@oj-module/cli 0.2.46 → 0.2.48

package/templates/src/_platform/api/org/user/api.ts

@@ -0,0 +1,46 @@
+import { respond } from "../../_shared/respond";
+// GET /api/_platform/org/user?uid= —— 某人的部门路径 / 主部门 / 职务（共享读面）。
+// 不给 uid 即查自己；scope=self 下问别人 → 403（不是 404：不泄露账号存在性）。
+import { readUserDepartments, resolveReadFace } from "../../_shared/service/domain/org-read";
+
+async function get() {
+	await respond(async () => {
+		const q = http.query as Record<string, unknown>;
+		const reader = await resolveReadFace(q.scope);
+		return readUserDepartments(reader, q.uid == null || String(q.uid).trim() === "" ? reader.uid : Number(q.uid));
+	});
+}
+get.schema = {
+	query: {
+		type: "object",
+		properties: {
+			scope: { type: "string", enum: ["self", "all"] },
+			uid: { type: "number" },
+		},
+	},
+};
+get.response = {
+	type: "object",
+	required: ["userId", "username", "position", "mainDeptId", "mainDeptPath", "departments"],
+	properties: {
+		userId: { type: "number" },
+		username: { type: "string" },
+		displayName: { type: ["string", "null"] },
+		position: { type: ["string", "null"] },
+		mainDeptId: { type: ["number", "null"] },
+		mainDeptPath: { type: "array", items: { type: "string" } },
+		departments: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["deptId", "deptPath"],
+				properties: {
+					deptId: { type: "number" },
+					deptPath: { type: "array", items: { type: "string" } },
+				},
+			},
+		},
+	},
+};
+
+export default { get };

package/templates/src/_platform/api/schema.yaml

@@ -32,6 +32,14 @@ tables:
       email: {type: text}
       phone_number: {type: text}
       description: {type: text}
+      # 0016：是否登录过本站。同步会为「从未登录」的全员建档，contacts 只返回 activated=1，
+      # 否则任何登录账号都能以 60 次/分把整份企业名册拖走（方案 §9.1）。存量行迁移时置 1。
+      activated: {type: integer, null: false}
+      # 职务（与来源无关的通用字段）
+      position: {type: text}
+      # 外部源侧的状态快照（企微 1/2/4/5）。**绝不**自动改写 is_forbidden——那会和
+      # 本站管理员的手动启停互相覆盖（方案 §4.3）
+      external_status: {type: integer}
   sys_setting:
     # 共享表（B 组 D8）：登录方式发现 /system/login-methods 是未登录端点，此刻没有租户上下文；
     # 且这些开关是部署级语义，不是每 corp 语义。
@@ -163,3 +171,43 @@ tables:
       source_url: {type: text, null: false}
       max_seq: {type: integer, null: false}
       updated_at: {type: integer, null: false}
+  # ---- 0016：组织架构领域（CRUD 基线 + 外部源适配器的落点）----
+  # 定位（方案 §14）：CRUD 是基线，企微 / LDAP 只是适配器 → 表里不出现任何 wecom_* / ldap_* 字段。
+  # origin 是**归属权**标识（D13）：local = 本站管理员全权；wecom/ldap/sso = 该适配器管辖，
+  # 同步与回收只作用于自己 origin 的行，绝不碰别的（否则本地建的部门会被同步干掉）。
+  sys_department:
+    # 租户表：组织架构天然按租户隔离（企微部署下 tenant_id = corp_id），
+    # 只在有租户上下文时被读写，与 users / sys_oplog 同组（0015 A 组口径）。
+    pk: id
+    columns:
+      id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
+      origin: {type: text, null: false}
+      # 外部源主键（企微部门 id / LDAP entryUUID）；origin='local' 时由应用层生成稳定串
+      origin_id: {type: text, null: false}
+      # 本地父部门 id（不是外部 id）：本地部门与同步部门可混挂，且不随外部调整而变
+      parent_id: {type: integer}
+      # 未获权限时为 NULL（企微代开发未授权「部门名」即如此），展示层用 origin_id 兜底
+      name: {type: text}
+      name_en: {type: text}
+      order_no: {type: integer, null: false}
+      # 同步可见性，**仅由同步轮次维护**（失去可见范围 → 0）；本地部门恒 1
+      sync_visible: {type: integer, null: false}
+      # 软删除。只由外部源的删除事件置 1（D9）：本地删除走真删
+      deleted: {type: integer, null: false}
+      # 最近一次完整全量命中的 job（墓碑回收前必先校验本轮完整且无 skip）
+      seen_job_id: {type: integer}
+      update_time: {type: integer, null: false}
+  # 成员 ↔ 部门（多对多）：企微一人可在多个部门，order_no / is_leader 与 department[] 逐位对应。
+  # 全本地 id 关联，**与来源完全无关**——接任何适配器都不用动这张表。
+  sys_dept_member:
+    pk: id
+    columns:
+      id: {type: integer, autoincrement: true}
+      tenant_id: {type: text, null: false}
+      user_id: {type: integer, null: false}
+      dept_id: {type: integer, null: false}
+      order_no: {type: integer, null: false}
+      is_leader: {type: integer, null: false}
+      is_main: {type: integer, null: false}
+      update_time: {type: integer, null: false}

