@oj-module/cli 0.2.49 → 0.2.53

package/templates/src/auth/api/wecom/sync/api.ts

@@ -18,7 +18,7 @@ import { assertPermission, assertTenantSelf } from "#/_platform/_shared/service/
 import { recordOp } from "#/_platform/_shared/service/infra/audit";
 import { rateLimit } from "#/_platform/_shared/service/infra/rate";
 import { createWecomClient, runtimeCache, runtimeHttp } from "../../_shared/wecom/client";
-import { readWecomConfig } from "../../_shared/wecom/config";
+import { corpIdentity, readBase } from "../../_shared/wecom/config";
 import { findProfile, probeProfile, runtimeStoreDeps } from "../../_shared/wecom/store";
 import { attachProfile, cancelSync, emptyView, startSync, syncStatus } from "../../_shared/wecom/sync";
 
@@ -44,12 +44,15 @@ const STATS = {
 
 const VIEW = {
 	type: "object",
-	required: ["connected", "authMode", "profileStatus", "status", "phase", "stats", "progress", "errCode", "errDetail", "startedAt", "finishedAt", "updateTime"],
+	required: ["connected", "authMode", "profileStatus", "agentId", "credentialKind", "status", "phase", "stats", "progress", "errCode", "errDetail", "startedAt", "finishedAt", "updateTime"],
 	properties: {
 		// 授权事实（页面据此决定「整条隐藏 / 成员授权卡片 / 冻结黄条 / 正常同步栏」）
 		connected: { type: "boolean" },
 		authMode: { type: "number" },
 		profileStatus: { type: ["string", "null"] },
+		// 分辨锚点：多应用/共存企业下前端必须原样回传（C6）
+		agentId: { type: ["string", "null"] },
+		credentialKind: { type: ["string", "null"], enum: ["suite", "corp", null] },
 		status: { type: "string", enum: ["idle", "running", "done", "failed", "cancelled"] },
 		phase: { type: "string", enum: ["departments", "members", "reconcile"] },
 		stats: STATS,
@@ -80,6 +83,18 @@ function agentOf(raw: unknown): string | null {
 	return s.length > 0 ? s : null;
 }
 
+/**
+ * 未带 agent 时的兜底：**只有当本租户就是本部署自建的那家企业**才用配置里的 agent。
+ *
+ * 共存下的双应用租户（同一 corp 同时有代开发行与自建行）不带 agent 时探针只能 400，
+ * 而「点进自己组织架构页」不该要求管理员手填应用 id。别家企业没有这个兜底——
+ * 它们的 agent 只能来自登录链接/状态条回传，不由本站配置决定（那正是代开发的意义）。
+ */
+function selfAgentOf(tenantId: string): string | null {
+	const self = corpIdentity();
+	return self && self.corpId === tenantId ? self.agentId : null;
+}
+
 /**
  * 解析当前租户的授权档案（企业代码 = 租户；多应用时必须带 agent）。
  *
@@ -88,14 +103,15 @@ function agentOf(raw: unknown): string | null {
  * 是自己填错了），findProfile 负责解密出 permanent_code。
  */
 async function profileOf(tenantId: string, agent: unknown) {
-	const probe = await probeProfile(tenantId, agentOf(agent));
+	const probe = await probeProfile(tenantId, agentOf(agent) ?? selfAgentOf(tenantId));
 	if (!probe) {
 		throw Object.assign(new Error("本站尚未开通企业微信：没有可同步的授权记录"), { status: 400 });
 	}
 	if (probe.status !== "active") {
 		throw Object.assign(new Error("该企业已取消授权或应用已停用：组织架构同步已冻结，请联系服务商重新开通"), { status: 400 });
 	}
-	const cfg = readWecomConfig();
+	// 同步只用与来源无关的两项（落库密钥 + 基址）：读整套 suite 配置会把自建部署打成 400
+	const cfg = readBase();
 	const profile = await findProfile(tenantId, probe.agentId, runtimeStoreDeps(cfg));
 	return { profile, probe, cfg };
 }
@@ -149,7 +165,7 @@ const status = {
 			const tenantId = currentTenant();
 			if (!tenantId)
 				throw Object.assign(new Error("缺少租户上下文"), { status: 400 });
-			const probe = await probeProfile(tenantId, agentOf((http.query as Record<string, unknown>).agent));
+			const probe = await probeProfile(tenantId, agentOf((http.query as Record<string, unknown>).agent) ?? selfAgentOf(tenantId));
 			if (!probe)
 				return attachProfile(emptyView("idle"), null);
 			return attachProfile(await syncStatus(tenantId, probe.agentId), probe);

