@oj-module/cli 0.2.64 → 0.2.67

package/templates/src/app/api/_platform/migrations/0001__baseline.pg.sql

@@ -0,0 +1,173 @@
+-- 0001__baseline（postgres 方言）：_platform 全部表结构基线。压平口径见 0001__baseline.sql 头注释。
+--
+-- 方言差异（沿用历史迁移的既有惯例）：
+--   · AUTOINCREMENT → BIGSERIAL（SERIAL 系允许 seed 显式写 id，GENERATED ALWAYS 系不允许）；
+--   · TEXT 在 pg 合法，键列与文本列一律保留 TEXT，无需收窄；
+--   · 秒级 / 毫秒级 epoch 的整型一律取 BIGINT（int4 上限 2.1e9，毫秒时间戳 1.7e12 直接溢出）；
+--   · 部分唯一索引 pg 原生支持（工号「有值才唯一」与 sqlite 同语法）。
+
+CREATE TABLE IF NOT EXISTS users (
+  id BIGSERIAL PRIMARY KEY,
+  tenant_id TEXT NOT NULL DEFAULT 'default',
+  corp_id TEXT,
+  username TEXT NOT NULL,
+  password_hash TEXT NOT NULL,
+  avatar_base64 TEXT NOT NULL DEFAULT '',
+  source TEXT NOT NULL DEFAULT 'local',
+  display_name TEXT,
+  must_change INTEGER NOT NULL DEFAULT 0,
+  is_forbidden INTEGER NOT NULL DEFAULT 0,
+  email TEXT,
+  phone_number TEXT,
+  description TEXT,
+  activated INTEGER NOT NULL DEFAULT 0,
+  position TEXT,
+  external_status INTEGER,
+  employee_no TEXT,
+  UNIQUE (tenant_id, username)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_users_employee_no
+  ON users (tenant_id, employee_no) WHERE employee_no IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS sys_setting (
+  key TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  "group" TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'string',
+  value TEXT,
+  default_value TEXT,
+  label_key TEXT,
+  options TEXT,
+  secret INTEGER NOT NULL DEFAULT 0,
+  update_time BIGINT NOT NULL DEFAULT 0,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  group_label_key TEXT
+);
+
+CREATE TABLE IF NOT EXISTS sys_oplog (
+  id BIGSERIAL PRIMARY KEY,
+  create_time BIGINT NOT NULL,
+  user_id BIGINT NOT NULL DEFAULT 0,
+  username TEXT NOT NULL DEFAULT 'system',
+  action TEXT NOT NULL,
+  module TEXT NOT NULL DEFAULT 'framework',
+  version TEXT,
+  target TEXT,
+  detail TEXT,
+  level INTEGER NOT NULL DEFAULT 6,
+  tenant_id TEXT NOT NULL DEFAULT 'default'
+);
+CREATE INDEX IF NOT EXISTS idx_sys_oplog_time ON sys_oplog (create_time, id);
+
+CREATE TABLE IF NOT EXISTS sys_solution_route (
+  path TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  category TEXT NOT NULL,
+  "order" INTEGER NOT NULL DEFAULT 0,
+  title_key TEXT,
+  required_permission TEXT,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  enabled INTEGER NOT NULL DEFAULT 1
+);
+CREATE INDEX IF NOT EXISTS idx_sys_solution_route_module ON sys_solution_route (module);
+
+CREATE TABLE IF NOT EXISTS sys_role (
+  name TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  title TEXT,
+  description TEXT,
+  builtin INTEGER NOT NULL DEFAULT 0,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  title_key TEXT
+);
+
+CREATE TABLE IF NOT EXISTS sys_permission (
+  code TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  title_key TEXT,
+  deprecated INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS sys_role_permission (
+  role_name TEXT NOT NULL,
+  permission_code TEXT NOT NULL,
+  PRIMARY KEY (role_name, permission_code)
+);
+
+CREATE TABLE IF NOT EXISTS sys_user_role (
+  user_id BIGINT NOT NULL,
+  role_name TEXT NOT NULL,
+  tenant_id TEXT NOT NULL DEFAULT 'default',
+  PRIMARY KEY (user_id, role_name)
+);
+
+CREATE TABLE IF NOT EXISTS sys_refresh_token (
+  token_hash TEXT PRIMARY KEY,
+  user_id BIGINT NOT NULL,
+  expires_at BIGINT NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  created_at BIGINT NOT NULL,
+  tenant_id TEXT NOT NULL DEFAULT 'default'
+);
+CREATE INDEX IF NOT EXISTS idx_sys_refresh_token_user ON sys_refresh_token (user_id);
+
+CREATE TABLE IF NOT EXISTS sys_rate_window (
+  rate_key TEXT PRIMARY KEY,
+  window_start BIGINT NOT NULL,
+  count INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS sys_login_throttle (
+  pair_key TEXT PRIMARY KEY,
+  fail_count INTEGER NOT NULL,
+  blocked_until BIGINT NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS market_history (
+  id BIGSERIAL PRIMARY KEY,
+  solution TEXT NOT NULL,
+  version TEXT NOT NULL,
+  action TEXT NOT NULL,
+  status TEXT NOT NULL,
+  operator TEXT,
+  message TEXT,
+  created_at BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS reg_source_seq (
+  source_url TEXT NOT NULL PRIMARY KEY,
+  max_seq BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS sys_department (
+  id BIGSERIAL PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  origin TEXT NOT NULL DEFAULT 'local',
+  origin_id TEXT NOT NULL,
+  parent_id BIGINT,
+  name TEXT,
+  name_en TEXT,
+  order_no INTEGER NOT NULL DEFAULT 0,
+  sync_visible INTEGER NOT NULL DEFAULT 1,
+  deleted INTEGER NOT NULL DEFAULT 0,
+  seen_job_id BIGINT,
+  update_time BIGINT NOT NULL,
+  UNIQUE (tenant_id, origin, origin_id)
+);
+CREATE INDEX IF NOT EXISTS idx_sys_department_parent
+  ON sys_department (tenant_id, parent_id, deleted, order_no);
+
+CREATE TABLE IF NOT EXISTS sys_dept_member (
+  id BIGSERIAL PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  user_id BIGINT NOT NULL,
+  dept_id BIGINT NOT NULL,
+  order_no INTEGER NOT NULL DEFAULT 0,
+  is_leader INTEGER NOT NULL DEFAULT 0,
+  is_main INTEGER NOT NULL DEFAULT 0,
+  update_time BIGINT NOT NULL,
+  UNIQUE (tenant_id, user_id, dept_id)
+);
+CREATE INDEX IF NOT EXISTS idx_sys_dept_member_dept ON sys_dept_member (tenant_id, dept_id, order_no);
+CREATE INDEX IF NOT EXISTS idx_sys_dept_member_user ON sys_dept_member (tenant_id, user_id, is_main);

