openxiangda 2.34.3 → 2.44.0

package/dist/browser/components/administration/RoleMembershipManager.js

@@ -0,0 +1,724 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+import { Alert, App, Button, DatePicker, Descriptions, Drawer, Empty, Form, Input, Select, Skeleton, Space, Table, Tag, } from 'antd';
+import dayjs from 'dayjs';
+import { assertNativeRoleMembershipBatchInput } from 'openxiangda-contracts/browser';
+import { executeRoleMembershipBatch, listRoleManagementScopeValues, listRoleMemberships, loadAuthorizationMutationReceipt, loadRoleManagementCatalog, loadWorkflowRoleReferences, previewRoleMembershipBatch, searchRoleManagementUsers, } from '../../platform-client';
+import { membershipBatchItems, membershipBatchMerge, membershipBatchPending, membershipBatchReceiptMatches, } from './membership-batch-model';
+const statusNames = { active: '有效', expired: '已过期', revoked: '已撤销' };
+const outcomeNames = {
+    ready: '可以提交',
+    already_committed: '原操作已提交',
+    committed: '已提交',
+    replayed: '原回执已恢复',
+    failed: '已拒绝',
+    unconfirmed: '结果未知',
+};
+const errorText = (failure) => failure instanceof Error ? failure.message : '读取失败，请重试';
+function allowed(catalog, roleCode, action) {
+    return (catalog.roleManagement.unrestricted ||
+        catalog.roleManagement.wildcardActions.includes(action) ||
+        Boolean(catalog.roleManagement.roles
+            .find((role) => role.roleCode === roleCode)
+            ?.actions.includes(action)));
+}
+function useRead(key, read) {
+    const reader = useRef(read);
+    reader.current = read;
+    const [attempt, setAttempt] = useState(0);
+    const [state, setState] = useState({ key, attempt, error: '', loading: Boolean(key) });
+    useEffect(() => {
+        let active = true;
+        setState({ key, attempt, error: '', loading: Boolean(key) });
+        if (key)
+            void reader
+                .current()
+                .then((data) => {
+                if (active)
+                    setState({ key, attempt, data, error: '', loading: false });
+            })
+                .catch((failure) => {
+                if (active)
+                    setState({
+                        key,
+                        attempt,
+                        error: errorText(failure),
+                        loading: false,
+                    });
+            });
+        return () => {
+            active = false;
+        };
+    }, [key, attempt]);
+    const current = state.key === key && state.attempt === attempt
+        ? state
+        : { data: undefined, error: '', loading: Boolean(key) };
+    return { ...current, reload: () => setAttempt((value) => value + 1) };
+}
+/** Current-user administration, shared by platform and application pages. */
+export function RoleMembershipManager({ initialRoleCode = '', refreshKey = 0, }) {
+    const { message } = App.useApp();
+    const catalog = useRead(`members-catalog:${refreshKey}`, loadRoleManagementCatalog);
+    const [roleCode, setRoleCode] = useState(initialRoleCode), [keyword, setKeyword] = useState(''), [status, setStatus] = useState('active');
+    const [dimensionCode, setDimensionCode] = useState(''), [scopeValue, setScopeValue] = useState(), [page, setPage] = useState(1);
+    const [selected, setSelected] = useState([]), [editing, setEditing] = useState(), [reference, setReference] = useState();
+    const blocked = Boolean(editing), query = {
+        roleCode,
+        keyword,
+        status: status === 'all' ? undefined : status,
+        ...(dimensionCode && scopeValue?.[0]
+            ? { dimensionCode, scopeValue: scopeValue[0] }
+            : {}),
+        limit: 20,
+        offset: (page - 1) * 20,
+    };
+    const members = useRead(catalog.data ? JSON.stringify([refreshKey, query]) : undefined, () => listRoleMemberships(query));
+    const role = catalog.data?.roles.find((item) => item.code === roleCode);
+    const canCreate = catalog.data?.roles.some((item) => allowed(catalog.data, item.code, 'membership.assign'));
+    const canUpdate = Boolean(selected.length &&
+        catalog.data &&
+        selected.every((row) => allowed(catalog.data, row.roleCode, 'membership.update')) &&
+        new Set(selected.map((row) => row.roleCode)).size === 1);
+    const canRevoke = Boolean(selected.length &&
+        catalog.data &&
+        selected.every((row) => allowed(catalog.data, row.roleCode, 'membership.revoke')));
+    const selectRole = (value) => {
+        setRoleCode(value);
+        setSelected([]);
+        setPage(1);
+        setDimensionCode('');
+        setScopeValue(undefined);
+    };
+    const open = (operation, rows = selected) => {
+        if (catalog.data)
+            setEditing({
+                operation,
+                rows,
+                catalog: catalog.data,
+                roleCode: rows[0]?.roleCode || roleCode,
+            });
+    };
+    const rowSelect = (rows) => {
+        if (rows.length > 50) {
+            void message.info('一次最多选择 50 位成员');
+            return;
+        }
+        setSelected(rows);
+    };
+    const selectable = (row) => Boolean(row.maintainable &&
+        row.status !== 'revoked' &&
+        catalog.data &&
+        (allowed(catalog.data, row.roleCode, 'membership.update') ||
+            allowed(catalog.data, row.roleCode, 'membership.revoke')));
+    return (_jsxs("div", { className: "oxa-member-management", children: [_jsxs("div", { className: "oxa-member-toolbar", children: [_jsx("p", { className: "oxa-member-help", children: "\u5728\u8FD9\u91CC\u7EF4\u62A4\u804C\u8D23\u6210\u5458\u3001\u4E1A\u52A1\u8303\u56F4\u4E0E\u6709\u6548\u671F\u3002\u89D2\u8272\u6743\u9650\u548C\u6D41\u7A0B\u6761\u4EF6\u7531\u5E94\u7528\u4EE3\u7801\u5B9A\u4E49\u3002" }), _jsx(Button, { type: "primary", disabled: blocked || !canCreate, onClick: () => open('create', []), children: "\u5206\u914D\u6210\u5458" })] }), catalog.loading && _jsx(Skeleton, { active: true }), catalog.error && (_jsx(Alert, { type: "error", showIcon: true, title: "\u65E0\u6CD5\u8BFB\u53D6\u6210\u5458\u7EF4\u62A4\u6743\u9650", description: catalog.error, action: _jsx(Button, { disabled: blocked, onClick: catalog.reload, children: "\u91CD\u8BD5" }) })), catalog.data && (_jsxs("div", { className: "oxa-member-layout", children: [_jsxs("aside", { className: "oxa-member-roles", "aria-label": "\u5E94\u7528\u89D2\u8272\u76EE\u5F55", children: [_jsxs("div", { className: "oxa-member-role-title", children: ["\u5E94\u7528\u89D2\u8272 \u00B7 ", catalog.data.roles.length] }), _jsx(Select, { "aria-label": "\u7B5B\u9009\u5E94\u7528\u89D2\u8272", className: "oxa-member-role-select", value: roleCode, disabled: blocked, options: [
