@sleep2agi/commhub-server 0.9.0-preview.13 → 0.9.0-preview.131

package/src/departments-http.test.ts

@@ -0,0 +1,185 @@
+// 组织架构(board #419):GET/POST/PATCH/DELETE /api/networks/:id/departments、PUT …/members/:uid/department。
+// HTTP 集成测试(真实 Bun.serve,私有端口,临时库)。钉住:谁能读 / 谁能写、部门规则(同级不重名、不成环、最多 10 层、
+// 只删空部门、负责人必须是成员)、成员所在部门,以及只增不改(/humans、/members 只多一个 department_id)。
+
+import { describe, expect, test, beforeAll, afterAll } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { register, createNetworkTokenForNode } from "./auth.js";
+import { db } from "./db.js";
+
+const DIR = mkdtempSync(join(tmpdir(), "anet-departments-"));
+let BASE = "";
+let hub: any = null;
+const PW = "DepartmentsPassw0rd!x";
+let NET = "", OTHER_NET = "";
+const U: Record<string, { token: string; id: string }> = {};
+
+async function send(token: string, method: string, path: string, body?: unknown) {
+  const res = await fetch(`${BASE}${path}`, { method, headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body) });
+  const text = await res.text();
+  let json: any = null;
+  try { json = JSON.parse(text); } catch {}
+  return { status: res.status, body: json };
+}
+const D = () => `/api/networks/${NET}/departments`;
+const list = async (who = "owner") => (await send(U[who].token, "GET", D())).body;
+const mk = async (name: string, extra: Record<string, unknown> = {}) => {
+  const r = await send(U.owner.token, "POST", D(), { name, ...extra });
+  expect(r.status).toBe(201);
+  return r.body.department as { id: string; name: string; parent_id: string | null };
+};
+
+beforeAll(async () => {
+  process.env.COMMHUB_DB ||= join(DIR, "hub.db");
+  process.env.COMMHUB_UPLOADS_DIR = join(DIR, "uploads");
+  process.env.HOST = "127.0.0.1";
+  const a = register(`dep_owner_${Date.now()}`, PW, undefined, "Owner");
+  expect(a.ok).toBe(true);
+  U.owner = { token: a.token!, id: a.user!.user_id };
+  NET = a.network_id!;
+  db.run("UPDATE users SET role = 'admin' WHERE user_id = ?1", [U.owner.id]);
+  const mod: any = await import("./server.js");
+  hub = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  BASE = `http://127.0.0.1:${hub.port}`;
+  const add = async (username: string, role: string) => {
+    expect((await send(U.owner.token, "POST", "/api/admin/users", { username, password: PW, network_id: NET, role })).status).toBe(200);
+    const login = await send("", "POST", "/api/auth/login", { username, password: PW });
+    expect(login.status).toBe(200);
+    return { token: login.body.token as string, id: login.body.user.user_id as string };
+  };
+  const stamp = Date.now();
+  U.admin = await add(`dep_admin_${stamp}`, "admin");
+  U.member = await add(`dep_member_${stamp}`, "member");
+  U.viewer = await add(`dep_viewer_${stamp}`, "viewer");
+  U.node = { token: createNetworkTokenForNode(U.owner.id, NET, "dep-node", "node_dep").token!, id: "node_dep" };
+  const o = register(`dep_outsider_${stamp}`, PW);
+  U.outsider = { token: o.token!, id: o.user!.user_id };
+  OTHER_NET = o.network_id!;
+}, 30_000);
+
+afterAll(() => {
+  try { hub?.stop?.(true); } catch {}
+  try { rmSync(DIR, { recursive: true, force: true }); } catch {}
+});
+
+describe("who can read / write", () => {
+  test("every member, a node token of this network and a hub admin can read; outsiders and other networks' nodes can't", async () => {
+    for (const who of ["owner", "admin", "member", "viewer", "node"]) expect((await send(U[who].token, "GET", D())).status).toBe(200);
+    expect((await send(U.outsider.token, "GET", D())).status).toBe(403);
+    expect((await send("", "GET", D())).status).toBe(401);
+    const otherNode = createNetworkTokenForNode(U.outsider.id, OTHER_NET, "dep-other", "node_dep_other").token!;
+    expect((await send(otherNode, "GET", D())).status).toBe(403);
+  });
+
+  test("only network owner / admin (and hub admin) can write", async () => {
+    expect((await send(U.admin.token, "POST", D(), { name: "管理员建的" })).status).toBe(201);
+    for (const who of ["member", "viewer", "node", "outsider"]) {
+      expect((await send(U[who].token, "POST", D(), { name: `不该建-${who}` })).status).toBe(403);
+    }
+    const anyDept = (await list()).departments[0].id;
+    expect((await send(U.member.token, "PATCH", `${D()}/${anyDept}`, { name: "x" })).status).toBe(403);
+    expect((await send(U.member.token, "DELETE", `${D()}/${anyDept}`)).status).toBe(403);