package/templates/src/app/api/_platform/migrations/0001__baseline.sql

@@ -0,0 +1,188 @@
+-- 0001__baseline（sqlite 方言）：_platform 全部表结构基线
+--
+-- 为什么是一条基线：本产品正式发版前，0001–0018 共 45 个迁移文件只是演进过程的中间态。
+-- 压平后一个模块只有一条迁移（迁移账本按 [module, version] 记账，序列不允许空洞，
+-- 故必须仍从 0001 开始）。**升级既有开发库不受支持**：老库账本已记 0001–0018，
+-- 新基线会被视为「已应用」而跳过 —— 删掉本地 sqlite 重启即按本文件重建（见 devkit manual）。
+--
+-- 压平口径：与「顺序执行 0001–0018 后的最终结构」逐列、逐索引等价；
+-- 同时补齐了此前只有 sqlite 版、没有 mysql/pg 版的 7 条迁移（0002/0003/0005/0006/0007/0011/0013）。
+-- 与 schema.yaml 的一致性由 templates-migration-schema-parity.test.ts 双向守着。
+
+-- ── users（租户表 A 组：tenant_id 是真实列，唯一性收敛到租户内）─────────────────
+CREATE TABLE IF NOT EXISTS users (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL DEFAULT 'default',
+  corp_id TEXT,
+  username TEXT NOT NULL,
+  password_hash TEXT NOT NULL,
+  avatar_base64 TEXT NOT NULL DEFAULT '',
+  source TEXT NOT NULL DEFAULT 'local',
+  display_name TEXT,
+  must_change INTEGER NOT NULL DEFAULT 0,
+  is_forbidden INTEGER NOT NULL DEFAULT 0,
+  email TEXT,
+  phone_number TEXT,
+  description TEXT,
+  activated INTEGER NOT NULL DEFAULT 0,
+  position TEXT,
+  external_status INTEGER,
+  employee_no TEXT,
+  UNIQUE (tenant_id, username)
+);
+-- 工号租户内唯一。可空是必需的：存量本地账号与部分外部账号没有工号，
+-- 唯一性只在有值时成立 → 部分索引（sqlite/pg 同语法；mysql 靠 NULL 可重复等效）。
+CREATE UNIQUE INDEX IF NOT EXISTS uk_users_employee_no
+  ON users (tenant_id, employee_no) WHERE employee_no IS NOT NULL;
+
+-- ── sys_setting（共享表 B 组：登录方式发现是未登录端点，此刻无租户上下文）────────
+CREATE TABLE IF NOT EXISTS sys_setting (
+  key TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  "group" TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'string',
+  value TEXT,
+  default_value TEXT,
+  label_key TEXT,
+  options TEXT,
+  secret INTEGER NOT NULL DEFAULT 0,
+  update_time INTEGER NOT NULL DEFAULT 0,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  group_label_key TEXT
+);
+
+-- ── sys_oplog（租户表 A 组）──────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS sys_oplog (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  create_time INTEGER NOT NULL,
+  user_id INTEGER NOT NULL DEFAULT 0,
+  username TEXT NOT NULL DEFAULT 'system',
+  action TEXT NOT NULL,
+  module TEXT NOT NULL DEFAULT 'framework',
+  version TEXT,
+  target TEXT,
+  detail TEXT,
+  level INTEGER NOT NULL DEFAULT 6,
+  tenant_id TEXT NOT NULL DEFAULT 'default'
+);
+CREATE INDEX IF NOT EXISTS idx_sys_oplog_time ON sys_oplog (create_time, id);
+
+-- ── sys_solution_route（共享表 B 组：站点级路由注册，path 唯一）────────────────
+CREATE TABLE IF NOT EXISTS sys_solution_route (
+  path TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  category TEXT NOT NULL,
+  "order" INTEGER NOT NULL DEFAULT 0,
+  title_key TEXT,
+  required_permission TEXT,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  enabled INTEGER NOT NULL DEFAULT 1
+);
+CREATE INDEX IF NOT EXISTS idx_sys_solution_route_module ON sys_solution_route (module);
+
+-- ── RBAC 目录（共享表 B 组：角色/权限码是框架目录，分配关系在 A 组 sys_user_role）──
+CREATE TABLE IF NOT EXISTS sys_role (
+  name TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  title TEXT,
+  description TEXT,
