@svadmin/ui 0.47.1 → 0.49.0

package/dist/components/SecuritySettings.svelte

@@ -1,9 +1,7 @@
 <script lang="ts">
-  import { useNotification } from '@svadmin/core';
+  import { captureAdminContext, notifyWithProvider, type SessionInfo } from '@svadmin/core';
   import { useTranslation } from '@svadmin/core/i18n';
-
   import { AlertTriangle, Monitor, Smartphone, Trash2 } from '@lucide/svelte';
-  import type { Component } from 'svelte';
   import * as Alert from './ui/alert/index.js';
   import { Button } from './ui/button/index.js';
   import { Switch } from './ui/switch/index.js';
@@ -11,126 +9,193 @@
   import SettingsGroup from './content/SettingsGroup.svelte';
   import SettingsFieldRow from './content/SettingsFieldRow.svelte';
   import DataState from './content/DataState.svelte';
+  import FeedbackNotice from './content/FeedbackNotice.svelte';
 
   const i18n = useTranslation();
-  const notification = useNotification();
-
-  interface SessionInfo {
-    id: string;
-    os: string;
-    browser: string;
-    ip: string;
-    lastActive: string;
-    isCurrent: boolean;
-    Icon: Component;
-  }
+  const adminContext = captureAdminContext();
+  const authProvider = $derived(adminContext.authProvider);
+  const sessionProvider = $derived(adminContext.sessionProvider);
+  const isZh = $derived(i18n.locale === 'zh-CN');
 
   let is2faEnabled = $state(false);
-  let sessions = $state<SessionInfo[]>([
-    { id: 'current', os: 'macOS', browser: 'Chrome', ip: '192.168.1.102', lastActive: 'Active now', isCurrent: true, Icon: Monitor },
-    { id: 'mobile', os: 'iOS', browser: 'Safari', ip: '192.168.1.105', lastActive: '2 hours ago', isCurrent: false, Icon: Smartphone },
-    { id: 'desktop', os: 'Windows', browser: 'Edge', ip: '10.0.0.4', lastActive: '2 days ago', isCurrent: false, Icon: Monitor },
-  ]);
-
+  let sessions = $state.raw<SessionInfo[]>([]);
+  let loadingSessions = $state(false);
+  let sessionError = $state<string | null>(null);
+  let updatingMfa = $state(false);
+  let revoking = $state<string | null>(null);
   let currentPassword = $state('');
   let newPassword = $state('');
   let confirmPassword = $state('');
   let passwordErrorMessage = $state('');
-  let lastChanged = $state('3 months ago');
+  let changingPassword = $state(false);
+  let requestId = 0;
 
-  function handlePasswordChange(event: SubmitEvent) {
-    event.preventDefault();
-    passwordErrorMessage = '';
+  function message(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+  }
 
-    if (!currentPassword) {
-      passwordErrorMessage = i18n.t('profile.currentPassword');
-      return;
-    }
-    if (newPassword.length < 8) {
-      passwordErrorMessage = i18n.t('validation.minLength', { min: 8 });
-      return;
-    }
-    if (newPassword !== confirmPassword) {
-      passwordErrorMessage = i18n.t('auth.passwordMismatch');
-      return;
+  async function loadSecurity(): Promise<void> {
+    const currentRequest = ++requestId;
+    const provider = sessionProvider;
+    const context = adminContext.enterpriseRequestContext;
+    sessions = [];
+    is2faEnabled = false;
+    sessionError = null;
+    loadingSessions = false;
+    if (!provider) return;
+    loadingSessions = true;
+    try {
+      const [nextSessions, mfa] = await Promise.all([
+        provider.listSessions(context),
+        provider.getMfaState?.(context) ?? { enabled: false },
+      ]);
+      if (currentRequest !== requestId) return;
+      sessions = nextSessions;
+      is2faEnabled = mfa.enabled;
+    } catch (caught) {
+      if (currentRequest === requestId) sessionError = message(caught);
+    } finally {
+      if (currentRequest === requestId) loadingSessions = false;
     }
+  }
 
