openxiangda 1.0.132 → 1.0.134

package/README.md

@@ -108,6 +108,9 @@ openxiangda auth-config methods --json
 openxiangda function invoke submit_public_registration --body-json '{"input":{}}'
 openxiangda connector invoke sms.sendCode --body-json '{"body":{"phone":"13800000000"}}'
 openxiangda notification preview public_register_notice --body-json '{"payload":{"title":"测试"}}'
+openxiangda organization capabilities --profile dev --json
+openxiangda organization department-list --profile dev --json
+openxiangda organization account-list --profile dev --keyword alice --json
 openxiangda permission snapshot --form-codes customer,orders --json
 openxiangda permission audit --json
 ```
@@ -306,7 +309,49 @@ const PublicAccessError = ({ error }: { error: { message?: string } }) => (
 
 多表只读查询和固定口径统计优先声明 `src/resources/data-views/*.json` 数据视图，而不是在页面里手写多次单表查询再拼数据。默认 `storageMode: "materialized"` 会创建 PostgreSQL materialized view，适合读多写少和可接受刷新延迟的列表/报表；`storageMode: "live"` 每次查询实时编译逻辑视图，适合强实时但数据量可控的复杂查询。`viewType: "aggregate"` 是统计聚合视图，适合按客户、状态、月份等维度聚合 count/sum/avg/min/max。发布时 CLI 会把 `formCode` 解析为当前 profile 的 `formUuid`；页面通过 `sdk.dataView.query(code, params)` 查询行级视图，通过 `sdk.dataView.stats(code, params)` 查询聚合视图，也可以用 `sdk.dataSource.run()` 路由 `dataView.query` / `dataView.stats`。materialized 模式应为常用筛选、排序、统计维度和时间桶声明 `indexes`，并确认用户能接受的刷新延迟；live 模式忽略 `indexes`，不需要刷新。
 
-后端业务逻辑优先声明为 App Function：源码放在 `src/functions/<functionCode>/index.ts`，资源 manifest 放在 `src/resources/functions/<functionCode>.json`。函数运行在 trusted_node 中，通过 `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`、`ctx.dataView`、`ctx.connector`、`ctx.notification`、`ctx.platform.api` 等受控 API 访问平台能力；自动化、流程和运行时接口都可以调用同一个 function。运行时页面调用会在 `ctx.operator`、`ctx.currentUser`、`ctx.permissions` 中注入可信的 `roleCodes`、`currentRoleCode`、`hasFullAccess`、`isAppAdmin`、`isPlatformAdmin`，敏感动作必须读取这些服务端上下文做授权，不要信任页面 input 里传入的角色字段。`ctx.form.createOne/updateOne/updateById` 是后端受控写入，授权边界是函数 manifest 的 `resources.forms` 绑定和函数调用授权，不是页面用户对目标表单的直接提交入口；报名、签到、福利选择等内部多表写入应走 App Function，不要为了写内部表单给普通用户开放原始 submit 权限。JS_CODE V2 仍兼容，但新逻辑建议写成 function，再由 `function_call` 节点、`sdk.function.invoke(code, { input })` 或 `/:appType/v1/functions/:code/invoke.json` 调用。直接运行时接口默认要求调用者具备应用自动化管理权限；如果普通应用角色需要从页面调用，必须在函数 `definitionJson.runtimeInvoke.roleCodes` 显式声明允许的当前应用角色。自动化/流程内部调用走服务端受控上下文。
+后端业务逻辑优先声明为 App Function：源码放在 `src/functions/<functionCode>/index.ts`，资源 manifest 放在 `src/resources/functions/<functionCode>.json`。函数运行在 trusted_node 中，通过 `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`、`ctx.dataView`、`ctx.connector`、`ctx.notification`、`ctx.organization`、`ctx.platform.api` 等受控 API 访问平台能力；自动化、流程和运行时接口都可以调用同一个 function。运行时页面调用会在 `ctx.operator`、`ctx.currentUser`、`ctx.permissions` 中注入可信的 `roleCodes`、`currentRoleCode`、`hasFullAccess`、`isAppAdmin`、`isPlatformAdmin`，敏感动作必须读取这些服务端上下文做授权，不要信任页面 input 里传入的角色字段。`ctx.form.createOne/updateOne/updateById` 是后端受控写入，授权边界是函数 manifest 的 `resources.forms` 绑定和函数调用授权，不是页面用户对目标表单的直接提交入口；报名、签到、福利选择等内部多表写入应走 App Function，不要为了写内部表单给普通用户开放原始 submit 权限。JS_CODE V2 仍兼容，但新逻辑建议写成 function，再由 `function_call` 节点、`sdk.function.invoke(code, { input })` 或 `/:appType/v1/functions/:code/invoke.json` 调用。直接运行时接口默认要求调用者具备应用自动化管理权限；如果普通应用角色需要从页面调用，必须在函数 `definitionJson.runtimeInvoke.roleCodes` 显式声明允许的当前应用角色。自动化/流程内部调用走服务端受控上下文。
+
+平台部门和账号管理走 app-scoped organization 能力。调用者必须在目标应用拥有 `app:organization:manage`；平台管理员天然可用，普通应用角色需要显式授权。Runtime service principal 不会直接放行，`ctx.organization` 会按真实操作人 / audit actor 校验权限。新接口只提供创建、更新、查询和密码专用操作，不提供删除；`account-update` 不能携带 `password`，重置他人密码必须走 `account-reset-password`，当前用户改密用 SDK / `ctx.organization.accounts.changeMyPassword({ oldPassword, newPassword })`。
+
+CLI 写操作必须加 `--force`：
+
+```bash
+openxiangda organization capabilities --profile dev --json
+openxiangda organization department-list --profile dev --json
+openxiangda organization department-create --profile dev --body-json '{"name":"销售部","parentId":"dept-root"}' --force
+openxiangda organization department-update dept-sales --profile dev --body-json '{"name":"华东销售部"}' --force
+openxiangda organization account-list --profile dev --keyword alice --page 1 --page-size 20 --json
+openxiangda organization account-create --profile dev --body-json '{"id":"user-alice","username":"alice","password":"P@ssw0rd","name":"Alice","departmentIds":["dept-sales"],"affiliatedDepartmentId":"dept-sales"}' --force
+openxiangda organization account-update user-alice --profile dev --body-json '{"name":"Alice Chen","departmentIds":["dept-sales"]}' --force