+    expect((await send(U.member.token, "PUT", `/api/networks/${NET}/members/${U.member.id}/department`, { department_id: anyDept })).status).toBe(403);
+  });
+});
+
+describe("departments", () => {
+  test("create: top level and child, auto id and custom id, sibling names unique, validation", async () => {
+    const top = await mk("军团基建");
+    expect(top.id).toMatch(/^dept_/);
+    expect(top.parent_id).toBeNull();
+    const child = await mk("前端组", { parent_id: top.id, id: "fe-team" });
+    expect(child.id).toBe("fe-team");
+    expect(child.parent_id).toBe(top.id);
+    expect((await send(U.owner.token, "POST", D(), { name: "前端组", parent_id: top.id })).status).toBe(409);
+    expect((await send(U.owner.token, "POST", D(), { name: "前端组" })).status).toBe(201); // same name under another parent is fine
+    expect((await send(U.owner.token, "POST", D(), { name: "另一个", id: "fe-team" })).body.error).toBe("department_id_taken");
+    expect((await send(U.owner.token, "POST", D(), { name: "  " })).body.error).toBe("invalid_department_name");
+    expect((await send(U.owner.token, "POST", D(), { name: "x".repeat(41) })).body.error).toBe("invalid_department_name");
+    expect((await send(U.owner.token, "POST", D(), { name: "坏 id", id: "has space" })).body.error).toBe("invalid_department_id");
+    expect((await send(U.owner.token, "POST", D(), { name: "孤儿", parent_id: "nope" })).body.error).toBe("parent_not_found");
+    expect((await send(U.owner.token, "POST", D(), { name: "外人负责", leader_user_id: U.outsider.id })).body.error).toBe("leader_not_member");
+  });
+
+  test("rename, move (no cycles, depth ≤ 10), set / clear leader, sort", async () => {
+    const a = await mk("移动甲");
+    const b = await mk("移动乙", { parent_id: a.id });
+    const c = await mk("移动丙", { parent_id: b.id });
+    expect((await send(U.owner.token, "PATCH", `${D()}/${a.id}`, { parent_id: c.id })).body.error).toBe("department_cycle");
+    expect((await send(U.owner.token, "PATCH", `${D()}/${a.id}`, { parent_id: a.id })).body.error).toBe("department_cycle");
+    const moved = await send(U.owner.token, "PATCH", `${D()}/${c.id}`, { parent_id: null, name: "移动丙(顶层)" });
+    expect(moved.status).toBe(200);
+    expect(moved.body.department.parent_id).toBeNull();
+    expect(moved.body.department.name).toBe("移动丙(顶层)");
+    const led = await send(U.owner.token, "PATCH", `${D()}/${b.id}`, { leader_user_id: U.member.id, sort: 5 });
+    expect(led.body.department.leader_user_id).toBe(U.member.id);
+    expect(led.body.department.sort).toBe(5);
+    expect((await send(U.owner.token, "PATCH", `${D()}/${b.id}`, { leader_user_id: null })).body.department.leader_user_id).toBeNull();
+    expect((await send(U.owner.token, "PATCH", `${D()}/${b.id}`, {})).body.error).toBe("empty_patch");
+    expect((await send(U.owner.token, "PATCH", `${D()}/missing`, { name: "x" })).status).toBe(404);
+    // depth: a chain of 10 is fine, the 11th level is refused (create and move)
+    let parent: string | null = null;
+    const chain: string[] = [];
+    for (let i = 0; i < 10; i++) { const d = await mk(`层${i}`, parent ? { parent_id: parent } : {}); chain.push(d.id); parent = d.id; }
+    expect((await send(U.owner.token, "POST", D(), { name: "第11层", parent_id: parent })).body.error).toBe("department_too_deep");
+    const two = await mk("两层");
+    await mk("两层的子", { parent_id: two.id });
+    expect((await send(U.owner.token, "PATCH", `${D()}/${two.id}`, { parent_id: chain[8] })).body.error).toBe("department_too_deep");
+  });
+
+  test("members: put into a department, counts, unassign; /members (admin list) carries department_id, /humans unchanged", async () => {
+    const team = await mk("成员测试部");
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.member.id}/department`, { department_id: team.id })).body.department_id).toBe(team.id);
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.viewer.id}/department`, { department_id: team.id })).status).toBe(200);
+    const l = await list("member");
+    expect(l.departments.find((d: any) => d.id === team.id).member_count).toBe(2);
+    expect(l.members.find((m: any) => m.user_id === U.member.id).department_id).toBe(team.id);
+    expect(l.members.find((m: any) => m.user_id === U.owner.id).department_id).toBeNull();
+    // /humans stays identity-only (its key set is pinned by member-presence / agent-acl tests): who sits where comes
+    // from GET …/departments (members[]), which every member can read.