-    notification.success(i18n.t('profile.passwordChanged'), 3000);
-    lastChanged = 'Just now';
+  $effect(() => {
+    void authProvider;
+    void sessionProvider;
+    void adminContext.tenantCacheKey?.__svadminTenant;
     currentPassword = '';
     newPassword = '';
     confirmPassword = '';
+    passwordErrorMessage = '';
+    changingPassword = false;
+    updatingMfa = false;
+    revoking = null;
+    void loadSecurity();
+    return () => { requestId += 1; };
+  });
+
+  async function handleMfaChange(enabled: boolean): Promise<void> {
+    const provider = sessionProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    if (!provider?.setMfaEnabled) return;
+    updatingMfa = true;
+    try {
+      const result = await provider.setMfaEnabled(enabled, context);
+      if (currentRequest !== requestId) return;
+      is2faEnabled = result.enabled;
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) updatingMfa = false;
+    }
   }
 
-  function revokeSession(id: string) {
-    sessions = sessions.filter((session) => session.id !== id);
+  async function handlePasswordChange(event: SubmitEvent): Promise<void> {
+    event.preventDefault();
+    passwordErrorMessage = '';
+    const provider = authProvider;
+    const currentRequest = requestId;
+    if (!provider?.updatePassword) return;
+    if (!currentPassword) passwordErrorMessage = i18n.t('profile.currentPassword');
+    else if (newPassword.length < 8) passwordErrorMessage = i18n.t('validation.minLength', { min: 8 });
+    else if (newPassword !== confirmPassword) passwordErrorMessage = i18n.t('auth.passwordMismatch');
+    if (passwordErrorMessage) return;
+
+    changingPassword = true;
+    try {
+      const result = await provider.updatePassword({ currentPassword, password: newPassword, confirmPassword });
+      if (!result.success) throw new Error(result.error?.message ?? (isZh ? '密码修改失败' : 'Password update failed'));
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'success', message: i18n.t('profile.passwordChanged') }, adminContext.notificationProvider);
+      currentPassword = '';
+      newPassword = '';
+      confirmPassword = '';
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      passwordErrorMessage = message(caught);
+    } finally {
+      if (currentRequest === requestId) changingPassword = false;
+    }
+  }
+
+  async function revokeSession(id: string): Promise<void> {
+    const provider = sessionProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    if (!provider) return;
+    revoking = id;
+    try {
+      const result = await provider.revokeSession(id, context);
+      if (!result.success) throw new Error(result.error?.message ?? (isZh ? '会话撤销失败' : 'Session revocation failed'));
+      if (currentRequest !== requestId) return;
+      sessions = sessions.filter((session) => session.id !== id);
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) revoking = null;
+    }
   }
 
-  function revokeAllOthers() {
-    sessions = sessions.filter((session) => session.isCurrent);
+  async function revokeAllOthers(): Promise<void> {
+    const provider = sessionProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    if (!provider) return;
+    revoking = '*';
+    try {
+      const result = await provider.revokeOtherSessions(context);
+      if (!result.success) throw new Error(result.error?.message ?? (isZh ? '会话撤销失败' : 'Session revocation failed'));
+      if (currentRequest !== requestId) return;
+      sessions = sessions.filter((session) => session.current);
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) revoking = null;
+    }
   }
 </script>
 