+openxiangda organization account-reset-password user-alice --profile dev --body-json '{"newPassword":"NewP@ssw0rd"}' --force
+```
+
+页面 SDK 和 App Function 使用同一套后端权限：
+
+```ts
+const capabilities = await sdk.organization.capabilities()
+if (!capabilities.result?.canManage) {
+  throw new Error("当前账号没有组织账号管理权限")
+}
+
+await sdk.organization.departments.create({
+  name: "销售部",
+  parentId: "dept-root",
+})
+
+await sdk.organization.accounts.create({
+  id: "user-alice",
+  username: "alice",
+  password: initialPassword,
+  name: "Alice",
+  departmentIds: ["dept-sales"],
+})
+
+// App Function / trusted JS uses ctx.organization with the same permission check.
+await ctx.organization.accounts.resetPassword("user-alice", {
+  newPassword,
+})
+```
 
 应用登录能力通过 auth resource 和 runtime SDK 提供：登录配置放在 `src/resources/auth/<code>.json`，默认 React SPA 模板已包含 `/view/:appType/login`，自定义页面可使用 `createAuthClient({ appType, servicePrefix })` 或 `LoginPage` / `useAuth` from `openxiangda/runtime/react`。手机号验证码、CAS/SSO 或其他外部登录可以由 App Function provider 校验外部凭证，但 provider 只能返回 `phone` / `email` / `externalId` / `unionId` 等身份声明；平台后端按 auth resource 策略执行账号匹配、绑定、创建或拒绝，并由平台统一签发 token/cookie。默认注册策略是拒绝，开启自动注册或白名单注册前必须确认身份匹配键、默认角色、验证码 TTL/频率/失败次数、审计字段和错误文案策略。
 

package/lib/cli.js

@@ -86,6 +86,7 @@ async function main(argv) {
   if (command === 'function') return appFunction(rest);
   if (command === 'connector') return connector(rest);
   if (command === 'notification') return notification(rest);
+  if (command === 'organization') return organization(rest);
   if (command === 'permission') return permission(rest);
   if (command === 'settings') return settings(rest);
   if (command === 'resource') return resource(rest);
@@ -150,6 +151,7 @@ Usage:
   openxiangda function list|get|create|update|upsert|delete|invoke [--json-file file]
   openxiangda connector list|get|create|update|upsert|delete|invoke|download-test [--json-file file]
   openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send
+  openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password
   openxiangda permission role-list|role-create|role-update|role-delete|role-bind|snapshot|audit
   openxiangda permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind
   openxiangda permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind
@@ -2955,10 +2957,13 @@ async function notification(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
+      '用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send|capabilities|dingding-preview|dingding-send',
       '  preview <notificationType|templateCode> [--form-code code|--form-uuid FORM_XXX] --body-json \'{"payload":{"title":"测试"}}\'',
       '  send <notificationType> --body-json \'{"recipientId":"USER_ID","payload":{"title":"测试"}}\' --force',
       '  batch-send <notificationType> --body-json \'{"recipients":[{"recipientId":"USER_ID","payload":{}}]}\' --force',
+      '  capabilities --json',
+      '  dingding-preview <notificationType> [--template-code code|--template-id id] --body-json \'{"payload":{"title":"测试"}}\'',
+      '  dingding-send <notificationType> --body-json \'{"recipientId":"USER_ID","payload":{"title":"测试"}}\' --force',
     ].join('\n'));
     return;
   }
@@ -3053,6 +3058,27 @@ async function notification(args) {
       path: apiPathWithPostDeleteAction(`${appPrefix}/type-configs/${encodeURIComponent(code)}`),
     });
   }
+  if (subcommand === 'capabilities') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/dingtalk/capabilities`,
+      strictEnvelope: true,
+    });
+  }
+  if (subcommand === 'dingding-preview' || subcommand === 'dingding-send') {
+    if (subcommand === 'dingding-send' && !flags.force) {
+      fail('openxiangda notification dingding-send 是发送动作，必须加 --force');
+    }
+    const code = positional[0] || flags.code;
+    const rawBody = readDirectJsonBody(flags, `notification ${subcommand}`, { optional: true });
+    const body = buildDingTalkNotificationActionBody(target, code, rawBody, flags);
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/dingtalk/${subcommand === 'dingding-send' ? 'send' : 'preview'}`,
+      body,
+      strictEnvelope: true,
+    });
+  }
   if (['preview', 'send', 'batch-send'].includes(subcommand)) {
     if ((subcommand === 'send' || subcommand === 'batch-send') && !flags.force) {
       fail(`openxiangda notification ${subcommand} 是发送动作，必须加 --force`);
@@ -3077,7 +3103,170 @@ async function notification(args) {
     });
   }
 