+  builtin INTEGER NOT NULL DEFAULT 0,
+  deprecated INTEGER NOT NULL DEFAULT 0,
+  -- title = 安装期解析文本；title_key = 原始 i18n key（UI 实时翻译锚，与 sys_permission.title_key 同形）
+  title_key TEXT
+);
+
+CREATE TABLE IF NOT EXISTS sys_permission (
+  code TEXT PRIMARY KEY,
+  module TEXT NOT NULL,
+  title_key TEXT,
+  deprecated INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS sys_role_permission (
+  role_name TEXT NOT NULL,
+  permission_code TEXT NOT NULL,
+  PRIMARY KEY (role_name, permission_code)
+);
+
+CREATE TABLE IF NOT EXISTS sys_user_role (
+  user_id INTEGER NOT NULL,
+  role_name TEXT NOT NULL,
+  tenant_id TEXT NOT NULL DEFAULT 'default',
+  PRIMARY KEY (user_id, role_name)
+);
+
+-- ── sys_refresh_token（租户表 A 组）──────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS sys_refresh_token (
+  token_hash TEXT PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  tenant_id TEXT NOT NULL DEFAULT 'default'
+);
+CREATE INDEX IF NOT EXISTS idx_sys_refresh_token_user ON sys_refresh_token (user_id);
+
+-- ── 限速/登录节流（共享表 B 组：登录前就要用，无租户上下文）─────────────────────
+CREATE TABLE IF NOT EXISTS sys_rate_window (
+  rate_key TEXT PRIMARY KEY,
+  window_start INTEGER NOT NULL,
+  count INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS sys_login_throttle (
+  pair_key TEXT PRIMARY KEY,
+  fail_count INTEGER NOT NULL,
+  blocked_until INTEGER NOT NULL DEFAULT 0
+);
+
+-- ── 市场操作留痕（共享表 B 组：安装/升级/回滚是站点级动作）──────────────────────
+CREATE TABLE IF NOT EXISTS market_history (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  solution TEXT NOT NULL,
+  version TEXT NOT NULL,
+  action TEXT NOT NULL,
+  status TEXT NOT NULL,
+  operator TEXT,
+  message TEXT,
+  created_at INTEGER NOT NULL
+);
+
+-- ── 索引新鲜度水位（共享表 B 组：受害者是站点，记录点就在站点）────────────────────
+CREATE TABLE IF NOT EXISTS reg_source_seq (
+  source_url TEXT NOT NULL PRIMARY KEY,
+  max_seq INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+-- ── 组织架构（租户表 A 组：tenant_id 前缀索引，不进 shared_allow）────────────────
+CREATE TABLE IF NOT EXISTS sys_department (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL,
+  origin TEXT NOT NULL DEFAULT 'local',
+  origin_id TEXT NOT NULL,
+  parent_id INTEGER,
+  name TEXT,
+  name_en TEXT,
+  order_no INTEGER NOT NULL DEFAULT 0,
+  sync_visible INTEGER NOT NULL DEFAULT 1,
+  deleted INTEGER NOT NULL DEFAULT 0,
+  seen_job_id INTEGER,
+  update_time INTEGER NOT NULL,
+  UNIQUE (tenant_id, origin, origin_id)
+);
+CREATE INDEX IF NOT EXISTS idx_sys_department_parent
+  ON sys_department (tenant_id, parent_id, deleted, order_no);
+
+CREATE TABLE IF NOT EXISTS sys_dept_member (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tenant_id TEXT NOT NULL,
+  user_id INTEGER NOT NULL,
+  dept_id INTEGER NOT NULL,
+  order_no INTEGER NOT NULL DEFAULT 0,
+  is_leader INTEGER NOT NULL DEFAULT 0,
+  is_main INTEGER NOT NULL DEFAULT 0,
+  update_time INTEGER NOT NULL,
+  UNIQUE (tenant_id, user_id, dept_id)
+);
+CREATE INDEX IF NOT EXISTS idx_sys_dept_member_dept ON sys_dept_member (tenant_id, dept_id, order_no);
+CREATE INDEX IF NOT EXISTS idx_sys_dept_member_user ON sys_dept_member (tenant_id, user_id, is_main);