 <div class="space-y-6">
-  <div>
-    <h2 class="text-xl font-semibold text-foreground">{i18n.t('settings.security')}</h2>
-    <p class="mt-1 text-sm text-muted-foreground">{i18n.t('settings.securityDescription')}</p>
-  </div>
-
+  <div><h2 class="text-xl font-semibold text-foreground">{i18n.t('settings.security')}</h2><p class="mt-1 text-sm text-muted-foreground">{i18n.t('settings.securityDescription')}</p></div>
+  {#if !sessionProvider}
+    <FeedbackNotice tone="warning" message={isZh ? '未配置 SessionProvider。会话和 MFA 设置不会使用模拟数据。' : 'SessionProvider is not configured. Session and MFA controls do not use simulated data.'} />
+  {/if}
   <SettingsGroup title={i18n.t('security.twoFactorAuth')} description={i18n.t('security.twoFactorDescription')}>
-      <SettingsFieldRow label={i18n.t('security.enable2fa')} description={is2faEnabled ? i18n.t('security.twoFactorActive') : i18n.t('security.twoFactorInactive')}>
-        {#snippet control()}<Switch id="two-factor" bind:checked={is2faEnabled} />{/snippet}
-      </SettingsFieldRow>
+    <SettingsFieldRow label={i18n.t('security.enable2fa')} description={is2faEnabled ? i18n.t('security.twoFactorActive') : i18n.t('security.twoFactorInactive')}>
+      {#snippet control()}<Switch checked={is2faEnabled} disabled={!sessionProvider?.setMfaEnabled || updatingMfa} onCheckedChange={handleMfaChange} />{/snippet}
+    </SettingsFieldRow>
   </SettingsGroup>
-
-  <SettingsGroup title={i18n.t('profile.changePassword')} description={i18n.t('security.passwordLastChanged', { time: lastChanged })}>
-      <form onsubmit={handlePasswordChange} class="max-w-lg space-y-4">
-        {#if passwordErrorMessage}
-          <Alert.Root variant="destructive">
-            <AlertTriangle class="h-4 w-4" />
-            <Alert.Description>{passwordErrorMessage}</Alert.Description>
-          </Alert.Root>
-        {/if}
-
-        <PasswordInput id="security-current-password" label={i18n.t('profile.currentPassword')} bind:value={currentPassword} autocomplete="current-password" />
-        <PasswordInput id="security-new-password" label={i18n.t('profile.newPassword')} bind:value={newPassword} autocomplete="new-password" showStrength />
-        <PasswordInput id="security-confirm-password" label={i18n.t('auth.confirmPassword')} bind:value={confirmPassword} autocomplete="new-password" />
-
-        <Button type="submit">{i18n.t('profile.updatePassword')}</Button>
-      </form>
+  <SettingsGroup title={i18n.t('profile.changePassword')} description={isZh ? '密码修改由 AuthProvider 持久化。' : 'Password changes are persisted by AuthProvider.'}>
+    {#if !authProvider?.updatePassword}<FeedbackNotice tone="warning" message={isZh ? '当前 AuthProvider 不支持修改密码。' : 'The current AuthProvider does not support password updates.'} />{/if}
+    <form onsubmit={handlePasswordChange} class="max-w-lg space-y-4">
+      {#if passwordErrorMessage}<Alert.Root variant="destructive"><AlertTriangle class="h-4 w-4" /><Alert.Description>{passwordErrorMessage}</Alert.Description></Alert.Root>{/if}
+      <PasswordInput id="security-current-password" label={i18n.t('profile.currentPassword')} bind:value={currentPassword} autocomplete="current-password" disabled={!authProvider?.updatePassword || changingPassword} />
+      <PasswordInput id="security-new-password" label={i18n.t('profile.newPassword')} bind:value={newPassword} autocomplete="new-password" showStrength disabled={!authProvider?.updatePassword || changingPassword} />
+      <PasswordInput id="security-confirm-password" label={i18n.t('auth.confirmPassword')} bind:value={confirmPassword} autocomplete="new-password" disabled={!authProvider?.updatePassword || changingPassword} />
+      <Button type="submit" disabled={!authProvider?.updatePassword || changingPassword}>{changingPassword ? (isZh ? '更新中...' : 'Updating...') : i18n.t('profile.updatePassword')}</Button>
