@oj-module/cli 0.2.48 → 0.2.50

package/templates/src/login/web/pages/login.tsx

@@ -66,8 +66,13 @@ export default function LoginPage() {
 		const current = useTenantStore.getState().tenant;
 		return current === DEFAULT_TENANT ? "" : current;
 	});
-	// 企微 tab 的企业代码（优先用已持久化的值，单租户的 default 不预填）
-	const [corp, setCorp] = useState(() => tenant);
+	// 企微深链入口：应用「主页」配成 /login?corp=<corpId>&agent=<agentId>，
+	// 成员从企微内点开即带参到达——据此预填企业代码/应用，并由下方 effect 自动发起授权。
+	const urlCorp = new URLSearchParams(search).get("corp")?.trim() ?? "";
+	const urlAgent = new URLSearchParams(search).get("agent")?.trim() ?? "";
+	// 企微 tab 的企业代码（优先用 URL 深链带的，其次已持久化的值，单租户的 default 不预填）
+	const [corp, setCorp] = useState(() => urlCorp || tenant);
+	const [agent, setAgent] = useState(() => urlAgent);
 
 	// 企微 302 落地参数：只在首次渲染解析一次（ticket 一次性，解析结果必须稳定）
 	const [landing] = useState(() => parseWecomLanding(search));
@@ -110,6 +115,23 @@ export default function LoginPage() {
 		})();
 	}, [landing, login, navigate, search]);
 
+	// 企微深链自动入口：带 ?corp= 到达（且非回跳落地 / 非出错）且企微方式可用时，
+	// 直接整页发起授权——「点开即登录」，无需手动点「企业微信」tab。
+	const autoFiredRef = useRef(false);
+	useEffect(() => {
+		const c = new URLSearchParams(search).get("corp")?.trim() ?? "";
+		// 企微内（wxwork UA）从「应用主页」点开即自动发起授权；带 ?corp= 的深链同样自动发起。
+		const inWecom = typeof navigator !== "undefined" && /wxwork/i.test(navigator.userAgent);
+		if ((!c && !inWecom) || landing || autoFiredRef.current)
+			return;
+		if (new URLSearchParams(search).get("error"))
+			return;
+		if (!methods.includes("wecom"))
+			return;
+		autoFiredRef.current = true;
+		window.location.assign(`${resolveApiBase()}${wecomAuthorizePath(corp, agent)}`);
+	}, [landing, methods, search, corp, agent]);
+
 	async function onFinish(values: LoginFormValues, method: LoginMethod) {
 		setLoading(true);
 		setError(undefined);
@@ -144,7 +166,7 @@ export default function LoginPage() {
 		// 必须拼 API base（部署期可为 /api 或网关前缀）；拼站点 base 只会落到
 		// SPA 兜底页——点击后页面原地重载、一个 auth 请求都不发。
 		// 企业代码不在这里写 store——只有服务端回跳带的 tenant 才是权威值。
-		window.location.assign(`${resolveApiBase()}${wecomAuthorizePath(corp)}`);
+		window.location.assign(`${resolveApiBase()}${wecomAuthorizePath(corp, agent)}`);
 	}
 
 	const showTabs = methods.length > 1;
@@ -180,6 +202,7 @@ export default function LoginPage() {
 	// 受控值不走 antd 表单（Form.Item 无 name），故显式给 id/htmlFor：
 	// 少了这层关联，标签只是视觉文本，读屏与 getByLabel 都取不到输入框。
 	const wecomCorpId = "wecom-corp";
+	const wecomAgentId = "wecom-agent";
 	const wecomPanel = (
 		<Form layout="vertical" onFinish={wecomLogin}>
 			<Form.Item
@@ -195,6 +218,19 @@ export default function LoginPage() {
 					onChange={e => setCorp(e.target.value)}
 				/>
 			</Form.Item>
+			<Form.Item
+				label={t("login:method.wecom.agent")}
+				htmlFor={wecomAgentId}
+				extra={t("login:method.wecom.agentHint")}
+			>
+				<Input
+					id={wecomAgentId}
+					autoComplete="off"
+					placeholder="1000..."
+					value={agent}
+					onChange={e => setAgent(e.target.value)}
+				/>
+			</Form.Item>
 			<Button type="primary" htmlType="submit" block>
 				{t("login:method.wecom.action")}
 			</Button>