+    const humans = await send(U.viewer.token, "GET", `/api/networks/${NET}/humans`);
+    expect(humans.body.humans.find((h: any) => h.user_id === U.member.id).department_id).toBeUndefined();
+    const members = await send(U.owner.token, "GET", `/api/networks/${NET}/members`);
+    const row = members.body.members.find((m: any) => m.user_id === U.member.id);
+    expect(row.department_id).toBe(team.id);
+    for (const k of ["user_id", "role", "username", "agent_access", "task_access"]) expect(row).toHaveProperty(k); // old fields unchanged
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.outsider.id}/department`, { department_id: team.id })).status).toBe(404);
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.member.id}/department`, { department_id: "nope" })).body.error).toBe("department_not_found");
+    expect((await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.viewer.id}/department`, { department_id: null })).body.department_id).toBeNull();
+  });
+
+  test("delete only when empty (no sub-departments, no members), with the counts", async () => {
+    const parent = await mk("删除测试部");
+    const kid = await mk("删除测试子部", { parent_id: parent.id });
+    await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.admin.id}/department`, { department_id: parent.id });
+    const blocked = await send(U.owner.token, "DELETE", `${D()}/${parent.id}`);
+    expect(blocked.status).toBe(409);
+    expect(blocked.body).toMatchObject({ error: "department_not_empty", children: 1, members: 1 });
+    expect((await send(U.owner.token, "DELETE", `${D()}/${kid.id}`)).status).toBe(200);
+    await send(U.owner.token, "PUT", `/api/networks/${NET}/members/${U.admin.id}/department`, { department_id: null });
+    expect((await send(U.owner.token, "DELETE", `${D()}/${parent.id}`)).status).toBe(200);
+    expect((await list()).departments.some((d: any) => d.id === parent.id)).toBe(false);
+    expect((await send(U.owner.token, "DELETE", `${D()}/${parent.id}`)).status).toBe(404);
+  });
+
+  test("a leader who leaves the network reads as no leader", async () => {
+    const stamp = Date.now();
+    expect((await send(U.owner.token, "POST", "/api/admin/users", { username: `dep_leaver_${stamp}`, password: PW, network_id: NET, role: "member" })).status).toBe(200);
+    const leaver = (await send("", "POST", "/api/auth/login", { username: `dep_leaver_${stamp}`, password: PW })).body.user.user_id as string;
+    const d = await mk("负责人会走", { leader_user_id: leaver });
+    expect(d).toBeTruthy();
+    expect((await send(U.owner.token, "DELETE", `/api/networks/${NET}/members/${leaver}`)).status).toBe(200);
+    expect((await list()).departments.find((x: any) => x.id === d.id).leader_user_id).toBeNull();
+  });
+
+  test("deleting a network removes its departments", async () => {
+    const r = register(`dep_gone_${Date.now()}`, PW);
+    const net = r.network_id!;
+    expect((await send(r.token!, "POST", `/api/networks/${net}/departments`, { name: "会被删" })).status).toBe(201);
+    expect(db.get("SELECT 1 AS x FROM network_departments WHERE network_id = ?1", net)).toBeTruthy();
+    expect((await send(r.token!, "DELETE", `/api/networks/${net}`)).status).toBe(200);
+    expect(db.get("SELECT 1 AS x FROM network_departments WHERE network_id = ?1", net)).toBeFalsy();
+  });
+});

package/src/departments.ts

@@ -0,0 +1,260 @@
+// 人类成员的组织架构(board #419):部门(多层)+ 每个成员归一个部门 + 部门负责人。
+//
+// 只增不改:新表 network_departments,network_members 多一列 department_id(默认 NULL = 未分配)。
+// 旧 app 不读这两样,行为不变。网络本身就是根(parent_id = NULL 的部门挂在网络下面)。
+//
+// 权限:网络里任何成员(含 viewer、受限成员)都能读组织架构 —— 和 /humans 通讯录同一可见范围;
+// 写(建 / 改名 / 移动 / 删除部门、设负责人、调人)只给网络 owner / admin 和 Hub 管理员。节点令牌只能读自己网络的。
+//
+// /humans 通讯录保持只有身份字段(它的键集合被测试钉着);谁在哪个部门从 GET …/departments 的 members[] 读。
+// 规则:同一上级下部门不重名;移动不能挂到自己或自己的下级下面;最多 MAX_DEPTH 层;
+// 只有空部门(没有子部门、没有成员)能删;负责人必须是本网络成员;人离开网络后,作为负责人的引用读出来是 null。
+
+import { db, logAudit } from "./db.js";
+import { deleteDepartmentGrants, deleteDepartmentGrantsForNetwork } from "./department-heads.js";