+    </form>
   </SettingsGroup>
-
   <SettingsGroup title={i18n.t('security.activeSessions')} description={i18n.t('security.sessionsDescription')}>
-    {#snippet actions()}{#if sessions.length > 1}<Button variant="outline" size="sm" onclick={revokeAllOthers}>{i18n.t('security.revokeOthers')}</Button>{/if}{/snippet}
+    {#snippet actions()}{#if sessions.some((session) => !session.current)}<Button variant="outline" size="sm" disabled={revoking !== null} onclick={revokeAllOthers}>{i18n.t('security.revokeOthers')}</Button>{/if}{/snippet}
+    {#if loadingSessions}
+      <DataState state="loading" />
+    {:else if sessionError}
+      <DataState state="error" description={sessionError} retry={loadSecurity} />
+    {:else if sessions.length === 0}
+      <DataState state="empty" title={i18n.t('security.noSessions')} description={sessionProvider ? (isZh ? 'Provider 未返回活跃会话。' : 'The provider returned no active sessions.') : (isZh ? '配置 SessionProvider 后可管理真实会话。' : 'Configure SessionProvider to manage real sessions.')} />
+    {:else}
       <div class="divide-y">
         {#each sessions as session (session.id)}
           <div class="flex items-center justify-between gap-4 py-3">
-            <div class="flex min-w-0 items-center gap-3">
-              <div class="rounded-lg bg-muted p-2 text-muted-foreground">
-                <session.Icon class="h-5 w-5" />
-              </div>
-              <div class="min-w-0 space-y-1">
-                <div class="flex flex-wrap items-center gap-2">
-                  <span class="text-sm font-medium">{session.os} - {session.browser}</span>
-                  {#if session.isCurrent}
-                    <span class="rounded bg-primary/10 px-1.5 py-0.5 text-[10px] font-semibold text-primary">{i18n.t('security.currentSession')}</span>
-                  {/if}
-                </div>
-                <div class="flex flex-wrap items-center gap-2 text-xs text-muted-foreground">
-                  <span>{session.ip}</span>
-                  <span>{session.lastActive}</span>
-                </div>
-              </div>
-            </div>
-            {#if !session.isCurrent}
-              <Button variant="ghost" size="icon-sm" onclick={() => revokeSession(session.id)} title={i18n.t('security.revokeSession')}>
-                <Trash2 class="h-4 w-4" />
-              </Button>
-            {/if}
+            <div class="flex min-w-0 items-center gap-3"><div class="rounded-lg bg-muted p-2 text-muted-foreground">{#if (session.os ?? '').toLowerCase().includes('ios') || (session.os ?? '').toLowerCase().includes('android')}<Smartphone class="h-5 w-5" />{:else}<Monitor class="h-5 w-5" />{/if}</div><div class="min-w-0 space-y-1"><div class="flex flex-wrap items-center gap-2"><span class="text-sm font-medium">{session.os ?? (isZh ? '未知系统' : 'Unknown OS')} - {session.browser ?? (isZh ? '未知浏览器' : 'Unknown browser')}</span>{#if session.current}<span class="rounded bg-primary/10 px-1.5 py-0.5 text-[10px] font-semibold text-primary">{i18n.t('security.currentSession')}</span>{/if}</div><div class="flex flex-wrap items-center gap-2 text-xs text-muted-foreground"><span>{session.ipAddress ?? '-'}</span><span>{session.lastActiveAt ? new Date(session.lastActiveAt).toLocaleString() : '-'}</span></div></div></div>
+            {#if !session.current}<Button variant="ghost" size="icon-sm" disabled={revoking !== null} onclick={() => revokeSession(session.id)} title={i18n.t('security.revokeSession')}><Trash2 class="h-4 w-4" /></Button>{/if}
           </div>
-        {:else}
-          <DataState state="empty" title={i18n.t('security.noSessions')} />
         {/each}
       </div>
+    {/if}
   </SettingsGroup>
 </div>