+                                    { value: '', label: '全部角色' },
+                                    ...catalog.data.roles.map((item) => ({
+                                        value: item.code,
+                                        label: item.name,
+                                    })),
+                                ], onChange: selectRole }), _jsxs("div", { className: "oxa-member-role-buttons", children: [_jsx("button", { type: "button", className: !roleCode ? 'active' : '', disabled: blocked, onClick: () => selectRole(''), children: "\u5168\u90E8\u89D2\u8272" }), catalog.data.roles.map((item) => (_jsxs("button", { type: "button", className: roleCode === item.code ? 'active' : '', disabled: blocked, onClick: () => selectRole(item.code), children: [_jsx("strong", { children: item.name }), _jsx("small", { children: item.description || item.code })] }, item.code)))] })] }), _jsxs("section", { className: "oxa-member-main", children: [_jsxs("div", { className: "oxa-member-toolbar", children: [_jsxs("div", { children: [_jsx("h3", { children: role?.name || '全部成员' }), _jsx("span", { className: "oxa-member-help", children: role?.description ||
+                                                    (role ? role.code : '仅显示当前有权读取的角色') })] }), role && (_jsx(Button, { disabled: blocked, onClick: () => setReference(role.code), children: "\u67E5\u770B\u5173\u8054\u6D41\u7A0B" }))] }), _jsxs("div", { className: "oxa-member-filters", children: [_jsx(Input.Search, { "aria-label": "\u641C\u7D22\u89D2\u8272\u6210\u5458", allowClear: true, placeholder: "\u641C\u7D22\u6210\u5458\u540D\u79F0\u6216\u7F16\u53F7", disabled: blocked, onSearch: (value) => {
+                                            setKeyword(value.trim());
+                                            setPage(1);
+                                        } }), _jsx(Select, { "aria-label": "\u6210\u5458\u72B6\u6001", value: status, disabled: blocked, onChange: (value) => {
+                                            setStatus(value);
+                                            setPage(1);
+                                        }, options: [
+                                            { value: 'active', label: '有效成员' },
+                                            { value: 'expired', label: '已过期' },
+                                            { value: 'revoked', label: '已撤销' },
+                                            { value: 'all', label: '全部状态' },
+                                        ] }), _jsx(Select, { "aria-label": "\u7B5B\u9009\u8303\u56F4\u7EF4\u5EA6", value: dimensionCode || undefined, allowClear: true, disabled: blocked, placeholder: "\u4E1A\u52A1\u8303\u56F4", options: catalog.data.scopeDimensions.map((item) => ({
+                                            value: item.code,
+                                            label: item.name,
+                                        })), onChange: (value) => {
+                                            setDimensionCode(value || '');
+                                            setScopeValue(undefined);
+                                            setPage(1);
+                                        } }), dimensionCode && (_jsx(ScopeChoices, { dimensionCode: dimensionCode, value: scopeValue, disabled: blocked, multiple: false, onChange: (value) => {
+                                            setScopeValue(value);
+                                            setPage(1);
+                                        } }, dimensionCode)), _jsx(Button, { disabled: blocked, onClick: () => {
+                                            members.reload();
+                                            catalog.reload();
+                                        }, children: "\u5237\u65B0\u6210\u5458" })] }), _jsxs("div", { className: "oxa-member-selection", children: [_jsx("span", { children: selected.length
+                                            ? `已选择 ${selected.length} 位成员`
+                                            : '可跨页选择，最多 50 位' }), _jsxs(Space, { wrap: true, children: [_jsx(Button, { disabled: blocked || !canUpdate, onClick: () => open('update'), children: "\u6279\u91CF\u8C03\u6574" }), _jsx(Button, { danger: true, disabled: blocked || !canRevoke, onClick: () => open('revoke'), children: "\u6279\u91CF\u64A4\u9500" }), selected.length > 0 && (_jsx(Button, { disabled: blocked, onClick: () => setSelected([]), children: "\u6E05\u9664\u9009\u62E9" }))] })] }), members.error && (_jsx(Alert, { type: "error", showIcon: true, title: "\u6210\u5458\u8BFB\u53D6\u5931\u8D25", description: members.error, action: _jsx(Button, { disabled: blocked, onClick: members.reload, children: "\u91CD\u8BD5" }) })), _jsx(Table, { rowKey: "id", size: "small", loading: members.loading, dataSource: members.error ? [] : members.data?.items, scroll: { x: 840 }, locale: {
+                                    emptyText: (_jsx(Empty, { image: Empty.PRESENTED_IMAGE_SIMPLE, description: members.error
+                                            ? '本次成员未读取成功，请重试'
+                                            : members.loading
+                                                ? '正在读取角色成员'
+                                                : '当前筛选下没有角色成员' })),
+                                }, rowSelection: {
+                                    selectedRowKeys: selected.map((row) => row.id),
+                                    preserveSelectedRowKeys: true,
+                                    getCheckboxProps: (row) => ({
+                                        disabled: blocked || !selectable(row),
+                                    }),
+                                    onChange: (_keys, rows) => rowSelect(rows),
+                                }, pagination: {
+                                    current: page,
+                                    total: members.data?.total,
+                                    pageSize: 20,
+                                    showSizeChanger: false,
+                                    disabled: blocked,
+                                    onChange: setPage,
+                                }, columns: [
+                                    {
+                                        title: '成员',
+                                        width: 170,
+                                        render: (_, row) => (_jsxs(_Fragment, { children: [_jsx("b", { children: row.userName || row.userId }), _jsx("small", { className: "oxa-member-sub", children: row.userId })] })),