-  fail('用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send');
+  fail('用法: openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send|capabilities|dingding-preview|dingding-send');
+}
+
+async function organization(args) {
+  const { subcommand, rest } = parseSubcommandArgs(args);
+  const { flags, positional } = parseArgs(rest);
+  if (wantsSubcommandHelp(subcommand, flags)) {
+    print([
+      '用法: openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password',
+      '  capabilities --json',
+      '  department-list --json',
+      '  department-get <departmentId> --json',
+      '  department-create --body-json \'{"name":"销售部"}\' --force',
+      '  department-update <departmentId> --body-json \'{"name":"华东销售"}\' --force',
+      '  account-list [--keyword text|--department-ids id1,id2] --json',
+      '  account-get <userId> --json',
+      '  account-create --body-json \'{"username":"u1","password":"P@ssw0rd","name":"张三"}\' --force',
+      '  account-update <userId> --body-json \'{"name":"张三"}\' --force',
+      '  account-reset-password <userId> --body-json \'{"newPassword":"P@ssw0rd"}\' --force',
+    ].join('\n'));
+    return;
+  }
+
+  const config = loadConfig();
+  const target = getWorkspaceTarget(config, flags.profile || config.currentProfile, flags);
+  const appPrefix = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/organization`;
+
+  if (subcommand === 'capabilities') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/capabilities`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/departments`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-get') {
+    const departmentId = positional[0] || flags['department-id'] || flags.id;
+    if (!departmentId) fail('用法: openxiangda organization department-get <departmentId>');
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/departments/${encodeURIComponent(departmentId)}`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-create') {
+    if (!flags.force) fail('openxiangda organization department-create 是写操作，必须加 --force');
+    const body = readDirectJsonBody(flags, 'organization department-create');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/departments`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'department-update') {
+    if (!flags.force) fail('openxiangda organization department-update 是写操作，必须加 --force');
+    const departmentId = positional[0] || flags['department-id'] || flags.id;
+    if (!departmentId) fail('用法: openxiangda organization department-update <departmentId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization department-update');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/departments/${encodeURIComponent(departmentId)}`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: apiPathWithQuery(`${appPrefix}/accounts`, {
+        ids: flags.ids,
+        departmentIds: flags['department-ids'],
+        keyword: flags.keyword,
+        name: flags.name,
+        username: flags.username,
+        phone: flags.phone,
+        email: flags.email,
+        jobNumber: flags['job-number'],
+        page: flags.page,
+        pageSize: flags['page-size'] || flags.limit,
+      }),
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-get') {
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-get <userId>');
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}`,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-create') {
+    if (!flags.force) fail('openxiangda organization account-create 是写操作，必须加 --force');
+    const body = readDirectJsonBody(flags, 'organization account-create');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-update') {
+    if (!flags.force) fail('openxiangda organization account-update 是写操作，必须加 --force');
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-update <userId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization account-update');
+    if (Object.prototype.hasOwnProperty.call(body || {}, 'password')) {
+      fail('account-update 不允许包含 password，请使用 account-reset-password');
+    }
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  if (subcommand === 'account-reset-password') {
+    if (!flags.force) fail('openxiangda organization account-reset-password 是密码写操作，必须加 --force');
+    const userId = positional[0] || flags['user-id'] || flags.id;
+    if (!userId) fail('用法: openxiangda organization account-reset-password <userId> --body-json ... --force');
+    const body = readDirectJsonBody(flags, 'organization account-reset-password');