package/dist/components/SecuritySettings.svelte.d.ts

@@ -1,4 +1,3 @@
-import type { Component } from 'svelte';
-declare const SecuritySettings: Component<Record<string, never>, {}, "">;
+declare const SecuritySettings: import("svelte").Component<Record<string, never>, {}, "">;
 type SecuritySettings = ReturnType<typeof SecuritySettings>;
 export default SecuritySettings;

package/dist/components/account/SettingsEnterprisePage.svelte

@@ -1,4 +1,12 @@
 <script lang="ts">
+  import {
+    captureAdminContext,
+    notifyWithProvider,
+    type EnterpriseSecurityEvent,
+    type EnterpriseSecurityPolicy,
+    type IdentityProviderSummary,
+    type Organization,
+  } from '@svadmin/core';
   import { useTranslation } from '@svadmin/core/i18n';
   import { Button } from '../ui/button/index.js';
   import { Input } from '../ui/input/index.js';
@@ -10,38 +18,234 @@
   import SettingsGroup from '../content/SettingsGroup.svelte';
   import SettingsFieldRow from '../content/SettingsFieldRow.svelte';
   import IntegrationCard from '../content/IntegrationCard.svelte';
-  import type { IntegrationSummary } from '../content/IntegrationCard.svelte';
-  import SecurityEventTable from '../content/SecurityEventTable.svelte';
-  import type { SecurityEvent } from '../content/SecurityEventTable.svelte';
+  import SecurityEventTable, { type SecurityEvent } from '../content/SecurityEventTable.svelte';
+  import DataState from '../content/DataState.svelte';
+  import FeedbackNotice from '../content/FeedbackNotice.svelte';
+
   const i18n = useTranslation();
-  let ssoEnabled = $state(false);
-  let auditLogging = $state(true);
-  const identity: IntegrationSummary[] = [{ id: 'sso', name: 'Enterprise identity provider', description: i18n.t('account.ssoDescription'), account: 'SAML / OIDC', connected: false }];
-  const events: SecurityEvent[] = [{ id: '1', event: 'SSO policy updated', actor: 'Alex Chen', location: 'Shanghai, CN', createdAt: 'Today, 09:12', severity: 'info' }, { id: '2', event: 'Audit log retention changed', actor: 'Alex Chen', location: 'Shanghai, CN', createdAt: 'Yesterday, 16:40', severity: 'warning' }];
+  const adminContext = captureAdminContext();
+  const identityProvider = $derived(adminContext.identityGovernanceProvider);
+  const organizationProvider = $derived(adminContext.organizationProvider);
+  const isZh = $derived(i18n.locale === 'zh-CN');
+
+  let policy = $state<EnterpriseSecurityPolicy | null>(null);
+  let organization = $state<Organization | null>(null);
+  let organizationName = $state('');
+  let sessionTimeoutValue = $state('');
+  let auditRetentionValue = $state('');
+  let identityProviders = $state.raw<IdentityProviderSummary[]>([]);
+  let events = $state.raw<EnterpriseSecurityEvent[]>([]);
+  let metadataUrl = $state('');
+  let loading = $state(false);
+  let saving = $state(false);
+  let savingOrganization = $state(false);
+  let testing = $state(false);
+  let error = $state<string | null>(null);
+  let requestId = 0;
+  const organizationChanged = $derived(Boolean(
+    organizationProvider?.updateCurrentOrganization
+    && organization
+    && organizationName.trim()
+    && organizationName.trim() !== organization.name,
+  ));
+  const policyNumbersValid = $derived.by(() => {
+    const sessionTimeout = Number(sessionTimeoutValue);
+    const auditRetention = Number(auditRetentionValue);
+    return /^\d+$/.test(sessionTimeoutValue)
+      && /^\d+$/.test(auditRetentionValue)
+      && Number.isSafeInteger(sessionTimeout)
+      && Number.isSafeInteger(auditRetention)
+      && sessionTimeout > 0
+      && auditRetention > 0;
+  });
+
+  function message(error: unknown): string {
+    return error instanceof Error ? error.message : String(error);
+  }
+
+  async function loadSettings(): Promise<void> {
+    const currentRequest = ++requestId;
+    const scopedIdentityProvider = identityProvider;
+    const scopedOrganizationProvider = organizationProvider;
+    const context = adminContext.enterpriseRequestContext;
+    policy = null;
+    organization = null;
+    organizationName = '';
+    sessionTimeoutValue = '';
+    auditRetentionValue = '';
+    identityProviders = [];
+    events = [];
+    error = null;
+    loading = false;
+    saving = false;
+    savingOrganization = false;
+    testing = false;
+    if (!scopedIdentityProvider && !scopedOrganizationProvider) return;
+    loading = true;
+    try {
+      const [nextPolicy, nextIdentityProviders, nextEvents, nextOrganization] = await Promise.all([
+        scopedIdentityProvider?.getSecurityPolicy(context) ?? null,
