fix: use real settings data boundaries

2026-07-02 19:53:41 -07:00
parent 1cdf89c608
commit 5412bbb143
14 changed files with 414 additions and 170 deletions
--- a/app/(app)/app/settings/audit/page.tsx
+++ b/app/(app)/app/settings/audit/page.tsx
@@ -2,9 +2,9 @@ import { redirect } from "next/navigation";

 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Table } from "@/components/ui/table";
+import { listAuditLogs } from "@/modules/core/server/audit";
 import { getCurrentAuthContext } from "@/modules/core/server/auth";
 import { hasPermission } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
 import { TablePagination, TableToolbar } from "@/modules/settings/components/TableToolbar";
 import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";

@@ -25,9 +25,12 @@ export default async function AuditPage({ searchParams }: AuditPageProps): Promi
  const params = (await searchParams) ?? {};
  const query = getSearchParam(params, "q");
  const page = getPage(params);
-  const data = await readData();
+  const logs = await listAuditLogs({
+    organizationId: context.account.platformRoleId ? undefined : context.organization?.id,
+    limit: 100,
+  });
  const normalizedQuery = query.trim().toLowerCase();
-  const filteredLogs = data.auditLogs.filter((log) =>
+  const filteredLogs = logs.filter((log) =>
    [log.actorEmail ?? "系统", log.action, log.targetType, log.targetId ?? "", log.result, log.reason]
      .join(" ")
      .toLowerCase()
@@ -38,10 +41,6 @@ export default async function AuditPage({ searchParams }: AuditPageProps): Promi

  return (
    <div className="flex flex-col gap-5">
-      <section className="border-b pb-4">
-        <h2 className="text-xl font-semibold">审计日志</h2>
-      </section>
-
      <Card>
        <CardHeader>
          <CardTitle>审计列表</CardTitle>
--- a/app/(app)/app/settings/layout.tsx
+++ b/app/(app)/app/settings/layout.tsx
@@ -3,12 +3,5 @@ type SettingsLayoutProps = {
 };

 export default function SettingsLayout({ children }: SettingsLayoutProps): React.ReactElement {
-  return (
-    <div className="mx-auto flex w-full max-w-7xl flex-col gap-5">
-      <section className="border-b pb-4">
-        <h1 className="text-2xl font-semibold tracking-normal">系统设置</h1>
-      </section>
-      {children}
-    </div>
-  );
+  return <div className="mx-auto flex w-full max-w-7xl flex-col gap-5">{children}</div>;
 }
--- a/app/(app)/app/settings/organizations/[id]/page.tsx
+++ b/app/(app)/app/settings/organizations/[id]/page.tsx
@@ -7,7 +7,13 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Table } from "@/components/ui/table";
 import { getCurrentAuthContext, toPublicAccount } from "@/modules/core/server/auth";
 import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
+import {
+  listSettingsAccounts,
+  listSettingsJoinRequests,
+  listSettingsMemberships,
+  listSettingsOrganizationInvitations,
+  listSettingsOrganizations,
+} from "@/modules/core/server/settings";
 import { OrganizationDetailClient } from "@/modules/settings/components/OrganizationDetailClient";

 type OrganizationDetailPageProps = {
@@ -29,19 +35,24 @@ export default async function OrganizationDetailPage({
  }

  const { id } = await params;
-  const data = await readData();
-  const organization = data.organizations.find((item) => item.id === id);
+  const organizations = await listSettingsOrganizations({ organizationId: id });
+  const organization = organizations[0];
  if (!organization) {
    notFound();
  }

-  if (context.organization?.id && context.organization.id !== organization.id) {
+  if (!context.account.platformRoleId && context.organization?.id && context.organization.id !== organization.id) {
    redirect("/app/settings/organizations");
  }

-  const roles = await getRoleDefinitions(organization.id);
-  const organizationMemberships = data.memberships.filter((membership) => membership.organizationId === organization.id);
-  const accountById = new Map(data.accounts.map((account) => [account.id, account]));
+  const [roles, organizationMemberships, organizationAccounts, invitations, joinRequests] = await Promise.all([
+    getRoleDefinitions(organization.id),
+    listSettingsMemberships({ organizationId: organization.id }),
+    listSettingsAccounts({ organizationId: organization.id }),
+    listSettingsOrganizationInvitations({ organizationId: organization.id }),
+    listSettingsJoinRequests({ organizationId: organization.id }),
+  ]);
+  const accountById = new Map(organizationAccounts.map((account) => [account.id, account]));
  const members = organizationMemberships
    .map((membership) => {
      const account = accountById.get(membership.accountId);
@@ -55,10 +66,7 @@ export default async function OrganizationDetailPage({
      };
    })
    .filter((item): item is NonNullable<typeof item> => item !== null);
-  const invitations = data.organizationInvitations.filter((invitation) => invitation.organizationId === organization.id);
-  const pendingRequests = data.joinRequests.filter(
-    (request) => request.organizationId === organization.id && request.status === "pending",
-  );
+  const pendingRequests = joinRequests.filter((request) => request.status === "pending");