+    if (!body.newPassword) fail('account-reset-password body 缺少 newPassword');
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${appPrefix}/accounts/${encodeURIComponent(userId)}/password/reset`,
+      body,
+      strictEnvelope: true,
+    });
+  }
+
+  fail('用法: openxiangda organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password');
+}
+
+function buildDingTalkNotificationActionBody(target, code, rawBody = {}, flags = {}) {
+  const body = { ...(rawBody || {}) };
+  if (flags['template-code'] && !body.templateCode) body.templateCode = flags['template-code'];
+  if (flags['template-id'] && !body.templateId) body.templateId = flags['template-id'];
+  if (code && !body.notificationType && !body.templateCode && !body.templateId && !body.code) {
+    body.notificationType = code;
+  }
+  const formUuid =
+    body.formUuid ||
+    flags['form-uuid'] ||
+    resolveOptionalFormUuid(target.bound, body.formCode || flags['form-code']);
+  if (formUuid) body.formUuid = formUuid;
+  delete body.formCode;
+  return body;
 }
 
 async function normalizeNotificationPreviewBody(config, target, code, rawBody = {}, flags = {}) {
@@ -4570,6 +4759,7 @@ async function commands(args) {
       'function list|get|create|update|upsert|delete|invoke',
       'connector list|get|create|update|upsert|delete|invoke|download-test',
       'notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
+      'organization capabilities|department-list|department-get|department-create|department-update|account-list|account-get|account-create|account-update|account-reset-password',
       'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|snapshot|audit',
       'permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind',
       'permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions',
@@ -6382,6 +6572,13 @@ function validateNotificationChannels(label, channelsConfig, errors) {
       errors.push(`${label}: 不支持的通知渠道 ${channel}`);
     }
     validateNoSensitiveNotificationConfig(`${label}.channelsConfig.${channel}`, config, errors);
+    if (channel === 'dingding') {
+      validateDingTalkNotificationConfig(
+        `${label}.channelsConfig.${channel}`,
+        config,
+        errors
+      );
+    }
   }
 }
 
@@ -6396,6 +6593,62 @@ function validateNoSensitiveNotificationConfig(label, value, errors) {
   }
 }
 
+function validateDingTalkNotificationConfig(label, value, errors) {
+  const config = value?.config || {};
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return;
+  if (
+    config.deliveryMode !== undefined &&
+    !['card_preferred', 'card_only', 'work_notice_only'].includes(
+      String(config.deliveryMode)
+    )
+  ) {
+    errors.push(`${label}.config.deliveryMode: 只能是 card_preferred、card_only 或 work_notice_only`);
+  }
+  const card = config.card || {};
+  if (card && typeof card === 'object' && !Array.isArray(card)) {
+    if (
+      card.mode !== undefined &&
+      !['standard', 'custom'].includes(String(card.mode))
+    ) {
+      errors.push(`${label}.config.card.mode: 只能是 standard 或 custom`);
+    }
+    if (
+      card.mode === 'custom' &&
+      card.paramMap !== undefined &&
+      (!card.paramMap ||
+        typeof card.paramMap !== 'object' ||
+        Array.isArray(card.paramMap))
+    ) {
+      errors.push(`${label}.config.card.paramMap: custom 卡片 paramMap 必须是对象`);
+    }
+    if (
+      card.fieldConfigs !== undefined &&
+      !Array.isArray(card.fieldConfigs)
+    ) {
+      errors.push(`${label}.config.card.fieldConfigs: 必须是数组`);
+    }
+  }
+}
+
+function resolveNotificationChannelEnvReferences(value) {
+  if (!value || typeof value !== 'object') return value;
+  if (Array.isArray(value)) {
+    return value.map(item => resolveNotificationChannelEnvReferences(item));
+  }
+  const next = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (
+      ['cardTemplateId', 'dingTalkTemplateId'].includes(key) &&
+      isEnvReference(item)
+    ) {
+      next[key] = resolveEnvReference(item, `DingTalk ${key}`);
+    } else {
+      next[key] = resolveNotificationChannelEnvReferences(item);
+    }
+  }
+  return next;
+}
+
 function resourceLabel(kind, item) {
   return `${kind}:${item.code || item.__source || item.__index || '?'}`;
 }
@@ -7634,13 +7887,13 @@ async function publishAutomationResources(config, target, automations, result, o
 
 async function publishFunctionResources(config, target, functions, result, options = {}) {
   for (const functionItem of functions) {