package/templates/src/app/api/_platform/migrations/0002__market_release.mysql.sql

@@ -0,0 +1,17 @@
+-- 0002__market_release（mysql 方言）：列语义同 0002__market_release.sql 头注释。
+-- 差异（沿用 _platform 基线的既有惯例）：键列/短文本收窄为 VARCHAR；秒级 epoch 取 BIGINT；
+-- 索引写在 CREATE TABLE 内（mysql 无 CREATE INDEX IF NOT EXISTS）。
+CREATE TABLE IF NOT EXISTS market_release (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  product VARCHAR(255) NOT NULL,
+  version VARCHAR(255) NOT NULL,
+  key_id VARCHAR(255),
+  sha256 VARCHAR(64),
+  size BIGINT,
+  published_at BIGINT NOT NULL,
+  published_at_source VARCHAR(16) NOT NULL,
+  yanked BIGINT NOT NULL DEFAULT 0,
+  first_seen_at BIGINT NOT NULL,
+  UNIQUE KEY uk_market_release_version (product, version),
+  KEY idx_market_release_published (published_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

package/templates/src/app/api/_platform/migrations/0002__market_release.pg.sql

@@ -0,0 +1,16 @@
+-- 0002__market_release（postgres 方言）：列语义同 0002__market_release.sql 头注释。
+-- 差异（沿用 _platform 基线的既有惯例）：TEXT 全保留，秒级 epoch 取 BIGINT。
+CREATE TABLE IF NOT EXISTS market_release (
+  id BIGSERIAL PRIMARY KEY,
+  product TEXT NOT NULL,
+  version TEXT NOT NULL,
+  key_id TEXT,
+  sha256 TEXT,
+  size BIGINT,
+  published_at BIGINT NOT NULL,
+  published_at_source TEXT NOT NULL,
+  yanked INTEGER NOT NULL DEFAULT 0,
+  first_seen_at BIGINT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uk_market_release_version ON market_release (product, version);
+CREATE INDEX IF NOT EXISTS idx_market_release_published ON market_release (published_at);