package/templates/src/_platform/api/seed.mysql.sql

@@ -1,9 +1,9 @@
 -- _platform 种子数据 mysql 方言覆盖（方言覆盖文件必胜；INSERT OR IGNORE → INSERT IGNORE）。
--- 语句分号切分与注释纪律同基线 seed.sql；账号口径同基线（账号名=角色名，must_change=0）。
-INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
+-- 语句分号切分与注释纪律同基线 seed.sql；账号口径同基线（账号名=角色名，口令 aA123456，must_change=0）。
+INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT IGNORE INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
 DELETE FROM sys_user_role WHERE role_name = 'superadmin' AND user_id = (SELECT id FROM users WHERE username = 'admin');
 UPDATE users SET must_change = 0 WHERE username IN ('superadmin', 'admin', 'editor', 'viewer');
 INSERT IGNORE INTO sys_role (name, module, title, builtin) VALUES ('superadmin', 'framework', '超级管理员', 1);
@@ -14,3 +14,8 @@ INSERT IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin' FR
 INSERT IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'admin' FROM users WHERE username = 'admin';
 INSERT IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'editor' FROM users WHERE username = 'editor';
 INSERT IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'viewer' FROM users WHERE username = 'viewer';
+-- 组织架构共享读面全量权限点（基线 seed 同款，注释不重复）：scope=all 挂 platform.org.read.all
+INSERT IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES ('platform.org.read.all', 'framework', 'system:perm.platform_org_read_all', 0);
+-- 企微组织架构同步（B2）：触发同步是打上游的动作，挂权限点；admin/superadmin 天然通过，
+-- 只有自定义角色需要显式绑定（与 platform.org.read.all 同一条纪律：不落库就永远绑不上）。
+INSERT IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES ('auth.wecom.sync', 'auth', 'system:perm.auth_wecom_sync', 0);