+                                    },
+                                    {
+                                        title: '角色 / 来源',
+                                        width: 165,
+                                        render: (_, row) => (_jsxs(_Fragment, { children: [row.roleName || row.roleCode, _jsxs("small", { className: "oxa-member-sub", children: [row.maintainable
+                                                            ? '手动维护'
+                                                            : row.immutableReason === 'authenticated_user_role'
+                                                                ? '系统认证成员'
+                                                                : '同步授权投影', ' ', "\u00B7 r", row.revision] })] })),
+                                    },
+                                    {
+                                        title: '业务范围',
+                                        render: (_, row) => row.scopeGrants.length ? (row.scopeGrants.map((grant) => (_jsxs(Tag, { children: [catalog.data?.scopeDimensions.find((item) => item.code === grant.dimensionCode)?.name || grant.dimensionCode, ' ', "\u00B7 ", grant.values.length, " \u9879"] }, grant.dimensionCode)))) : (_jsx("span", { className: "oxa-member-help", children: "\u672A\u5355\u72EC\u9650\u5B9A" })),
+                                    },
+                                    {
+                                        title: '有效期',
+                                        width: 180,
+                                        render: (_, row) => (_jsxs(_Fragment, { children: [row.validTo ? formatTime(row.validTo) : '长期有效', row.validFrom && (_jsxs("small", { className: "oxa-member-sub", children: ["\u81EA ", formatTime(row.validFrom)] }))] })),
+                                    },
+                                    {
+                                        title: '状态',
+                                        width: 85,
+                                        render: (_, row) => (_jsx(Tag, { color: row.status === 'active' ? 'green' : 'default', children: statusNames[row.status] })),
+                                    },
+                                    {
+                                        title: '操作',
+                                        width: 135,
+                                        render: (_, row) => !row.maintainable ? (_jsx("span", { className: "oxa-member-help", children: "\u6765\u6E90\u53EA\u8BFB" })) : row.status === 'revoked' ? ('—') : (_jsxs(Space, { children: [_jsx(Button, { type: "link", size: "small", disabled: blocked ||
+                                                        !allowed(catalog.data, row.roleCode, 'membership.update'), onClick: () => open('update', [row]), children: "\u8C03\u6574" }), _jsx(Button, { type: "link", size: "small", danger: true, disabled: blocked ||
+                                                        !allowed(catalog.data, row.roleCode, 'membership.revoke'), onClick: () => open('revoke', [row]), children: "\u64A4\u9500" })] })),
+                                    },
+                                ] })] })] })), editing && (_jsx(MembershipBatchEditor, { edit: editing, onClose: () => {
+                    setEditing(undefined);
+                    setSelected([]);
+                    members.reload();
+                    catalog.reload();
+                }, onChanged: members.reload })), reference && (_jsx(RoleReferences, { roleCode: reference, onClose: () => setReference(undefined) }))] }));
+}
+function ScopeChoices({ dimensionCode, value, onChange, disabled, multiple = true, }) {
+    const [term, setTerm] = useState(''), [search, setSearch] = useState(''), [offset, setOffset] = useState(0), [known, setKnown] = useState({});
+    const listKey = JSON.stringify([dimensionCode, search]);
+    const [pages, setPages] = useState({ key: listKey, options: [] });
+    const options = pages.key === listKey ? pages.options : [];
+    useEffect(() => {
+        const timer = setTimeout(() => {
+            setSearch(term);
+            setOffset(0);
+        }, 250);
+        return () => clearTimeout(timer);
+    }, [term]);
+    const result = useRead(JSON.stringify([dimensionCode, search, offset]), () => listRoleManagementScopeValues(dimensionCode, {
+        keyword: search,
+        limit: 20,
+        offset,
+    }));
+    useEffect(() => {
+        if (result.data) {
+            const data = result.data;
+            setKnown((previous) => Object.fromEntries([
+                ...(value || []).map((id) => [id, previous[id] || id]),
+                ...data.items.map((item) => [item.id, item.label]),
+            ]));
+            setPages((previous) => ({
+                key: listKey,
+                options: [
+                    ...new Map([
+                        ...(data.offset && previous.key === listKey
+                            ? previous.options
+                            : []),
+                        ...data.items.map((item) => ({
+                            value: item.id,
+                            label: item.label,
+                        })),
+                    ].map((item) => [item.value, item])).values(),
+                ].slice(0, 200),
+            }));
+        }
+    }, [result.data]);
+    const choices = new Map([
+        ...(value || []).map((id) => [id, known[id] || id]),
+        ...options.map((item) => [item.value, item.label]),
+    ]);
+    return (_jsxs("div", { className: "oxa-member-picker", children: [_jsx(Select, { "aria-label": "\u9009\u62E9\u8303\u56F4\u503C", mode: multiple ? 'multiple' : undefined, maxCount: multiple ? 100 : undefined, allowClear: true, disabled: disabled, showSearch: { filterOption: false, onSearch: setTerm }, loading: result.loading, value: multiple ? value : value?.[0], placeholder: "\u641C\u7D22\u5E76\u9009\u62E9\u8303\u56F4\u503C", options: [...choices].map(([id, label]) => ({ value: id, label })), onChange: (items) => onChange(Array.isArray(items) ? items : items ? [items] : []) }), result.error && (_jsxs("span", { className: "oxa-member-help", role: "alert", children: [result.error, ' ', _jsx(Button, { type: "link", size: "small", disabled: disabled, onClick: result.reload, children: "\u91CD\u8BD5" })] })), result.data?.items.length === 20 && (_jsx(Button, { type: "link", size: "small", disabled: disabled || result.loading || options.length >= 200, onClick: () => setOffset((value) => value + 20), children: options.length >= 200 ? '请细化搜索' : '更多范围值' }))] }));
+}
+function MemberChoices({ value, onChange, }) {
