@oj-module/cli 0.2.43 → 0.2.45

package/templates/src/notification/api/api.ts

@@ -7,6 +7,7 @@
 // 出参挂平级 `.response`（动词级优先于组级，组级沿嵌套继承）——oj 运行期据此校验入参、
 // 并供 `oj openapi` 生成 openapi.json → 前端 `ojm api` 生成 __client。
 // `.schema` 是 JSON Schema 严格子集（关键字白名单），union 用类型数组表达（见 userId）。
+import { isSelfTenant } from "#/_platform/_shared/service/infra/access";
 import { clearNotices, markAllRead, markRead, noticesFor, pushBroadcastNotice, pushNotice } from "./_shared/notify";
 
 const notifications = {
@@ -19,6 +20,10 @@ const notifications = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		try {
 			json.ok(await noticesFor(uid));
 		}
@@ -35,6 +40,10 @@ const notifications = {
 				json.fail(401, "unauthorized");
 				return;
 			}
+			if (!(await isSelfTenant())) {
+				json.fail(403, "forbidden");
+				return;
+			}
 			const body = (http.body ?? {}) as { id?: unknown };
 			const id = String(body.id ?? "");
 			if (!id) {
@@ -62,6 +71,10 @@ const notifications = {
 				json.fail(401, "unauthorized");
 				return;
 			}
+			if (!(await isSelfTenant())) {
+				json.fail(403, "forbidden");
+				return;
+			}
 			try {
 				await markAllRead(uid);
 				json.ok(null);
@@ -80,6 +93,10 @@ const notifications = {
 				json.fail(401, "unauthorized");
 				return;
 			}
+			if (!(await isSelfTenant())) {
+				json.fail(403, "forbidden");
+				return;
+			}
 			try {
 				await clearNotices(uid);
 				json.ok(null);
@@ -133,6 +150,10 @@ const push = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		const b = (http.body ?? {}) as {
 			userId?: unknown
 			title?: unknown
@@ -187,6 +208,10 @@ const broadcast = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		const b = (http.body ?? {}) as {
 			title?: unknown
 			message?: unknown

package/templates/src/notification/api/del/api.ts

@@ -1,5 +1,6 @@
 // POST /api/notification/del —— 删除一条通知（发射原语 HTTP 入口）。
 // 按人项校验归属，非本人返回 403；广播项仅删本人回执。Bearer 守卫保护。
+import { isSelfTenant } from "#/_platform/_shared/service/infra/access";
 import { delNotice } from "../_shared/notify";
 
 // POST /api/notification/del —— 删除一条通知（发射原语 HTTP 入口）。
@@ -12,6 +13,10 @@ const handler = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		const b = (http.body ?? {}) as { id?: unknown, userId?: unknown };
 		const id = String(b.id ?? "");
 		if (!id) {

package/templates/src/notification/api/manifest.yaml

@@ -1,6 +1,9 @@
 name: notification
 desc: 通知模块（契约化通知读写：读 + 单条已读 + 全部已读 + 清空 + 广播；表与种子归属本模块）
 version: 0.1.0
+deps: # 租户自洽守卫（isSelfTenant）读 _platform 的 users 判定「token 的 sub 是否在本租户」；
+  # 跨模块别名 `#/_platform/…` 的依赖门禁（oj build S008）
+  _platform: ^0.1.0
 tables:
   - notifications
   - notifications_broadcast

package/templates/src/notification/api/migrations/0005__tenant.mysql.sql

@@ -0,0 +1,6 @@
+-- 0005__tenant（mysql 方言）：通知四表租户化。
+-- 差异：TEXT 不能带字面默认值 → 租户列用 VARCHAR(255)。
+ALTER TABLE notifications ADD COLUMN tenant_id VARCHAR(255) NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast ADD COLUMN tenant_id VARCHAR(255) NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_read ADD COLUMN tenant_id VARCHAR(255) NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_hidden ADD COLUMN tenant_id VARCHAR(255) NOT NULL DEFAULT 'default';

