feat: add health data management workspace

app/api/health/admin/route.ts

@@ -0,0 +1,22 @@
+import { jsonFailure, jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { listHealthAdminData } from "@/modules/health/server/operations";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("health:read", {
+    action: "health.admin.list",
+    targetType: "health",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看健康数据", 400);
+  }
+
+  const data = await listHealthAdminData(organizationId);
+  return jsonSuccess("健康数据已加载", { data });
+}

app/api/health/chronic-conditions/route.ts

@@ -0,0 +1,43 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createChronicCondition, isMutationFailure } from "@/modules/health/server/operations";
+import { validateChronicConditionInput } from "@/modules/health/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("health:manage", {
+    action: "health.condition.create",
+    targetType: "chronic_condition",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护慢病记录", 400);
+  }
+
+  const input = validateChronicConditionInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const condition = await createChronicCondition({ ...input.data, organizationId });
+  if (isMutationFailure(condition)) {
+    return jsonFailure(condition.reason, condition.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "health.condition.create",
+    targetType: "chronic_condition",
+    targetId: condition.id,
+    result: "success",
+    reason: `新增慢病记录：${condition.elderName} / ${condition.name}`,
+  });
+
+  return jsonSuccess("慢病记录已创建", { condition }, 201);
+}

app/api/health/health-routes.test.ts

@@ -0,0 +1,372 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import type { AuthContext } from "@/modules/core/types";
+import {
+  createChronicCondition,
+  createVitalRecord,
+  listHealthAdminData,
+  updateHealthReview,
+  upsertHealthProfile,
+} from "@/modules/health/server/operations";
+
+vi.mock("@/modules/core/server/auth", () => ({
+  requirePermission: vi.fn(),
+}));
+
+vi.mock("@/modules/core/server/audit", () => ({
+  recordAuditLog: vi.fn(),
+}));
+
+vi.mock("@/modules/health/server/operations", () => ({
+  createChronicCondition: vi.fn(),
+  createVitalRecord: vi.fn(),
+  isMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listHealthAdminData: vi.fn(),
+  updateHealthReview: vi.fn(),
+  upsertHealthProfile: vi.fn(),
+}));
+
+const account: AuthContext["account"] = {
+  id: "account-1",
+  name: "Admin",
+  email: "admin@example.com",
+  avatarUrl: "",
+  role: "org_admin",
+  status: "active",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+function createAuthContext(overrides: Partial<AuthContext> = {}): AuthContext {
+  return {
+  account,
+  organization: {
+    id: "org-1",
+    name: "Demo Org",
+    slug: "demo-org",
+    status: "active",
+    registrationEnabled: true,
+    oidcEnabled: false,
+    oidcIssuerUrl: "",
+    oidcClientId: "",
+    oidcHasClientSecret: false,
+    oidcScopes: "openid profile email",
+    oidcRedirectUri: "",
+    oidcAvatarClaim: "picture",
+    oidcAutoProvision: false,
+    createdAt: "2026-07-02T00:00:00.000Z",
+    updatedAt: "2026-07-02T00:00:00.000Z",
+  },
+  organizations: [],
+  permissions: ["health:read", "health:manage"],
+  session: {
+    id: "session-1",
+    accountId: "account-1",
+    activeOrganizationId: "org-1",
+    createdAt: "2026-07-02T00:00:00.000Z",
+    expiresAt: "2026-07-09T00:00:00.000Z",
+  },
+  ...overrides,
+  };
+}
+
+const authContext = createAuthContext();
+
+const healthAdminData = {
+  chronicConditions: [],
+  elders: [],
+  metrics: {
+    eldersWithProfiles: 0,
+    pendingReviews: 0,
+    activeChronicConditions: 0,
+    vitalsToday: 0,
+  },
+  profiles: [],
+  reviews: [],
+  vitals: [],
+};
+
+function allowAuth(): void {
+  vi.mocked(requirePermission).mockResolvedValue({
+    success: true,
+    context: authContext,
+  });
+}
+
+function jsonRequest(body: Record<string, unknown>): Request {
+  return new Request("http://localhost/api/health", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+async function readJson(response: Response): Promise<Record<string, unknown>> {
+  return (await response.json()) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  allowAuth();
+});
+
+describe("health admin API routes", () => {
+  it("loads health admin data for the active organization", async () => {
+    vi.mocked(listHealthAdminData).mockResolvedValue(healthAdminData);
+
+    const { GET } = await import("./admin/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(body.data).toEqual(healthAdminData);
+    expect(listHealthAdminData).toHaveBeenCalledWith("org-1");
+  });
+
+  it("returns permission failures before loading admin data", async () => {
+    const denied = Response.json({ success: false, reason: "权限不足" }, { status: 403 });
+    vi.mocked(requirePermission).mockResolvedValue({ success: false, response: denied });
+
+    const { GET } = await import("./admin/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(403);
+    expect(body.reason).toBe("权限不足");
+    expect(listHealthAdminData).not.toHaveBeenCalled();
+  });
+
+  it("requires an active organization before loading admin data", async () => {
+    vi.mocked(requirePermission).mockResolvedValue({
+      success: true,
+      context: createAuthContext({ organization: undefined }),
+    });
+
+    const { GET } = await import("./admin/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("请选择机构后查看健康数据");
+    expect(listHealthAdminData).not.toHaveBeenCalled();
+  });
+
+  it("upserts one elder health profile", async () => {
+    vi.mocked(upsertHealthProfile).mockResolvedValue({
+      allergyNotes: "青霉素过敏",
+      careRestrictions: "低盐饮食",
+      createdAt: "2026-07-02T00:00:00.000Z",
+      elderId: "elder-1",
+      elderName: "王桂兰",
+      emergencyNotes: "胸闷需立即复核",
+      id: "profile-1",
+      medicalHistory: "高血压",
+      medicationNotes: "晨服降压药",
+      organizationId: "org-1",
+      updatedAt: "2026-07-02T00:00:00.000Z",
+    });
+
+    const { PUT } = await import("./profiles/[elderId]/route");