  return (
    <div className="flex flex-col gap-5">
--- a/app/(app)/app/settings/organizations/page.tsx
+++ b/app/(app)/app/settings/organizations/page.tsx
@@ -5,7 +5,7 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Table } from "@/components/ui/table";
 import { getCurrentAuthContext } from "@/modules/core/server/auth";
 import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
+import { listSettingsOrganizations } from "@/modules/core/server/settings";
 import {
  OrganizationManagementClient,
  OrganizationRowActions,
@@ -30,9 +30,10 @@ export default async function OrganizationsPage({ searchParams }: OrganizationsP
  const params = (await searchParams) ?? {};
  const query = getSearchParam(params, "q");
  const page = getPage(params);
-  const data = await readData();
+  const organizationScopeId = context.account.platformRoleId ? undefined : context.organization?.id;
+  const organizations = await listSettingsOrganizations(organizationScopeId ? { organizationId: organizationScopeId } : {});
  const normalizedQuery = query.trim().toLowerCase();
-  const filteredOrganizations = data.organizations.filter((organization) =>
+  const filteredOrganizations = organizations.filter((organization) =>
    [organization.name, organization.slug, organization.status].join(" ").toLowerCase().includes(normalizedQuery),
  );
  const pageCount = getPageCount(filteredOrganizations.length);
@@ -51,10 +52,11 @@ export default async function OrganizationsPage({ searchParams }: OrganizationsP

  return (
    <div className="flex flex-col gap-5">
-      <section className="flex flex-col gap-3 border-b pb-4 lg:flex-row lg:items-center lg:justify-between">
-        <h2 className="text-xl font-semibold">机构管理</h2>
-        {canManageOrganizations ? <OrganizationManagementClient /> : null}
-      </section>
+      {canManageOrganizations ? (
+        <div className="flex justify-end">
+          <OrganizationManagementClient />
+        </div>
+      ) : null}

      <Card>
        <CardHeader>
--- a/app/(app)/app/settings/roles/page.tsx
+++ b/app/(app)/app/settings/roles/page.tsx
@@ -36,10 +36,11 @@ export default async function RolesPage({ searchParams }: RolesPageProps): Promi

  return (
    <div className="flex flex-col gap-5">
-      <section className="flex flex-col gap-3 border-b pb-4 lg:flex-row lg:items-center lg:justify-between">
-        <h2 className="text-xl font-semibold">角色权限</h2>
-        {canManageRoles ? <RoleManagementClient permissions={PERMISSION_DEFINITIONS} /> : null}
-      </section>
+      {canManageRoles ? (
+        <div className="flex justify-end">
+          <RoleManagementClient permissions={PERMISSION_DEFINITIONS} />
+        </div>
+      ) : null}

      <Card>
        <CardHeader>
--- a/app/(app)/app/settings/status/page.tsx
+++ b/app/(app)/app/settings/status/page.tsx
@@ -6,7 +6,12 @@ import { Table } from "@/components/ui/table";
 import { checkDatabaseConnection } from "@/modules/core/server/db";
 import { getCurrentAuthContext } from "@/modules/core/server/auth";
 import { hasPermission } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
+import {
+  countSettingsBeds,
+  listSettingsAccounts,
+  listSettingsIncidents,
+  listSettingsOrganizations,
+} from "@/modules/core/server/settings";
 import { IncidentStatusActions } from "@/modules/settings/components/IncidentStatusActions";
 import { TablePagination, TableToolbar } from "@/modules/settings/components/TableToolbar";
 import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
@@ -28,10 +33,18 @@ export default async function StatusPage({ searchParams }: StatusPageProps): Pro
  const params = (await searchParams) ?? {};
  const query = getSearchParam(params, "q");
  const page = getPage(params);
-  const [data, databaseHealth] = await Promise.all([readData(), checkDatabaseConnection()]);
+  const organizationScopeId = context.account.platformRoleId ? undefined : context.organization?.id;
+  const scopeParams = organizationScopeId ? { organizationId: organizationScopeId } : {};
+  const [organizations, accounts, bedCount, incidents, databaseHealth] = await Promise.all([
+    listSettingsOrganizations(scopeParams),
+    listSettingsAccounts(scopeParams),
+    countSettingsBeds(scopeParams),
+    listSettingsIncidents(scopeParams),
+    checkDatabaseConnection(),
+  ]);
  const canManageIncidents = hasPermission(context.permissions, "incident:manage");
  const normalizedQuery = query.trim().toLowerCase();
-  const filteredIncidents = data.incidents.filter((incident) =>
+  const filteredIncidents = incidents.filter((incident) =>
    [incident.title, incident.description, incident.source, incident.severity, incident.status]
      .join(" ")
      .toLowerCase()
@@ -42,36 +55,33 @@ export default async function StatusPage({ searchParams }: StatusPageProps): Pro