package/templates/src/notification/api/migrations/0005__tenant.sql

@@ -0,0 +1,6 @@
+-- 0005__tenant：通知四表租户化（企微代开发 v3 Phase 0 的 A 组）。
+-- 广播/按人通知都是租户内数据：不同 corp 的公告与已读回执必须互不可见。
+ALTER TABLE notifications ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_read ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE notifications_broadcast_hidden ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';

package/templates/src/notification/api/schema.yaml

@@ -5,6 +5,7 @@ tables:
     pk: id
     columns:
       id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
       user_id: {type: integer, null: true}
       avatar: {type: text, null: false}
       date: {type: text, null: false}
@@ -17,6 +18,7 @@ tables:
     pk: id
     columns:
       id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
       avatar: {type: text, null: false}
       date: {type: text, null: false}
       message: {type: text, null: false}
@@ -28,6 +30,7 @@ tables:
     pk: id
     columns:
       id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
       broadcast_id: {type: integer, null: false}
       user_id: {type: integer, null: false}
       read_time: {type: text, null: false}
@@ -35,6 +38,7 @@ tables:
     pk: id
     columns:
       id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
       broadcast_id: {type: integer, null: false}
       user_id: {type: integer, null: false}
       create_time: {type: text, null: false}

package/templates/src/personal-center/api/profile/api.ts

@@ -1,6 +1,9 @@
+import { RESERVED_USERNAME_PREFIX } from "#/_platform/_shared/service/domain/users";
 // POST /api/personal-center/profile —— 保存「我的资料」（个人中心表单入库端点）。
 // 只允许改本人行（http.user.id 权威，不接受 body 传 id）；username 全局唯一，
 // 重名 400；avatar 走 upload 端点（multipart），不在此通道。
+import { isSelfTenant } from "#/_platform/_shared/service/infra/access";
+
 const handler = {
 	async post() {
 		const uid = http.user?.id;
@@ -8,6 +11,10 @@ const handler = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		const b = (http.body ?? {}) as {
 			username?: unknown
 			email?: unknown
@@ -17,6 +24,12 @@ const handler = {
 		const patch: Record<string, string> = {};
 		if (b.username != null && String(b.username).trim() !== "") {
 			const username = String(b.username).trim();
+			// 与建号同红线（B6）：自助改名不能抢占 ldap:/sso:/wecom: 命名空间——
+			// 否则该外部成员首次登录时 ensureXXXUser 按用户名查到的是**别人那一行**，直接签发别人的 uid。
+			if (RESERVED_USERNAME_PREFIX.test(username)) {
+				json.fail(400, "username prefix reserved for external identity sources");
+				return;
+			}
 			const dup = await db.table("users").select(["id"]).where({ field: "username", op: "eq", value: username }).all();
 			if (dup.some(r => Number(r.id) !== Number(uid))) {
 				json.fail(400, "username already taken");

package/templates/src/personal-center/api/upload/api.ts

@@ -6,6 +6,8 @@
 //   · 大文件（> max_upload）：服务端已流式直落 blob、字节不进 handler，此时
 //     http.file(0) 会**报错**，必须改走 files[0].key + blob.get(key)。
 // 头像通常远小于阈值，但别写成「只会一种」——换了上传组件/放开体积就会 500。
+import { isSelfTenant } from "#/_platform/_shared/service/infra/access";
+
 function toBase64(bytes: Uint8Array): string {
 	const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 	let out = "";
@@ -23,7 +25,6 @@ function toBase64(bytes: Uint8Array): string {
 	return out;
 }
 