package/templates/src/system/web/locales/en-US.json

@@ -141,7 +141,8 @@
 			"status": "Status",
 			"installedAt": "Onboarded at",
 			"action": "Actions",
-			"authMode": "Auth mode"
+			"authMode": "Auth mode",
+			"source": "Source"
 		},
 		"statusActive": "Active",
 		"statusDisabled": "Disabled",
@@ -205,6 +206,28 @@
 					"hint": "Contact the service provider to investigate, then retry."
 				}
 			}
+		},
+		"source": {
+			"suite": "Delegated",
+			"corp": "Internal app"
+		},
+		"authModeNone": "—",
+		"configErrorTitle": "Deployment config check failed",
+		"coexistHint": "This deployment runs both delegated (suite) and internal (corp) apps (wecom_allow_coexist: 'true').",
+		"corp": {
+			"title": "Internal app (self-built)",
+			"hint": "This deployment connects as an internal app: credentials come from config.yaml (wecom_corp_id / wecom_corp_secret / wecom_corp_agent_id). Fill them in, then click \"Verify and connect\"; the corporation is registered only after all three checks pass.",
+			"corpId": "Corporation ID",
+			"agentId": "AgentId",
+			"callbackUrl": "Contacts event callback URL",
+			"callbackHint": "Fill this URL into WeCom → Tools → Contacts sync → Set event receiver URL. Leave the app's own message callback empty: the two use different tokens, and pointing both at one URL makes half the payloads fail signature verification.",
+			"callbackConfigured": "Contacts event callback credentials",
+			"callbackYes": "Configured (member changes sync in real time)",
+			"callbackNo": "Not configured (full sync only; to get increments, fill Token / EncodingAESKey for this URL in the WeCom console)",
+			"connect": "Verify and connect",
+			"connectConfirm": "Connect checks: whether the app Secret can fetch a token, whether contacts are readable, and whether any member is visible. Re-run it whenever the Corporation ID / AgentId changed or the Secret was rotated.",
+			"connectOk": "Connected: {{depts}} departments visible, {{members}} members in the sample department",
+			"connectHint": "After rotating the app Secret you must click \"Verify and connect\" again, otherwise every call fails with 40001. How many people get synced depends on the app's visible scope — set it to the whole company for a full sync."
 		}
 	},
 	"err": {

package/templates/src/system/web/locales/zh-CN.json

@@ -141,7 +141,8 @@
 			"status": "状态",
 			"installedAt": "开通时间",
 			"action": "操作",
-			"authMode": "授权模式"
+			"authMode": "授权模式",
+			"source": "来源"
 		},
 		"statusActive": "启用",
 		"statusDisabled": "停用",
@@ -205,6 +206,28 @@
 					"hint": "请联系服务商排查后重试。"
 				}
 			}
+		},
+		"source": {
+			"suite": "代开发",
+			"corp": "企业内部应用"
+		},
+		"authModeNone": "—",
+		"configErrorTitle": "部署配置自检未通过",
+		"coexistHint": "本部署同时启用了代开发与企业内部应用（wecom_allow_coexist: 'true'）。",
+		"corp": {
+			"title": "企业内部应用（自建）",
+			"hint": "本部署作为企业内部应用接入：凭据来自 config.yaml 的 wecom_corp_id / wecom_corp_secret / wecom_corp_agent_id。填好后点「验证并接入」，三步校验全过才会登记企业。",
+			"corpId": "企业ID",
+			"agentId": "AgentId",
+			"callbackUrl": "通讯录事件回调地址",
+			"callbackHint": "把上面这个地址填到企微「管理工具 → 通讯录同步 → 设置接收事件服务器」；应用自身的「接收消息」回调请留空——两处 Token 不同，填同一个 URL 会让一半报文验签失败。",
+			"callbackConfigured": "通讯录事件回调凭据",
+			"callbackYes": "已配置（成员变更会实时同步）",
+			"callbackNo": "未配置（只做全量同步；要增量请在企微后台填 Token / EncodingAESKey 到同一地址）",
+			"connect": "验证并接入",
+			"connectConfirm": "接入会依次校验：应用 Secret 能否换 token、能否读通讯录、可见范围内能否读到人。改过企业ID / AgentId 或换过 Secret 都必须重新点一次。",
+			"connectOk": "接入成功：可见范围内 {{depts}} 个部门，示例部门 {{members}} 人",
+			"connectHint": "换过应用 Secret 后必须重新「验证并接入」，否则所有调用都会 40001；同步到多少人取决于「应用可见范围」，要全量请设为全公司。"
 		}
 	},
 	"err": {