package/templates/src/app/api/_platform/migrations/0002__market_release.sql

@@ -0,0 +1,33 @@
+-- 0002__market_release（sqlite 方言）：发布历史表。
+--
+-- 定性：**共享表**（schema.yaml `tenant: false` + config.yaml `tenant.shared_allow` 双声明）。
+-- 理由：发布历史描述的是「这个 CDN 上出现过哪些包、谁发的」，CDN 本身就是站点级的；
+-- 按租户隔离会把同一份市场索引割裂成互不可见的碎片。
+--
+-- 数据来源是**签名索引**（market/api.ts syncReleases）：站点每次读发布历史时把索引里出现过的
+-- product@version 补进来。为什么不在 CLI 发版时上报：`ojm market publish` 是纯本地操作
+-- （可离线、无登录态），签名索引本身就是发版事实，再开一条上报链路只会多一套授权面与漂移源。
+--
+-- 语义：
+--   · 一行 = 一个 product@version（唯一键），history 是 append-only：published_at 首次写定后不改
+--   · published_at 优先取分发包的 Last-Modified（真正的落 CDN 时刻），取不到回落索引 issued_at，
+--     由 published_at_source 标明来源（file / index）
+--   · yanked 跟随索引（0 在架 / 1 已下线）——下线是当前状态，不是历史事实的改写
+CREATE TABLE IF NOT EXISTS market_release (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  product TEXT NOT NULL,
+  version TEXT NOT NULL,
+  key_id TEXT,
+  sha256 TEXT,
+  size INTEGER,
+  published_at INTEGER NOT NULL,
+  published_at_source TEXT NOT NULL,
+  yanked INTEGER NOT NULL DEFAULT 0,
+  first_seen_at INTEGER NOT NULL
+);
+
+-- 同步幂等：同一 product@version 只落一行（并发同步撞键由插入侧吞掉）
+CREATE UNIQUE INDEX IF NOT EXISTS uk_market_release_version ON market_release (product, version);
+
+-- 发布历史页主查询：按发布时间倒序分页
+CREATE INDEX IF NOT EXISTS idx_market_release_published ON market_release (published_at);

package/templates/src/app/api/_platform/schema.yaml

@@ -167,6 +167,24 @@ tables:
       operator: {type: text}
       message: {type: text}
       created_at: {type: integer, null: false}
+  # 发布历史（2026-11-05）：签名索引里出现过的每个 product@version 一行。
+  # 站点读发布历史时从索引同步（只补新行），published_at 首次写定后不改。
+  market_release:
+    # 共享表（B 组）：CDN 是站点级的，按租户隔离会把同一份市场索引割裂成互不可见的碎片。
+    tenant: false
+    pk: id
+    columns:
+      id: {type: integer, autoincrement: true}
+      product: {type: text, null: false}
+      version: {type: text, null: false}
+      key_id: {type: text}
+      sha256: {type: text}
+      size: {type: integer}
+      published_at: {type: integer, null: false}
+      # file = 分发包 Last-Modified（真正的落 CDN 时刻）；index = 索引 issued_at 兜底
+      published_at_source: {type: text, null: false}
+      yanked: {type: integer, null: false}
+      first_seen_at: {type: integer, null: false}
   # REG-CS2 索引新鲜度：站点按源记住见过的最大 seq（防回放/降级，回退即拒）。
   # 读写由 _lifecycle/source-seq.ts 落到本表；source_url 为业务主键（无自增 id）。
   reg_source_seq:

package/templates/src/app/api/_platform/seed.mysql.sql

@@ -19,3 +19,13 @@ INSERT IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES (
 -- 企微组织架构同步（B2）：触发同步是打上游的动作，挂权限点；admin/superadmin 天然通过，
 -- 只有自定义角色需要显式绑定（与 platform.org.read.all 同一条纪律：不落库就永远绑不上）。
 INSERT IGNORE INTO sys_permission (code, module, title_key, deprecated) VALUES ('auth.wecom.sync', 'auth', 'system:perm.auth_wecom_sync', 0);
+
+-- 系统设置默认值（与基础 seed 逐条对应）：方言文件不得漏段，漏了会让设置页/登录方式发现静默缺默认值。
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('framework.site_title', 'framework', 'general', 'string', 'React Antd Admin', 'React Antd Admin', 'system:setting.site_title', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('framework.market_cdn_url', 'framework', 'security', 'string', '/cdn', '/cdn', 'system:setting.market_cdn_url', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('ldap.enabled', 'ldap', 'login', 'bool', '0', '0', 'system:setting.ldap_enabled', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('sso.enabled', 'sso', 'login', 'bool', '0', '0', 'system:setting.sso_enabled', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('wecom.enabled', 'wecom', 'login', 'bool', '0', '0', 'system:setting.wecom_enabled', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('ldap_base_dn', 'ldap', 'ldap', 'string', '', '', 'system:setting.ldap_base_dn', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('ldap_uid_attr', 'ldap', 'ldap', 'string', 'uid', 'uid', 'system:setting.ldap_uid_attr', 0, 0);
+INSERT IGNORE INTO sys_setting (`key`, module, `group`, type, value, default_value, label_key, secret, update_time) VALUES ('ldap_email_attr', 'ldap', 'ldap', 'string', 'mail', 'mail', 'system:setting.ldap_email_attr', 0, 0);