package/templates/src/auth/web/__client/api.schemas.ts

@@ -19,6 +19,7 @@ export const schemas = {
 	"env": z.string(),
 	"corp_name": z.string().nullable().optional(),
 	"status": z.enum(["active", "disabled"]),
+	"credential_kind": z.enum(["suite", "corp"]),
 	"auth_mode": z.number(),
 	"installed_at": z.number(),
 	"update_time": z.number()
@@ -40,6 +41,24 @@ export const schemas = {
 	"installUrl": z.string(),
 	"callbackUrl": z.string(),
 	"expiresIn": z.number()
+}),
+	},
+	"authWecomAdminOverviewGet": {
+		data: z.object({
+	"kinds": z.array(z.enum(["suite", "corp"])),
+	"configError": z.string().nullable(),
+	"callbackUrl": z.string().nullable(),
+	"corpId": z.string().nullable(),
+	"agentId": z.string().nullable(),
+	"corpCallbackConfigured": z.boolean()
+}),
+	},
+	"authWecomAdminConnectPost": {
+		data: z.object({
+	"corpId": z.string(),
+	"agentId": z.string(),
+	"departments": z.number(),
+	"members": z.number()
 }),
 	},
 	"authWecomTicketPost": {
@@ -108,7 +127,9 @@ export const schemas = {
 }).nullable(),
 	"startedAt": z.number(),
 	"finishedAt": z.number(),
-	"updateTime": z.number()
+	"updateTime": z.number(),
+	"agentId": z.string().nullable(),
+	"credentialKind": z.union([z.literal("suite"), z.literal("corp"), z.literal(null)]).nullable()
 }),
 	},
 	"authWecomSyncCancelPost": {

package/templates/src/auth/web/__client/api.ts

@@ -33,7 +33,7 @@ export function createAuthClient(ctx: ModuleContext) {
 	}
 	ctx.register.apiPrefix(API_PREFIX);
 	bindRequest(ctx.utils.request);
-	return { authLoginPost, authLogoutPost, authRefreshPost, authPasswordPut, authLdapLoginPost, authWecomAdminAppsGet, authWecomAdminStatusPost, authWecomAdminInstallGet, authWecomLoginGet, authWecomCallbackGet, authWecomTicketPost, authWecomEventGet, authWecomEventPost, authWecomSyncStartPost, authWecomSyncStatusGet, authWecomSyncCancelPost };
+	return { authLoginPost, authLogoutPost, authRefreshPost, authPasswordPut, authLdapLoginPost, authWecomAdminAppsGet, authWecomAdminStatusPost, authWecomAdminInstallGet, authWecomAdminOverviewGet, authWecomAdminConnectPost, authWecomLoginGet, authWecomCallbackGet, authWecomTicketPost, authWecomEventGet, authWecomEventPost, authWecomSyncStartPost, authWecomSyncStatusGet, authWecomSyncCancelPost };
 }
 
 /**
@@ -211,6 +211,52 @@ export async function authWecomAdminInstallGet(): Promise<AuthWecomAdminInstallG
 	}
 }
 