+import { deleteChatGroupsForNetwork, groupTx, removeMemberFromChatGroups, syncDepartmentGroups, unlinkDepartmentGroup } from "./department-groups.js";
+
+// auth.ts 的 removeNetworkMember 从这里拿(auth.ts 只 import departments.js 一行,文档钉着它的行号)。
+export { groupTx, removeMemberFromChatGroups };
+
+try { db.exec("ALTER TABLE network_members ADD COLUMN department_id TEXT"); } catch {}
+db.exec(`
+  CREATE TABLE IF NOT EXISTS network_departments (
+    network_id     TEXT NOT NULL,
+    department_id  TEXT NOT NULL,
+    name           TEXT NOT NULL,
+    parent_id      TEXT,
+    leader_user_id TEXT,
+    sort           INTEGER NOT NULL DEFAULT 0,
+    created_by     TEXT,
+    created_at     TEXT NOT NULL DEFAULT (datetime('now')),
+    updated_at     TEXT NOT NULL DEFAULT (datetime('now')),
+    PRIMARY KEY (network_id, department_id)
+  );
+  CREATE INDEX IF NOT EXISTS idx_network_departments_parent ON network_departments(network_id, parent_id);
+`);
+
+export const MAX_DEPTH = 10;
+export const MAX_DEPARTMENTS = 500;
+const NAME_MAX = 40;
+const ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+type DeptRow = { network_id: string; department_id: string; name: string; parent_id: string | null; leader_user_id: string | null; sort: number; created_at: string; updated_at: string };
+export type Department = { id: string; name: string; parent_id: string | null; leader_user_id: string | null; sort: number; member_count: number; created_at: string; updated_at: string };
+
+type Fail = { ok: false; status: number; error: string };
+type Ok<T> = { ok: true } & T;
+
+const fail = (status: number, error: string): Fail => ({ ok: false, status, error });
+
+function rows(networkId: string): DeptRow[] {
+  return db.all<DeptRow>(
+    "SELECT network_id, department_id, name, parent_id, leader_user_id, sort, created_at, updated_at FROM network_departments WHERE network_id = ?1 ORDER BY sort, created_at, department_id",
+    networkId,
+  );
+}
+function one(networkId: string, id: string): DeptRow | null {
+  return db.get<DeptRow>(
+    "SELECT network_id, department_id, name, parent_id, leader_user_id, sort, created_at, updated_at FROM network_departments WHERE network_id = ?1 AND department_id = ?2",
+    networkId, id,
+  ) ?? null;
+}
+function isMember(networkId: string, userId: string): boolean {
+  return !!db.get<{ user_id: string }>("SELECT user_id FROM network_members WHERE network_id = ?1 AND user_id = ?2", networkId, userId);
+}
+
+/** 读:部门(带直属人数)+ 每个成员在哪个部门。负责人不在本网络了 → null。 */
+export function listDepartments(networkId: string): { departments: Department[]; members: Array<{ user_id: string; department_id: string | null }> } {
+  const members = db.all<{ user_id: string; department_id: string | null }>(
+    "SELECT user_id, department_id FROM network_members WHERE network_id = ?1 ORDER BY joined_at, user_id",
+    networkId,
+  );
+  const memberIds = new Set(members.map((m) => m.user_id));
+  const all = rows(networkId);
+  const ids = new Set(all.map((d) => d.department_id));
+  // 成员行指着一个已经不存在的部门(理论上删除时已清空;防御)→ 当未分配。
+  const placed = members.map((m) => ({ user_id: m.user_id, department_id: m.department_id && ids.has(m.department_id) ? m.department_id : null }));
+  const counts = new Map<string, number>();
+  for (const m of placed) if (m.department_id) counts.set(m.department_id, (counts.get(m.department_id) ?? 0) + 1);
+  return {
+    departments: all.map((d) => ({
+      id: d.department_id,
+      name: d.name,
+      parent_id: d.parent_id,
+      leader_user_id: d.leader_user_id && memberIds.has(d.leader_user_id) ? d.leader_user_id : null,
+      sort: d.sort,
+      member_count: counts.get(d.department_id) ?? 0,
+      created_at: d.created_at,
+      updated_at: d.updated_at,
+    })),
+    members: placed,
+  };
+}
+
+const cleanName = (raw: unknown): string | null => {
+  if (typeof raw !== "string") return null;
+  const name = raw.trim();
+  return name && [...name].length <= NAME_MAX ? name : null;
+};
+
+function depthOf(networkId: string, id: string | null): number {