-// POST /api/personal-center/upload —— 头像上传（multipart→base64，P4-3，D7/F4）。
 const handler = {
 	async post() {
 		const uid = http.user?.id;
@@ -31,6 +32,12 @@ const handler = {
 			json.fail(401, "unauthorized");
 			return;
 		}
+		// 写入目标按 uid 定位 users 行：伪造 X-TENANT-ID 时该行在本租户不存在，
+		// 不拦就会「更新 0 行却回 200」，还顺带在 blob 里留下垃圾文件
+		if (!(await isSelfTenant())) {
+			json.fail(403, "forbidden");
+			return;
+		}
 		if (!http.files || http.files.length === 0) {
 			json.fail(400, "no file");
 			return;

package/templates/src/system/web/entry.ts

@@ -13,6 +13,7 @@ const Roles = lazy(() => import("./pages/roles"));
 const Oplog = lazy(() => import("./pages/oplog"));
 const Settings = lazy(() => import("./pages/settings"));
 const LoginMethods = lazy(() => import("./pages/login-methods"));
+const WecomAdmin = lazy(() => import("./pages/wecom"));
 
 const routes: AppRouteRecordRaw[] = [
 	{
@@ -56,6 +57,13 @@ const routes: AppRouteRecordRaw[] = [
 				Component: LoginMethods,
 				handle: { title: "system:menu.loginMethods" },
 			},
+			{
+				// 企微代开发后台（服务商运营面）：页面内再判一次 superadmin（路由级不做角色门禁，
+				// 与 users/roles 页同策略——403 面板比路由消失更容易解释）
+				path: "/system/wecom",
+				Component: WecomAdmin,
+				handle: { title: "system:menu.wecom" },
+			},
 		],
 	},
 ];

package/templates/src/system/web/locales/en-US.json

@@ -6,7 +6,8 @@
 		"roles": "Roles & Permissions",
 		"oplog": "Audit Log",
 		"settings": "Site Settings",
-		"loginMethods": "Login Methods"
+		"loginMethods": "Login Methods",
+		"wecom": "WeCom Integration"
 	},
 	"common": {
 		"confirm": "Confirm",
@@ -73,7 +74,36 @@
 		"title": "Enabled login methods",
 		"methodLocal": "Local password",
 		"methodLdap": "LDAP",
-		"methodSso": "SSO"
+		"methodSso": "SSO",
+		"methodWecom": "WeCom"
+	},
+	"wecom": {
+		"title": "Onboard a corporation",
+		"hint": "Click \"Generate install link\" and send the link or QR code to the corporation's admin for approval. The callback on the corporation side writes the row into this table after approval. The link expires in 10 minutes and works once; the QR code greys out when it does, so regenerate it.",
+		"appsTitle": "Onboarded corporations",
+		"genInstall": "Generate install link",
+		"installOk": "Generated. Send the link to the corporation's admin.",
+		"installUrl": "Install link",
+		"callbackUrl": "Callback URL",
+		"expiresIn": "Valid for",
+		"expiresValue": "{{count}} minutes",
+		"col": {
+			"corp": "Corporation",
+			"agent": "App",
+			"env": "Env",
+			"status": "Status",
+			"installedAt": "Onboarded at",
+			"action": "Actions"
+		},
+		"statusActive": "Active",
+		"statusDisabled": "Disabled",
+		"statusOk": "Status updated",
+		"statusOkRevoked": "Status updated; {{count}} login sessions of this corporation were revoked",
+		"disable": "Disable",
+		"enable": "Enable",
+		"disableConfirm": "Disable this app? Members of this corporation will no longer be able to sign in with it.",
+		"enableConfirm": "Enable this app?",
+		"empty": "No corporations onboarded yet"
 	},
 	"err": {
 		"forbidden": "Forbidden",
@@ -91,6 +121,7 @@
 		"site_title": "Site Title",
 		"ldap_enabled": "Enable LDAP login",
 		"sso_enabled": "Enable SSO login",
+		"wecom_enabled": "Enable WeCom login",
 		"ldap_base_dn": "LDAP Base DN",
 		"ldap_uid_attr": "LDAP UID Attribute",
 		"ldap_email_attr": "LDAP Email Attribute"