+export type AuthWecomAdminOverviewGetData = z.infer<(typeof schemas)["authWecomAdminOverviewGet"]["data"]>;
+
+export async function authWecomAdminOverviewGet(): Promise<AuthWecomAdminOverviewGetData> {
+	const client = ensureReq();
+	try {
+		const env = await client.get(`auth/wecom/admin/overview`).json<OjEnvelope<AuthWecomAdminOverviewGetData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as AuthWecomAdminOverviewGetData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["authWecomAdminOverviewGet"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] authWecomAdminOverviewGet 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
+export type AuthWecomAdminConnectPostData = z.infer<(typeof schemas)["authWecomAdminConnectPost"]["data"]>;
+
+export async function authWecomAdminConnectPost(): Promise<AuthWecomAdminConnectPostData> {
+	const client = ensureReq();
+	try {
+		const env = await client.post(`auth/wecom/admin/connect`).json<OjEnvelope<AuthWecomAdminConnectPostData>>();
+		// 2xx + code!==0 也是业务错误（§6.2 通道 a）：oj 不会这么发，但契约机制的价值恰是防漂移
+		if (typeof env.code === "number" && env.code !== 0)
+			throw new ContractApiError(env.code, env.msg ?? "业务错误（信封 code 非 0）");
+		const data = env.data as AuthWecomAdminConnectPostData;
+		if (import.meta.env.DEV) {
+			const { schemas } = await import("./api.schemas");
+			const r = schemas["authWecomAdminConnectPost"].data.safeParse(data);
+			if (!r.success)
+				throw new ContractApiError(-1, `[契约违例] authWecomAdminConnectPost 响应与契约不符：${r.error.issues.map(i => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")}`);
+		}
+		return data;
+	}
+	catch (e) {
+		throw await toApiError(e);
+	}
+}
+
 export async function authWecomLoginGet(): Promise<unknown> {
 	const client = ensureReq();
 	try {

package/templates/src/login/web/pages/login.tsx

@@ -54,12 +54,19 @@ export default function LoginPage() {
 	const login = useAuthStore(s => s.login);
 	const [error, setError] = useState<string>();
 	const [loading, setLoading] = useState(false);
+	const [known, setKnown] = useState(false);
+	const inWecom = typeof navigator !== "undefined" && /wxwork/i.test(navigator.userAgent);
 	const [methods, setMethods] = useState<LoginMethod[]>(["local"]);
 	const [active, setActive] = useState<LoginMethod>("local");
 	// 企业代码入口默认收起：单租户部署（绝大多数）保持今天的登录页外观，
 	// 只有服务商/客户带 `?tenant=` 或手工展开时才需要填。
-	// 例外：持久化租户不是部署默认值时必须展开——租户头是**隐式**跟着请求走的
+	// 例外一：持久化租户不是部署默认值时必须展开——租户头是**隐式**跟着请求走的
 	// （runtime 每请求注入），藏起来等于让上一次的租户无声地把这次登录带走。
+	// 例外二：**开了企业微信登录就默认展开**（见下方 effect）——企微租户的键是 corp_id，
+	//   一旦有企业接入，「登录哪个租户」就是真问题：平台管理员在 default，而各企业的
+	//   管理员在各自的 corp 租户里，收起等于让运维找不到切租户的入口。
+	//   判据用「wecom 是否在登录方式里」而不是去数租户：匿名请求没有租户上下文，
+	//   统计租户要动用 db.asSystem（全仓仅 tenant-admin.ts 一处，不为此破例）。
 	const [showTenant, setShowTenant] = useState(() => useTenantStore.getState().tenant !== DEFAULT_TENANT);
 	// 表单里的企业代码：带上 persisted 值（URL `?tenant=` 已先落到 store），用户看得见才改得动
 	const [tenant] = useState(() => {
@@ -77,18 +84,31 @@ export default function LoginPage() {
 	// 企微 302 落地参数：只在首次渲染解析一次（ticket 一次性，解析结果必须稳定）
 	const [landing] = useState(() => parseWecomLanding(search));
 	const exchangedRef = useRef(false);
+	// 仅「认证中 / 已失败」两态：企微内、回跳落地、或 ?corp 深链即进入认证态，
+	// 直接展示「认证中」，不渲染登录表单；只有认证失败（换票失败 / 企微方式不可用）才回落表单。
+	const [phase, setPhase] = useState<"auth" | "form">(
+		inWecom || landing || urlCorp ? "auth" : "form",
+	);
 
