@oj-module/cli 0.2.46 → 0.2.48

package/templates/src/system/web/__client/api.ts

@@ -33,7 +33,7 @@ export function createSystemClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { systemLoginMethodsGet, systemOplogGet, systemOplogPost, systemPermissionsGet, systemRolesGet, systemRolesPost, systemRolesDelete, systemRolesBindingsPut, systemSettingsGet, systemSettingsPut, systemUsersGet, systemUsersPost, systemUsersForbiddenPut, systemUsersPasswordPut, systemUsersRolesPut };
+	return { systemDepartmentsGet, systemDepartmentsPost, systemDepartmentsPut, systemDepartmentsDelete, systemDepartmentsMovePut, systemDepartmentsDetachPost, systemDepartmentsMembersGet, systemDepartmentsMembersPost, systemDepartmentsMembersPut, systemDepartmentsMembersDelete, systemLoginMethodsGet, systemOplogGet, systemOplogPost, systemPermissionsGet, systemRolesGet, systemRolesPost, systemRolesDelete, systemRolesBindingsPut, systemSettingsGet, systemSettingsPut, systemUsersGet, systemUsersPost, systemUsersDelete, systemUsersProfilePut, systemUsersForbiddenPut, systemUsersPasswordPut, systemUsersRolesPut };
 }
 
 /**
@@ -64,6 +64,249 @@ async function toApiError(e: unknown): Promise<unknown> {
 	return e;
 }
 
+export type SystemDepartmentsGetData = z.infer<(typeof schemas)["systemDepartmentsGet"]["data"]>;
+
+export async function systemDepartmentsGet(): Promise<SystemDepartmentsGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/departments`).json<OjEnvelope<SystemDepartmentsGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsPostBody = z.input<(typeof schemas)["systemDepartmentsPost"]["body"]>;
+export type SystemDepartmentsPostData = z.infer<(typeof schemas)["systemDepartmentsPost"]["data"]>;
+
+export async function systemDepartmentsPost(body: SystemDepartmentsPostBody): Promise<SystemDepartmentsPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`system/departments`, { json: body }).json<OjEnvelope<SystemDepartmentsPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsPutQuery = z.input<(typeof schemas)["systemDepartmentsPut"]["query"]>;
+export type SystemDepartmentsPutBody = z.input<(typeof schemas)["systemDepartmentsPut"]["body"]>;
+export type SystemDepartmentsPutData = z.infer<(typeof schemas)["systemDepartmentsPut"]["data"]>;
+
+export async function systemDepartmentsPut(input: { query: SystemDepartmentsPutQuery, body: SystemDepartmentsPutBody }): Promise<SystemDepartmentsPutData> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/departments`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsPutData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsDeleteQuery = z.input<(typeof schemas)["systemDepartmentsDelete"]["query"]>;
+export type SystemDepartmentsDeleteData = z.infer<(typeof schemas)["systemDepartmentsDelete"]["data"]>;
+
+export async function systemDepartmentsDelete(query: SystemDepartmentsDeleteQuery): Promise<SystemDepartmentsDeleteData> {
+	const client = ensureReq();
+	try {
+		const env = await client.delete(`system/departments`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemDepartmentsDeleteData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsDeleteData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsDelete"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsDelete 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsMovePutQuery = z.input<(typeof schemas)["systemDepartmentsMovePut"]["query"]>;
+export type SystemDepartmentsMovePutBody = z.input<(typeof schemas)["systemDepartmentsMovePut"]["body"]>;
+export type SystemDepartmentsMovePutData = z.infer<(typeof schemas)["systemDepartmentsMovePut"]["data"]>;
+
+export async function systemDepartmentsMovePut(input: { query: SystemDepartmentsMovePutQuery, body: SystemDepartmentsMovePutBody }): Promise<SystemDepartmentsMovePutData> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/departments/move`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsMovePutData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMovePutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMovePut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMovePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsDetachPostQuery = z.input<(typeof schemas)["systemDepartmentsDetachPost"]["query"]>;
+export type SystemDepartmentsDetachPostData = z.infer<(typeof schemas)["systemDepartmentsDetachPost"]["data"]>;
+
+export async function systemDepartmentsDetachPost(query: SystemDepartmentsDetachPostQuery): Promise<SystemDepartmentsDetachPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`system/departments/detach`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemDepartmentsDetachPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsDetachPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsDetachPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsDetachPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsMembersGetQuery = z.input<(typeof schemas)["systemDepartmentsMembersGet"]["query"]>;
+export type SystemDepartmentsMembersGetData = z.infer<(typeof schemas)["systemDepartmentsMembersGet"]["data"]>;
+
+export async function systemDepartmentsMembersGet(query: SystemDepartmentsMembersGetQuery): Promise<SystemDepartmentsMembersGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`system/departments/members`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemDepartmentsMembersGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMembersGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMembersGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMembersGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsMembersPostQuery = z.input<(typeof schemas)["systemDepartmentsMembersPost"]["query"]>;
+export type SystemDepartmentsMembersPostBody = z.input<(typeof schemas)["systemDepartmentsMembersPost"]["body"]>;
+export type SystemDepartmentsMembersPostData = z.infer<(typeof schemas)["systemDepartmentsMembersPost"]["data"]>;
+
+export async function systemDepartmentsMembersPost(input: { query: SystemDepartmentsMembersPostQuery, body: SystemDepartmentsMembersPostBody }): Promise<SystemDepartmentsMembersPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`system/departments/members`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsMembersPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMembersPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMembersPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMembersPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsMembersPutQuery = z.input<(typeof schemas)["systemDepartmentsMembersPut"]["query"]>;
+export type SystemDepartmentsMembersPutBody = z.input<(typeof schemas)["systemDepartmentsMembersPut"]["body"]>;
+export type SystemDepartmentsMembersPutData = z.infer<(typeof schemas)["systemDepartmentsMembersPut"]["data"]>;
+
+export async function systemDepartmentsMembersPut(input: { query: SystemDepartmentsMembersPutQuery, body: SystemDepartmentsMembersPutBody }): Promise<SystemDepartmentsMembersPutData> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/departments/members`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemDepartmentsMembersPutData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMembersPutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMembersPut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMembersPut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemDepartmentsMembersDeleteQuery = z.input<(typeof schemas)["systemDepartmentsMembersDelete"]["query"]>;
+export type SystemDepartmentsMembersDeleteData = z.infer<(typeof schemas)["systemDepartmentsMembersDelete"]["data"]>;
+
+export async function systemDepartmentsMembersDelete(query: SystemDepartmentsMembersDeleteQuery): Promise<SystemDepartmentsMembersDeleteData> {
+	const client = ensureReq();
+	try {
+		const env = await client.delete(`system/departments/members`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemDepartmentsMembersDeleteData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemDepartmentsMembersDeleteData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemDepartmentsMembersDelete"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemDepartmentsMembersDelete 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
 export type SystemLoginMethodsGetData = z.infer<(typeof schemas)["systemLoginMethodsGet"]["data"]>;
 