package/templates/src/app/api/_platform/seed.pg.sql

@@ -19,3 +19,13 @@ INSERT INTO sys_permission (code, module, title_key, deprecated) VALUES ('platfo
 -- 企微组织架构同步（B2）：触发同步是打上游的动作，挂权限点；admin/superadmin 天然通过，
 -- 只有自定义角色需要显式绑定（与 platform.org.read.all 同一条纪律：不落库就永远绑不上）。
 INSERT INTO sys_permission (code, module, title_key, deprecated) VALUES ('auth.wecom.sync', 'auth', 'system:perm.auth_wecom_sync', 0) ON CONFLICT DO NOTHING;
+
+-- 系统设置默认值（与基础 seed 逐条对应）：方言文件不得漏段，漏了会让设置页/登录方式发现静默缺默认值。
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('framework.site_title', 'framework', 'general', 'string', 'React Antd Admin', 'React Antd Admin', 'system:setting.site_title', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('framework.market_cdn_url', 'framework', 'security', 'string', '/cdn', '/cdn', 'system:setting.market_cdn_url', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap.enabled', 'ldap', 'login', 'bool', '0', '0', 'system:setting.ldap_enabled', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('sso.enabled', 'sso', 'login', 'bool', '0', '0', 'system:setting.sso_enabled', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('wecom.enabled', 'wecom', 'login', 'bool', '0', '0', 'system:setting.wecom_enabled', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_base_dn', 'ldap', 'ldap', 'string', '', '', 'system:setting.ldap_base_dn', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_uid_attr', 'ldap', 'ldap', 'string', 'uid', 'uid', 'system:setting.ldap_uid_attr', 0, 0) ON CONFLICT DO NOTHING;
+INSERT INTO sys_setting (key, module, "group", type, value, default_value, label_key, secret, update_time) VALUES ('ldap_email_attr', 'ldap', 'ldap', 'string', 'mail', 'mail', 'system:setting.ldap_email_attr', 0, 0) ON CONFLICT DO NOTHING;

package/templates/src/app/api/auth/_shared/wecom/client.ts

@@ -15,6 +15,8 @@
 
 const API_BASE = "https://qyapi.weixin.qq.com";
 const TIMEOUT_MS = 5000;
+/** 软超时的检查步长：主链路一结束，最坏再挂一个步长就收尾 */
+const TIMEOUT_STEP_MS = 50;
 const TOKEN_SKEW_SECS = 300;
 
 export interface WecomHttp {
@@ -37,6 +39,14 @@ export interface WecomClientDeps {
  * 软超时：服务端 isolate 无 `setTimeout` / `AbortSignal` 全局，不能用 `AbortSignal.timeout`。
  * 这里用运行时注入的 `tasks.sleep(ms)` 起一个「到点就 reject」的竞态；fetch 不被真正 abort，
  * 只是不再等它（后台连接最终由 OS/池回收）。`tasks` 不可用时降级为原 promise（无超时）。
+ *
+ * **必须短步长**：oj 运行时要等请求上下文里所有未完成的异步任务（含 `tasks.sleep`）
+ * 结束才 flush 响应。早期实现挂一条 `sleep(5000)` 做竞态，上游 100ms 就返回时那条
+ * sleep 仍在飞，于是每个调企微接口的请求都被白拖到 5s 才发得出响应——登录回调
+ * `/api/auth/wecom/callback` 实测恒定 5011ms，正是企微工作台进入 5-6s 白屏的来源。
+ * 改成按 `TIMEOUT_STEP_MS` 逐段 sleep 并检查 settled 后，主链路一结束、最多再挂
+ * 一个步长即收尾（<=50ms），超时语义不变。
+ *
  * 输家 promise 在 race 结束后仍可能 reject，挂 `.catch` 防 unhandled rejection。
  */
 function withSoftTimeout<T>(p: Promise<T>, ms: number): Promise<T> {
@@ -44,11 +54,21 @@ function withSoftTimeout<T>(p: Promise<T>, ms: number): Promise<T> {
 	const sleep = g.tasks?.sleep;
 	if (typeof sleep !== "function")
 		return p;
-	const timeout = sleep(ms).then(
-		() => { throw new Error(`超时 ${ms}ms`); },
-		() => undefined as never, // sleep 自身异常不中断主链路（返回 never 以免 race 结果退化为 void | T）
-	);
+	let settled = false;
+	const deadline = Date.now() + ms;
+	const timeout = (async () => {
+		for (;;) {
+			const left = deadline - Date.now();
+			if (settled || left <= 0)
+				break;
+			await sleep(Math.min(left, TIMEOUT_STEP_MS));
+		}
+		if (!settled)
+			throw new Error(`超时 ${ms}ms`);
+		return undefined as never;
+	})();
 	return Promise.race([p, timeout]).finally(() => {
+		settled = true;
 		// 输家 promise 在 race 结束后仍可能 reject，挂 catch 防 unhandled rejection
 		timeout.catch(() => {});
 	});