 	useEffect(() => {
 		fetchLoginMethods()
 			.then((r) => {
-				const m = r.methods.filter(isKnownMethod);
+				setKnown(true);
+				// 先按 string[] 看一眼：runtime 的返回类型把 wecom 排除在外，而这里恰恰要认它
+				const raw: string[] = r.methods;
+				const m = raw.filter(isKnownMethod);
 				if (!m.length)
 					return;
 				setMethods(m);
+				// 有企微登录 ⇒ 有企业租户（租户键 = corp_id）⇒ 默认展开企业代码，
+				// 否则平台/企业两类管理员没法切换登录目标（用户仍可点「收起」手动折叠）。
+				if (raw.includes("wecom"))
+					setShowTenant(true);
 				if (!m.includes("local"))
 					setActive(m[0]);
 			})
 			.catch(() => {
+				setKnown(true);
 				// 发现失败时回落单表单（local），不阻断登录。
 			});
 	}, []);
@@ -110,6 +130,7 @@ export default function LoginPage() {
 			}
 			catch (e) {
 				setError(e instanceof Error ? e.message : String(e));
+				setPhase("form");
 				setLoading(false);
 			}
 		})();
@@ -121,13 +142,16 @@ export default function LoginPage() {
 	useEffect(() => {
 		const c = new URLSearchParams(search).get("corp")?.trim() ?? "";
 		// 企微内（wxwork UA）从「应用主页」点开即自动发起授权；带 ?corp= 的深链同样自动发起。
-		const inWecom = typeof navigator !== "undefined" && /wxwork/i.test(navigator.userAgent);
 		if ((!c && !inWecom) || landing || autoFiredRef.current)
 			return;
-		if (new URLSearchParams(search).get("error"))
+		if (new URLSearchParams(search).get("error")) {
+			setPhase("form");
 			return;
-		if (!methods.includes("wecom"))
+		}
+		if (known && !methods.includes("wecom")) {
+			setPhase("form");
 			return;
+		}
 		autoFiredRef.current = true;
 		window.location.assign(`${resolveApiBase()}${wecomAuthorizePath(corp, agent)}`);
 	}, [landing, methods, search, corp, agent]);
@@ -245,6 +269,18 @@ export default function LoginPage() {
 		return form(m);
 	}
 
+	// 认证态：只展示「认证中」，不渲染任何登录表单（满足「只有登录失败才出现 login」）
+	if (phase === "auth") {
+		return (
+			<>
+				<Typography.Title level={3}>
+					{t("login:page.title")}
+				</Typography.Title>
+				<Alert style={{ marginBottom: 16 }} type="info" message={t("login:method.wecom.exchanging")} showIcon />
+			</>
+		);
+	}
+
 	return (
 		<>
 			<Typography.Title level={3}>
@@ -253,26 +289,20 @@ export default function LoginPage() {
 			<Typography.Paragraph type="secondary">
 				{t("login:page.subtitle")}
 			</Typography.Paragraph>
-			{landing && loading && (
-				<Alert style={{ marginBottom: 16 }} type="info" message={t("login:method.wecom.exchanging")} showIcon />
-			)}
 			{error && <Alert style={{ marginBottom: 16 }} type="error" message={error} showIcon />}
-			{/* 换票期间不渲染 tab：避免用户在跳转前又点一次登录 */}
-			{landing && loading
-				? null
-				: showTabs
-					? (
-						<Tabs
-							activeKey={active}
-							onChange={key => setActive(key as LoginMethod)}
-							items={methods.map(m => ({
-								key: m,
-								label: t(`login:method.${m}`),
-								children: panelOf(m),
-							}))}
-						/>
-					)
-					: panelOf(methods[0] ?? "local")}
+			{showTabs
+				? (
+					<Tabs
+						activeKey={active}
+						onChange={key => setActive(key as LoginMethod)}
+						items={methods.map(m => ({
+							key: m,
+							label: t(`login:method.${m}`),
+							children: panelOf(m),
+						}))}
+					/>
+				)
+				: panelOf(methods[0] ?? "local")}
 		</>
 	);
 }

