@oj-module/cli 0.2.49 → 0.2.50

package/templates/src/system/web/pages/departments/sync-bar.tsx

@@ -18,6 +18,10 @@ interface SyncView {
 	connected: boolean
 	authMode: number
 	profileStatus: "active" | "disabled" | null
+	/** 已解析到的应用 id：多应用/共存企业的分辨锚点，start / cancel 要原样回传 */
+	agentId: string | null
+	/** suite=代开发 / corp=企业内部应用（自建）：自建应用没有「授权模式」这回事 */
+	credentialKind: "suite" | "corp" | null
 	status: "idle" | "running" | "done" | "failed" | "cancelled"
 	phase: "departments" | "members" | "reconcile"
 	stats: { departments: number, members: number, skipped: number, reconciled: boolean }
@@ -36,25 +40,45 @@ const MIN_GAP_MS = 6000;
 /** 一轮点击最多推多少片（12 秒/片 ≈ 12 分钟）：兜底防呆，正常企业两三次就到底 */
 const MAX_SLICES = 60;
 
+/**
+ * 已解析到的应用 id。同一家企业有两行档案（代开发 + 自建，迁移期常见）时后端要求带 agent，
+ * 而这个值只有后端知道：首次 status 不带（后端按「本站自建应用优先」解析），拿到后记住，
+ * 后续 start / cancel 原样回传。放模块级是为了跨组件实例复用，不参与渲染。
+ */
+let agentParam: string | null = null;
+
+function withAgent(url: string): string {
+	return agentParam ? `${url}?agent=${encodeURIComponent(agentParam)}` : url;
+}
+
+function agentBody(): { agent?: string } {
+	return agentParam ? { agent: agentParam } : {};
+}
+
+function remember(view: SyncView): SyncView {
+	agentParam = view.agentId ?? agentParam;
+	return view;
+}
+
 async function fetchStatus(): Promise<SyncView> {
-	const env = await request.get("auth/wecom/sync/status").json<{ code: number, data?: SyncView }>();
+	const env = await request.get(withAgent("auth/wecom/sync/status")).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步状态读取失败");
-	return env.data;
+	return remember(env.data);
 }
 
 async function pushSlice(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/start", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/start", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步未能启动");
-	return env.data;
+	return remember(env.data);
 }
 
 async function cancelSync(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/cancel", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/cancel", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("取消同步失败");
-	return env.data;
+	return remember(env.data);
 }
 
 function sleep(ms: number): Promise<void> {
@@ -180,7 +204,8 @@ export function WecomSyncBar({ onFinished }: { onFinished: () => void }) {
 	if (!view || !view.connected)
 		return null;
 
-	if (view.authMode !== 0) {
+	// 成员授权卡片只对代开发成立：自建应用没有「授权模式」，authMode 恒 0（双保险，防上游写脏数据）
+	if (view.credentialKind !== "corp" && view.authMode !== 0) {
 		return (
 			<Alert
 				type="warning"

package/templates/src/system/web/pages/wecom/index.tsx

@@ -1,6 +1,6 @@
 import { request, useUserStore } from "@oj-module/runtime";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
+import { Alert, App, Button, Card, Descriptions, Popconfirm, QRCode, Space, Table, Tag, Typography } from "antd";
 import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 
@@ -16,7 +16,9 @@ interface AppRow {
 	env: string
 	corp_name: string | null
 	status: "active" | "disabled"
-	/** 0=管理员授权 / 1=成员授权：成员授权下这家企业的应用做不了组织架构同步 */
+	/** 应用来源：suite=代开发 / corp=企业内部应用（自建） */
+	credential_kind: "suite" | "corp"
+	/** 0=管理员授权 / 1=成员授权：成员授权下这家企业的应用做不了组织架构同步；自建行恒 0 */
 	auth_mode: number
 	installed_at: number
 	update_time: number
@@ -28,6 +30,23 @@ interface InstallInfo {
 	expiresIn: number
 }
 
+/** GET /auth/wecom/admin/overview：本部署配了哪几套凭据、回调地址填什么 */
+interface Overview {
+	kinds: Array<"suite" | "corp">
+	configError: string | null
+	callbackUrl: string | null
+	corpId: string | null
+	agentId: string | null
+	corpCallbackConfigured: boolean
+}
+
+interface ConnectResult {
+	corpId: string
+	agentId: string
+	departments: number
+	members: number
+}
+
 /**
  * 端点不在本模块的生成 client 里（`__client` 按模块切分），故直接用 runtime 的 ky 出口。
  * 路径不带前导 `/`：与 request 的 baseURL 拼接口径一致（fetchLogin 同款）。
@@ -37,6 +56,11 @@ async function fetchApps(): Promise<AppRow[]> {
 	return env.data ?? [];
 }
 