 export async function systemLoginMethodsGet(): Promise<SystemLoginMethodsGetData> {
@@ -327,6 +570,55 @@ export async function systemUsersPost(body: SystemUsersPostBody): Promise<System
 	}
 }
 
+export type SystemUsersDeleteQuery = z.input<(typeof schemas)["systemUsersDelete"]["query"]>;
+export type SystemUsersDeleteData = z.infer<(typeof schemas)["systemUsersDelete"]["data"]>;
+
+export async function systemUsersDelete(query: SystemUsersDeleteQuery): Promise<SystemUsersDeleteData> {
+	const client = ensureReq();
+	try {
+		const env = await client.delete(`system/users`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<SystemUsersDeleteData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemUsersDeleteData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersDelete"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersDelete 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type SystemUsersProfilePutQuery = z.input<(typeof schemas)["systemUsersProfilePut"]["query"]>;
+export type SystemUsersProfilePutBody = z.input<(typeof schemas)["systemUsersProfilePut"]["body"]>;
+export type SystemUsersProfilePutData = z.infer<(typeof schemas)["systemUsersProfilePut"]["data"]>;
+
+export async function systemUsersProfilePut(input: { query: SystemUsersProfilePutQuery, body: SystemUsersProfilePutBody }): Promise<SystemUsersProfilePutData> {
+	const client = ensureReq();
+	try {
+		const env = await client.put(`system/users/profile`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<SystemUsersProfilePutData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as SystemUsersProfilePutData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["systemUsersProfilePut"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] systemUsersProfilePut 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
 export type SystemUsersForbiddenPutQuery = z.input<(typeof schemas)["systemUsersForbiddenPut"]["query"]>;
 export type SystemUsersForbiddenPutBody = z.input<(typeof schemas)["systemUsersForbiddenPut"]["body"]>;
 