package/templates/src/system/api/settings/api.ts

@@ -1,7 +1,7 @@
 import { respond } from "#/_platform/_shared/respond";
 import { listSettings, updateSetting } from "#/_platform/_shared/service/domain/settings";
 // /api/system/settings —— 系统设置（PRD §4.3）：GET 按组列出（secret 掩码），PUT 写值（写审计）。
-import { assertSystemAdmin } from "#/_platform/_shared/service/infra/access";
+import { assertSuperAdmin } from "#/_platform/_shared/service/infra/access";
 
 const settingItemSchema = {
 	type: "object",
@@ -23,7 +23,7 @@ const settingItemSchema = {
 
 async function get() {
 	await respond(async () => {
-		await assertSystemAdmin();
+		await assertSuperAdmin();
 		return listSettings();
 	});
 }
@@ -41,7 +41,7 @@ get.response = {
 
 async function put() {
 	await respond(async () => {
-		await assertSystemAdmin();
+		await assertSuperAdmin();
 		const body = http.body || {};
 		return updateSetting(Number(http.user?.id), String(body.key ?? ""), String(body.value ?? ""));
 	});

package/templates/src/system/web/entry.ts

@@ -54,9 +54,10 @@ const routes: AppRouteRecordRaw[] = [
 				handle: { title: "system:menu.oplog" },
 			},
 			{
+				// 站点设置（证书/站点级开关）：仅超管可见可访问
 				path: "/system/settings",
 				Component: Settings,
-				handle: { title: "system:menu.settings" },
+				handle: { title: "system:menu.settings", roles: ["superadmin"] },
 			},
 			{
 				path: "/system/login-methods",
@@ -64,11 +65,10 @@ const routes: AppRouteRecordRaw[] = [
 				handle: { title: "system:menu.loginMethods" },
 			},
 			{
-				// 企微代开发后台（服务商运营面）：页面内再判一次 superadmin（路由级不做角色门禁，
-				// 与 users/roles 页同策略——403 面板比路由消失更容易解释）
+				// 企微代开发后台（服务商运营面）：仅超管可见（路由级 roles + 页面内二次判定）
 				path: "/system/wecom",
 				Component: WecomAdmin,
-				handle: { title: "system:menu.wecom" },
+				handle: { title: "system:menu.wecom", roles: ["superadmin"] },
 			},
 		],
 	},

package/templates/src/system/web/locales/en-US.json

@@ -141,7 +141,8 @@
 			"status": "Status",
 			"installedAt": "Onboarded at",
 			"action": "Actions",
-			"authMode": "Auth mode"
+			"authMode": "Auth mode",
+			"source": "Source"
 		},
 		"statusActive": "Active",
 		"statusDisabled": "Disabled",
@@ -205,6 +206,42 @@
 					"hint": "Contact the service provider to investigate, then retry."
 				}
 			}
+		},
+		"source": {
+			"suite": "Delegated",
+			"corp": "Internal app"
+		},
+		"authModeNone": "—",
+		"configErrorTitle": "Deployment config check failed",
+		"coexistHint": "This deployment runs both delegated (suite) and internal (corp) apps (wecom_allow_coexist: 'true').",
+		"corp": {
+			"title": "Internal app (self-built)",
+			"hint": "This deployment connects as an internal app: credentials come from config.yaml (wecom_corp_id / wecom_corp_secret / wecom_corp_agent_id). Fill them in, then click \"Verify and connect\"; the corporation is registered only after all three checks pass.",
+			"corpId": "Corporation ID",
+			"agentId": "AgentId",
+			"callbackUrl": "Contacts event callback URL",
+			"callbackHint": "Fill this URL into WeCom → Tools → Contacts sync → Set event receiver URL. Leave the app's own message callback empty: the two use different tokens, and pointing both at one URL makes half the payloads fail signature verification.",
+			"callbackConfigured": "Contacts event callback credentials",
+			"callbackYes": "Configured (member changes sync in real time)",
+			"callbackNo": "Not configured (full sync only; to get increments, fill Token / EncodingAESKey for this URL in the WeCom console)",
+			"connect": "Verify and connect",
+			"connectConfirm": "Connect checks: whether the app Secret can fetch a token, whether contacts are readable, and whether any member is visible. Re-run it whenever the Corporation ID / AgentId changed or the Secret was rotated.",
+			"connectOk": "Connected: {{depts}} departments visible, {{members}} members in the sample department",
+			"connectHint": "After rotating the app Secret you must click \"Verify and connect\" again, otherwise every call fails with 40001. How many people get synced depends on the app's visible scope — set it to the whole company for a full sync."
+		},
+		"tenantAdmin": {
+			"title": "Tenant administrators",
+			"hint": "Each enterprise tenant (tenant key = corp ID) gets an admin account automatically on provisioning, used to manage that tenant's org chart, members and roles. It is a tenant-level admin and cannot see other enterprises. The initial password is random and known to no one — to take over, reset a password you know here, hand it to the tenant admin, and they will be forced to change it on first login.",
+			"username": "Admin account",
+			"state": "State",
+			"exists": "Provisioned",
+			"missing": "Not provisioned",
+			"action": "Action",
+			"reset": "Reset password",
+			"resetTitle": "Reset tenant admin password",
+			"resetHint": "This resets the tenant admin password of enterprise {{corpId}}. Choose the new password yourself and deliver it out-of-band — only a bcrypt hash is stored, so no existing password can ever be shown. The admin must change it on first login, and their existing sessions are revoked immediately.",
+			"resetPlaceholder": "New password (at least 6 chars)",
+			"resetOk": "Tenant admin password reset"
 		}
 	},
 	"err": {