+    const response = await PUT(jsonRequest({ allergyNotes: "青霉素过敏" }), {
+      params: Promise.resolve({ elderId: "elder-1" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(upsertHealthProfile).toHaveBeenCalledWith(
+      expect.objectContaining({
+        elderId: "elder-1",
+        organizationId: "org-1",
+      }),
+    );
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "health.profile.upsert" }));
+  });
+
+  it("rejects invalid vital input", async () => {
+    const { POST } = await import("./vitals/route");
+    const response = await POST(jsonRequest({ elderId: "elder-1", recordedAt: "bad-date", source: "manual" }));
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("记录时间无效");
+    expect(createVitalRecord).not.toHaveBeenCalled();
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+
+  it("creates a vital record", async () => {
+    vi.mocked(createVitalRecord).mockResolvedValue({
+      review: {
+        createdAt: "2026-07-02T00:00:00.000Z",
+        description: "血压偏高",
+        elderId: "elder-1",
+        elderName: "王桂兰",
+        id: "review-1",
+        organizationId: "org-1",
+        resolutionNotes: "",
+        reviewedAt: undefined,
+        reviewedByAccountId: undefined,
+        reviewedByName: undefined,
+        severity: "warning",
+        status: "pending",
+        title: "血压异常",
+        updatedAt: "2026-07-02T00:00:00.000Z",
+        vitalRecordId: "vital-1",
+      },
+      vital: {
+        bloodGlucoseTenths: 62,
+        createdAt: "2026-07-02T00:00:00.000Z",
+        createdByAccountId: "account-1",
+        createdByName: "Admin",
+        diastolicBp: 96,
+        elderId: "elder-1",
+        elderName: "王桂兰",
+        heartRate: 88,
+        id: "vital-1",
+        notes: "复测",
+        organizationId: "org-1",
+        recordedAt: "2026-07-02T09:00:00.000Z",
+        source: "manual",
+        spo2: 96,
+        systolicBp: 158,
+        temperatureTenths: 367,
+        updatedAt: "2026-07-02T00:00:00.000Z",
+        weightTenths: 612,
+      },
+    });
+
+    const { POST } = await import("./vitals/route");
+    const response = await POST(
+      jsonRequest({
+        elderId: "elder-1",
+        recordedAt: "2026-07-02T09:00:00.000Z",
+        source: "manual",
+        systolicBp: 158,
+        diastolicBp: 96,
+      }),
+    );
+    const body = await readJson(response);
+
+    expect(response.status).toBe(201);
+    expect(body.success).toBe(true);
+    expect(createVitalRecord).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "account-1",
+        organizationId: "org-1",
+      }),
+    );
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "health.vital.create" }));
+  });
+
+  it("creates a chronic condition", async () => {
+    vi.mocked(createChronicCondition).mockResolvedValue({
+      createdAt: "2026-07-02T00:00:00.000Z",
+      diagnosedAt: "2024-01-01T00:00:00.000Z",
+      elderId: "elder-1",
+      elderName: "王桂兰",
+      followUpNotes: "每周复查",
+      id: "condition-1",
+      name: "高血压",
+      organizationId: "org-1",
+      status: "active",
+      treatmentNotes: "规律用药",
+      updatedAt: "2026-07-02T00:00:00.000Z",
+    });
+
+    const { POST } = await import("./chronic-conditions/route");
+    const response = await POST(
+      jsonRequest({
+        diagnosedAt: "2024-01-01T00:00:00.000Z",
+        elderId: "elder-1",
+        name: "高血压",
+        status: "active",
+      }),
+    );
+    const body = await readJson(response);
+
+    expect(response.status).toBe(201);
+    expect(body.success).toBe(true);
+    expect(createChronicCondition).toHaveBeenCalledWith(expect.objectContaining({ organizationId: "org-1" }));
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "health.condition.create" }));
+  });
+
+  it("returns structured failures for missing or cross-organization chronic condition elders", async () => {
+    vi.mocked(createChronicCondition).mockResolvedValue({
+      success: false,
+      reason: "老人档案不存在",
+      status: 404,
+    });
+
+    const { POST } = await import("./chronic-conditions/route");
+    const response = await POST(
+      jsonRequest({
+        elderId: "elder-from-other-org",
+        name: "高血压",
+        status: "active",
+      }),
+    );
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("老人档案不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+
+  it("updates an anomaly review", async () => {
+    vi.mocked(updateHealthReview).mockResolvedValue({
+      createdAt: "2026-07-02T00:00:00.000Z",
+      description: "血压偏高",
+      elderId: "elder-1",
+      elderName: "王桂兰",
+      id: "review-1",
+      organizationId: "org-1",
+      resolutionNotes: "已复测并通知医生",
+      reviewedAt: "2026-07-02T10:00:00.000Z",
+      reviewedByAccountId: "account-1",
+      reviewedByName: "Admin",
+      severity: "warning",
+      status: "reviewed",
+      title: "血压异常",
+      updatedAt: "2026-07-02T10:00:00.000Z",
+      vitalRecordId: "vital-1",
+    });
+
+    const { PATCH } = await import("./reviews/[id]/route");
+    const response = await PATCH(jsonRequest({ status: "reviewed", resolutionNotes: "已复测并通知医生" }), {
+      params: Promise.resolve({ id: "review-1" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(updateHealthReview).toHaveBeenCalledWith(
+      expect.objectContaining({
+        accountId: "account-1",
+        id: "review-1",
+        organizationId: "org-1",
+      }),
+    );
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "health.review.update" }));
+  });
+
+  it("returns structured failures for missing or cross-organization reviews", async () => {
+    vi.mocked(updateHealthReview).mockResolvedValue({
+      success: false,
+      reason: "异常复核记录不存在",
+      status: 404,
+    });
+
+    const { PATCH } = await import("./reviews/[id]/route");
+    const response = await PATCH(jsonRequest({ status: "reviewed", resolutionNotes: "已复核" }), {
+      params: Promise.resolve({ id: "review-from-other-org" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("异常复核记录不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+});