-    const code = functionItem.code || functionItem.functionCode;
+    const code = functionItem.code || functionItem.functionCode || functionItem.resourceCode;
     if (shouldSkipNoopResource(options, 'function', code)) {
       recordNoopResource(result, 'function', code, options);
       continue;
     }
     const existing = await findExistingFunction(config, target, code);
-    const definitionJson = await resolveManifestJson(
+    let definitionJson = await resolveManifestJson(
       config,
       target.profileName,
       functionItem,
@@ -7648,6 +7901,7 @@ async function publishFunctionResources(config, target, functions, result, optio
       'definitionFile'
     );
     applyResourceBindingsToRuntimeDefinition(target.bound, functionItem, definitionJson);
+    definitionJson = normalizeFunctionDefinitionJson(functionItem, definitionJson);
     const body = stripUndefinedValues({
       code,
       name: functionItem.name || definitionJson.name || code,
@@ -9189,7 +9443,9 @@ function normalizeNotificationTemplateManifest(bound, template) {
     name: template.name || template.code,
     content: template.content || '',
     description: template.description || '',
-    channelsConfig: template.channelsConfig,
+    channelsConfig: resolveNotificationChannelEnvReferences(
+      template.channelsConfig
+    ),
     level,
     formUuid,
     priority: template.priority,
@@ -9970,21 +10226,44 @@ function automationEquals(target, desired, existing) {
 
 function functionEquals(target, desired, existing) {
   if (!existing) return false;
-  const desiredDefinition = resolveManifestPlainJson(desired, 'definitionJson', 'definitionFile');
+  let desiredDefinition = resolveManifestPlainJson(desired, 'definitionJson', 'definitionFile');
   applyResourceBindingsToRuntimeDefinition(target.bound, desired, desiredDefinition);
+  desiredDefinition = normalizeFunctionDefinitionJson(desired, desiredDefinition);
   const desiredStatus = desired.status === undefined ? 'active' : String(desired.status || 'active');
+  const existingResourceBindings =
+    existing.resourceBindings ??
+    existing.resourceBindingsJson ??
+    existing.definitionJson?.resourceBindings ??
+    {};
   return (
-    String(existing.code || existing.functionCode || existing.resourceCode || '') === String(desired.code || desired.functionCode || '') &&
+    String(existing.code || existing.functionCode || existing.resourceCode || '') === String(desired.code || desired.functionCode || desired.resourceCode || '') &&
     String(existing.name || '') === String(desired.name || desiredDefinition.name || desired.code || '') &&
     String(existing.description || '') === String(
       desired.description !== undefined ? desired.description : desiredDefinition.description || ''
     ) &&
     jsonEqualsForPlan(existing.definitionJson, desiredDefinition, desired.__dir) &&
-    jsonEqualsForPlan(existing.resourceBindings || {}, desiredDefinition.resourceBindings || {}, desired.__dir) &&
+    jsonEqualsForPlan(existingResourceBindings, desiredDefinition.resourceBindings || {}, desired.__dir) &&
     String(existing.status || 'active') === desiredStatus
   );
 }
 
+function normalizeFunctionDefinitionJson(functionItem, definitionJson) {
+  const definition = clonePlainJson(definitionJson || {});
+  const functionCode =
+    definition.functionCode ||
+    functionItem.functionCode ||
+    functionItem.resourceCode ||
+    functionItem.code;
+  return stripUndefinedValues({
+    ...definition,
+    kind: definition.kind || 'app_function',
+    version: definition.version || 'function_v1',
+    ...(functionCode ? { functionCode: String(functionCode) } : {}),
+    runtimeMode: definition.runtimeMode || 'trusted_node',
+    sourceType: definition.sourceType || 'file_snapshot',
+  });
+}
+
 function authConfigEquals(desired, existing) {
   if (!existing) return false;
   const expected = normalizeAuthConfigManifest(desired);

package/openxiangda-skills/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openxiangda
-description: "Use OpenXiangda for any private low-code platform or sy-lowcode-app-workspace work: architecture design, app creation, forms, pages, resources, workflows, automations, JS_CODE, permissions, data views, connectors, notifications, publishing, deployment, diagnosis, feedback, profile/login state, and CLI commands. Trigger on OpenXiangda, 享搭, 私有化低代码, 低代码平台, .openxiangda/state.json, app-workspace.config.ts, or openxiangda CLI usage."
