口令",
+		"forbidden": "禁用",
+		"createOk": "建号成功，首次登录须改密",
+		"firstLoginHint": "首登改密",
+		"membership": "成员资格",
+		"pwdPlaceholder": "至少 6 位",
+		"columns": {
+			"username": "用户名",
+			"displayName": "显示名",
+			"email": "邮箱",
+			"roles": "角色",
+			"status": "状态",
+			"actions": "操作"
+		}
+	},
+	"userRoles": {
+		"title": "成员资格",
+		"saved": "角色已更新",
+		"none": "（无角色）"
+	},
+	"rolesPage": {
+		"tabRoles": "角色",
+		"tabPerms": "权限点",
+		"builtin": "内置",
+		"deprecated": "已废弃",
+		"holders": "持有者",
+		"permissions": "已绑定权限点",
+		"titleKey": "标题键",
+		"readonlyHint": "只读视图：角色与绑定由解决方案工具链（upsertSolutionPerms）管理"
+	},
+	"oplog": {
+		"filterAction": "操作 (action)",
+		"filterUsername": "用户名（前缀匹配）",
+		"filterModule": "模块",
+		"filterLimit": "条数上限",
+		"truncated": "结果已按上限截断，请缩小过滤范围",
+		"columns": {
+			"time": "时间",
+			"username": "用户名",
+			"action": "操作",
+			"module": "模块",
+			"target": "目标",
+			"detail": "详情",
+			"level": "级别"
+		}
+	},
+	"settingsPage": {
+		"secretHint": "敏感项不可在线修改",
+		"saved": "设置已保存"
+	},
+	"loginMethodsPage": {
+		"title": "当前启用的登录方式",
+		"methodLocal": "本地口令",
+		"methodLdap": "LDAP",
+		"methodSso": "SSO 单点登录"
+	},
+	"err": {
+		"forbidden": "无权限",
+		"selfAction": "不能对自己执行该操作",
+		"pwdTooShort": "口令至少 6 位",
+		"usernameExists": "用户名已存在",
+		"usernameReserved": "该用户名前缀为外部身份源保留",
+		"mustChange": {
+			"title": "需要先修改密码",
+			"hint": "当前账号尚未完成首次改密，管理功能暂不可用。修改完成后将自动返回。",
+			"go": "去修改密码"
+		}
+	},
+	"setting": {
+		"site_title": "站点标题",
+		"ldap_enabled": "启用 LDAP 登录",
+		"sso_enabled": "启用 SSO 登录",
+		"ldap_base_dn": "LDAP Base DN",
+		"ldap_uid_attr": "LDAP UID 属性",
+		"ldap_email_attr": "LDAP 邮箱属性"
+	}
+}