package/templates/src/system/web/pages/departments/sync-bar.tsx

@@ -18,6 +18,10 @@ interface SyncView {
 	connected: boolean
 	authMode: number
 	profileStatus: "active" | "disabled" | null
+	/** 已解析到的应用 id：多应用/共存企业的分辨锚点，start / cancel 要原样回传 */
+	agentId: string | null
+	/** suite=代开发 / corp=企业内部应用（自建）：自建应用没有「授权模式」这回事 */
+	credentialKind: "suite" | "corp" | null
 	status: "idle" | "running" | "done" | "failed" | "cancelled"
 	phase: "departments" | "members" | "reconcile"
 	stats: { departments: number, members: number, skipped: number, reconciled: boolean }
@@ -36,25 +40,45 @@ const MIN_GAP_MS = 6000;
 /** 一轮点击最多推多少片（12 秒/片 ≈ 12 分钟）：兜底防呆，正常企业两三次就到底 */
 const MAX_SLICES = 60;
 
+/**
+ * 已解析到的应用 id。同一家企业有两行档案（代开发 + 自建，迁移期常见）时后端要求带 agent，
+ * 而这个值只有后端知道：首次 status 不带（后端按「本站自建应用优先」解析），拿到后记住，
+ * 后续 start / cancel 原样回传。放模块级是为了跨组件实例复用，不参与渲染。
+ */
+let agentParam: string | null = null;
+
+function withAgent(url: string): string {
+	return agentParam ? `${url}?agent=${encodeURIComponent(agentParam)}` : url;
+}
+
+function agentBody(): { agent?: string } {
+	return agentParam ? { agent: agentParam } : {};
+}
+
+function remember(view: SyncView): SyncView {
+	agentParam = view.agentId ?? agentParam;
+	return view;
+}
+
 async function fetchStatus(): Promise<SyncView> {
-	const env = await request.get("auth/wecom/sync/status").json<{ code: number, data?: SyncView }>();
+	const env = await request.get(withAgent("auth/wecom/sync/status")).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步状态读取失败");
-	return env.data;
+	return remember(env.data);
 }
 
 async function pushSlice(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/start", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/start", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步未能启动");
-	return env.data;
+	return remember(env.data);
 }
 
 async function cancelSync(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/cancel", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/cancel", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("取消同步失败");
-	return env.data;
+	return remember(env.data);
 }
 
 function sleep(ms: number): Promise<void> {
@@ -180,7 +204,8 @@ export function WecomSyncBar({ onFinished }: { onFinished: () => void }) {
 	if (!view || !view.connected)
 		return null;
 
-	if (view.authMode !== 0) {
+	// 成员授权卡片只对代开发成立：自建应用没有「授权模式」，authMode 恒 0（双保险，防上游写脏数据）
+	if (view.credentialKind !== "corp" && view.authMode !== 0) {
 		return (
 			<Alert
 				type="warning"

package/templates/src/system/web/pages/wecom/index.tsx

@@ -1,6 +1,6 @@
 import { request, useUserStore } from "@oj-module/runtime";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
+import { Alert, App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -16,7 +16,9 @@ interface AppRow {
 	env: string
 	corp_name: string | null
 	status: "active" | "disabled"
-	/** 0=管理员授权 / 1=成员授权：成员授权下这家企业的应用做不了组织架构同步 */
+	/** 应用来源：suite=代开发 / corp=企业内部应用（自建） */
+	credential_kind: "suite" | "corp"
+	/** 0=管理员授权 / 1=成员授权：成员授权下这家企业的应用做不了组织架构同步；自建行恒 0 */
 	auth_mode: number
 	installed_at: number
 	update_time: number
@@ -28,6 +30,23 @@ interface InstallInfo {
 	expiresIn: number
 }
 