+async function fetchOverview(): Promise<Overview> {
+	const env = await request.get("auth/wecom/admin/overview").json<{ code: number, data?: Overview }>();
+	return env.data ?? { kinds: [], configError: null, callbackUrl: null, corpId: null, agentId: null, corpCallbackConfigured: false };
+}
+
 async function setStatus(input: { corpId: string, agentId: string, status: "active" | "disabled" }): Promise<{ updated: number, revokedSessions: number }> {
 	const env = await request.post("auth/wecom/admin/status", { json: input }).json<{ code: number, data?: { updated: number, revokedSessions: number } }>();
 	return env.data ?? { updated: 0, revokedSessions: 0 };
@@ -49,12 +73,19 @@ async function createInstall(): Promise<InstallInfo> {
 	return env.data;
 }
 
+async function connectCorp(): Promise<ConnectResult> {
+	const env = await request.post("auth/wecom/admin/connect", { json: {} }).json<{ code: number, data?: ConnectResult }>();
+	if (!env.data)
+		throw new Error("企业微信未返回接入结果");
+	return env.data;
+}
+
 /**
- * 企微代开发后台（服务商运营面，superadmin 独占）：
- *   · 已授权企业 × 应用清单（同一企业测试/正式两个应用各一行）；
- *   · 启停（停用企业最后一个应用时后端同时吊销该企业会话）；
- *   · 开通入口（点「生成开通链接」→ 后端调企微 get_customized_auth_url 换 qrcode_url，
- *     企业管理员扫/开即授权，授权成功由 create_auth 回调落库）。
+ * 企微后台（superadmin 独占），两块卡片按「本部署配了哪套凭据」决定显不显示：
+ *   · 代开发：已授权企业 × 应用清单、启停、开通入口（点「生成开通链接」→ 后端调
+ *     get_customized_auth_url 换 qrcode_url，企业管理员扫/开即授权，由 create_auth 回调落库）；
+ *   · 企业内部应用（自建）：本企业的那一份凭据 + 回调地址 + 「验证并接入」。
+ * 两套可以同时启用（`wecom_allow_coexist: 'true'`），此时两张卡片并列，清单里按「来源」区分。
  */
 export default function WecomAdminPage() {
 	const { t } = useTranslation();
@@ -83,6 +114,14 @@ export default function WecomAdminPage() {
 		retry: false,
 	});
 
+	// 概览读的是**部署常量**而不是库：配置错的时候清单可能是空的，而这里必须还能说清「缺什么」
+	const overviewQuery = useQuery({
+		queryKey: ["system", "wecom-overview"],
+		queryFn: fetchOverview,
+		enabled: isSuper,
+		retry: false,
+	});
+
 	const statusMut = useMutation({
 		mutationFn: setStatus,
 		onSuccess: (r) => {
@@ -106,9 +145,24 @@ export default function WecomAdminPage() {
 		onError: e => message.error(explainError(e, t)),
 	});
 
+	const connectMut = useMutation({
+		mutationFn: connectCorp,
+		onSuccess: (r) => {
+			message.success(t("system:wecom.corp.connectOk", { depts: r.departments, members: r.members }));
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-apps"] });
+			queryClient.invalidateQueries({ queryKey: ["system", "wecom-overview"] });
+		},
+		onError: e => message.error(explainError(e, t)),
+	});
+
 	if (!isSuper)
 		return <ForbiddenPanel t={t} />;
 