package/templates/src/app/api/home/migrations/0001__create_home_tables.mysql.sql

@@ -0,0 +1,14 @@
+-- 0001（mysql 方言）：home 两表建表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGINT AUTO_INCREMENT；TEXT 不能带字面默认值 → 收窄 VARCHAR(255)。
+CREATE TABLE IF NOT EXISTS home_pie (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  category VARCHAR(255) NOT NULL DEFAULT '',
+  value INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS home_line (
+  id BIGINT AUTO_INCREMENT PRIMARY KEY,
+  day INTEGER NOT NULL DEFAULT 0,
+  value INTEGER NOT NULL DEFAULT 0
+);
+

package/templates/src/app/api/home/migrations/0001__create_home_tables.pg.sql

@@ -0,0 +1,14 @@
+-- 0001（postgres 方言）：home 两表建表。口径同基础件。
+-- 方言差异：AUTOINCREMENT → BIGSERIAL（SERIAL 系允许 seed 显式写 id）；TEXT 在 pg 合法且可带默认值。
+CREATE TABLE IF NOT EXISTS home_pie (
+  id BIGSERIAL PRIMARY KEY,
+  category TEXT NOT NULL DEFAULT '',
+  value INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS home_line (
+  id BIGSERIAL PRIMARY KEY,
+  day INTEGER NOT NULL DEFAULT 0,
+  value INTEGER NOT NULL DEFAULT 0
+);
+

package/templates/src/app/api/home/migrations/0002__tenant.pg.sql

@@ -0,0 +1,4 @@
+-- 0002__tenant（postgres 方言）：首页图表两表租户化。TEXT 在 pg 合法，与基础件同语法。
+ALTER TABLE home_pie ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+ALTER TABLE home_line ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default';
+