+/** GET /auth/wecom/admin/overview：本部署配了哪几套凭据、回调地址填什么 */
+interface Overview {
+	kinds: Array<"suite" | "corp">
+	configError: string | null
+	callbackUrl: string | null
+	corpId: string | null
+	agentId: string | null
+	corpCallbackConfigured: boolean
+}
+
+interface ConnectResult {
+	corpId: string
+	agentId: string
+	departments: number
+	members: number
+}
+
 /**
  * 端点不在本模块的生成 client 里（`__client` 按模块切分），故直接用 runtime 的 ky 出口。
  * 路径不带前导 `/`：与 request 的 baseURL 拼接口径一致（fetchLogin 同款）。
@@ -37,6 +56,11 @@ async function fetchApps(): Promise<AppRow[]> {
 	return env.data ?? [];
 }
 
+async function fetchOverview(): Promise<Overview> {
+	const env = await request.get("auth/wecom/admin/overview").json<{ code: number, data?: Overview }>();
+	return env.data ?? { kinds: [], configError: null, callbackUrl: null, corpId: null, agentId: null, corpCallbackConfigured: false };
+}
+
 async function setStatus(input: { corpId: string, agentId: string, status: "active" | "disabled" }): Promise<{ updated: number, revokedSessions: number }> {
 	const env = await request.post("auth/wecom/admin/status", { json: input }).json<{ code: number, data?: { updated: number, revokedSessions: number } }>();
 	return env.data ?? { updated: 0, revokedSessions: 0 };
@@ -49,12 +73,19 @@ async function createInstall(): Promise<InstallInfo> {
 	return env.data;
 }
 
+async function connectCorp(): Promise<ConnectResult> {
+	const env = await request.post("auth/wecom/admin/connect", { json: {} }).json<{ code: number, data?: ConnectResult }>();
+	if (!env.data)
+		throw new Error("企业微信未返回接入结果");
+	return env.data;
+}
+
 /**
- * 企微代开发后台（服务商运营面，superadmin 独占）：
- *   · 已授权企业 × 应用清单（同一企业测试/正式两个应用各一行）；
- *   · 启停（停用企业最后一个应用时后端同时吊销该企业会话）；
- *   · 开通入口（点「生成开通链接」→ 后端调企微 get_customized_auth_url 换 qrcode_url，
- *     企业管理员扫/开即授权，授权成功由 create_auth 回调落库）。
+ * 企微后台（superadmin 独占），两块卡片按「本部署配了哪套凭据」决定显不显示：
+ *   · 代开发：已授权企业 × 应用清单、启停、开通入口（点「生成开通链接」→ 后端调
+ *     get_customized_auth_url 换 qrcode_url，企业管理员扫/开即授权，由 create_auth 回调落库）；
+ *   · 企业内部应用（自建）：本企业的那一份凭据 + 回调地址 + 「验证并接入」。
+ * 两套可以同时启用（`wecom_allow_coexist: 'true'`），此时两张卡片并列，清单里按「来源」区分。
  */
 export default function WecomAdminPage() {
 	const { t } = useTranslation();
@@ -83,6 +114,14 @@ export default function WecomAdminPage() {
 		retry: false,
 	});
 
+	// 概览读的是**部署常量**而不是库：配置错的时候清单可能是空的，而这里必须还能说清「缺什么」
+	const overviewQuery = useQuery({
+		queryKey: ["system", "wecom-overview"],
+		queryFn: fetchOverview,
+		enabled: isSuper,
+		retry: false,
+	});
+
 	const statusMut = useMutation({
 		mutationFn: setStatus,
 		onSuccess: (r) => {
@@ -106,9 +145,24 @@ export default function WecomAdminPage() {
 		onError: e => message.error(explainError(e, t)),
 	});
 
+	const connectMut = useMutation({
+		mutationFn: connectCorp,
+		onSuccess: (r) => {
+			message.success(t("system:wecom.corp.connectOk", { depts: r.departments, members: r.members }));
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-apps"] });
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-overview"] });
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
 	if (!isSuper)
 		return <ForbiddenPanel t={t} />;
 