package/templates/src/_platform/api/seed.pg.sql

@@ -1,9 +1,9 @@
 -- _platform 种子数据 pg 方言覆盖（方言覆盖文件必胜；INSERT OR IGNORE → ON CONFLICT DO NOTHING）。
--- 语句分号切分与注释纪律同基线 seed.sql；账号口径同基线（账号名=角色名，must_change=0）。
-INSERT INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0) ON CONFLICT DO NOTHING;
-INSERT INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0) ON CONFLICT DO NOTHING;
-INSERT INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0) ON CONFLICT DO NOTHING;
-INSERT INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0) ON CONFLICT DO NOTHING;
+-- 语句分号切分与注释纪律同基线 seed.sql；账号口径同基线（账号名=角色名，口令 aA123456，must_change=0）。
+INSERT INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0) ON CONFLICT DO NOTHING;
+INSERT INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0) ON CONFLICT DO NOTHING;
+INSERT INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0) ON CONFLICT DO NOTHING;
+INSERT INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0) ON CONFLICT DO NOTHING;
 DELETE FROM sys_user_role WHERE role_name = 'superadmin' AND user_id = (SELECT id FROM users WHERE username = 'admin');
 UPDATE users SET must_change = 0 WHERE username IN ('superadmin', 'admin', 'editor', 'viewer');
 INSERT INTO sys_role (name, module, title, builtin) VALUES ('superadmin', 'framework', '超级管理员', 1) ON CONFLICT DO NOTHING;
@@ -14,3 +14,8 @@ INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin' FROM user
 INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'admin' FROM users WHERE username = 'admin' ON CONFLICT DO NOTHING;
 INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'editor' FROM users WHERE username = 'editor' ON CONFLICT DO NOTHING;
 INSERT INTO sys_user_role (user_id, role_name) SELECT id, 'viewer' FROM users WHERE username = 'viewer' ON CONFLICT DO NOTHING;
+-- 组织架构共享读面全量权限点（基线 seed 同款，注释不重复）：scope=all 挂 platform.org.read.all
+INSERT INTO sys_permission (code, module, title_key, deprecated) VALUES ('platform.org.read.all', 'framework', 'system:perm.platform_org_read_all', 0) ON CONFLICT DO NOTHING;
+-- 企微组织架构同步（B2）：触发同步是打上游的动作，挂权限点；admin/superadmin 天然通过，
+-- 只有自定义角色需要显式绑定（与 platform.org.read.all 同一条纪律：不落库就永远绑不上）。
+INSERT INTO sys_permission (code, module, title_key, deprecated) VALUES ('auth.wecom.sync', 'auth', 'system:perm.auth_wecom_sync', 0) ON CONFLICT DO NOTHING;

package/templates/src/_platform/api/seed.sql

@@ -2,12 +2,13 @@
 -- 方言覆盖：seed.mysql.sql / seed.pg.sql（INSERT OR IGNORE 为 sqlite 专属语法，方言文件必胜，同迁移约定）。
 -- 注意：seed 按英文分号朴素切分语句，注释里也不要出现英文分号。
 -- 账号生命周期 D12（2026-10-22 调整）：四个内置角色各一个开发账号，**账号名=角色名**
--- （superadmin/admin/editor/viewer，避免心智负担），口令均 123456，must_change=0 免首登改密——
+-- （superadmin/admin/editor/viewer，避免心智负担），口令均 aA123456（bcrypt cost=10、$2y$ 前缀，
+-- 2026-11-01 由 123456 改来），must_change=0 免首登改密——
 -- 纯开发便利（默认凭据不随机生成的取舍见计划 A2 阶段小结），生产部署须改密或删除
-INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
-INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$ylE2NdjnYiuEcq54W/KxH.bhvGaQQg3rbmYI3mcEHX6LdQEAqixeC', 0);
+INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('superadmin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('admin', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('editor', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
+INSERT OR IGNORE INTO users (username, password_hash, must_change) VALUES ('viewer', '$2y$10$9HEtASi9jG0VIBMMVqxAmOqrE4f6wiezhGmi50iPG1s1MXlncSO0e', 0);
 -- 历史 seed 把 admin 绑在 superadmin 上；收敛为账号名=角色名（幂等 DELETE，每次重放生效）。
 -- 已存在库中 admin 行可能残留 must_change=1，UPDATE 统一收敛为 0（四个均为 seed 自有开发账号）
 DELETE FROM sys_user_role WHERE role_name = 'superadmin' AND user_id = (SELECT id FROM users WHERE username = 'admin');
@@ -22,6 +23,10 @@ INSERT OR IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'superadmin'
 INSERT OR IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'admin' FROM users WHERE username = 'admin';
 INSERT OR IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'editor' FROM users WHERE username = 'editor';
 INSERT OR IGNORE INTO sys_user_role (user_id, role_name) SELECT id, 'viewer' FROM users WHERE username = 'viewer';
+-- 组织架构共享读面的全量权限点（方案 D5）：scope=all 挂它，没挂的人只能看自己的部门路径。
+-- ⚡ 权限点**必须先落库**才能被管理员绑给 custom 角色（createRole/updateBindings 会校验 code 存在），
+-- 只在端点里 assertPermission 而不落库 = 这个权限点永远绑不上，门禁形同虚设。
+INSERT OR IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES ('platform.org.read.all', 'framework', 'system:perm.platform_org_read_all', 0);
 -- 系统设置默认值（PRD §4.3；C4 设置页 / C5 登录方式发现的数据源；framework.market_cdn_url 安全组仅 superadmin 可改）
 -- framework.market_cdn_url 缺省 /cdn = 本站点自供（config.yaml 的 /cdn 挂载直出工程根 cdn/），脚手架免 setup；外部真 CDN 才改指绝对地址
 INSERT OR IGNORE INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('framework.site_title', 'framework', 'general', 'string', 'React Antd Admin', 'React Antd Admin', 'system:setting.site_title', 0, 0);
@@ -34,3 +39,6 @@ INSERT OR IGNORE INTO sys_setting (key, module, "group", type, value, default_va
 INSERT OR IGNORE INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_base_dn', 'ldap', 'ldap', 'string', '', '', 'system:setting.ldap_base_dn', 0, 0);
 INSERT OR IGNORE INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_uid_attr', 'ldap', 'ldap', 'string', 'uid', 'uid', 'system:setting.ldap_uid_attr', 0, 0);
 INSERT OR IGNORE INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_email_attr', 'ldap', 'ldap', 'string', 'mail', 'mail', 'system:setting.ldap_email_attr', 0, 0);
+-- 企微组织架构同步（B2）：触发同步是打上游的动作，挂权限点；admin/superadmin 天然通过，
+-- 只有自定义角色需要显式绑定（与 platform.org.read.all 同一条纪律：不落库就永远绑不上）。
+INSERT OR IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES ('auth.wecom.sync', 'auth', 'system:perm.auth_wecom_sync', 0);