+  let depth = 0;
+  let cur = id;
+  const seen = new Set<string>();
+  while (cur) {
+    if (seen.has(cur)) return Infinity;
+    seen.add(cur);
+    depth += 1;
+    cur = one(networkId, cur)?.parent_id ?? null;
+  }
+  return depth;
+}
+/** 以 id 为根的子树最深有几层(含自己)。 */
+function subtreeHeight(networkId: string, id: string): number {
+  const children = db.all<{ department_id: string }>("SELECT department_id FROM network_departments WHERE network_id = ?1 AND parent_id = ?2", networkId, id);
+  return 1 + children.reduce((m, c) => Math.max(m, subtreeHeight(networkId, c.department_id)), 0);
+}
+function isDescendant(networkId: string, ancestor: string, id: string | null): boolean {
+  let cur = id;
+  const seen = new Set<string>();
+  while (cur) {
+    if (cur === ancestor) return true;
+    if (seen.has(cur)) return true;
+    seen.add(cur);
+    cur = one(networkId, cur)?.parent_id ?? null;
+  }
+  return false;
+}
+function siblingNameTaken(networkId: string, parentId: string | null, name: string, exceptId?: string): boolean {
+  const sql = parentId === null
+    ? "SELECT department_id FROM network_departments WHERE network_id = ?1 AND parent_id IS NULL AND name = ?2"
+    : "SELECT department_id FROM network_departments WHERE network_id = ?1 AND parent_id = ?3 AND name = ?2";
+  const hits = parentId === null ? db.all<{ department_id: string }>(sql, networkId, name) : db.all<{ department_id: string }>(sql, networkId, name, parentId);
+  return hits.some((h) => h.department_id !== exceptId);
+}
+function publicOne(networkId: string, id: string): Department {
+  return listDepartments(networkId).departments.find((d) => d.id === id)!;
+}
+
+export function createDepartment(networkId: string, actor: string, body: Record<string, unknown>): Ok<{ department: Department }> | Fail {
+  const name = cleanName(body.name);
+  if (!name) return fail(400, "invalid_department_name");
+  let id: string;
+  if (body.id !== undefined && body.id !== null && body.id !== "") {
+    if (typeof body.id !== "string" || !ID_RE.test(body.id)) return fail(400, "invalid_department_id");
+    if (one(networkId, body.id)) return fail(409, "department_id_taken");
+    id = body.id;
+  } else {
+    id = `dept_${crypto.randomUUID().replace(/-/g, "").slice(0, 16)}`;
+  }
+  const parentId = body.parent_id === undefined || body.parent_id === null || body.parent_id === "" ? null : body.parent_id;
+  if (parentId !== null && (typeof parentId !== "string" || !one(networkId, parentId))) return fail(400, "parent_not_found");
+  if (depthOf(networkId, parentId as string | null) + 1 > MAX_DEPTH) return fail(400, "department_too_deep");
+  if (siblingNameTaken(networkId, parentId as string | null, name)) return fail(409, "department_name_taken");
+  const leader = body.leader_user_id === undefined || body.leader_user_id === null || body.leader_user_id === "" ? null : body.leader_user_id;
+  if (leader !== null && (typeof leader !== "string" || !isMember(networkId, leader))) return fail(400, "leader_not_member");
+  if (body.sort !== undefined && !Number.isInteger(body.sort)) return fail(400, "invalid_sort");
+  const count = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_departments WHERE network_id = ?1", networkId)?.n ?? 0;
+  if (count >= MAX_DEPARTMENTS) return fail(400, "too_many_departments");
+  const sort = body.sort === undefined
+    ? (db.get<{ n: number }>(
+      parentId === null
+        ? "SELECT COUNT(*) AS n FROM network_departments WHERE network_id = ?1 AND parent_id IS NULL"
+        : "SELECT COUNT(*) AS n FROM network_departments WHERE network_id = ?1 AND parent_id = ?2",
+      ...(parentId === null ? [networkId] : [networkId, parentId]),
+    )?.n ?? 0)
+    : body.sort as number;
+  groupTx(() => {
+    db.run(
+      "INSERT INTO network_departments (network_id, department_id, name, parent_id, leader_user_id, sort, created_by) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
+      [networkId, id, name, parentId, leader, sort, actor],
+    );