package/templates/src/system/web/entry.ts

@@ -9,6 +9,7 @@ import { createSystemClient } from "./__client/api";
 
 const Users = lazy(() => import("./pages/users"));
 const UserRoles = lazy(() => import("./pages/users/roles"));
+const Departments = lazy(() => import("./pages/departments"));
 const Roles = lazy(() => import("./pages/roles"));
 const Oplog = lazy(() => import("./pages/oplog"));
 const Settings = lazy(() => import("./pages/settings"));
@@ -37,6 +38,11 @@ const routes: AppRouteRecordRaw[] = [
 				Component: UserRoles,
 				handle: { title: "system:menu.userRoles", hideInMenu: true },
 			},
+			{
+				path: "/system/departments",
+				Component: Departments,
+				handle: { title: "system:menu.departments" },
+			},
 			{
 				path: "/system/roles",
 				Component: Roles,

package/templates/src/system/web/locales/en-US.json

@@ -7,7 +7,8 @@
 		"oplog": "Audit Log",
 		"settings": "Site Settings",
 		"loginMethods": "Login Methods",
-		"wecom": "WeCom Integration"
+		"wecom": "WeCom Integration",
+		"departments": "Departments"
 	},
 	"common": {
 		"confirm": "Confirm",
@@ -16,7 +17,9 @@
 		"saved": "Saved",
 		"search": "Search",
 		"reset": "Reset",
-		"create": "Create"
+		"create": "Create",
+		"edit": "Edit",
+		"delete": "Delete"
 	},
 	"users": {
 		"create": "Create User",
@@ -32,8 +35,12 @@
 			"email": "Email",
 			"roles": "Roles",
 			"status": "Account status (forbidden / password change)",
-			"actions": "Actions"
-		}
+			"actions": "Actions",
+			"position": "Position",
+			"departments": "Departments"
+		},
+		"mainDept": "Main dept",
+		"filterDept": "Filter by department (incl. sub-depts)"
 	},
 	"userRoles": {
 		"title": "Membership",
@@ -50,6 +57,46 @@
 		"titleKey": "Title Key",
 		"readonlyHint": "Read-only view: roles and bindings are managed by solution tooling (upsertSolutionPerms)"
 	},
+	"departments": {
+		"create": "New Department",
+		"edit": "Edit Department",
+		"view": "View",
+		"createHint": "Org structure is shared baseline data; WeCom/LDAP are only adapters writing into it",
+		"members": "Members",
+		"memberCount": "Members",
+		"detach": "Manage locally",
+		"detachHint": "Once detached, sync no longer rewrites this department — rename/move/delete all open up",
+		"readonlyHint": "This department is maintained by an external source; structural fields are read-only",
+		"unnamed": "(unnamed)",
+		"hidden": "Out of visible scope",
+		"removed": "Deleted at source",
+		"root": "(top level)",
+		"selectUser": "Select user",
+		"addMember": "Add member",
+		"removeMember": "Remove",
+		"noMembers": "No members",
+		"confirmDelete": "Delete this department? Its member links are removed too",
+		"confirmRemoveMember": "Remove this user from the department?",
+		"yes": "Yes",
+		"no": "No",
+		"origin": {
+			"local": "Local",
+			"wecom": "WeCom",
+			"ldap": "LDAP",
+			"sso": "SSO"
+		},
+		"columns": {
+			"name": "Name",
+			"nameEn": "English name",
+			"parent": "Parent"
+		},
+		"memberColumns": {
+			"user": "User",
+			"main": "Main",
+			"leader": "Leader",
+			"actions": "Actions"
+		}
+	},
 	"oplog": {
 		"filterAction": "Action",
 		"filterUsername": "Username (prefix)",
@@ -79,7 +126,7 @@
 	},
 	"wecom": {
 		"title": "Onboard a corporation",
-		"hint": "Click \"Generate install link\" and send the link or QR code to the corporation's admin for approval. The callback on the corporation side writes the row into this table after approval. The link expires in 10 minutes and works once; the QR code greys out when it does, so regenerate it.",
+		"hint": "Click \"Generate install link\" and send the link or QR code to the corporation's admin to scan/open for approval. On success this system auto-registers the corporation via the create_auth callback (writes wecom_app_profile). The link is generated by WeCom get_customized_auth_url; its validity follows WeCom's response (up to 10 days). The QR code greys out when it expires, so regenerate it.",