+description: "Use OpenXiangda for any private low-code platform or sy-lowcode-app-workspace work: architecture design, app creation, forms, pages, resources, workflows, automations, JS_CODE, permissions, organization/account management, data views, connectors, notifications, publishing, deployment, diagnosis, feedback, profile/login state, and CLI commands. Trigger on OpenXiangda, 享搭, 私有化低代码, 低代码平台, .openxiangda/state.json, app-workspace.config.ts, or openxiangda CLI usage."
 ---
 
 # OpenXiangda
@@ -30,6 +30,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 | App Function / function_call / 可复用后端逻辑            | `openxiangda-workflow-automation`                                                          | declare `src/resources/functions/<code>.json` + `src/functions/<code>/index.ts`                                                                          |
 | 应用登录 / Auth SDK / 手机号验证码 / CAS / 钉钉免登      | `openxiangda-architecture-design` + `openxiangda-page`                                     | design security gate first, then declare `src/resources/auth/<code>.json` and use `createAuthClient` / `LoginPage`                                       |
 | 角色 / 权限组 / 字段权限 / 数据范围                      | `openxiangda-permission-settings`                                                          | `openxiangda permission ...` / `openxiangda settings ...`                                                                                                |
+| 平台部门 / 平台账号 / 重置密码 / 组织账号管理            | `openxiangda-architecture-design` + `openxiangda-page`                                     | check `openxiangda organization capabilities --json`; use `sdk.organization` / `ctx.organization` only after `app:organization:manage` is granted         |
 | 外部人员无需登录访问 / 公开报名 / 公开查询 / public page | `openxiangda-architecture-design` + `openxiangda-permission-settings` + `openxiangda-page` | 先确认公开范围、外部角色、ticket、grants；再声明 `routes` + `public-access`，并用 `OpenXiangdaProvider` + `OpenXiangdaPageProvider` + `PublicAccessGate` |
 | 看应用结构 / 快照 / 对比 / 诊断 / 排查 / 报错            | `openxiangda-inspect`                                                                      | `openxiangda app snapshot <APP_XXX> --profile <name> --json`                                                                                             |
 | 登录 / 切换平台 / profile / token / whoami               | `openxiangda-core`                                                                         | `openxiangda env --profile <name>` / `openxiangda auth status`                                                                                           |
@@ -48,7 +49,7 @@ OpenXiangda supports two workspace modes. Classic `sy-lowcode-app-workspace` pub
 - ✅ For app login/auth requirements, run the auth security gate before coding: enabled methods, registration policy, identity matching keys, provider boundary, default roles, rate limits, audit fields, and third-party ownership must be confirmed.
 - ✅ For public/no-login access requirements, run the public access design gate before coding: public routes, external role codes, guest vs ticket, form/dataView/function/connector grants, backend permission groups, and visible loading/error fallback states must be confirmed. New React SPA apps use `/view/:appType/public/*`, `src/resources/routes/`, `src/resources/public-access/`, and `PublicAccessGate`; route children that use Page SDK hooks must be inside `OpenXiangdaProvider` + `OpenXiangdaPageProvider`.
 - ✅ Public/no-login validation must inspect the JSON envelope, not only HTTP status. HTTP 200 with `code: "PUBLIC_GRANT_DENIED"` is a denied request; success requires `code` `200`, `"200"`, or compatible `0`, and no `success: false`.
-- ✅ Use first-class resource CLI commands for discovery, diagnosis, and small live fixes: `route`, `public-access`, `auth-config`, `function`, `connector`, `notification`, `data-view`, `menu`, and `permission`. For multi-resource formal development, still prefer `src/resources/**` + `openxiangda resource validate|plan|publish`. If a direct CLI write is intentionally used, add `--write-manifest` when the repository should stay the source of truth.
+- ✅ Use first-class resource CLI commands for discovery, diagnosis, and small live fixes: `route`, `public-access`, `auth-config`, `function`, `connector`, `notification`, `organization`, `data-view`, `menu`, and `permission`. For multi-resource formal development, still prefer `src/resources/**` + `openxiangda resource validate|plan|publish`. If a direct CLI write is intentionally used, add `--write-manifest` when the repository should stay the source of truth.
 - ✅ For form-entry UX, pick components in this order: OpenXiangda platform form components → `antd` / `antd-mobile` wrappers → custom component only when neither exists.
 - ✅ In React SPA apps, keep imports on public package entrypoints such as `openxiangda`, `openxiangda/runtime`, and `openxiangda/runtime/react`. The default template already groups large vendor chunks; if a bundle is too large, use route-level lazy loading and Vite `manualChunks`, not `openxiangda/packages/sdk/dist/...` internal paths.
 - ✅ For image thumbnails or lightweight previews, use `imageCompression` on `ImageField` or `AttachmentField`. Keep the original `url` for the source file and use `thumbUrl` / `previewUrl` / `variants` for smaller images.