package/templates/src/_platform/web/__client/api.schemas.ts

@@ -102,4 +102,130 @@ export const schemas = {
 
 }).catchall(z.unknown())),
 	},
+	"platformOrgTreeGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional()
+}),
+		data: z.array(z.object({
+	"id": z.number(),
+	"parentId": z.number().nullable(),
+	"name": z.string().nullable(),
+	"nameEn": z.string().nullable().optional(),
+	"orderNo": z.number(),
+	"memberCount": z.number()
+})),
+	},
+	"platformOrgDepartmentsGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"parent": z.number().optional(),
+	"keyword": z.string().optional(),
+	"page": z.number().min(1).optional(),
+	"size": z.number().min(1).max(200).optional()
+}),
+		data: z.object({
+	"list": z.array(z.object({
+	"id": z.number(),
+	"parentId": z.number().nullable(),
+	"name": z.string().nullable(),
+	"nameEn": z.string().nullable().optional(),
+	"orderNo": z.number(),
+	"memberCount": z.number()
+})),
+	"total": z.number(),
+	"page": z.number(),
+	"size": z.number(),
+	"truncated": z.boolean()
+}),
+	},
+	"platformOrgMembersGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"dept": z.number().optional(),
+	"includeSub": z.string().optional(),
+	"keyword": z.string().optional(),
+	"page": z.number().min(1).optional(),
+	"size": z.number().min(1).max(200).optional()
+}),
+		data: z.object({
+	"list": z.array(z.object({
+	"userId": z.number(),
+	"username": z.string(),
+	"displayName": z.string().nullable().optional(),
+	"deptId": z.number(),
+	"deptPath": z.array(z.string()),
+	"isMain": z.boolean()
+})),
+	"total": z.number(),
+	"page": z.number(),
+	"size": z.number(),
+	"truncated": z.boolean()
+}),
+	},
+	"platformOrgUserGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"uid": z.number().optional()
+}),
+		data: z.object({
+	"userId": z.number(),
+	"username": z.string(),
+	"displayName": z.string().nullable().optional(),
+	"position": z.string().nullable(),
+	"mainDeptId": z.number().nullable(),
+	"mainDeptPath": z.array(z.string()),
+	"departments": z.array(z.object({
+	"deptId": z.number(),
+	"deptPath": z.array(z.string())
+}))
+}),
+	},
+	"platformOrgPickerGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"keyword": z.string().min(2),
+	"limit": z.number().min(1).max(50).optional()
+}),
+		data: z.object({
+	"departments": z.array(z.object({
+	"id": z.number(),
+	"parentId": z.number().nullable(),
+	"name": z.string().nullable(),
+	"nameEn": z.string().nullable().optional(),
+	"orderNo": z.number(),
+	"memberCount": z.number()
+})),
+	"users": z.array(z.object({
+	"userId": z.number(),
+	"username": z.string(),
+	"displayName": z.string().nullable().optional(),
+	"deptId": z.number(),
+	"deptPath": z.array(z.string()),
+	"isMain": z.boolean()
+}))
+}),
+	},
+	"platformOrgResolvePost": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional()
+}),
+		body: z.object({
+	"deptIds": z.array(z.number()).optional(),
+	"userIds": z.array(z.number()).optional(),
+	"includeSub": z.boolean().optional()
+}),
+		data: z.object({
+	"userIds": z.array(z.number())
+}),
+	},
+	"platformOrgIsMemberGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"uid": z.number().optional(),
+	"dept": z.number()
+}),
+		data: z.object({
+	"isMember": z.boolean()
+}),
+	},
 };