 		"appsTitle": "Onboarded corporations",
 		"genInstall": "Generate install link",
 		"installOk": "Generated. Send the link to the corporation's admin.",
@@ -93,7 +140,8 @@
 			"env": "Env",
 			"status": "Status",
 			"installedAt": "Onboarded at",
-			"action": "Actions"
+			"action": "Actions",
+			"authMode": "Auth mode"
 		},
 		"statusActive": "Active",
 		"statusDisabled": "Disabled",
@@ -103,7 +151,61 @@
 		"enable": "Enable",
 		"disableConfirm": "Disable this app? Members of this corporation will no longer be able to sign in with it.",
 		"enableConfirm": "Enable this app?",
-		"empty": "No corporations onboarded yet"
+		"empty": "No corporations onboarded yet",
+		"authModeAdmin": "Admin-authorized",
+		"authModeMember": "Member-authorized",
+		"authModeHint": "In member-authorized mode the app has no contacts permission, so this corporation's org structure cannot be synced. The corporation admin must switch it to admin-authorized in the WeCom console and re-authorize.",
+		"sync": {
+			"updatedAt": "WeCom org structure updated {{time}}",
+			"neverSynced": "WeCom org structure has never been synced",
+			"auto": "auto sync",
+			"syncNow": "Sync now",
+			"retry": "Retry",
+			"resume": "Resume sync",
+			"cancel": "Cancel sync",
+			"syncing": "Reading WeCom org structure…",
+			"syncingProgress": "Syncing: {{done}}/{{total}} departments processed",
+			"done": "Sync finished: {{depts}} departments / {{members}} members",
+			"paused": "Sync paused ({{depts}} departments processed). Click \"Resume sync\" to continue.",
+			"skipped": "{{count}} departments skipped due to permission (normal for departments outside the visible scope)",
+			"cancelled": "Sync cancelled",
+			"ago": {
+				"justNow": "just now",
+				"minutes": "{{count}} minutes ago",
+				"hours": "{{count}} hours ago",
+				"days": "{{count}} days ago"
+			},
+			"memberAuth": {
+				"title": "This corporation uses member-authorized mode: the app has no contacts permission",
+				"hint": "Ask the corporation admin to switch to admin-authorized mode in the WeCom console and re-authorize; then sync becomes available."
+			},
+			"frozen": {
+				"title": "Authorization was revoked or the app is disabled: sync is frozen",
+				"hint": "The data below is the snapshot from the last successful sync. Ask the service provider to re-onboard the corporation."
+			},
+			"err": {
+				"permission": {
+					"title": "The app lacks contacts permission (error {{code}})",
+					"hint": "Corporation admin: WeCom console → App management → this app → Permissions, enable the contacts scopes and submit."
+				},
+				"rateLimited": {
+					"title": "WeCom API rate limited (error {{code}})",
+					"hint": "Backoff already applied. Click \"Resume sync\" in a moment."
+				},
+				"ipWhitelist": {
+					"title": "Server egress IP is not whitelisted by WeCom (error {{code}})",
+					"hint": "The service provider must add the trusted IP in the WeCom console."
+				},
+				"network": {
+					"title": "Cannot reach WeCom ({{code}})",
+					"hint": "Check server network access to WeCom and retry."
+				},
+				"unknown": {
+					"title": "Sync failed (error {{code}})",
+					"hint": "Contact the service provider to investigate, then retry."
+				}
+			}
+		}
 	},
 	"err": {
 		"forbidden": "Forbidden",
@@ -125,5 +227,9 @@
 		"ldap_base_dn": "LDAP Base DN",
 		"ldap_uid_attr": "LDAP UID Attribute",
 		"ldap_email_attr": "LDAP Email Attribute"
+	},
+	"perm": {
+		"platform_org_read_all": "Org directory: read all",
+		"auth_wecom_sync": "WeCom org sync"
 	}
 }