package/templates/src/system/web/locales/zh-CN.json

@@ -6,7 +6,8 @@
 		"roles": "角色权限",
 		"oplog": "操作日志",
 		"settings": "站点设置",
-		"loginMethods": "登录方式"
+		"loginMethods": "登录方式",
+		"wecom": "企业微信代开发"
 	},
 	"common": {
 		"confirm": "确认",
@@ -73,7 +74,36 @@
 		"title": "当前启用的登录方式",
 		"methodLocal": "本地口令",
 		"methodLdap": "LDAP",
-		"methodSso": "SSO 单点登录"
+		"methodSso": "SSO 单点登录",
+		"methodWecom": "企业微信"
+	},
+	"wecom": {
+		"title": "开通企业",
+		"hint": "点「生成开通链接」后把链接或二维码发给企业管理员，由其确认授权；确认后企业侧的回调会写入本表。链接 10 分钟内有效且只能用一次，过期后二维码会置灰，需重新生成。",
+		"appsTitle": "已开通企业",
+		"genInstall": "生成开通链接",
+		"installOk": "已生成，请把链接发给企业管理员",
+		"installUrl": "开通链接",
+		"callbackUrl": "回调地址",
+		"expiresIn": "有效期",
+		"expiresValue": "{{count}} 分钟",
+		"col": {
+			"corp": "企业",
+			"agent": "应用",
+			"env": "环境",
+			"status": "状态",
+			"installedAt": "开通时间",
+			"action": "操作"
+		},
+		"statusActive": "启用",
+		"statusDisabled": "停用",
+		"statusOk": "状态已更新",
+		"statusOkRevoked": "状态已更新，并吊销了该企业 {{count}} 个登录会话",
+		"disable": "停用",
+		"enable": "启用",
+		"disableConfirm": "停用该应用？企业成员将无法用它登录。",
+		"enableConfirm": "启用该应用？",
+		"empty": "暂无已开通企业"
 	},
 	"err": {
 		"forbidden": "无权限",
@@ -91,6 +121,7 @@
 		"site_title": "站点标题",
 		"ldap_enabled": "启用 LDAP 登录",
 		"sso_enabled": "启用 SSO 登录",
+		"wecom_enabled": "启用企业微信登录",
 		"ldap_base_dn": "LDAP Base DN",
 		"ldap_uid_attr": "LDAP UID 属性",
 		"ldap_email_attr": "LDAP 邮箱属性"

package/templates/src/system/web/pages/login-methods/index.tsx

@@ -8,9 +8,10 @@ const METHOD_KEY: Record<string, string> = {
 	local: "system:loginMethodsPage.methodLocal",
 	ldap: "system:loginMethodsPage.methodLdap",
 	sso: "system:loginMethodsPage.methodSso",
+	wecom: "system:loginMethodsPage.methodWecom",
 };
 
-/** 登录方式发现（C5/D2，只读）：local 恒在，ldap/sso 由设置项开关。 */
+/** 登录方式发现（C5/D2，只读）：local 恒在，ldap/sso/wecom 由设置项开关。 */
 export default function LoginMethodsPage() {
 	const { t } = useTranslation();
 	const query = useQuery({ queryKey: ["system", "login-methods"], queryFn: systemLoginMethodsGet });

package/templates/src/system/web/pages/users/index.tsx

@@ -135,7 +135,7 @@ export default function UsersPage() {
 				onOk={() => createForm.submit()}
 			>
 				<Form form={createForm} layout="vertical" onFinish={values => createMut.mutate(values)}>
-					<Form.Item name="username" label={t("system:users.columns.username")} rules={[{ required: true }]} extra="ldap:/ sso: 为外部身份源保留">
+					<Form.Item name="username" label={t("system:users.columns.username")} rules={[{ required: true }]} extra="ldap:/ sso:/ wecom: 为外部身份源保留">
 						<Input />
 					</Form.Item>
 					<Form.Item name="password" label="Password" rules={[{ required: true }, { min: 6 }]} extra={t("system:users.pwdPlaceholder")}>