package/templates/src/_platform/web/__client/api.ts

@@ -33,7 +33,7 @@ export function create_platformClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { platformContactsGet, platformContactsDetailGet, platformMarketInstallPost, platformMarketInstallCancelPost, platformMarketTaskGet, platformMarketEnablePost, platformMarketMetaGet, platformMarketTrustGet, platformMarketTrustPost, platformMarketTrustKeyPost, platformMarketTrustKeyDelete, platformMarketIndexGet, platformMarketUninstallImpactGet, platformMarketUninstallPost, platformMarketHistoryGet, platformSolutionsRoutesGet, platformSolutionsVerifyPost, platformSolutionsVerifyLastGet };
+	return { platformContactsGet, platformContactsDetailGet, platformMarketInstallPost, platformMarketInstallCancelPost, platformMarketTaskGet, platformMarketEnablePost, platformMarketMetaGet, platformMarketTrustGet, platformMarketTrustPost, platformMarketTrustKeyPost, platformMarketTrustKeyDelete, platformMarketIndexGet, platformMarketUninstallImpactGet, platformMarketUninstallPost, platformMarketHistoryGet, platformSolutionsRoutesGet, platformSolutionsVerifyPost, platformSolutionsVerifyLastGet, platformOrgTreeGet, platformOrgDepartmentsGet, platformOrgMembersGet, platformOrgUserGet, platformOrgPickerGet, platformOrgResolvePost, platformOrgIsMemberGet };
 }
 