+    const [term, setTerm] = useState(''), [search, setSearch] = useState(''), [cursor, setCursor] = useState(), [known, setKnown] = useState({});
+    const [pages, setPages] = useState({ key: search, options: [] });
+    const options = pages.key === search ? pages.options : [];
+    const searchReady = search.length <= 64 &&
+        (search.length >= 2 || /^\p{Script=Han}$/u.test(search));
+    useEffect(() => {
+        const timer = setTimeout(() => {
+            setSearch(term.trim());
+            setCursor(undefined);
+        }, 250);
+        return () => clearTimeout(timer);
+    }, [term]);
+    const result = useRead(searchReady ? JSON.stringify([search, cursor]) : undefined, () => searchRoleManagementUsers({ keyword: search, cursor, limit: 20 }));
+    useEffect(() => {
+        if (result.data) {
+            const values = result.data.items.map((item) => ({
+                value: item.id,
+                label: item.label,
+                disabled: !item.selectable,
+            }));
+            setKnown((previous) => Object.fromEntries([
+                ...(value || []).map((id) => [id, previous[id] || id]),
+                ...values.map((item) => [item.value, item.label]),
+            ]));
+            setPages((previous) => ({
+                key: search,
+                options: [
+                    ...new Map([
+                        ...(cursor && previous.key === search ? previous.options : []),
+                        ...values,
+                    ].map((item) => [item.value, item])).values(),
+                ].slice(0, 200),
+            }));
+        }
+    }, [result.data]);
+    const choices = new Map([
+        ...(value || []).map((id) => [id, { value: id, label: known[id] || id, disabled: false }]),
+        ...options.map((item) => [item.value, item]),
+    ]);
+    return (_jsxs(_Fragment, { children: [_jsx(Select, { "aria-label": "\u9009\u62E9\u6210\u5458", mode: "multiple", maxCount: 50, value: value, onChange: onChange, loading: result.loading, showSearch: { filterOption: false, onSearch: setTerm }, placeholder: "\u641C\u7D22\u5E76\u9009\u62E9\u6210\u5458\uFF0C\u6700\u591A 50 \u4F4D", notFoundContent: searchReady ? undefined : '请输入姓名或账号搜索', options: [...choices.values()] }), !searchReady && (_jsx("p", { className: "oxa-member-help", children: "\u8F93\u5165\u59D3\u540D\u6216\u8D26\u53F7\u641C\u7D22\uFF0C\u81F3\u5C11 2 \u4E2A\u5B57\u7B26\u6216 1 \u4E2A\u6C49\u5B57\uFF0C\u6700\u591A 64 \u4E2A\u5B57\u7B26\u3002" })), result.error && (_jsxs("p", { className: "oxa-member-help", role: "alert", children: [result.error, ' ', _jsx(Button, { type: "link", size: "small", onClick: result.reload, children: "\u91CD\u8BD5" })] })), result.data?.nextCursor && (_jsx(Button, { type: "link", size: "small", disabled: result.loading || options.length >= 200, onClick: () => setCursor(result.data.nextCursor), children: options.length >= 200 ? '请细化搜索' : '更多成员' }))] }));
+}
+function MembershipBatchEditor({ edit, onClose, onChanged, }) {
+    const { modal } = App.useApp(), [form] = Form.useForm();
+    const [rows, setRows] = useState(edit.rows), [catalog, setCatalog] = useState(edit.catalog), [items, setItems] = useState(), [proposal, setProposal] = useState();
+    const [outcomes, setOutcomes] = useState({}), [receipts, setReceipts] = useState({}), [unknown, setUnknown] = useState([]);
+    const [busy, setBusy] = useState(false), [error, setError] = useState(''), [attempted, setAttempted] = useState(false), [dirty, setDirty] = useState(false);
+    const roleCode = Form.useWatch('roleCode', form) ||
+        edit.roleCode ||
+        catalog.roles.find((role) => allowed(catalog, role.code, 'membership.assign'))?.code ||
+        '';
+    const scopeMode = Form.useWatch('scopeMode', form), dimensionCode = Form.useWatch('dimensionCode', form), fromMode = Form.useWatch('fromMode', form), toMode = Form.useWatch('toMode', form);
+    const dimensions = catalog.scopeDimensions.filter((dimension) => dimension.applicability.allRoles ||
+        dimension.applicability.roleCodes.includes(roleCode));
+    const pending = items
+        ? membershipBatchPending(items, outcomes, receipts)
+        : [], unconfirmed = pending.filter((item) => unknown.includes(item.operationId) ||
+        outcomes[item.operationId]?.status === 'unconfirmed');
+    const ready = pending.filter((item) => ['ready'].includes(outcomes[item.operationId]?.status || ''));
+    const unfinished = items ? pending.length > 0 : dirty;
+    useEffect(() => {
+        if (!unfinished && !busy)
+            return;
+        const prevent = (event) => {
+            event.preventDefault();
+            event.returnValue = '';
+        };
+        window.addEventListener('beforeunload', prevent);
+        return () => window.removeEventListener('beforeunload', prevent);
+    }, [unfinished, busy]);
+    const close = () => {
+        if (busy)
+            return;
+        if (unfinished)
+            modal.confirm({
+                title: unconfirmed.length
+                    ? '关闭前请保留原操作编号'
+                    : '放弃当前未完成的成员维护？',
+                content: unconfirmed.length
+                    ? '结果未知的操作可能已经提交。关闭后可按下方操作编号核对回执，请先复制编号。'
+                    : '已提交项会保留，未提交的草稿将被放弃。',
+                okText: '关闭',
+                cancelText: '继续核对',
+                onOk: onClose,
+            });
+        else
+            onClose();
+    };
+    const preview = async () => {
+        setError('');
+        let values;
+        try {
+            values = await form.validateFields();
+        }
+        catch {
+            return;
+        }
+        if (edit.operation === 'update' &&
+            values.scopeMode === 'keep' &&
+            values.fromMode === 'keep' &&
+            values.toMode === 'keep') {
+            setError('请选择至少一项需要调整的范围或有效期设置');
+            return;
+        }
+        setBusy(true);
+        try {
+            const settings = {
+                reason: values.reason,
+                scopeMode: values.scopeMode,
+                dimensionCode: values.dimensionCode,
+                scopeValues: values.scopeValues || [],
+                fromMode: values.fromMode,
+                toMode: values.toMode,
+                validFrom: values.validFrom?.toISOString(),
+                validTo: values.validTo?.toISOString(),
+            };
+            const candidate = membershipBatchItems(edit.operation, rows, values.users || [], roleCode, settings);
+            assertNativeRoleMembershipBatchInput({