+    // RFC-042 §4:新部门带负责人 → 上级部门群的 roster 多了这个负责人。没有负责人的新部门是空的,roster 不变。
+    if (leader !== null) syncDepartmentGroups(networkId);
+  });
+  return { ok: true, department: publicOne(networkId, id) };
+}
+
+export function updateDepartment(networkId: string, id: string, body: Record<string, unknown>): Ok<{ department: Department }> | Fail {
+  const cur = one(networkId, id);
+  if (!cur) return fail(404, "department_not_found");
+  let name = cur.name;
+  let parentId = cur.parent_id;
+  let leader = cur.leader_user_id;
+  let sort = cur.sort;
+  let touched = false;
+  if (body.name !== undefined) {
+    const n = cleanName(body.name);
+    if (!n) return fail(400, "invalid_department_name");
+    name = n; touched = true;
+  }
+  if (body.parent_id !== undefined) {
+    const p = body.parent_id === null || body.parent_id === "" ? null : body.parent_id;
+    if (p !== null && (typeof p !== "string" || !one(networkId, p))) return fail(400, "parent_not_found");
+    if (p !== null && isDescendant(networkId, id, p as string)) return fail(400, "department_cycle");
+    if (depthOf(networkId, p as string | null) + subtreeHeight(networkId, id) > MAX_DEPTH) return fail(400, "department_too_deep");
+    parentId = p as string | null; touched = true;
+  }
+  if (body.leader_user_id !== undefined) {
+    const l = body.leader_user_id === null || body.leader_user_id === "" ? null : body.leader_user_id;
+    if (l !== null && (typeof l !== "string" || !isMember(networkId, l))) return fail(400, "leader_not_member");
+    leader = l as string | null; touched = true;
+  }
+  if (body.sort !== undefined) {
+    if (!Number.isInteger(body.sort)) return fail(400, "invalid_sort");
+    sort = body.sort as number; touched = true;
+  }
+  if (!touched) return fail(400, "empty_patch");
+  if ((name !== cur.name || parentId !== cur.parent_id) && siblingNameTaken(networkId, parentId, name, id)) return fail(409, "department_name_taken");
+  groupTx(() => {
+    db.run(
+      "UPDATE network_departments SET name = ?3, parent_id = ?4, leader_user_id = ?5, sort = ?6, updated_at = datetime('now') WHERE network_id = ?1 AND department_id = ?2",
+      [networkId, id, name, parentId, leader, sort],
+    );
+    // RFC-042 §4:改上级(子树变了)/ 换负责人 → 同一事务对账部门群。只改名 / 排序不影响 roster。
+    if (parentId !== cur.parent_id || leader !== cur.leader_user_id) syncDepartmentGroups(networkId);
+  });
+  return { ok: true, department: publicOne(networkId, id) };
+}
+
+/** 只删空部门:有子部门 / 有成员 → 409(带数字,界面照着说)。 */
+export function deleteDepartment(networkId: string, id: string): Ok<{ deleted: string }> | (Fail & { children?: number; members?: number }) {
+  if (!one(networkId, id)) return fail(404, "department_not_found");
+  const children = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_departments WHERE network_id = ?1 AND parent_id = ?2", networkId, id)?.n ?? 0;
+  const members = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM network_members WHERE network_id = ?1 AND department_id = ?2", networkId, id)?.n ?? 0;
+  if (children || members) return { ...fail(409, "department_not_empty"), children, members };
+  // RFC-040:部门的项目授权(network_department_project_grants)和部门同一事务删掉。
+  groupTx(() => {
+    db.run("DELETE FROM network_departments WHERE network_id = ?1 AND department_id = ?2", [networkId, id]);
+    deleteDepartmentGrants(networkId, id);
+    // RFC-042:部门群解除关联(群和成员、以后的聊天记录都留着),不删。
+    unlinkDepartmentGroup(networkId, id);
+    // 删掉的部门的负责人可能还在上级部门群的 roster 里(负责人不必在本部门):对账一次。解除关联的群不再对账。
+    syncDepartmentGroups(networkId);
+  });
+  return { ok: true, deleted: id };
+}
+
+/** 把成员放进一个部门(null = 未分配)。 */
+export function setMemberDepartment(networkId: string, userId: string, departmentId: unknown): Ok<{ user_id: string; department_id: string | null }> | Fail {
+  if (!isMember(networkId, userId)) return fail(404, "member_not_found");
+  const dept = departmentId === null || departmentId === "" ? null : departmentId;
+  if (dept !== null && (typeof dept !== "string" || !one(networkId, dept))) return fail(400, "department_not_found");