package/templates/src/app/api/home/seed.mysql.sql

@@ -0,0 +1,71 @@
+-- 方言覆盖（mysql）：INSERT OR IGNORE → INSERT IGNORE，语句与基础件逐条对应。
+-- home 模块种子（P4-1）。按分号朴素切分（S006）。
+-- home_pie：五分类（code 对齐前端 DATA_KEY），幂等 INSERT OR IGNORE。
+INSERT IGNORE INTO home_pie (category, value) VALUES ('electronics', 320);
+INSERT IGNORE INTO home_pie (category, value) VALUES ('home_goods', 210);
+INSERT IGNORE INTO home_pie (category, value) VALUES ('apparel_accessories', 180);
+INSERT IGNORE INTO home_pie (category, value) VALUES ('food_beverages', 150);
+INSERT IGNORE INTO home_pie (category, value) VALUES ('beauty_skincare', 95);
+
+-- home_line：日窗口序列（day = epoch-day，种子围绕"当前日期"生成，约 60 天窗口）。
+-- 刻意缺 today-30 / today-12 两天，演示"缺哪天补哪天"——handler 在窗口内对缺失日补 0；
+-- 若整个窗口无 seed（seed 随时间变旧），handler 回落确定式趋势兜底（懒补数）。
+INSERT IGNORE INTO home_line (day, value) VALUES (20640, 181);
+INSERT IGNORE INTO home_line (day, value) VALUES (20641, 190);
+INSERT IGNORE INTO home_line (day, value) VALUES (20642, 199);
+INSERT IGNORE INTO home_line (day, value) VALUES (20643, 208);
+INSERT IGNORE INTO home_line (day, value) VALUES (20644, 217);
+INSERT IGNORE INTO home_line (day, value) VALUES (20645, 226);
+INSERT IGNORE INTO home_line (day, value) VALUES (20646, 235);
+INSERT IGNORE INTO home_line (day, value) VALUES (20647, 244);
+INSERT IGNORE INTO home_line (day, value) VALUES (20648, 253);
+INSERT IGNORE INTO home_line (day, value) VALUES (20649, 262);
+INSERT IGNORE INTO home_line (day, value) VALUES (20650, 271);
+INSERT IGNORE INTO home_line (day, value) VALUES (20651, 280);
+INSERT IGNORE INTO home_line (day, value) VALUES (20652, 289);
+INSERT IGNORE INTO home_line (day, value) VALUES (20653, 298);
+INSERT IGNORE INTO home_line (day, value) VALUES (20654, 100);
+INSERT IGNORE INTO home_line (day, value) VALUES (20655, 109);
+INSERT IGNORE INTO home_line (day, value) VALUES (20656, 118);
+INSERT IGNORE INTO home_line (day, value) VALUES (20657, 127);
+INSERT IGNORE INTO home_line (day, value) VALUES (20658, 136);
+INSERT IGNORE INTO home_line (day, value) VALUES (20659, 145);
+INSERT IGNORE INTO home_line (day, value) VALUES (20660, 154);
+INSERT IGNORE INTO home_line (day, value) VALUES (20661, 163);
+INSERT IGNORE INTO home_line (day, value) VALUES (20662, 172);
+INSERT IGNORE INTO home_line (day, value) VALUES (20663, 181);
+INSERT IGNORE INTO home_line (day, value) VALUES (20664, 190);
+INSERT IGNORE INTO home_line (day, value) VALUES (20665, 199);
+INSERT IGNORE INTO home_line (day, value) VALUES (20666, 208);
+INSERT IGNORE INTO home_line (day, value) VALUES (20667, 217);
+INSERT IGNORE INTO home_line (day, value) VALUES (20668, 226);
+INSERT IGNORE INTO home_line (day, value) VALUES (20669, 235);
+INSERT IGNORE INTO home_line (day, value) VALUES (20671, 253);
+INSERT IGNORE INTO home_line (day, value) VALUES (20672, 262);
+INSERT IGNORE INTO home_line (day, value) VALUES (20673, 271);
+INSERT IGNORE INTO home_line (day, value) VALUES (20674, 280);
+INSERT IGNORE INTO home_line (day, value) VALUES (20675, 289);
+INSERT IGNORE INTO home_line (day, value) VALUES (20676, 298);
+INSERT IGNORE INTO home_line (day, value) VALUES (20677, 100);
+INSERT IGNORE INTO home_line (day, value) VALUES (20678, 109);
+INSERT IGNORE INTO home_line (day, value) VALUES (20679, 118);
+INSERT IGNORE INTO home_line (day, value) VALUES (20680, 127);
+INSERT IGNORE INTO home_line (day, value) VALUES (20681, 136);
+INSERT IGNORE INTO home_line (day, value) VALUES (20682, 145);
+INSERT IGNORE INTO home_line (day, value) VALUES (20683, 154);
+INSERT IGNORE INTO home_line (day, value) VALUES (20684, 163);
+INSERT IGNORE INTO home_line (day, value) VALUES (20685, 172);
+INSERT IGNORE INTO home_line (day, value) VALUES (20686, 181);
+INSERT IGNORE INTO home_line (day, value) VALUES (20687, 190);
+INSERT IGNORE INTO home_line (day, value) VALUES (20689, 208);
+INSERT IGNORE INTO home_line (day, value) VALUES (20690, 217);
+INSERT IGNORE INTO home_line (day, value) VALUES (20691, 226);
+INSERT IGNORE INTO home_line (day, value) VALUES (20692, 235);
+INSERT IGNORE INTO home_line (day, value) VALUES (20693, 244);
+INSERT IGNORE INTO home_line (day, value) VALUES (20694, 253);
+INSERT IGNORE INTO home_line (day, value) VALUES (20695, 262);
+INSERT IGNORE INTO home_line (day, value) VALUES (20696, 271);
+INSERT IGNORE INTO home_line (day, value) VALUES (20697, 280);
+INSERT IGNORE INTO home_line (day, value) VALUES (20698, 289);
+INSERT IGNORE INTO home_line (day, value) VALUES (20699, 298);
+INSERT IGNORE INTO home_line (day, value) VALUES (20700, 100);