+	const overview = overviewQuery.data;
+	const kinds = overview?.kinds ?? [];
+	const hasSuite = kinds.includes("suite");
+	const hasCorp = kinds.includes("corp");
+
 	const columns = [
 		{
 			title: t("system:wecom.col.corp"),
@@ -120,16 +174,26 @@ export default function WecomAdminPage() {
 				</div>
 			),
 		},
+		{
+			// 来源列：共存部署里清单会同时出现两类行，不标出来就分不清「这行是谁装进来的」
+			title: t("system:wecom.col.source"),
+			dataIndex: "credential_kind",
+			render: (v: AppRow["credential_kind"]) => (v === "corp"
+				? <Tag color="blue">{t("system:wecom.source.corp")}</Tag>
+				: <Tag>{t("system:wecom.source.suite")}</Tag>),
+		},
 		{ title: t("system:wecom.col.agent"), dataIndex: "agent_id" },
 		{ title: t("system:wecom.col.env"), dataIndex: "env", render: (v: string) => <Tag>{v}</Tag> },
 		{
 			// 权限三态：成员授权是「装了也同步不了」的硬约束（企微侧通讯录接口一律 60011），
-			// 摆在清单上，服务商不用点进去试一遍才知道
+			// 摆在清单上，服务商不用点进去试一遍才知道。自建应用没有这个概念，显示空值。
 			title: t("system:wecom.col.authMode"),
 			dataIndex: "auth_mode",
-			render: (v: number) => (v === 0
-				? <Tag color="green">{t("system:wecom.authModeAdmin")}</Tag>
-				: <Tag color="orange">{t("system:wecom.authModeMember")}</Tag>),
+			render: (v: number, row: AppRow) => (row.credential_kind === "corp"
+				? <Typography.Text type="secondary">{t("system:wecom.authModeNone")}</Typography.Text>
+				: v === 0
+					? <Tag color="green">{t("system:wecom.authModeAdmin")}</Tag>
+					: <Tag color="orange">{t("system:wecom.authModeMember")}</Tag>),
 		},
 		{
 			title: t("system:wecom.col.status"),
@@ -166,41 +230,95 @@ export default function WecomAdminPage() {
 
 	return (
 		<Space direction="vertical" size="middle" style={{ width: "100%" }}>
-			<Card
-				title={t("system:wecom.title")}
-				extra={(
-					<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
-						{t("system:wecom.genInstall")}
-					</Button>
-				)}
-			>
-				<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
-				{install && (
-					<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
-						{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
-						    企业管理员多半在手机上收通知，扫码比复制链接快 */}
-						<QRCode
-							value={install.installUrl}
-							size={160}
-							type="svg"
-							bordered
-							status={expired ? "expired" : "active"}
-							onRefresh={() => installMut.mutate()}
-						/>
-						<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
-							<Descriptions.Item label={t("system:wecom.installUrl")}>
-								<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
-							</Descriptions.Item>
-							<Descriptions.Item label={t("system:wecom.callbackUrl")}>
-								<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
-							</Descriptions.Item>
-							<Descriptions.Item label={t("system:wecom.expiresIn")}>
-								{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
-							</Descriptions.Item>
-						</Descriptions>
-					</div>
-				)}
-			</Card>
+			{overview?.configError && (
+				<Alert
+					type="error"
+					showIcon
+					message={t("system:wecom.configErrorTitle")}
+					description={overview.configError}
+				/>
+			)}
+			{hasSuite && hasCorp && (
+				<Alert type="info" showIcon message={t("system:wecom.coexistHint")} />
+			)}
+			{hasSuite && (
+				<Card
+					title={t("system:wecom.title")}
+					extra={(
+						<Button type="primary" loading={installMut.isPending} onClick={() => installMut.mutate()}>
+							{t("system:wecom.genInstall")}
+						</Button>
+					)}
+				>
+					<Typography.Paragraph type="secondary">{t("system:wecom.hint")}</Typography.Paragraph>
+					{install && (
+						<div style={{ display: "flex", gap: 24, alignItems: "flex-start", flexWrap: "wrap" }}>
+							{/* 二维码用 antd 内置 QRCode（同一份共享 antd，不额外引二维码依赖）：
+							    企业管理员多半在手机上收通知，扫码比复制链接快 */}
+							<QRCode
+								value={install.installUrl}
+								size={160}
+								type="svg"
+								bordered
+								status={expired ? "expired" : "active"}
+								onRefresh={() => installMut.mutate()}
+							/>
+							<Descriptions column={1} size="small" bordered style={{ flex: 1, minWidth: 320 }}>
+								<Descriptions.Item label={t("system:wecom.installUrl")}>
+									<Typography.Text copyable={{ text: install.installUrl }}>{install.installUrl}</Typography.Text>
+								</Descriptions.Item>
+								<Descriptions.Item label={t("system:wecom.callbackUrl")}>
+									<Typography.Text copyable={{ text: install.callbackUrl }}>{install.callbackUrl}</Typography.Text>
+								</Descriptions.Item>
+								<Descriptions.Item label={t("system:wecom.expiresIn")}>
+									{t("system:wecom.expiresValue", { count: Math.round(install.expiresIn / 60) })}
+								</Descriptions.Item>
+							</Descriptions>
+						</div>
+					)}
+				</Card>
+			)}
+			{hasCorp && (
+				<Card
+					title={t("system:wecom.corp.title")}
+					extra={(
+						<Popconfirm
+							title={t("system:wecom.corp.connectConfirm")}
+							onConfirm={() => connectMut.mutate()}
+						>
+							<Button type="primary" loading={connectMut.isPending}>
+								{t("system:wecom.corp.connect")}
+							</Button>
+						</Popconfirm>
+					)}
+				>
+					<Typography.Paragraph type="secondary">{t("system:wecom.corp.hint")}</Typography.Paragraph>
+					<Descriptions column={1} size="small" bordered>
+						<Descriptions.Item label={t("system:wecom.corp.corpId")}>
+							<Typography.Text>{overview?.corpId ?? "-"}</Typography.Text>
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.agentId")}>
+							<Typography.Text>{overview?.agentId ?? "-"}</Typography.Text>
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.callbackUrl")}>
+							{overview?.callbackUrl
+								? <Typography.Text copyable={{ text: overview.callbackUrl }}>{overview.callbackUrl}</Typography.Text>
+								: "-"}
+						</Descriptions.Item>
+						<Descriptions.Item label={t("system:wecom.corp.callbackConfigured")}>
+							{overview?.corpCallbackConfigured
+								? <Tag color="green">{t("system:wecom.corp.callbackYes")}</Tag>
+								: <Tag color="orange">{t("system:wecom.corp.callbackNo")}</Tag>}
+						</Descriptions.Item>
+					</Descriptions>
+					<Typography.Paragraph type="secondary" style={{ marginTop: 12, marginBottom: 0 }}>
+						{t("system:wecom.corp.callbackHint")}
+					</Typography.Paragraph>
+					<Typography.Paragraph type="warning" style={{ marginBottom: 0 }}>
+						{t("system:wecom.corp.connectHint")}
+					</Typography.Paragraph>
+				</Card>
+			)}
 			<Card title={t("system:wecom.appsTitle")}>
 				<Typography.Paragraph type="secondary" style={{ marginBottom: 12 }}>
 					{t("system:wecom.authModeHint")}