+                schemaVersion: 'openxiangda.native-role-membership-batch-request/v2',
+                items: candidate,
+            });
+            const response = await previewRoleMembershipBatch({ items: candidate });
+            if (response.mode !== 'preview')
+                throw new Error('预览响应与请求不一致，请重试');
+            setOutcomes(membershipBatchMerge(candidate, {}, response.items));
+            setProposal(response);
+            setItems(candidate);
+            setUnknown([]);
+            setAttempted(false);
+        }
+        catch (failure) {
+            setError(errorText(failure));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const execute = async (target) => {
+        if (!target.length)
+            return;
+        setBusy(true);
+        setError('');
+        setAttempted(true);
+        try {
+            const response = await executeRoleMembershipBatch({ items: target });
+            if (response.mode !== 'execute' ||
+                response.items.some((item) => item.status === 'ready' || item.status === 'already_committed'))
+                throw new Error('提交结果无法核对，请保留原操作编号');
+            const merged = membershipBatchMerge(target, outcomes, response.items);
+            setOutcomes(merged);
+            setUnknown((previous) => previous.filter((id) => !target.some((item) => item.operationId === id)));
+            setReceipts((previous) => ({
+                ...previous,
+                ...Object.fromEntries(response.items.flatMap((item) => item.status === 'committed' || item.status === 'replayed'
+                    ? [[item.operationId, item.result.receipt]]
+                    : [])),
+            }));
+            onChanged();
+        }
+        catch (failure) {
+            setError(errorText(failure));
+            setUnknown((previous) => [
+                ...new Set([...previous, ...target.map((item) => item.operationId)]),
+            ]);
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const recover = async () => {
+        setBusy(true);
+        setError('');
+        let missing = 0;
+        for (const item of unconfirmed) {
+            try {
+                const receipt = await loadAuthorizationMutationReceipt(item.operationId);
+                if (!membershipBatchReceiptMatches(item, receipt))
+                    throw new Error('回执与原成员操作不一致');
+                setReceipts((previous) => ({
+                    ...previous,
+                    [item.operationId]: receipt,
+                }));
+                setUnknown((previous) => previous.filter((id) => id !== item.operationId));
+            }
+            catch {
+                missing++;
+            }
+        }
+        if (missing)
+            setError(`${missing} 项尚未核对到匹配回执，请保留原操作编号；可显式重试相同操作。`);
+        else
+            onChanged();
+        setBusy(false);
+    };
+    const rebase = async () => {
+        if (unconfirmed.length)
+            return;
+        setBusy(true);
+        setError('');
+        try {
+            const nextCatalog = await loadRoleManagementCatalog();
+            if (items && edit.operation !== 'create') {
+                const wanted = rows.filter((row) => pending.some((item) => item.operation !== 'create' && item.membershipId === row.id));
+                const fresh = [];
+                for (const row of wanted) {
+                    const page = await listRoleMemberships({
+                        userId: row.userId,
+                        roleCode: row.roleCode,
+                        limit: 20,
+                        offset: 0,
+                    });
+                    const current = page.items.find((item) => item.id === row.id);
+                    if (!current || !current.maintainable || current.status === 'revoked')
+                        throw new Error(`成员 ${row.userName || row.userId} 已撤销或不再可维护，请关闭后重新选择`);
+                    fresh.push(current);
+                }
+                setRows(fresh);
+            }
+            else if (items && edit.operation === 'create')
+                form.setFieldValue('users', pending.flatMap((item) => item.operation === 'create' ? [item.userId] : []));
+            setCatalog(nextCatalog);
+            setItems(undefined);
+            setProposal(undefined);
+            setOutcomes({});
+            setUnknown([]);
+            setAttempted(false);
+        }
+        catch (failure) {
+            setError(errorText(failure));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const title = edit.operation === 'create'
+        ? '分配角色成员'
+        : edit.operation === 'update'
+            ? '调整角色成员'
+            : '撤销角色成员';
+    return (_jsxs(Drawer, { open: true, title: title, size: 900, className: "oxa-member-drawer", onClose: close, footer: _jsxs("div", { className: "oxa-member-footer", children: [_jsx("span", { children: busy
+                        ? '正在核对平台结果'
+                        : items
+                            ? `待处理 ${pending.length} 项 · 原操作编号已保留`
+                            : '预览后核对差异，再显式提交' }), _jsxs(Space, { wrap: true, children: [_jsx(Button, { disabled: busy, onClick: close, children: "\u5173\u95ED" }), !items ? (_jsx(Button, { type: "primary", loading: busy, disabled: busy, onClick: () => void preview(), children: "\u9884\u89C8\u53D8\u66F4" })) : (_jsxs(_Fragment, { children: [!attempted && (_jsx(Button, { disabled: busy, onClick: () => {
+                                        setItems(undefined);
+                                        setProposal(undefined);
+                                        setOutcomes({});
+                                    }, children: "\u8FD4\u56DE\u7F16\u8F91" })), pending.length > 0 && !unconfirmed.length && (_jsx(Button, { disabled: busy, onClick: () => void rebase(), children: "\u8F7D\u5165\u6700\u65B0\u57FA\u51C6\u5E76\u4FDD\u7559\u8F93\u5165" })), unconfirmed.length > 0 ? (_jsxs(_Fragment, { children: [_jsx(Button, { disabled: busy, onClick: () => void recover(), children: "\u6838\u5BF9\u672A\u77E5\u7ED3\u679C" }), _jsxs(Button, { type: "primary", loading: busy, disabled: busy, onClick: () => void execute(unconfirmed), children: ["\u91CD\u8BD5\u76F8\u540C\u64CD\u4F5C \u00B7 ", unconfirmed.length, " \u9879"] })] })) : (ready.length > 0 && (_jsxs(Button, { type: "primary", danger: edit.operation === 'revoke', loading: busy, disabled: busy, onClick: () => void execute(ready), children: ["\u63D0\u4EA4\u53EF\u6267\u884C\u7684 ", ready.length, " \u9879"] })))] }))] })] }), children: [_jsx("p", { className: "oxa-member-help", children: "\u53EA\u7EF4\u62A4\u6210\u5458\u6388\u6743\u3002\u5DF2\u6709\u5F85\u529E\u4FDD\u7559\u53C2\u4E0E\u5FEB\u7167\uFF0C\u5B9E\u9645\u529E\u7406\u4ECD\u590D\u6838\u5F53\u524D\u8D44\u683C\uFF1B\u65B0\u6210\u5458\u5728\u4EE5\u540E\u5206\u6D3E\u65F6\u53C2\u4E0E\u89E3\u6790\u3002" }), error && (_jsx(Alert, { type: "error", showIcon: true, title: "\u6210\u5458\u7EF4\u62A4\u5C1A\u672A\u5B8C\u6210", description: error, style: { marginBottom: 16 } })), !items ? (_jsxs(Form, { form: form, layout: "vertical", disabled: busy, onValuesChange: () => setDirty(true), initialValues: {