app/api/health/profiles/[elderId]/route.ts

@@ -0,0 +1,51 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { isMutationFailure, upsertHealthProfile } from "@/modules/health/server/operations";
+import { validateHealthProfileInput } from "@/modules/health/types";
+
+type RouteContext = {
+  params: Promise<{
+    elderId: string;
+  }>;
+};
+
+export async function PUT(request: Request, context: RouteContext): Promise<Response> {
+  const { elderId } = await context.params;
+  const auth = await requirePermission("health:manage", {
+    action: "health.profile.upsert",
+    targetType: "elder",
+    targetId: elderId,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护健康档案", 400);
+  }
+
+  const input = validateHealthProfileInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const profile = await upsertHealthProfile({ ...input.data, elderId, organizationId });
+  if (isMutationFailure(profile)) {
+    return jsonFailure(profile.reason, profile.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "health.profile.upsert",
+    targetType: "elder",
+    targetId: elderId,
+    result: "success",
+    reason: `维护健康档案：${profile.elderName}`,
+  });
+
+  return jsonSuccess("健康档案已保存", { profile });
+}

app/api/health/reviews/[id]/route.ts

@@ -0,0 +1,56 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { isMutationFailure, updateHealthReview } from "@/modules/health/server/operations";
+import { validateHealthReviewUpdateInput } from "@/modules/health/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("health:manage", {
+    action: "health.review.update",
+    targetType: "health_review",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后处理异常复核", 400);
+  }
+
+  const input = validateHealthReviewUpdateInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const review = await updateHealthReview({
+    ...input.data,
+    id,
+    organizationId,
+    accountId: auth.context.account.id,
+  });
+  if (isMutationFailure(review)) {
+    return jsonFailure(review.reason, review.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "health.review.update",
+    targetType: "health_review",
+    targetId: review.id,
+    result: "success",
+    reason: `处理健康异常复核：${review.elderName}`,
+  });
+
+  return jsonSuccess("异常复核已更新", { review });
+}

app/api/health/vitals/route.ts

@@ -0,0 +1,43 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createVitalRecord, isMutationFailure } from "@/modules/health/server/operations";
+import { validateVitalRecordInput } from "@/modules/health/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("health:manage", {
+    action: "health.vital.create",
+    targetType: "vital_record",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后录入生命体征", 400);
+  }
+
+  const input = validateVitalRecordInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const created = await createVitalRecord({ ...input.data, organizationId, accountId: auth.context.account.id });
+  if (isMutationFailure(created)) {
+    return jsonFailure(created.reason, created.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "health.vital.create",
+    targetType: "vital_record",
+    targetId: created.vital.id,
+    result: "success",
+    reason: `录入生命体征：${created.vital.elderName}`,
+  });
+
+  return jsonSuccess("生命体征已录入", created, 201);
+}