package/templates/src/system/web/locales/zh-CN.json

@@ -141,7 +141,8 @@
 			"status": "状态",
 			"installedAt": "开通时间",
 			"action": "操作",
-			"authMode": "授权模式"
+			"authMode": "授权模式",
+			"source": "来源"
 		},
 		"statusActive": "启用",
 		"statusDisabled": "停用",
@@ -205,6 +206,42 @@
 					"hint": "请联系服务商排查后重试。"
 				}
 			}
+		},
+		"source": {
+			"suite": "代开发",
+			"corp": "企业内部应用"
+		},
+		"authModeNone": "—",
+		"configErrorTitle": "部署配置自检未通过",
+		"coexistHint": "本部署同时启用了代开发与企业内部应用（wecom_allow_coexist: 'true'）。",
+		"corp": {
+			"title": "企业内部应用（自建）",
+			"hint": "本部署作为企业内部应用接入：凭据来自 config.yaml 的 wecom_corp_id / wecom_corp_secret / wecom_corp_agent_id。填好后点「验证并接入」，三步校验全过才会登记企业。",
+			"corpId": "企业ID",
+			"agentId": "AgentId",
+			"callbackUrl": "通讯录事件回调地址",
+			"callbackHint": "把上面这个地址填到企微「管理工具 → 通讯录同步 → 设置接收事件服务器」；应用自身的「接收消息」回调请留空——两处 Token 不同，填同一个 URL 会让一半报文验签失败。",
+			"callbackConfigured": "通讯录事件回调凭据",
+			"callbackYes": "已配置（成员变更会实时同步）",
+			"callbackNo": "未配置（只做全量同步；要增量请在企微后台填 Token / EncodingAESKey 到同一地址）",
+			"connect": "验证并接入",
+			"connectConfirm": "接入会依次校验：应用 Secret 能否换 token、能否读通讯录、可见范围内能否读到人。改过企业ID / AgentId 或换过 Secret 都必须重新点一次。",
+			"connectOk": "接入成功：可见范围内 {{depts}} 个部门，示例部门 {{members}} 人",
+			"connectHint": "换过应用 Secret 后必须重新「验证并接入」，否则所有调用都会 40001；同步到多少人取决于「应用可见范围」，要全量请设为全公司。"
+		},
+		"tenantAdmin": {
+			"title": "租户管理员",
+			"hint": "每个企业租户（租户键＝企业ID）在开通时会自动建一个 admin 账号，用于管理本租户的组织架构、成员与角色。它是**租户级**管理员，看不到别家企业。初始口令随机且无人知晓——需要接管时由你在这里重设一个已知口令，交给对方后对方首次登录会被强制改密。",
+			"username": "管理员账号",
+			"state": "状态",
+			"exists": "已开通",
+			"missing": "未开通",
+			"action": "操作",
+			"reset": "重设口令",
+			"resetTitle": "重设租户管理员口令",
+			"resetHint": "将重设企业 {{corpId}} 的租户管理员口令。新口令请自行设定并线下告知对方——系统只存 bcrypt，不会也无法回显任何已有口令。重设后对方首次登录必须改密，其旧会话立即失效。",
+			"resetPlaceholder": "新口令（至少 6 位）",
+			"resetOk": "租户管理员口令已重设"
 		}
 	},
 	"err": {