+  groupTx(() => {
+    db.run("UPDATE network_members SET department_id = ?3 WHERE network_id = ?1 AND user_id = ?2", [networkId, userId, dept]);
+    // RFC-042 §4:调进 / 调出 → 同一事务对账部门群(manual 行不动)。
+    syncDepartmentGroups(networkId);
+  });
+  return { ok: true, user_id: userId, department_id: dept as string | null };
+}
+
+/** 网络删掉时一起清(和项目授权同一时机调用)。 */
+export function deleteDepartmentsForNetwork(networkId: string): void {
+  db.run("DELETE FROM network_departments WHERE network_id = ?1", [networkId]);
+  deleteDepartmentGrantsForNetwork(networkId);
+  deleteChatGroupsForNetwork(networkId); // RFC-042:网络没了,群一起删
+}
+
+export function auditDepartment(user: { user_id: string; username: string }, action: string, networkId: string, detail: string): void {
+  logAudit(user.user_id, user.username, action, "network", networkId, detail.slice(0, 2000), undefined, networkId);
+}

package/src/desktop-message-seam.test.ts

@@ -0,0 +1,150 @@
+// #1459 —— P2 写路径与 P3 读路径的**接缝**。
+//
+// 通信龙 在 origin/main 上核出的覆盖缝：desktop-message.test.ts 测真实 send 但
+// 不碰 scope=user 读；user-inbox-read-http.test.ts 测 scope=user 读但用 SQL 直接
+// 播种行。两半各自对着自己的夹具绿，而"真实 send 写进的行、真实 scope=user
+// 读得回来"从没验过。本文件就走这一条：真 send → 真 HTTP 读。
+//
+// 附带钉住 network_id 不为 NULL 的**真实机制**：不是 INSERT 时兜底，而是
+// tools.ts 里 `if (!effectiveNetId) return writeDeniedReply(...)` 在写之前就拒。
+// 见下面 "解析不出 network 时拒发" 那条 —— 把那个 if 拿掉，本文件会红。
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+const PRIVATE_DB_DIR = mkdtempSync(join(tmpdir(), "anet-dm-seam-"));
+process.env.COMMHUB_DB ||= join(PRIVATE_DB_DIR, "hub.db");
+
+let server: ReturnType<typeof Bun.serve>;
+let base = "";
+let targetToken = "";
+let senderId = "", targetId = "", senderNet = "", secondNet = "";
+let send: (args: any) => Promise<Record<string, any>>;
+
+function buildSend(opts: { netId: string | null; userId: string | null; alias: string | null }) {
+  const mcp = new McpServer({ name: "test", version: "0" }) as any;
+  const tools: Record<string, any> = {};
+  const origTool = mcp.tool.bind(mcp);
+  mcp.tool = (name: string, _d: string, _s: any, handler: any) => { tools[name] = handler; return origTool(name, _d, _s, handler); };
+  const { registerTools } = require("./tools.js");
+  registerTools(mcp, undefined, opts.netId, opts.userId, opts.alias, false, "tok_seam_test");
+  return async (args: any) => JSON.parse((await tools["send_desktop_message"](args)).content[0].text);
+}
+
+beforeAll(async () => {
+  const { db } = await import("./db.js");
+  const { register, addNetworkMember } = await import("./auth.js");
+  const stamp = Date.now();
+
+  // 首个注册用户自动成为全局 admin，而 admin 读侧不走 scope 过滤分支。
+  // 收件人必须是普通 user，否则"读得回来"可能只是因为它绕过了过滤。
+  expect(register(`seam_admin_${stamp}`, "SeamAdmin-Strong-1!").ok).toBe(true);
+  const s = register(`seam_sender_${stamp}`, "SeamSender-Strong-1!");
+  const t = register(`seam_target_${stamp}`, "SeamTarget-Strong-1!");
+  expect(s.ok && t.ok).toBe(true);
+  targetToken = t.token!;
+  senderNet = s.network_id!;
+  secondNet = t.network_id!;
+  senderId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `seam_sender_${stamp}`)!.user_id;
+  targetId = db.get<{ user_id: string }>("SELECT user_id FROM users WHERE username = ?1", `seam_target_${stamp}`)!.user_id;
+  expect(db.get<{ role: string }>("SELECT role FROM users WHERE user_id = ?1", targetId)?.role).toBe("user");
+
+  // 收件人进发件人的网（真实形态：同网两成员）。
+  expect(addNetworkMember(senderNet, targetId, "member").ok).toBe(true);
+
+  send = buildSend({ netId: senderNet, userId: senderId, alias: "seam-sender" });
+
+  const mod = await import("./server.js");
+  server = mod.bootServer({ port: 0, hostname: "127.0.0.1" });
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(() => {
+  try { server?.stop(true); } catch {}
+  try { rmSync(PRIVATE_DB_DIR, { recursive: true, force: true }); } catch {}
+});
+
+const readOwn = async (token: string, qs = "") => {
+  const r = await fetch(`${base}/api/messages?scope=user${qs}`, { headers: { Authorization: `Bearer ${token}` } });