  return (
    <div className="flex flex-col gap-5">
-      <section className="flex flex-col gap-3 border-b pb-4 sm:flex-row sm:items-center sm:justify-between">
-        <div>
-          <h2 className="text-xl font-semibold">运行状态</h2>
-          <p className="mt-1 text-sm text-muted-foreground">{databaseHealth.reason}</p>
-        </div>
+      <section className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+        <p className="text-sm text-muted-foreground">{databaseHealth.reason}</p>
        <Badge variant={databaseHealth.ok ? "success" : "danger"}>{databaseHealth.ok ? "Healthy" : "Degraded"}</Badge>
      </section>

      <section className="grid gap-4 md:grid-cols-4">
        <Card>
          <CardHeader>
-            <CardTitle className="text-3xl">{data.organizations.length}</CardTitle>
+            <CardTitle className="text-3xl">{organizations.length}</CardTitle>
          </CardHeader>
          <CardContent className="pt-0 text-sm text-muted-foreground">机构</CardContent>
        </Card>
        <Card>
          <CardHeader>
-            <CardTitle className="text-3xl">{data.accounts.length}</CardTitle>
+            <CardTitle className="text-3xl">{accounts.length}</CardTitle>
          </CardHeader>
          <CardContent className="pt-0 text-sm text-muted-foreground">账号</CardContent>
        </Card>
        <Card>
          <CardHeader>
-            <CardTitle className="text-3xl">{data.beds.length}</CardTitle>
+            <CardTitle className="text-3xl">{bedCount}</CardTitle>
          </CardHeader>
          <CardContent className="pt-0 text-sm text-muted-foreground">床位</CardContent>
        </Card>
        <Card>
          <CardHeader>
-            <CardTitle className="text-3xl">{data.incidents.length}</CardTitle>
+            <CardTitle className="text-3xl">{incidents.length}</CardTitle>
          </CardHeader>
          <CardContent className="pt-0 text-sm text-muted-foreground">故障事件</CardContent>
        </Card>
--- a/app/(app)/app/settings/users/page.tsx
+++ b/app/(app)/app/settings/users/page.tsx
@@ -5,7 +5,12 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Table } from "@/components/ui/table";
 import { getCurrentAuthContext, toPublicAccount } from "@/modules/core/server/auth";
 import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
+import {
+  listSettingsAccounts,
+  listSettingsJoinRequests,
+  listSettingsMemberships,
+  listSettingsOrganizations,
+} from "@/modules/core/server/settings";
 import { ROLE_LABELS } from "@/modules/core/types";
 import type { RoleId } from "@/modules/core/types";
 import { TablePagination, TableToolbar } from "@/modules/settings/components/TableToolbar";
@@ -38,16 +43,23 @@ export default async function UsersPage({ searchParams }: UsersPageProps): Promi
  const params = (await searchParams) ?? {};
  const query = getSearchParam(params, "q");
  const page = getPage(params);
-  const data = await readData();
-  const roles = await getRoleDefinitions(context.organization?.id);
+  const canReadAllAccounts = Boolean(context.account.platformRoleId);
+  const organizationScopeId = canReadAllAccounts ? undefined : context.organization?.id;
+  const [organizations, accountsData, memberships, joinRequests, roles] = await Promise.all([
+    listSettingsOrganizations(organizationScopeId ? { organizationId: organizationScopeId } : {}),
+    listSettingsAccounts(organizationScopeId ? { organizationId: organizationScopeId } : {}),
+    listSettingsMemberships(organizationScopeId ? { organizationId: organizationScopeId } : {}),
+    listSettingsJoinRequests(organizationScopeId ? { organizationId: organizationScopeId } : {}),
+    getRoleDefinitions(context.organization?.id),
+  ]);
  const roleById = new Map(roles.map((role) => [role.id, role]));
-  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
-  const accounts = data.accounts.map((account) => {
+  const organizationById = new Map(organizations.map((organization) => [organization.id, organization]));
+  const accounts = accountsData.map((account) => {
    const membership = context.organization?.id
-      ? data.memberships.find(
+      ? memberships.find(
          (item) => item.accountId === account.id && item.organizationId === context.organization?.id && item.status === "active",
        )
-      : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
+      : memberships.find((item) => item.accountId === account.id && item.status === "active");
    const organization = membership ? organizationById.get(membership.organizationId) : undefined;
    const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;