package/templates/src/system/web/pages/departments/sync-bar.tsx

@@ -18,6 +18,10 @@ interface SyncView {
 	connected: boolean
 	authMode: number
 	profileStatus: "active" | "disabled" | null
+	/** 已解析到的应用 id：多应用/共存企业的分辨锚点，start / cancel 要原样回传 */
+	agentId: string | null
+	/** suite=代开发 / corp=企业内部应用（自建）：自建应用没有「授权模式」这回事 */
+	credentialKind: "suite" | "corp" | null
 	status: "idle" | "running" | "done" | "failed" | "cancelled"
 	phase: "departments" | "members" | "reconcile"
 	stats: { departments: number, members: number, skipped: number, reconciled: boolean }
@@ -36,25 +40,45 @@ const MIN_GAP_MS = 6000;
 /** 一轮点击最多推多少片（12 秒/片 ≈ 12 分钟）：兜底防呆，正常企业两三次就到底 */
 const MAX_SLICES = 60;
 
+/**
+ * 已解析到的应用 id。同一家企业有两行档案（代开发 + 自建，迁移期常见）时后端要求带 agent，
+ * 而这个值只有后端知道：首次 status 不带（后端按「本站自建应用优先」解析），拿到后记住，
+ * 后续 start / cancel 原样回传。放模块级是为了跨组件实例复用，不参与渲染。
+ */
+let agentParam: string | null = null;
+
+function withAgent(url: string): string {
+	return agentParam ? `${url}?agent=${encodeURIComponent(agentParam)}` : url;
+}
+
+function agentBody(): { agent?: string } {
+	return agentParam ? { agent: agentParam } : {};
+}
+
+function remember(view: SyncView): SyncView {
+	agentParam = view.agentId ?? agentParam;
+	return view;
+}
+
 async function fetchStatus(): Promise<SyncView> {
-	const env = await request.get("auth/wecom/sync/status").json<{ code: number, data?: SyncView }>();
+	const env = await request.get(withAgent("auth/wecom/sync/status")).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步状态读取失败");
-	return env.data;
+	return remember(env.data);
 }
 
 async function pushSlice(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/start", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/start", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("企业微信同步未能启动");
-	return env.data;
+	return remember(env.data);
 }
 
 async function cancelSync(): Promise<SyncView> {
-	const env = await request.post("auth/wecom/sync/cancel", { json: {} }).json<{ code: number, data?: SyncView }>();
+	const env = await request.post("auth/wecom/sync/cancel", { json: agentBody() }).json<{ code: number, data?: SyncView }>();
 	if (!env.data)
 		throw new Error("取消同步失败");
-	return env.data;
+	return remember(env.data);
 }
 
 function sleep(ms: number): Promise<void> {
@@ -180,7 +204,8 @@ export function WecomSyncBar({ onFinished }: { onFinished: () => void }) {
 	if (!view || !view.connected)
 		return null;
 
-	if (view.authMode !== 0) {
+	// 成员授权卡片只对代开发成立：自建应用没有「授权模式」，authMode 恒 0（双保险，防上游写脏数据）
+	if (view.credentialKind !== "corp" && view.authMode !== 0) {
 		return (
 			<Alert
 				type="warning"