package/templates/tests/wecom-admin.spec.ts

@@ -15,7 +15,7 @@ import { afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import { assertSuperAdmin, invalidateAllUsers } from "../src/_platform/api/_shared/service/infra/access";
 import { listApps, setAppStatus } from "../src/auth/api/_shared/wecom/admin";
 import { createWecomClient, runtimeCache, runtimeHttp } from "../src/auth/api/_shared/wecom/client";
-import { readWecomConfig } from "../src/auth/api/_shared/wecom/config";
+import { readSuiteConfig } from "../src/auth/api/_shared/wecom/config";
 import { installDb } from "./fixture";
 
 const g = globalThis as any;
@@ -123,7 +123,7 @@ function fakeClient(): { client: any, invalidated: string[] } {
 const deps = { store: { encrypt: (p: string) => `gcm(${p})`, decrypt: (b: string) => b, now: () => NOW } };
 
 /** createInstall 的薄包装：省掉动态 import 的样板 */
-async function createInstallForTest(cfg: ReturnType<typeof readWecomConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
+async function createInstallForTest(cfg: ReturnType<typeof readSuiteConfig>, client: ReturnType<typeof createWecomClient>, state: string) {
 	const { createInstall } = await import("../src/auth/api/_shared/wecom/admin");
 	return createInstall(cfg, client, state);
 }
@@ -274,7 +274,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("provider_token → get_customized_auth_url → qrcode_url（即开通链接），且绝不调 get_pre_auth_code", async () => {
 		const { calls, bodies } = stubUpstream();
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 
 		const r = await createInstallForTest(cfg, client, "st_1");
@@ -297,7 +297,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("调用方没传 state 时仍发默认 state（避免 40058 state missing）", async () => {
 		const { bodies } = stubUpstream();
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await createInstallForTest(cfg, client, "");
 		const body = bodies.find(b => b && b.templateid_list) as any;
@@ -307,14 +307,14 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 
 	it("缺 provider 凭证（wecom_provider_id / wecom_provider_secret）→ 400 并点名缺哪两个 vars", async () => {
 		installVars({ wecom_provider_id: "", wecom_provider_secret: "" });
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 400 });
 	});
 