+                    roleCode: edit.roleCode ||
+                        catalog.roles.find((role) => allowed(catalog, role.code, 'membership.assign'))?.code,
+                    scopeMode: 'keep',
+                    scopeValues: [],
+                    fromMode: 'keep',
+                    toMode: 'keep',
+                }, children: [edit.operation === 'create' ? (_jsxs(_Fragment, { children: [_jsx(Form.Item, { name: "users", label: "\u6210\u5458", rules: [
+                                    {
+                                        required: true,
+                                        type: 'array',
+                                        min: 1,
+                                        message: '请选择至少一位成员',
+                                    },
+                                ], children: _jsx(MemberChoices, {}) }), _jsx(Form.Item, { name: "roleCode", label: "\u89D2\u8272", rules: [{ required: true, message: '请选择角色' }], children: _jsx(Select, { "aria-label": "\u5206\u914D\u7684\u5E94\u7528\u89D2\u8272", options: catalog.roles
+                                        .filter((role) => allowed(catalog, role.code, 'membership.assign'))
+                                        .map((role) => ({ value: role.code, label: role.name })), onChange: () => {
+                                        form.setFieldValue('dimensionCode', undefined);
+                                        form.setFieldValue('scopeValues', []);
+                                    } }) })] })) : (_jsxs("div", { className: "oxa-member-draft-summary", children: [_jsxs("b", { children: [rows.length, " \u4F4D\u6210\u5458 \u00B7", ' ', catalog.roles.find((role) => role.code === roleCode)?.name ||
+                                        roleCode] }), _jsx("p", { children: rows.map((row) => row.userName || row.userId).join('、') }), _jsx("span", { children: "\u4F7F\u7528\u8BFB\u53D6\u65F6\u7684\u6210\u5458\u4FEE\u8BA2\uFF1B\u5176\u4ED6\u7BA1\u7406\u5458\u4FEE\u6539\u540E\u4F1A\u660E\u786E\u51B2\u7A81\u3002" })] })), edit.operation !== 'revoke' && (_jsxs(_Fragment, { children: [_jsx(Form.Item, { name: "scopeMode", label: "\u4E1A\u52A1\u8303\u56F4", children: _jsx(Select, { "aria-label": "\u8303\u56F4\u8C03\u6574\u65B9\u5F0F", options: [
+                                        {
+                                            value: 'keep',
+                                            label: edit.operation === 'create'
+                                                ? '不单独限定范围'
+                                                : '保持每位成员的现有范围',
+                                        },
+                                        ...(dimensions.length
+                                            ? [
+                                                {
+                                                    value: 'replace_dimension',
+                                                    label: '调整一个范围维度',
+                                                },
+                                            ]
+                                            : []),
+                                        ...(edit.operation === 'update'
+                                            ? [{ value: 'clear_all', label: '清空全部成员范围' }]
+                                            : []),
+                                    ] }) }), scopeMode === 'replace_dimension' && (_jsxs(_Fragment, { children: [_jsx(Form.Item, { name: "dimensionCode", label: "\u8303\u56F4\u7EF4\u5EA6", rules: [{ required: true, message: '请选择范围维度' }], children: _jsx(Select, { "aria-label": "\u8C03\u6574\u7684\u8303\u56F4\u7EF4\u5EA6", options: dimensions.map((dimension) => ({
+                                                value: dimension.code,
+                                                label: dimension.name,
+                                            })), onChange: () => form.setFieldValue('scopeValues', []) }) }), dimensionCode && (_jsx(Form.Item, { name: "scopeValues", label: "\u8303\u56F4\u503C", help: "\u66FF\u6362\u6B64\u7EF4\u5EA6\u7684\u503C\uFF0C\u4FDD\u7559\u5176\u4ED6\u7EF4\u5EA6\u53CA\u5DF2\u6709\u64CD\u4F5C\u4E0A\u9650\uFF1B\u7559\u7A7A\u4EC5\u79FB\u9664\u6B64\u7EF4\u5EA6\u3002", children: _jsx(ScopeChoices, { dimensionCode: dimensionCode, value: form.getFieldValue('scopeValues'), onChange: (value) => {
+                                                form.setFieldValue('scopeValues', value);
+                                                setDirty(true);
+                                            } }, dimensionCode) }))] })), scopeMode === 'clear_all' && (_jsx(Alert, { type: "warning", showIcon: true, title: "\u5C06\u6E05\u7A7A\u6240\u6709\u6210\u5458\u8303\u56F4", description: "\u89D2\u8272\u672C\u8EAB\u7684\u6743\u9650\u4FDD\u6301\uFF0C\u8303\u56F4\u53D8\u5316\u5C06\u7531\u5DF2\u53D1\u5E03\u7684\u6570\u636E\u89C4\u5219\u89E3\u91CA\u3002" })), _jsxs("div", { className: "oxa-member-time-grid", children: [_jsxs("div", { children: [_jsx(Form.Item, { name: "fromMode", label: "\u5F00\u59CB\u65F6\u95F4", children: _jsx(Select, { "aria-label": "\u5F00\u59CB\u65F6\u95F4\u8C03\u6574\u65B9\u5F0F", options: [
+                                                        {
+                                                            value: 'keep',
+                                                            label: edit.operation === 'create'
+                                                                ? '立即开始'
+                                                                : '保持原开始时间',
+                                                        },
+                                                        { value: 'set', label: '指定开始时间' },
+                                                        { value: 'clear', label: '取消开始限制' },
+                                                    ] }) }), fromMode === 'set' && (_jsx(Form.Item, { name: "validFrom", label: "\u65B0\u7684\u5F00\u59CB\u65F6\u95F4", rules: [{ required: true, message: '请填写开始时间' }], children: _jsx(DatePicker, { showTime: true, style: { width: '100%' } }) }))] }), _jsxs("div", { children: [_jsx(Form.Item, { name: "toMode", label: "\u5230\u671F\u65F6\u95F4", children: _jsx(Select, { "aria-label": "\u5230\u671F\u65F6\u95F4\u8C03\u6574\u65B9\u5F0F", options: [