package/templates/src/system/web/pages/users/index.tsx

@@ -19,7 +19,8 @@ type UserRow = SystemUsersGetData[number];
 /**
  * 用户管理（C1）：GET /system/users 列表 + 建号 / 禁用切换 / 重置口令。
  * 本人行禁用一切自操作（后端 assertNotSelf 400 兜底，前端不给会失败的按钮，R3）；
- * 成员资格入口仅 superadmin 可见（成员资格写是 superadmin-only，规格 §4）。
+ * 成员资格入口：superadmin 与 **本租户 admin** 均可见（授予 admin 已下放到租户内，
+ * 但授予 superadmin 仍只许 superadmin——见 domain/users.ts::assertMembershipAllowed）。
  * 部门列标出主部门，顶部可按部门筛选（含子部门）——筛选在前端做，名单本来就是一页全量。
  */
 export default function UsersPage() {
@@ -30,6 +31,8 @@ export default function UsersPage() {
 	const me = useUserStore(s => s.id);
 	const myRoles = useUserStore(s => s.roles);
 	const isSuper = myRoles.includes("superadmin");
+	// 任命本租户管理员已下放到租户内的 admin（提权到 superadmin 仍只许 superadmin）
+	const canManageMembership = isSuper || myRoles.includes("admin");
 
 	const [createOpen, setCreateOpen] = useState(false);
 	const [createForm] = Form.useForm<{ username: string, password: string, displayName?: string, email?: string }>();
@@ -129,9 +132,9 @@ export default function UsersPage() {
 					<Button size="small" disabled={String(row.id) === me} onClick={() => setPwdTarget(row)}>
 						{t("system:users.resetPwd")}
 					</Button>
-					{isSuper
-						? (
-							<Button size="small" type="link" onClick={() => navigate(`/system/users/${row.id}/roles`)}>
+						{canManageMembership
+							? (
+								<Button size="small" type="link" onClick={() => navigate(`/system/users/${row.id}/roles`)}>
 								{t("system:users.membership")}
 							</Button>
 						)

package/templates/src/system/web/pages/users/roles.tsx

@@ -11,9 +11,13 @@ import { explainError, isForbidden } from "../errors";
 import { ForbiddenPanel } from "../forbidden";
 
 /**
- * 成员资格（AC1-7，superadmin-only）：整集替换某用户角色。后端无 GET 单用户端点，
+ * 成员资格（AC1-7）：整集替换某用户角色。后端无 GET 单用户端点，
  * 当前角色从 GET /system/users 列表按 uid 回显；写走 PUT /system/users/roles?uid=。
- * admin（非 superadmin）手输 URL 进入后提交会被 service 层 403 → 页面渲染无权限（§3.2）。
+ *
+ * 可见性已从「superadmin-only」放宽到「本租户 admin 也可以」（见 users/index.tsx 的入口）：
+ * 授予 admin 已下放到租户内，否则企业租户永远配不出管理员（平台 superadmin 因租户
+ * 隔离查不到企业租户的用户）。但 **superadmin 仍只许 superadmin 授**——它握着跨租户
+ * 权限，故这里对非 superadmin 直接把该选项置灰，比让他提交后吃 403 清楚。
  */
 export default function UserRolesPage() {
 	const { t } = useTranslation();
@@ -22,6 +26,8 @@ export default function UserRolesPage() {
 	const { uid } = useParams();
 	const queryClient = useQueryClient();
 	const me = useUserStore(s => s.id);
+	const myRoles = useUserStore(s => s.roles);
+	const isSuper = myRoles.includes("superadmin");
 
 	// null = 尚未改动，回显服务端值；一旦勾选即持本地整集
 	const [selected, setSelected] = useState<string[] | null>(null);
@@ -51,7 +57,12 @@ export default function UserRolesPage() {
 		<Card title={`${t("system:userRoles.title")}: ${user?.username ?? `#${uid}`}`}>
 			<Space direction="vertical">
 				<Checkbox.Group
-					options={(rolesQuery.data ?? []).map(r => ({ label: `${r.name}${r.deprecated ? "（已废弃）" : ""}`, value: r.name }))}
+					options={(rolesQuery.data ?? []).map(r => ({
+						label: `${r.name}${r.deprecated ? "（已废弃）" : ""}`,
+						value: r.name,
+						// 非 superadmin 授不了平台级角色：置灰，提交后 403 太晚也太含糊
+						disabled: r.name === "superadmin" && !isSuper,
+					}))}
 					value={value}
 					onChange={v => setSelected(v)}
 				/>