package/templates/src/system/web/pages/wecom/index.tsx

@@ -0,0 +1,205 @@
+import { request, useUserStore } from "@oj-module/runtime";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { explainError } from "../errors";
+import { ForbiddenPanel } from "../forbidden";
+
+/** GET /auth/wecom/admin/apps 的行（后端不返回 permanent_code，secret 不出库） */
+interface AppRow {
+	suite_id: string
+	corp_id: string
+	agent_id: string
+	auth_corp_id: string
+	env: string
+	corp_name: string | null
+	status: "active" | "disabled"
+	installed_at: number
+	update_time: number
+}
+
+interface InstallInfo {
+	installUrl: string
+	callbackUrl: string
+	expiresIn: number
+}
+
+/**
+ * 端点不在本模块的生成 client 里（`__client` 按模块切分），故直接用 runtime 的 ky 出口。
+ * 路径不带前导 `/`：与 request 的 baseURL 拼接口径一致（fetchLogin 同款）。
+ */
+async function fetchApps(): Promise<AppRow[]> {
+	const env = await request.get("auth/wecom/admin/apps").json<{ code: number, data?: AppRow[] }>();
+	return env.data ?? [];
+}
+
+async function setStatus(input: { corpId: string, agentId: string, status: "active" | "disabled" }): Promise<{ updated: number, revokedSessions: number }> {
+	const env = await request.post("auth/wecom/admin/status", { json: input }).json<{ code: number, data?: { updated: number, revokedSessions: number } }>();
+	return env.data ?? { updated: 0, revokedSessions: 0 };
+}
+
+async function createInstall(): Promise<InstallInfo> {
+	const env = await request.get("auth/wecom/admin/install").json<{ code: number, data?: InstallInfo }>();
+	if (!env.data)
+		throw new Error("企业微信未返回开通链接");
+	return env.data;
+}
+
+/**
+ * 企微代开发后台（服务商运营面，superadmin 独占）：
+ *   · 已授权企业 × 应用清单（同一企业测试/正式两个应用各一行）；
+ *   · 启停（停用企业最后一个应用时后端同时吊销该企业会话）；
+ *   · 开通入口（预授权码 10 分钟有效，每次点都重新换）。
+ */
+export default function WecomAdminPage() {
+	const { t } = useTranslation();
+	const { message } = App.useApp();
+	const queryClient = useQueryClient();
+	const roles = useUserStore(s => s.roles);
+	const isSuper = roles.includes("superadmin");
+
+	const [install, setInstall] = useState<InstallInfo | null>(null);
+	const [expired, setExpired] = useState(false);
+
+	// 预授权码只有 10 分钟：到点把码置灰（antd QRCode 的 expired 态自带「刷新」入口），
+	// 免得操作员把一张已失效的码发出去、企业管理员点开只看到企微的「链接无效」。
+	// 计时器只负责「置灰」，复位放在生成成功那一刻（effect 里同步 setState 会多一次渲染）。
+	useEffect(() => {
+		if (!install)
+			return undefined;
+		const timer = setTimeout(setExpired, install.expiresIn * 1000, true);
+		return () => clearTimeout(timer);
+	}, [install]);
+
+	const appsQuery = useQuery({
+		queryKey: ["system", "wecom-apps"],
+		queryFn: fetchApps,
+		enabled: isSuper,
+		retry: false,
+	});
+
+	const statusMut = useMutation({
+		mutationFn: setStatus,
+		onSuccess: (r) => {
+			// 吊销了会话就明确说出来：这是「有人被踢下线」的事实，不该只显示「已保存」
+			message.success(r.revokedSessions > 0
+				? t("system:wecom.statusOkRevoked", { count: r.revokedSessions })
+				: t("system:wecom.statusOk"));
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-apps"] });
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
+	const installMut = useMutation({
+		mutationFn: createInstall,
+		onSuccess: (r) => {
+			setInstall(r);
+			setExpired(false);
+			// 预授权码一次有效：链接只在该页面的内存里，不写 localStorage
+			message.success(t("system:wecom.installOk"));
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
+	if (!isSuper)