+                                                        {
+                                                            value: 'keep',
+                                                            label: edit.operation === 'create'
+                                                                ? '长期有效'
+                                                                : '保持原到期时间',
+                                                        },
+                                                        { value: 'set', label: '指定到期时间' },
+                                                        { value: 'clear', label: '取消到期限制' },
+                                                    ] }) }), toMode === 'set' && (_jsx(Form.Item, { name: "validTo", label: "\u65B0\u7684\u5230\u671F\u65F6\u95F4", rules: [{ required: true, message: '请填写到期时间' }], children: _jsx(DatePicker, { showTime: true, style: { width: '100%' } }) }))] })] })] })), _jsx(Form.Item, { name: "reason", label: "\u64CD\u4F5C\u539F\u56E0", rules: [
+                            {
+                                required: true,
+                                whitespace: true,
+                                message: '请填写此次成员维护的原因',
+                            },
+                        ], children: _jsx(Input.TextArea, { rows: 2, maxLength: 1000 }) }), edit.operation === 'revoke' && (_jsx(Alert, { type: "warning", showIcon: true, title: "\u64A4\u9500\u6210\u5458\u89D2\u8272", description: "\u64A4\u9500\u540E\u7684\u6743\u9650\u5728\u540E\u7EED\u8BF7\u6C42\u4E2D\u91CD\u65B0\u8BA1\u7B97\u3002\u8FD9\u91CC\u4E0D\u4F1A\u6539\u6D3E\u5DF2\u7ECF\u751F\u6210\u7684\u6D41\u7A0B\u5F85\u529E\u3002" }))] })) : (_jsxs(_Fragment, { children: [_jsx(Alert, { type: unconfirmed.length
+                            ? 'warning'
+                            : pending.length
+                                ? 'info'
+                                : 'success', showIcon: true, title: unconfirmed.length
+                            ? '部分操作结果未知，请按原编号恢复'
+                            : pending.length
+                                ? '逐项核对变更和平台结果'
+                                : '本次操作均已核对', description: proposal
+                            ? '预览没有持久修改。提交会逐项再次检查权限、范围和修订，允许部分成功。'
+                            : undefined }), _jsx(Table, { rowKey: "operationId", size: "small", dataSource: items, scroll: { x: 650 }, pagination: { pageSize: 10, showSizeChanger: false }, columns: [
+                            {
+                                title: '成员 / 操作编号',
+                                render: (_, item) => (_jsxs(_Fragment, { children: [item.operation === 'create'
+                                            ? item.userId
+                                            : rows.find((row) => row.id === item.membershipId)
+                                                ?.userName ||
+                                                rows.find((row) => row.id === item.membershipId)
+                                                    ?.userId ||
+                                                item.membershipId, _jsx("small", { className: "oxa-member-operation-id", children: item.operationId })] })),
+                            },
+                            {
+                                title: '核对结果',
+                                width: 165,
+                                render: (_, item) => {
+                                    const receipt = receipts[item.operationId], outcome = outcomes[item.operationId];
+                                    return (_jsxs(_Fragment, { children: [_jsx(Tag, { color: receipt
+                                                    ? 'green'
+                                                    : unknown.includes(item.operationId) ||
+                                                        outcome?.status === 'unconfirmed'
+                                                        ? 'orange'
+                                                        : outcome?.status === 'failed'
+                                                            ? 'red'
+                                                            : 'blue', children: receipt
+                                                    ? '已提交 · 回执可核对'
+                                                    : unknown.includes(item.operationId)
+                                                        ? '结果未知'
+                                                        : outcomeNames[outcome?.status || 'unconfirmed'] }), outcome &&
+                                                (outcome.status === 'failed' ||
+                                                    outcome.status === 'unconfirmed') &&
+                                                !receipt && (_jsxs("small", { className: "oxa-member-sub", children: [memberError(outcome.error.code), _jsx("br", {}), outcome.error.pointer] }))] }));
+                                },
+                            },
+                            { title: '修改原因', render: (_, item) => item.reason },
+                        ], expandable: {
+                            defaultExpandAllRows: items.length <= 3,
+                            expandedRowRender: (item) => {
+                                const outcome = outcomes[item.operationId], receipt = receipts[item.operationId];
+                                return outcome &&
+                                    (outcome.status === 'ready' ||
+                                        outcome.status === 'already_committed') ? (_jsxs("div", { className: "oxa-member-diff", children: [_jsx(MemberChange, { title: "\u4FEE\u6539\u524D", value: outcome.before }), _jsx(MemberChange, { title: "\u4FEE\u6539\u540E", value: outcome.after })] })) : receipt ? (_jsx(Descriptions, { size: "small", column: 1, items: [
+                                        {
+                                            key: 'operation',
+                                            label: '原操作编号',
+                                            children: receipt.operationId,
+                                        },
+                                        {
+                                            key: 'createdAt',
+                                            label: '提交时间',
+                                            children: formatTime(receipt.createdAt),
+                                        },
+                                        {