@@ -154,7 +155,8 @@ When the user provides a root domain such as `https://yida.wisejob.cn/`, use it
 - Put engineering-managed resources in `src/resources/` and use `openxiangda resource validate|plan|publish|pull`. `workspace publish` publishes workspace forms/pages first, then runs non-destructive resource upsert. Only pass `--prune` when the user explicitly wants local manifests to delete platform-side extras.
 - For repeated read-only multi-form queries or predefined dashboard metrics, create a data view manifest in `src/resources/data-views/`. Use `storageMode: "materialized"` for refreshed lists/reports that tolerate delay; use `storageMode: "live"` for bounded real-time joins where source changes must appear immediately. Use row views plus `sdk.dataView.query` for joined lists/lookups; use `viewType: "aggregate"` plus `sdk.dataView.stats` for count/sum/avg/min/max statistics. Add `indexes` only for materialized views. Do not use data views for single-form CRUD, simple linkedForm selects, writes, write-back, unbounded realtime joins, or ad-hoc BI. Read `references/data-views.md` before designing one.
 - For external APIs, create a connector manifest in `src/resources/connectors/` and call it from pages through `sdk.connector`; never put third-party API keys in page source.
-- For reusable backend logic shared by pages, automations, and workflows, create an App Function in `src/resources/functions/<functionCode>.json` plus `src/functions/<functionCode>/index.ts`. Call it from pages with `sdk.function.invoke`, from automation/workflow graphs with `function_call`, or from the runtime endpoint when the caller has app automation management permission. Current App Function MVP exposes controlled helpers such as `ctx.resources`, `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`, `ctx.dataView`, `ctx.connector`, `ctx.notification`, and `ctx.platform.api`; it does not expose raw SQL or Redis. Runtime functions also receive trusted role context on `ctx.operator.roleCodes`, `ctx.operator.currentRoleCode`, `ctx.operator.hasFullAccess`, `ctx.currentUser`, and `ctx.permissions`; use these for server-side business authorization. Do not trust role codes sent in page input for sensitive actions. App Function form writes are trusted backend writes governed by declared `resources.forms` and function invocation authorization; do not grant normal users raw submit permission to internal forms just to let `ctx.form.createOne/updateOne/updateById` run.
+- For reusable backend logic shared by pages, automations, and workflows, create an App Function in `src/resources/functions/<functionCode>.json` plus `src/functions/<functionCode>/index.ts`. Call it from pages with `sdk.function.invoke`, from automation/workflow graphs with `function_call`, or from the runtime endpoint when the caller has app automation management permission. Current App Function MVP exposes controlled helpers such as `ctx.resources`, `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`, `ctx.dataView`, `ctx.connector`, `ctx.notification`, `ctx.organization`, and `ctx.platform.api`; it does not expose raw SQL or Redis. Runtime functions also receive trusted role context on `ctx.operator.roleCodes`, `ctx.operator.currentRoleCode`, `ctx.operator.hasFullAccess`, `ctx.currentUser`, and `ctx.permissions`; use these for server-side business authorization. Do not trust role codes sent in page input for sensitive actions. App Function form writes are trusted backend writes governed by declared `resources.forms` and function invocation authorization; do not grant normal users raw submit permission to internal forms just to let `ctx.form.createOne/updateOne/updateById` run.
+- For app-managed platform departments/accounts, use `sdk.organization.departments.*`, `sdk.organization.accounts.*`, `ctx.organization.departments.*`, or `ctx.organization.accounts.*`. The real current user/audit actor must hold `app:organization:manage` on the app; runtime service principals do not bypass this permission. Do not call legacy `/user` or `/department` write endpoints from apps. Do not include `password` in account updates; reset target accounts with `resetPassword`, and change the current user's password with `changeMyPassword({ oldPassword, newPassword })`.
 - For application login, declare auth resources in `src/resources/auth/<code>.json` and publish them with `openxiangda resource publish`. App Function auth providers may validate external credentials and return only an identity assertion; they must never issue tokens, set cookies, or write platform user/binding tables directly. The platform auth service decides create/bind/reject and issues tokens.
 - For external/no-login pages in React SPA apps, declare `src/resources/routes/<code>.json` and `src/resources/public-access/<code>.json`, put the page under `/view/:appType/public/*`, and use `PublicAccessGate` or `createPublicAccessClient`. The route tree must also include `OpenXiangdaPageProvider` inside `OpenXiangdaProvider` before any `usePageSdk()` / `usePageContext()` / `useDataSource()` call; otherwise pages throw `usePageSdkStore 必须在 PageProvider 内使用`. Always provide `fallback` and `errorFallback` for public routes so slow networks, missing tickets, or expired tickets do not render blank pages. Public guest access to forms, dataViews, functions, and connectors is denied unless policy `grants` explicitly names the resource; backend permission groups still apply.