+        scopedIdentityProvider?.listIdentityProviders(context) ?? [],
+        scopedIdentityProvider?.listSecurityEvents?.({ page: 1, pageSize: 20 }, context) ?? { data: [], total: 0 },
+        scopedOrganizationProvider?.getCurrentOrganization(context) ?? null,
+      ]);
+      if (currentRequest !== requestId) return;
+      policy = nextPolicy;
+      sessionTimeoutValue = nextPolicy ? String(nextPolicy.sessionTimeoutMinutes) : '';
+      auditRetentionValue = nextPolicy ? String(nextPolicy.auditRetentionDays) : '';
+      identityProviders = nextIdentityProviders;
+      events = nextEvents.data;
+      organization = nextOrganization;
+      organizationName = nextOrganization?.name ?? '';
+      metadataUrl = nextIdentityProviders[0]?.metadataUrl ?? '';
+    } catch (caught) {
+      if (currentRequest === requestId) error = message(caught);
+    } finally {
+      if (currentRequest === requestId) loading = false;
+    }
+  }
+
+  $effect(() => {
+    void identityProvider;
+    void organizationProvider;
+    void adminContext.tenantCacheKey?.__svadminTenant;
+    void loadSettings();
+    return () => { requestId += 1; };
+  });
+
+  async function saveSettings(): Promise<void> {
+    const provider = identityProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    if (!provider || !policy || !policyNumbersValid) return;
+    saving = true;
+    try {
+      const updatedPolicy = await provider.updateSecurityPolicy({
+        ...policy,
+        sessionTimeoutMinutes: Number(sessionTimeoutValue),
+        auditRetentionDays: Number(auditRetentionValue),
+      }, context);
+      if (currentRequest !== requestId) return;
+      policy = updatedPolicy;
+      sessionTimeoutValue = String(updatedPolicy.sessionTimeoutMinutes);
+      auditRetentionValue = String(updatedPolicy.auditRetentionDays);
+      notifyWithProvider({ type: 'success', message: isZh ? '企业策略已保存' : 'Enterprise policy saved' }, adminContext.notificationProvider);
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) saving = false;
+    }
+  }
+
+  async function saveOrganization(): Promise<void> {
+    const provider = organizationProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    const name = organizationName.trim();
+    if (!provider?.updateCurrentOrganization || !organization || !name || name === organization.name) return;
+    savingOrganization = true;
+    try {
+      const updatedOrganization = await provider.updateCurrentOrganization({ name }, context);
+      if (currentRequest !== requestId) return;
+      organization = updatedOrganization;
+      organizationName = updatedOrganization.name;
+      notifyWithProvider({ type: 'success', message: isZh ? '组织信息已保存' : 'Organization saved' }, adminContext.notificationProvider);
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) savingOrganization = false;
+    }
+  }
+
+  async function testConnection(target?: IdentityProviderSummary): Promise<void> {
+    const provider = identityProvider;
+    const currentRequest = requestId;
+    const context = adminContext.enterpriseRequestContext;
+    if (!provider) return;
+    testing = true;
+    try {
+      const selectedProvider = target ?? identityProviders[0];
+      const result = await provider.testIdentityProvider({
+        id: selectedProvider?.id,
+        protocol: selectedProvider?.protocol,
+        metadataUrl: target
+          ? target.metadataUrl
+          : (metadataUrl.trim() || selectedProvider?.metadataUrl),
+      }, context);
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({
+        type: result.success ? 'success' : 'error',
+        message: result.success
+          ? (isZh ? '身份源连接测试通过' : 'Identity provider connection succeeded')
+          : (result.error?.message ?? (isZh ? '身份源连接测试失败' : 'Identity provider connection failed')),
+      }, adminContext.notificationProvider);
+    } catch (caught) {
+      if (currentRequest !== requestId) return;
+      notifyWithProvider({ type: 'error', message: message(caught) }, adminContext.notificationProvider);
+    } finally {
+      if (currentRequest === requestId) testing = false;
+    }
+  }
+
+  const displayEvents = $derived(events.map((event): SecurityEvent => ({
+    id: event.id,
+    event: event.event,
+    actor: event.actor,
+    location: event.location,
+    createdAt: event.createdAt instanceof Date ? event.createdAt.toLocaleString() : String(event.createdAt),
+    severity: event.severity === 'critical' ? 'danger' : (event.severity ?? 'info'),
+  })));
 </script>
 