+                                            key: 'kind',
+                                            label: '操作',
+                                            children: receipt.operationKind,
+                                        },
+                                    ] })) : (_jsx("p", { children: "\u8BF7\u5148\u5904\u7406\u6B64\u9879\u7684\u62D2\u7EDD\u6216\u672A\u77E5\u7ED3\u679C\u3002" }));
+                            },
+                            rowExpandable: (item) => Boolean(outcomes[item.operationId] || receipts[item.operationId]),
+                        } })] })), Object.keys(receipts).length > 0 && (_jsxs("p", { className: "oxa-member-help", children: ["\u6B64\u9875\u9762\u5DF2\u6838\u5BF9 ", Object.keys(receipts).length, ' ', "\u9879\u539F\u56DE\u6267\uFF1B\u91CD\u65B0\u7F16\u8F91\u53EA\u5904\u7406\u5C1A\u672A\u63D0\u4EA4\u7684\u6210\u5458\u3002"] }))] }));
+}
+function MemberChange({ title, value, }) {
+    return (_jsxs("section", { children: [_jsx("h4", { children: title }), value ? (_jsx(Descriptions, { size: "small", column: 1, items: [
+                    { key: 'member', label: '成员', children: value.userId },
+                    { key: 'role', label: '角色', children: value.roleCode },
+                    {
+                        key: 'scopes',
+                        label: '范围',
+                        children: value.scopeGrants.length
+                            ? value.scopeGrants.map((grant) => (_jsxs("div", { children: [grant.dimensionCode, "\uFF1A", grant.values.join('、'), "\uFF08", grant.operations.join('、'), "\uFF09"] }, grant.dimensionCode)))
+                            : '未单独限定',
+                    },
+                    {
+                        key: 'from',
+                        label: '开始',
+                        children: value.validFrom
+                            ? formatTime(value.validFrom)
+                            : '立即开始',
+                    },
+                    {
+                        key: 'to',
+                        label: '到期',
+                        children: value.validTo ? formatTime(value.validTo) : '长期有效',
+                    },
+                    {
+                        key: 'status',
+                        label: '状态',
+                        children: statusNames[value.status],
+                    },
+                ] })) : (_jsx("p", { children: "\u5C1A\u65E0\u6210\u5458\u6388\u6743" }))] }));
+}
+function memberError(code) {
+    if (code.includes('REVISION_CONFLICT'))
+        return '成员已被修改，请载入最新基准';
+    if (code.includes('ACTION_REQUIRED') || code.includes('FORBIDDEN'))
+        return '没有此角色的维护权限';
+    if (code.includes('IMMUTABLE') || code.includes('PROJECTION'))
+        return '该来源由平台自动维护';
+    if (code.includes('SCOPE'))
+        return '范围配置不合法或已失效';
+    return code;
+}
+function formatTime(value) {
+    return dayjs(value).format('YYYY-MM-DD HH:mm');
+}
+function RoleReferences({ roleCode, onClose, }) {
+    const [page, setPage] = useState(1), [keyword, setKeyword] = useState('');
+    const result = useRead(JSON.stringify([roleCode, page, keyword]), () => loadWorkflowRoleReferences(roleCode, {
+        keyword,
+        limit: 20,
+        offset: (page - 1) * 20,
+    }));
+    return (_jsxs(Drawer, { open: true, title: "\u89D2\u8272\u5173\u8054\u7684\u6F5C\u5728\u6D41\u7A0B\u8282\u70B9", size: 900, onClose: onClose, children: [_jsx("p", { className: "oxa-member-help", children: "\u6309\u6FC0\u6D3B\u548C\u5728\u9014\u56FA\u5B9A\u7248\u672C\u67E5\u770B\u53EF\u80FD\u4F7F\u7528\u6B64\u804C\u8D23\u7684\u8282\u70B9\u3002\u8DEF\u7531\u8BB8\u53EF\u6765\u6E90\u4E0D\u8868\u793A\u89C4\u5219\u5B9E\u9645\u547D\u4E2D\uFF0C\u4E5F\u4E0D\u4EE3\u8868\u65E7\u4EFB\u52A1\u4F1A\u88AB\u6539\u6D3E\u3002" }), _jsx(Input.Search, { "aria-label": "\u641C\u7D22\u5173\u8054\u6D41\u7A0B\u8282\u70B9", placeholder: "\u641C\u7D22\u6D41\u7A0B\u6216\u8282\u70B9", allowClear: true, onSearch: (value) => {
+                    setKeyword(value.trim());
+                    setPage(1);
+                }, style: { marginBottom: 16 } }), result.error && (_jsx(Alert, { type: "error", showIcon: true, title: "\u5173\u8054\u6D41\u7A0B\u8BFB\u53D6\u5931\u8D25\u6216\u6CA1\u6709\u7BA1\u7406\u6743\u9650", description: result.error, action: _jsx(Button, { onClick: result.reload, children: "\u91CD\u8BD5" }) })), _jsx(Table, { rowKey: (item) => `${item.workflowCode}:${item.definitionVersion}:${item.bindingVersion}:${item.nodeId}:${item.source}:${item.routingSourceCode || ''}`, size: "small", loading: result.loading, dataSource: result.data?.items, scroll: { x: 750 }, pagination: {
+                    current: page,
+                    total: result.data?.total,
+                    pageSize: 20,
+                    showSizeChanger: false,
+                    onChange: setPage,
+                }, columns: [
+                    {
+                        title: '流程 / 节点',
+                        render: (_, item) => (_jsxs(_Fragment, { children: [_jsx("b", { children: item.workflowTitle }), _jsxs("small", { className: "oxa-member-sub", children: [item.nodeTitle, " \u00B7 ", item.workflowCode, "/", item.nodeId] })] })),
+                    },
+                    {
+                        title: '版本',
+                        render: (_, item) => (_jsxs(_Fragment, { children: ["\u5B9A\u4E49 v", item.definitionVersion, " / \u7ED1\u5B9A v", item.bindingVersion, _jsxs("small", { className: "oxa-member-sub", children: ["\u914D\u7F6E r", item.configurationRevision] })] })),
+                    },
+                    {
+                        title: '使用上下文',
+                        render: (_, item) => item.contexts.map((context) => (_jsx(Tag, { children: context === 'active' ? '当前激活' : '在途固定版本' }, context))),
+                    },
+                    {
+                        title: '来源',
+                        render: (_, item) => (_jsxs(_Fragment, { children: [item.source === 'default_binding'
+                                    ? '代码默认角色'
+                                    : item.source === 'node_override'
+                                        ? '节点配置覆盖'
+                                        : '代码许可路由来源', item.routingSourceCode && (_jsx("small", { className: "oxa-member-sub", children: item.routingSourceCode })), item.scopeDimensionCode && (_jsxs("small", { className: "oxa-member-sub", children: ["\u8303\u56F4\u7EF4\u5EA6\uFF1A", item.scopeDimensionCode] }))] })),
+                    },
+                ] })] }));
+}
+//# sourceMappingURL=RoleMembershipManager.js.map