 - When verifying public access, parse the response body and reject string business errors such as `PUBLIC_GRANT_DENIED` even if the HTTP status is 200. Do not use `response.ok` alone as the success condition.
@@ -194,7 +196,7 @@ Load these references on demand instead of memorizing them. Subskills cite the s
 
 Core CLI / state:
 
-- `references/openxiangda-api.md` — `/openxiangda-api/v1` request and response fields.
+- `references/openxiangda-api.md` — `/openxiangda-api/v1` request and response fields, including app-scoped organization APIs.
 - `references/architecture-design.md` — OpenXiangda architecture design gate, anti-pattern rejection, question gates, final design template, and black-box demo scenario.
 - `references/workspace-state.md` — `.openxiangda/state.json` shape and profile isolation rules.
 - `references/connector-resources.md` — `src/resources` manifests, connector schema, App Function boundary, and platform runtime calls.
@@ -212,7 +214,7 @@ Form authoring:
 Page authoring:
 
 - `references/pages/workspace-structure.md` — `src/pages/<pageCode>/` layout and config.
-- `references/pages/page-sdk.md` — `openxiangda/runtime` data, connector, data view, notification, and App Function APIs.
+- `references/pages/page-sdk.md` — `openxiangda/runtime` data, connector, data view, notification, organization, and App Function APIs.
 - `references/pages/publish-flow.md` — workspace publish steps for code pages.
 
 Workflow / automation / permissions:

package/openxiangda-skills/references/connector-resources.md

@@ -32,7 +32,7 @@ Notification manifests live under `src/resources/notifications/` and contain `te
 
 Data view manifests live under `src/resources/data-views/` and define read-only joined or aggregate query resources. Use `storageMode: "materialized"` for refreshed lists/reports where lag is acceptable, and `storageMode: "live"` for bounded real-time query shapes. Use row views with `sdk.dataView.query` and aggregate views with `sdk.dataView.stats`. Before generating one, confirm freshness tolerance, query bounds, and indexes for materialized filters/sort fields/dimensions/date buckets. Do not use them for single-form CRUD, simple linkedForm selects, writes, write-back, or ad-hoc BI. See `data-views.md` before generating one.
 
-App Function manifests live under `src/resources/functions/`, with source in `src/functions/<functionCode>/index.ts`. Use them for reusable server-side logic that pages, automations, and workflows can share through `sdk.function.invoke` or `function_call` nodes. App Functions expose controlled runtime helpers such as `ctx.resources`, `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`, `ctx.dataView`, `ctx.connector`, `ctx.notification`, and `ctx.platform.api`; they do not expose raw SQL or Redis in the current MVP. Runtime page invocations also expose trusted role context on `ctx.operator.roleCodes`, `ctx.operator.currentRoleCode`, `ctx.operator.hasFullAccess`, `ctx.currentUser`, and `ctx.permissions`; use that context for server-side authorization, and never trust page-submitted role codes for sensitive actions. App Function form writes are trusted backend writes governed by declared `resources.forms` and function invocation authorization, not by direct page-user submit access to the target form. Use JS_CODE V2 only for node-local workflow/automation scripts.
+App Function manifests live under `src/resources/functions/`, with source in `src/functions/<functionCode>/index.ts`. Use them for reusable server-side logic that pages, automations, and workflows can share through `sdk.function.invoke` or `function_call` nodes. App Functions expose controlled runtime helpers such as `ctx.resources`, `ctx.form.queryOne/queryMany/getById/createOne/updateOne/updateById`, `ctx.dataView`, `ctx.connector`, `ctx.notification`, `ctx.organization`, and `ctx.platform.api`; they do not expose raw SQL or Redis in the current MVP. Runtime page invocations also expose trusted role context on `ctx.operator.roleCodes`, `ctx.operator.currentRoleCode`, `ctx.operator.hasFullAccess`, `ctx.currentUser`, and `ctx.permissions`; use that context for server-side authorization, and never trust page-submitted role codes for sensitive actions. App Function form writes are trusted backend writes governed by declared `resources.forms` and function invocation authorization, not by direct page-user submit access to the target form. App Function organization writes require `app:organization:manage` on the real operator/audit actor. Use JS_CODE V2 only for node-local workflow/automation scripts.
 
 Auth manifests live under `src/resources/auth/`. Use them to enable app-level login methods and bind phone-code/CAS/custom providers to App Functions. Auth provider functions are called only by the platform auth flow. They validate external credentials and return identity assertions such as `phone`, `email`, `externalId`, or `unionId`; they must not issue tokens, set cookies, or mutate platform user/binding tables.