 /**
@@ -446,3 +446,172 @@ export async function platformSolutionsVerifyLastGet(): Promise<unknown> {
 		throw await toApiError(e);
 	}
 }
+
+export type PlatformOrgTreeGetQuery = z.input<(typeof schemas)["platformOrgTreeGet"]["query"]>;
+export type PlatformOrgTreeGetData = z.infer<(typeof schemas)["platformOrgTreeGet"]["data"]>;
+
+export async function platformOrgTreeGet(query: PlatformOrgTreeGetQuery): Promise<PlatformOrgTreeGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/tree`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgTreeGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgTreeGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgTreeGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgTreeGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgDepartmentsGetQuery = z.input<(typeof schemas)["platformOrgDepartmentsGet"]["query"]>;
+export type PlatformOrgDepartmentsGetData = z.infer<(typeof schemas)["platformOrgDepartmentsGet"]["data"]>;
+
+export async function platformOrgDepartmentsGet(query: PlatformOrgDepartmentsGetQuery): Promise<PlatformOrgDepartmentsGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/departments`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgDepartmentsGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgDepartmentsGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgDepartmentsGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgDepartmentsGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgMembersGetQuery = z.input<(typeof schemas)["platformOrgMembersGet"]["query"]>;
+export type PlatformOrgMembersGetData = z.infer<(typeof schemas)["platformOrgMembersGet"]["data"]>;
+
+export async function platformOrgMembersGet(query: PlatformOrgMembersGetQuery): Promise<PlatformOrgMembersGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/members`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgMembersGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgMembersGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgMembersGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgMembersGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgUserGetQuery = z.input<(typeof schemas)["platformOrgUserGet"]["query"]>;
+export type PlatformOrgUserGetData = z.infer<(typeof schemas)["platformOrgUserGet"]["data"]>;
+
+export async function platformOrgUserGet(query: PlatformOrgUserGetQuery): Promise<PlatformOrgUserGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/user`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgUserGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgUserGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgUserGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgUserGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgPickerGetQuery = z.input<(typeof schemas)["platformOrgPickerGet"]["query"]>;
+export type PlatformOrgPickerGetData = z.infer<(typeof schemas)["platformOrgPickerGet"]["data"]>;
+
+export async function platformOrgPickerGet(query: PlatformOrgPickerGetQuery): Promise<PlatformOrgPickerGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/picker`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgPickerGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgPickerGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgPickerGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgPickerGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgResolvePostQuery = z.input<(typeof schemas)["platformOrgResolvePost"]["query"]>;
+export type PlatformOrgResolvePostBody = z.input<(typeof schemas)["platformOrgResolvePost"]["body"]>;
+export type PlatformOrgResolvePostData = z.infer<(typeof schemas)["platformOrgResolvePost"]["data"]>;
+
+export async function platformOrgResolvePost(input: { query: PlatformOrgResolvePostQuery, body: PlatformOrgResolvePostBody }): Promise<PlatformOrgResolvePostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`_platform/org/resolve`, { searchParams: input.query as Record<string, string | number | boolean>, json: input.body }).json<OjEnvelope<PlatformOrgResolvePostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgResolvePostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgResolvePost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgResolvePost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type PlatformOrgIsMemberGetQuery = z.input<(typeof schemas)["platformOrgIsMemberGet"]["query"]>;
+export type PlatformOrgIsMemberGetData = z.infer<(typeof schemas)["platformOrgIsMemberGet"]["data"]>;
+
+export async function platformOrgIsMemberGet(query: PlatformOrgIsMemberGetQuery): Promise<PlatformOrgIsMemberGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`_platform/org/is-member`, { searchParams: query as Record<string, string | number | boolean> }).json<OjEnvelope<PlatformOrgIsMemberGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as PlatformOrgIsMemberGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["platformOrgIsMemberGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] platformOrgIsMemberGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}

package/templates/src/auth/api/_shared/ldap-login.ts

@@ -74,6 +74,8 @@ export function createLdapLogin(session: Pick<Session, "issueExternal">, gateway
 					email: firstAttr(entries[0].attrs, emailAttr) || null,
 					must_change: 0,
 					is_forbidden: 0,
+					// 能走到这里说明 LDAP bind 成功 = 真人本人在登录，进通讯录目录
+					activated: 1,
 				}).run();
 			}
 			catch (e) {

package/templates/src/auth/api/_shared/session.ts

@@ -100,12 +100,16 @@ export function createSession(deps: SessionDeps = runtimeDeps()) {
 	return {
 		/** B1+D14：本地登录——先验口令后查禁用；号不存在/口令错/禁用统一 401（不泄露账号状态）。 */
 		async localLogin(username: string, password: string): Promise<TokenBundle> {
-			const rows = await db.table("users").select(["id", "password_hash", "is_forbidden"]).where({ field: "username", op: "eq", value: String(username ?? "") }).all() as Array<Record<string, unknown>>;
+			const rows = await db.table("users").select(["id", "password_hash", "is_forbidden", "activated"]).where({ field: "username", op: "eq", value: String(username ?? "") }).all() as Array<Record<string, unknown>>;
 			const row = rows[0];
 			if (!row || !(await deps.bcryptVerify(String(password ?? ""), String(row.password_hash))))
 				fail(401, "invalid credentials");
 			if (Number(row.is_forbidden) === 1)
 				fail(401, "invalid credentials");
+			// 首次成功登录 = 这个号确实有真人在用 → 放行到通讯录目录（同步建的全员档初始 activated=0）。
+			// 只在 0→1 时写一次，老用户登录不产生额外 UPDATE。
+			if (Number(row.activated) === 0)
+				await db.table("users").update({ activated: 1 }).where({ field: "id", op: "eq", value: Number(row.id) }).run();
 			return issueFor(Number(row.id));
 		},
 