 	it("上游 errcode（如 provider_secret 错）→ 502（可重试语义，不是 500）", async () => {
 		g.fetch = async () => ({ ok: true, json: async () => ({ errcode: 40001, errmsg: "invalid provider secret" }) });
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "")).rejects.toMatchObject({ status: 502 });
 	});
@@ -330,7 +330,7 @@ describe("P3-C：开通入口（createInstall，代开发 get_customized_auth_ur
 				throw new Error(`stub fetch 未预期：${url}`);
 			},
 		});
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		const client = createWecomClient({ http: runtimeHttp(), cache: runtimeCache() });
 		await expect(createInstallForTest(cfg, client, "st_1")).rejects.toMatchObject({
 			status: 502,

package/templates/tests/wecom-connector.spec.ts

@@ -21,7 +21,7 @@ import {
 	eventUrlOf,
 	loginRedirectOf,
 	readCallbackConfig,
-	readWecomConfig,
+	readSuiteConfig,
 	siteRootOf,
 } from "../src/auth/api/_shared/wecom/config";
 import { envOfState, handleSuiteEvent } from "../src/auth/api/_shared/wecom/events";
@@ -105,6 +105,7 @@ function profile(suiteCorpAgent: { corp?: string, agent?: string, env?: string,
 		agentId: suiteCorpAgent.agent ?? "100001",
 		env: suiteCorpAgent.env ?? "prod",
 		corpName: "测试企业",
+		credentialKind: "suite" as const,
 		permanentCode: suiteCorpAgent.code ?? "perm_a",
 	};
 }
@@ -757,7 +758,7 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 		installVars({ wecom_suite_id: "", wecom_callback_token: "", wecom_enc_key: "" });
 		const msg = (() => {
 			try {
-				readWecomConfig();
+				readSuiteConfig();
 				return "";
 			}
 			catch (e) {
@@ -789,7 +790,7 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 
 	it("baseUrl 去尾斜杠后拼出两个企微侧地址（回调 URL 要原样填进后台）", () => {
 		installVars();
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		expect(cfg.baseUrl).toBe("https://site.example.com/api/auth/wecom");
 		// 不带 callback_format=json：官方文档只给「对外收款」写了这个参数，代开发的通用回调配置只有 XML
 		expect(eventUrlOf(cfg)).toBe("https://site.example.com/api/auth/wecom/event");
@@ -799,7 +800,7 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 
 	it("子路径部署：站点根保留子路径（302 回跳必须落 /oj/login，不是 /login）", () => {
 		installVars({ wecom_base_url: "https://site.example.com/oj/api/auth/wecom" });
-		const cfg = readWecomConfig();
+		const cfg = readSuiteConfig();
 		expect(siteRootOf(cfg)).toBe("https://site.example.com/oj");
 		expect(loginLandingUrl({ origin: siteRootOf(cfg), ticket: "tk", tenant: "ww_corp_a" }))
 			.toBe("https://site.example.com/oj/login?wecom_ticket=tk&tenant=ww_corp_a");
@@ -807,12 +808,12 @@ describe("P1-J：部署常量读取（缺项一次报全 / 密钥格式 fail-fas
 
 	it("baseUrl 后缀不对 → 400（宁可拒，也不猜站点根拼出错误回跳）", () => {
 		installVars({ wecom_base_url: "https://site.example.com/api/wecom" });
-		expect(() => siteRootOf(readWecomConfig())).toThrow(/必须以 \/api\/auth\/wecom 结尾/);
+		expect(() => siteRootOf(readSuiteConfig())).toThrow(/必须以 \/api\/auth\/wecom 结尾/);
 	});
 
 	it("baseUrl 非绝对地址 → 400（相对路径会让 redirect_uri 与回调 URL 双双失效）", () => {
 		installVars({ wecom_base_url: "/api/auth/wecom" });
-		expect(() => readWecomConfig()).toThrow(/绝对地址/);
+		expect(() => readSuiteConfig()).toThrow(/绝对地址/);
 	});
 
 	it("wecom_enc_key 只收 16/32 字节的 hex 或 base64（AES-192 会在加密时才炸，故在读配置处拦住）", () => {