 {#snippet auditControl()}
-  <Switch bind:checked={auditLogging} aria-label={i18n.t('account.auditLogging')} />
+  <Switch checked={policy?.auditLoggingEnabled ?? false} disabled={!policy || saving} aria-label={i18n.t('account.auditLogging')} onCheckedChange={(checked) => { if (policy) policy = { ...policy, auditLoggingEnabled: checked }; }} />
 {/snippet}
 
 {#snippet ssoControl()}
-  <Switch bind:checked={ssoEnabled} aria-label={i18n.t('account.enableSso')} />
+  <Switch checked={policy?.requireSso ?? false} disabled={!policy || saving} aria-label={i18n.t('account.enableSso')} onCheckedChange={(checked) => { if (policy) policy = { ...policy, requireSso: checked }; }} />
 {/snippet}
 
 <ContentPageShell pageId="account-settings-enterprise" width="wide">
   <ContentPageHeader title={i18n.t('account.settingsEnterprise')} description={i18n.t('account.settingsEnterpriseDescription')} />
-  <div class="grid items-start gap-4 lg:grid-cols-2">
-    <SettingsGroup title={i18n.t('account.securityPolicy')} description="Set organization-wide controls for authentication and sessions." bodyClass="space-y-4">
-      <div class="grid gap-4 sm:grid-cols-2"><div class="space-y-2"><Label for="session-timeout">{i18n.t('account.sessionTimeout')}</Label><Input id="session-timeout" value="30" /></div><div class="space-y-2"><Label for="retention">{i18n.t('account.dataRetention')}</Label><Input id="retention" value="365" /></div></div>
-      <SettingsFieldRow label={i18n.t('account.auditLogging')} description="Preserve an auditable record of organization-level changes." control={auditControl} separated />
-      <Button size="sm">{i18n.t('common.save')}</Button>
-    </SettingsGroup>
-    <SettingsGroup title={i18n.t('account.singleSignOn')} description={i18n.t('account.ssoDescription')} bodyClass="space-y-4">
-      <SettingsFieldRow label={i18n.t('account.enableSso')} description="Require the configured identity provider for organization members." control={ssoControl} />
-      <Input value="https://idp.example.com/metadata" aria-label={i18n.t('account.ssoProvider')} />
-      <Button variant="outline" size="sm">{i18n.t('common.test')}</Button>
-    </SettingsGroup>
-  </div>
-  <section class="space-y-3"><SectionHeader title={i18n.t('account.connections')} />{#each identity as integration (integration.id)}<IntegrationCard {integration} />{/each}</section>
-  <section class="space-y-3"><SectionHeader title={i18n.t('account.securityLog')} /><SecurityEventTable events={events} emptyTitle={i18n.t('common.noData')} emptyDescription={i18n.t('empty.description')} /></section>
+  {#if !identityProvider}
+    <FeedbackNotice tone="warning" message={isZh ? '未配置 IdentityGovernanceProvider。企业策略、SSO 测试和安全事件保持不可用，不会伪造保存结果。' : 'IdentityGovernanceProvider is not configured. Enterprise policy, SSO tests, and security events remain unavailable instead of simulating persistence.'} />
+  {/if}
+  {#if loading}
+    <DataState state="loading" />
+  {:else if error}
+    <DataState state="error" title={isZh ? '企业设置加载失败' : 'Enterprise settings failed to load'} description={error} retry={loadSettings} />
+  {:else}
+    <div class="grid items-start gap-4 lg:grid-cols-2">
+      <SettingsGroup title={i18n.t('account.securityPolicy')} description={isZh ? '配置组织级身份、会话与审计策略。' : 'Configure organization-wide identity, session, and audit controls.'} bodyClass="space-y-4">
+        {#if organizationProvider}
+          <div class="space-y-2"><Label for="organization-name">{isZh ? '组织名称' : 'Organization name'}</Label><div class="flex gap-2"><Input id="organization-name" bind:value={organizationName} disabled={!organizationProvider.updateCurrentOrganization || savingOrganization} /><Button variant="outline" size="sm" disabled={!organizationChanged || savingOrganization} onclick={saveOrganization}>{savingOrganization ? (isZh ? '保存中...' : 'Saving...') : i18n.t('common.save')}</Button></div></div>
+        {/if}
+        <div class="grid gap-4 sm:grid-cols-2">
+          <div class="space-y-2"><Label for="session-timeout">{i18n.t('account.sessionTimeout')}</Label><Input id="session-timeout" type="number" min="1" step="1" bind:value={sessionTimeoutValue} disabled={!policy || saving} /></div>
+          <div class="space-y-2"><Label for="retention">{i18n.t('account.dataRetention')}</Label><Input id="retention" type="number" min="1" step="1" bind:value={auditRetentionValue} disabled={!policy || saving} /></div>
+        </div>
+        {#if policy && !policyNumbersValid}<FeedbackNotice tone="warning" message={isZh ? '会话超时和审计保留天数必须为正整数。' : 'Session timeout and audit retention must be positive integers.'} />{/if}
+        <SettingsFieldRow label={i18n.t('account.auditLogging')} description={isZh ? '由后端持久化组织级审计策略。' : 'Persist the organization audit policy through the backend provider.'} control={auditControl} separated />
+        <Button size="sm" disabled={!identityProvider || !policy || !policyNumbersValid || saving} onclick={saveSettings}>{saving ? (isZh ? '保存中...' : 'Saving...') : i18n.t('common.save')}</Button>
+      </SettingsGroup>
+      <SettingsGroup title={i18n.t('account.singleSignOn')} description={i18n.t('account.ssoDescription')} bodyClass="space-y-4">
+        <SettingsFieldRow label={i18n.t('account.enableSso')} description={isZh ? '启用后由已配置身份源执行组织登录策略。' : 'Require the configured identity provider for organization members.'} control={ssoControl} />
+        <Input bind:value={metadataUrl} placeholder="https://idp.example.com/.well-known/openid-configuration" aria-label={i18n.t('account.ssoProvider')} disabled={!identityProvider || testing} />
+        <Button variant="outline" size="sm" disabled={!identityProvider || testing} onclick={() => testConnection()}>{testing ? (isZh ? '测试中...' : 'Testing...') : i18n.t('common.test')}</Button>
+      </SettingsGroup>
+    </div>
+    <section class="space-y-3">
+      <SectionHeader title={i18n.t('account.connections')} />
+      {#if identityProviders.length === 0}
+        <DataState state="empty" title={isZh ? '尚未配置身份源' : 'No identity provider configured'} description={isZh ? '请在后端 IdentityGovernanceProvider 中创建并验证身份源。' : 'Create and verify an identity provider through the backend IdentityGovernanceProvider.'} />
+      {:else}
+        {#each identityProviders as connection (connection.id)}
+          <IntegrationCard integration={{ id: connection.id, name: connection.name, account: connection.protocol.toUpperCase(), connected: connection.status === 'connected', description: connection.domain ?? connection.metadataUrl }} onconnect={() => testConnection(connection)} />
+        {/each}
+      {/if}
+    </section>
+    <section class="space-y-3"><SectionHeader title={i18n.t('account.securityLog')} /><SecurityEventTable events={displayEvents} emptyTitle={i18n.t('common.noData')} emptyDescription={isZh ? '当前 Provider 未返回安全事件。' : 'The provider returned no security events.'} /></section>
+  {/if}
 </ContentPageShell>