package/templates/src/auth/api/_shared/wecom/admin.ts

@@ -12,8 +12,8 @@ import type { WecomClient } from "./client";
 import type { WecomConfig } from "./config";
 import type { WecomStoreDeps } from "./store";
 import { invalidateAllUsers } from "#/_platform/_shared/service/infra/access";
-import { eventUrlOf, installUrlOf } from "./config";
-import { corpScope, getSuiteTicket, revokeTenantSessions, tenantOfCorp } from "./store";
+import { assertProviderConfig, eventUrlOf } from "./config";
+import { corpScope, revokeTenantSessions, tenantOfCorp } from "./store";
 
 export interface WecomAdminDeps {
 	client: WecomClient
@@ -29,13 +29,15 @@ export interface AppRow {
 	env: string
 	corp_name: string | null
 	status: string
+	/** 0=管理员授权 / 1=成员授权：成员授权下这家企业的应用做不了组织架构同步（§2.3） */
+	auth_mode: number
 	installed_at: number
 	update_time: number
 }
 
 export async function listApps(): Promise<AppRow[]> {
 	const rows = await db.table("wecom_app_profile")
-		.select(["suite_id", "corp_id", "agent_id", "auth_corp_id", "env", "corp_name", "status", "installed_at", "update_time"])
+		.select(["suite_id", "corp_id", "agent_id", "auth_corp_id", "env", "corp_name", "status", "auth_mode", "installed_at", "update_time"])
 		.all() as unknown as AppRow[];
 	// 稳定序：先按企业、再按应用；同企业多环境并排，运维一眼能看出「哪两个是同一家」
 	return rows.sort((a, b) => a.corp_id.localeCompare(b.corp_id) || a.agent_id.localeCompare(b.agent_id));
@@ -88,25 +90,30 @@ export async function setAppStatus(
 }
 
 export interface InstallResult {
+	/** 开通链接（代开发 = `get_customized_auth_url` 返回的 qrcode_url，企业管理员扫/开即授权） */
 	installUrl: string
 	/** 企微后台「指令回调 URL」应填这个（逐字） */
 	callbackUrl: string
+	/** 链接有效期（秒，以企微返回为准，可达 10 天） */
 	expiresIn: number
 }
 
-/** 生成开通入口：suite_access_token → 预授权码 → install URL（企业管理员点开即进入授权安装向导） */
+/**
+ * 生成开通入口（代开发）：provider_access_token → get_customized_auth_url → qrcode_url。
+ * 与第三方应用的「预授权码拼安装链接」不是一个接口——代开发**不支持** get_pre_auth_code
+ * （errcode 48002），必须用这个。授权完成由企微回调 create_auth 落库，与这里无关。
+ */
 export async function createInstall(
 	cfg: WecomConfig,
 	client: WecomClient,
-	store: WecomStoreDeps,
 	state: string,
 ): Promise<InstallResult> {
-	const ticket = await getSuiteTicket(cfg.suiteId, store);
-	const token = await client.suiteAccessToken(cfg.suiteId, cfg.suiteSecret, ticket.ticket);
-	const pre = await client.preAuthCode(token);
+	assertProviderConfig(cfg);
+	const providerToken = await client.providerAccessToken(cfg.providerId, cfg.providerSecret);
+	const auth = await client.customizedAuthUrl(providerToken, [cfg.suiteId], state);
 	return {
-		installUrl: installUrlOf(cfg, pre.code, state),
+		installUrl: auth.url,
 		callbackUrl: eventUrlOf(cfg),
-		expiresIn: pre.expiresIn,
+		expiresIn: auth.expiresIn,
 	};
 }