+	const overview = overviewQuery.data;
+	const kinds = overview?.kinds ?? [];
+	const hasSuite = kinds.includes("suite");
+	const hasCorp = kinds.includes("corp");
+
 	const columns = [
 		{
 			title: t("system:wecom.col.corp"),
@@ -120,16 +174,26 @@ export default function WecomAdminPage() {
 				</div>
 			),
 		},
+		{
+			// 来源列：共存部署里清单会同时出现两类行，不标出来就分不清「这行是谁装进来的」
+			title: t("system:wecom.col.source"),
+			dataIndex: "credential_kind",
+			render: (v: AppRow["credential_kind"]) => (v === "corp"
+				? <Tag color="blue">{t("system:wecom.source.corp")}</Tag>
+				: <Tag>{t("system:wecom.source.suite")}</Tag>),
+		},
 		{ title: t("system:wecom.col.agent"), dataIndex: "agent_id" },
 		{ title: t("system:wecom.col.env"), dataIndex: "env", render: (v: string) => <Tag>{v}</Tag> },
 		{
 			// 权限三态：成员授权是「装了也同步不了」的硬约束（企微侧通讯录接口一律 60011），
-			// 摆在清单上，服务商不用点进去试一遍才知道
+			// 摆在清单上，服务商不用点进去试一遍才知道。自建应用没有这个概念，显示空值。
 			title: t("system:wecom.col.authMode"),
 			dataIndex: "auth_mode",
-			render: (v: number) => (v === 0
-				? <Tag color="green">{t("system:wecom.authModeAdmin")}</Tag>
-				: <Tag color="orange">{t("system:wecom.authModeMember")}</Tag>),
+			render: (v: number, row: AppRow) => (row.credential_kind === "corp"
+				? <Typography.Text type="secondary">{t("system:wecom.authModeNone")}</Typography.Text>
+				: v === 0
+					? <Tag color="green">{t("system:wecom.authModeAdmin")}</Tag>
+					: <Tag color="orange">{t("system:wecom.authModeMember")}</Tag>),
 		},
 		{
 			title: t("system:wecom.col.status"),
@@ -166,41 +230,95 @@ export default function WecomAdminPage() {
 
 	return (
 		<Space direction="vertical" size="middle" style={{ width: "100%" }}>
-			<Card
-				title={t("system:wecom.title")}
-				extra={(
-					<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
-						{t("system:wecom.genInstall")}
-					</Button>
-				)}
-			>
-				<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
-				{install && (
-					<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
-						{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
-						    企业管理员多半在手机上收通知，扫码比复制链接快 */}
-						<QRCode
-							value={install.installUrl}
-							size={160}
-							type="svg"
-							bordered
-							status={expired ? "expired" : "active"}
-							onRefresh={() => installMut.mutate()}
-						/>
-						<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
-							<Descriptions.Item label={t("system:wecom.installUrl")}>
-								<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
-							</Descriptions.Item>
-							<Descriptions.Item label={t("system:wecom.callbackUrl")}>
-								<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
-							</Descriptions.Item>
-							<Descriptions.Item label={t("system:wecom.expiresIn")}>
-								{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
-							</Descriptions.Item>
-						</Descriptions>
-					</div>
-				)}
-			</Card>
+			{overview?.configError && (
+				<Alert
+					type="error"
+					showIcon
+					message={t("system:wecom.configErrorTitle")}
+					description={overview.configError}
+				/>
+			)}
+			{hasSuite && hasCorp && (
+				<Alert type="info" showIcon message={t("system:wecom.coexistHint")} />
+			)}
+			{hasSuite && (
+				<Card
+					title={t("system:wecom.title")}
+					extra={(
+						<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
+							{t("system:wecom.genInstall")}
+						</Button>
+					)}
+				>
+					<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
+					{install && (
+						<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
+							{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
+							    企业管理员多半在手机上收通知，扫码比复制链接快 */}
+							<QRCode
+								value={install.installUrl}
+								size={160}
+								type="svg"
+								bordered
+								status={expired ? "expired" : "active"}
+								onRefresh={() => installMut.mutate()}
+							/>
+							<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
+								<Descriptions.Item label={t("system:wecom.installUrl")}>
+									<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
+								</Descriptions.Item>
+								<Descriptions.Item label={t("system:wecom.callbackUrl")}>
+									<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
+								</Descriptions.Item>
+								<Descriptions.Item label={t("system:wecom.expiresIn")}>
+									{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
+								</Descriptions.Item>
+							</Descriptions>
+						</div>
+					)}
+				</Card>
+			)}
+			{hasCorp && (
+				<Card
+					title={t("system:wecom.corp.title")}
+					extra={(
+						<Popconfirm
+							title={t("system:wecom.corp.connectConfirm")}
+							onConfirm={() => connectMut.mutate()}
+						>
+							<Button type="primary" loading={connectMut.isPending}>
+								{t("system:wecom.corp.connect")}
+							</Button>
+						</Popconfirm>
+					)}
+				>
+					<Typography.Paragraph type="secondary">{t("system:wecom.corp.hint")}</Typography.Paragraph>
+					<Descriptions column={1} size="small" bordered>
+						<Descriptions.Item label={t("system:wecom.corp.corpId")}>
+							<Typography.Text>{overview?.corpId ?? "-"}</Typography.Text>
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.agentId")}>
+							<Typography.Text>{overview?.agentId ?? "-"}</Typography.Text>
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.callbackUrl")}>
+							{overview?.callbackUrl
+								? <Typography.Text copyable={{ text: overview.callbackUrl }}>{overview.callbackUrl}</Typography.Text>
+								: "-"}
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.callbackConfigured")}>
+							{overview?.corpCallbackConfigured
+								? <Tag color="green">{t("system:wecom.corp.callbackYes")}</Tag>
+								: <Tag color="orange">{t("system:wecom.corp.callbackNo")}</Tag>}
+						</Descriptions.Item>
+					</Descriptions>
+					<Typography.Paragraph type="secondary" style={{ marginTop: 12, marginBottom: 0 }}>
+						{t("system:wecom.corp.callbackHint")}
+					</Typography.Paragraph>
+					<Typography.Paragraph type="warning" style={{ marginBottom: 0 }}>
+						{t("system:wecom.corp.connectHint")}
+					</Typography.Paragraph>
+				</Card>
+			)}
 			<Card title={t("system:wecom.appsTitle")}>
 				<Typography.Paragraph type="secondary" style={{ marginBottom: 12 }}>
 					{t("system:wecom.authModeHint")}