+  return { status: r.status, body: await r.json() as any };
+};
+
+describe("#1459 P2 写 → P3 读 接缝", () => {
+  test("🔴 真实 send_desktop_message 写进的行，真实 GET ?scope=user 读得回来", async () => {
+    const sent = await send({ to_user_id: targetId, message: "接缝测试正文", title: "接缝", severity: "warning", kind: "agent_message" });
+    expect([sent.ok, sent.persisted]).toEqual([true, true]);
+
+    const { status, body } = await readOwn(targetToken);
+    expect(status).toBe(200);
+    const row = body.messages.find((m: any) => m.message_id === sent.message_id);
+    expect(row).toBeTruthy();                      // 承重：两半接得上
+    expect(row.content).toBe("接缝测试正文");
+    expect(row.title).toBe("接缝");
+    expect(row.severity).toBe("warning");
+    expect(row.user_id).toBe(targetId);
+  });
+
+  test("🔴 落库的 network_id 就是授权用的那个网，不是 NULL —— 否则 scoped 读回不来", async () => {
+    const { db } = require("./db.js");
+    const sent = await send({ to_user_id: targetId, message: "网络归属" });
+    const row = db.get<any>("SELECT network_id FROM user_inbox WHERE message_id = ?1", sent.message_id);
+    expect(row.network_id).toBe(senderNet);
+
+    const { body } = await readOwn(targetToken);
+    expect(body.messages.map((m: any) => m.message_id)).toContain(sent.message_id);
+  });
+
+  test("unread 随真实 send 增长", async () => {
+    const before = (await readOwn(targetToken)).body.unread;
+    await send({ to_user_id: targetId, message: "计数 +1" });
+    expect((await readOwn(targetToken)).body.unread).toBe(before + 1);
+  });
+
+  test("redact-at-read 作用在真实写进去的正文上", async () => {
+    const sent = await send({ to_user_id: targetId, message: "凭据 ntok_seamtoken123456 在正文里" });
+    const { db } = require("./db.js");
+    // 存储侧保留原文，遮蔽发生在**回读**时 —— 这两句一起才说明是 read-time 脱敏。
+    expect(db.get<any>("SELECT content FROM user_inbox WHERE message_id = ?1", sent.message_id).content)
+      .toContain("ntok_seamtoken123456");
+    const row = (await readOwn(targetToken)).body.messages.find((m: any) => m.message_id === sent.message_id);
+    expect(row.content).toContain("ntok_***redacted***");
+    expect(row.content).not.toContain("ntok_seamtoken123456");
+  });
+
+  // 🔴 这一条是 `if (!effectiveNetId) return` 这道守卫**唯一**能被触发的场景。
+  //    有 auth ctx 时前一道 `canWrite` 就拦了；而 canRestWriteNetwork 对
+  //    legacy 全局 token / --dev-open（authCtx 为 null）是 `return true`
+  //    （network-scope.ts:96）—— 那条路上只剩这道守卫挡着 NULL 孤儿行。
+  //    把 tools.ts:2320 那行删掉，本条会红（写出一行 network_id=NULL）。
+  test("🔴 legacy 无 auth ctx 的调用者同样拒发，不写 NULL 孤儿行", async () => {
+    const { db } = require("./db.js");
+    const legacy = buildSend({ netId: null, userId: null as any, alias: null as any });
+    const before = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n;
+    const r = await legacy({ to_user_id: targetId, message: "legacy 无网络上下文" });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("network_id_required");
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n).toBe(before);
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE network_id IS NULL")!.n).toBe(0);
+  });
+
+  test("🔴 解析不出 network 时**拒发**，而不是写一行 network_id=NULL 的孤儿", async () => {
+    const { db } = require("./db.js");
+    const { addNetworkMember } = require("./auth.js");
+    // 发件人进第二个网 ⇒ 不带 network_id 时 singleNetworkId 解析不出唯一网。
+    addNetworkMember(secondNet, senderId, "member");
+    const ambiguous = buildSend({ netId: null, userId: senderId, alias: "seam-sender" });
+
+    const before = db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n;
+    const r = await ambiguous({ to_user_id: targetId, message: "无法解析网络" });
+
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("network_id_required");
+    // 承重：拒发意味着**一行都不写**。若把 tools.ts 的
+    // `if (!effectiveNetId) return writeDeniedReply(...)` 拿掉，这里会多出一行
+    // network_id=NULL 的孤儿 —— 写得进去、scoped 读不回来。
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox")!.n).toBe(before);
+    expect(db.get<{ n: number }>("SELECT COUNT(*) AS n FROM user_inbox WHERE network_id IS NULL")!.n).toBe(0);
+  });
+});