+		return <ForbiddenPanel t={t} />;
+
+	const columns = [
+		{
+			title: t("system:wecom.col.corp"),
+			dataIndex: "corp_id",
+			render: (_: string, row: AppRow) => (
+				<div>
+					<div>{row.corp_id}</div>
+					{row.corp_name && <Typography.Text type="secondary">{row.corp_name}</Typography.Text>}
+				</div>
+			),
+		},
+		{ title: t("system:wecom.col.agent"), dataIndex: "agent_id" },
+		{ title: t("system:wecom.col.env"), dataIndex: "env", render: (v: string) => <Tag>{v}</Tag> },
+		{
+			title: t("system:wecom.col.status"),
+			dataIndex: "status",
+			render: (v: string) => (
+				<Tag color={v === "active" ? "green" : "red"}>
+					{t(v === "active" ? "system:wecom.statusActive" : "system:wecom.statusDisabled")}
+				</Tag>
+			),
+		},
+		{
+			title: t("system:wecom.col.installedAt"),
+			dataIndex: "installed_at",
+			render: (v: number) => (v ? new Date(v * 1000).toLocaleString() : "-"),
+		},
+		{
+			title: t("system:wecom.col.action"),
+			key: "action",
+			render: (_: unknown, row: AppRow) => {
+				const next = row.status === "active" ? "disabled" : "active";
+				return (
+					<Popconfirm
+						title={t(next === "disabled" ? "system:wecom.disableConfirm" : "system:wecom.enableConfirm")}
+						onConfirm={() => statusMut.mutate({ corpId: row.corp_id, agentId: row.agent_id, status: next })}
+					>
+						<Button danger={next === "disabled"} size="small" loading={statusMut.isPending}>
+							{t(next === "disabled" ? "system:wecom.disable" : "system:wecom.enable")}
+						</Button>
+					</Popconfirm>
+				);
+			},
+		},
+	];
+
+	return (
+		<Space direction="vertical" size="middle" style={{ width: "100%" }}>
+			<Card
+				title={t("system:wecom.title")}
+				extra={(
+					<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
+						{t("system:wecom.genInstall")}
+					</Button>
+				)}
+			>
+				<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
+				{install && (
+					<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
+						{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
+						    企业管理员多半在手机上收通知，扫码比复制链接快 */}
+						<QRCode
+							value={install.installUrl}
+							size={160}
+							type="svg"
+							bordered
+							status={expired ? "expired" : "active"}
+							onRefresh={() => installMut.mutate()}
+						/>
+						<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
+							<Descriptions.Item label={t("system:wecom.installUrl")}>
+								<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
+							</Descriptions.Item>
+							<Descriptions.Item label={t("system:wecom.callbackUrl")}>
+								<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
+							</Descriptions.Item>
+							<Descriptions.Item label={t("system:wecom.expiresIn")}>
+								{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
+							</Descriptions.Item>
+						</Descriptions>
+					</div>
+				)}
+			</Card>
+			<Card title={t("system:wecom.appsTitle")}>
+				<Table<AppRow>
+					rowKey={row => `${row.suite_id}:${row.corp_id}:${row.agent_id}`}
+					size="small"
+					loading={appsQuery.isLoading}
+					dataSource={appsQuery.data ?? []}
+					columns={columns}
+					pagination={false}
+					locale={{ emptyText: t("system:wecom.empty") }}
+				/>
+			</Card>
+		</Space>
+	);
+}