package/templates/tests/wecom-admin.spec.ts

@@ -15,7 +15,7 @@ import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { assertSuperAdmin, invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
 import { listApps, setAppStatus } from "../src/auth/api/_shared/wecom/admin";
 import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { readWecomConfig } from "../src/auth/api/_shared/wecom/config";
+import { readSuiteConfig } from "../src/auth/api/_shared/wecom/config";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -123,7 +123,7 @@ function fakeClient(): { client: any, invalidated: string[] } {
 const deps = { store: { encrypt: (p: string) => `gcm(${p})`, decrypt: (b: string) => b, now: () => NOW } };
 
 /** createInstall 的薄包装：省掉动态 import 的样板 */
-async function createInstallForTest(cfg: ReturnType<typeof readWecomConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
+async function createInstallForTest(cfg: ReturnType<typeof readSuiteConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
 	const { createInstall } = await import("../src/auth/api/_shared/wecom/admin");
 	return createInstall(cfg, client, state);
 }
@@ -274,7 +274,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("provider_token → get_customized_auth_url → qrcode_url（即开通链接），且绝不调 get_pre_auth_code", async () => {
 		const { calls, bodies } = stubUpstream();
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 
 		const r = await createInstallForTest(cfg, client, "st_1");
@@ -297,7 +297,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("调用方没传 state 时仍发默认 state（避免 40058 state missing）", async () => {
 		const { bodies } = stubUpstream();
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await createInstallForTest(cfg, client, "");
 		const body = bodies.find(b => b && b.templateid_list) as any;
@@ -307,14 +307,14 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("缺 provider 凭证（wecom_provider_id / wecom_provider_secret）→ 400 并点名缺哪两个 vars", async () => {
 		installVars({ wecom_provider_id: "", wecom_provider_secret: "" });
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 400 });
 	});
 
 	it("上游 errcode（如 provider_secret 错）→ 502（可重试语义，不是 500）", async () => {
 		g.fetch = async () => ({ ok: true, json: async () => ({ errcode: 40001, errmsg: "invalid provider secret" }) });
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 502 });
 	});
@@ -330,7 +330,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 				throw new Error(`stub fetch 未预期：${url}`);
 			},
 		});
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "st_1")).rejects.toMatchObject({
 			status: 502,