package/dist/components/account/SettingsSidebarPage.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { captureAdminContext } from '@svadmin/core';
   import { useTranslation } from '@svadmin/core/i18n';
   import { Button } from '../ui/button/index.js';
   import { Input } from '../ui/input/index.js';
@@ -7,7 +8,11 @@
   import ContentPageHeader from '../content/ContentPageHeader.svelte';
   import SettingsGroup from '../content/SettingsGroup.svelte';
   import SettingsFieldRow from '../content/SettingsFieldRow.svelte';
+  import FeedbackNotice from '../content/FeedbackNotice.svelte';
   const i18n = useTranslation();
+  const adminContext = captureAdminContext();
+  const credentialProvider = $derived(adminContext.credentialProvider);
+  const isZh = $derived(i18n.locale === 'zh-CN');
   const sections = [{ id: 'profile', title: i18n.t('account.basicSettings') }, { id: 'signin', title: i18n.t('account.socialSignIn') }, { id: 'preferences', title: i18n.t('account.preferences') }, { id: 'api', title: i18n.t('account.manageApi') }];
   let active = $state('profile');
   let visible = $state(true);
@@ -41,7 +46,13 @@
       {:else if active === 'preferences'}
         <SettingsGroup title={i18n.t('account.preferences')} bodyClass="grid gap-4 sm:grid-cols-3"><Input value="English" aria-label={i18n.t('account.language')} /><Input value="Asia/Shanghai" aria-label={i18n.t('account.timezone')} /><Input value="CNY" aria-label={i18n.t('account.currency')} /></SettingsGroup>
       {:else}
-        <SettingsGroup title={i18n.t('account.manageApi')} description="Use scoped credentials and rotate them when access changes." bodyClass="flex flex-col gap-3 sm:flex-row"><Input readonly value="sv_demo_pub_9f3e********41ab" aria-label="API key" /><Button variant="outline">{i18n.t('common.copy')}</Button></SettingsGroup>
+        <SettingsGroup title={i18n.t('account.manageApi')} description={isZh ? '使用有作用域的真实凭据，并在权限变更时轮换。' : 'Use scoped credentials and rotate them when access changes.'} bodyClass="space-y-3">
+          {#if credentialProvider}
+            <Button variant="outline" onclick={() => void adminContext.navigate('/settings/api')}>{isZh ? '打开 API 凭据管理' : 'Open API credential management'}</Button>
+          {:else}
+            <FeedbackNotice tone="warning" message={isZh ? '未配置 CredentialProvider，不会显示或生成演示密钥。' : 'CredentialProvider is not configured. No demo credential is displayed or generated.'} />
+          {/if}
+        </SettingsGroup>
       {/if}
     </div>
   </div>