@@ -65,15 +77,11 @@ export default async function UsersPage({ searchParams }: UsersPageProps): Promi

  return (
    <div className="flex flex-col gap-5">
-      <section className="border-b pb-4">
-        <h2 className="text-xl font-semibold">用户管理</h2>
-      </section>
-
      <UserManagementClient
        canManageAccounts={hasPermission(context.permissions, "account:manage")}
-        organizations={data.organizations}
+        organizations={organizations}
        roles={roles}
-        joinRequests={data.joinRequests}
+        joinRequests={joinRequests}
      />

      <Card>
@@ -125,7 +133,7 @@ export default async function UsersPage({ searchParams }: UsersPageProps): Promi
                      <UserAccountActions
                        account={account}
                        currentAccountId={context.account.id}
-                        organizations={data.organizations}
+                        organizations={organizations}
                        roles={roles}
                      />
                    </Table.Cell>
--- a/app/api/organizations/[id]/route.ts
+++ b/app/api/organizations/[id]/route.ts
@@ -37,6 +37,10 @@ function readStatus(value: unknown): OrganizationStatus | null {
  return ORGANIZATION_STATUSES.find((status) => status === value) ?? null;
 }

+function isValidSlug(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
+}
+
 export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
  const { id } = await context.params;
  const auth = await requirePermission("organization:manage", {
@@ -55,7 +59,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
  }

  const name = readString(body, "name");
-  const slug = readString(body, "slug");
+  const slug = readString(body, "slug").toLowerCase();
  const oidcIssuerUrl = readString(body, "oidcIssuerUrl");
  const oidcClientId = readString(body, "oidcClientId");
  const oidcClientSecret = readString(body, "oidcClientSecret");
@@ -66,6 +70,12 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
  if ("status" in body && !status) {
    return jsonFailure("机构状态无效");
  }
+  if ("slug" in body && !slug) {
+    return jsonFailure("机构标识不能为空");
+  }
+  if (slug && !isValidSlug(slug)) {
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
+  }
  const registrationEnabled = "registrationEnabled" in body ? readBoolean(body, "registrationEnabled") : null;
  const oidcEnabled = "oidcEnabled" in body ? readBoolean(body, "oidcEnabled") : null;
  const oidcAutoProvision = "oidcAutoProvision" in body ? readBoolean(body, "oidcAutoProvision") : null;
--- a/app/api/organizations/route.ts
+++ b/app/api/organizations/route.ts
@@ -17,14 +17,8 @@ function readString(source: Record<string, unknown>, key: string): string {
  return typeof value === "string" ? value.trim() : "";
 }

-function createSlug(name: string): string {
-  const base = name
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-|-$/g, "");
-
-  return base.length > 0 ? base : `org-${Date.now()}`;
+function isValidSlug(value: string): boolean {
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
 }

 export async function GET(): Promise<Response> {
@@ -76,13 +70,21 @@ export async function POST(request: Request): Promise<Response> {
  if (!name) {
    return jsonFailure("机构名称不能为空");
  }
+  const slug = readString(body, "slug").toLowerCase();
+  if (!slug) {
+    return jsonFailure("机构标识不能为空");
+  }
+  if (!isValidSlug(slug)) {
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
+  }

  const database = getDatabase();
+  try {
    const rows = await database
      .insert(organizations)
      .values({
        name,
-      slug: readString(body, "slug") || createSlug(name),
+        slug,
        status: "active",
      })
      .returning();
@@ -103,4 +105,12 @@ export async function POST(request: Request): Promise<Response> {
    });

    return jsonSuccess("机构已创建", { organization }, 201);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    if (message.includes("organizations_slug_unique")) {
+      return jsonFailure("机构标识已存在", 409);
+    }
+
+    return jsonFailure("机构创建失败", 500);
+  }
 }
--- a/app/api/settings/accounts/route.ts
+++ b/app/api/settings/accounts/route.ts
@@ -6,7 +6,11 @@ import { recordAuditLog } from "@/modules/core/server/audit";
 import { getDatabase } from "@/modules/core/server/db";
 import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
 import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
-import { readData } from "@/modules/core/server/store";
+import {
+  listSettingsAccounts,
+  listSettingsMemberships,
+  listSettingsOrganizations,
+} from "@/modules/core/server/settings";

 function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -27,30 +31,25 @@ export async function GET(): Promise<Response> {
    return auth.response;
  }

-  const data = await readData();
-  const canReadAllAccounts = hasPermission(auth.context.permissions, "platform:manage");
-  const organizationId = auth.context.organization?.id;
-  const roleDefinitions = await getRoleDefinitions(organizationId);
+  const canReadAllAccounts = Boolean(auth.context.account.platformRoleId) || hasPermission(auth.context.permissions, "platform:manage");
+  const organizationId = canReadAllAccounts ? undefined : auth.context.organization?.id;
+  const [accountRows, membershipRows, organizationRows, roleDefinitions] = await Promise.all([
+    listSettingsAccounts(organizationId ? { organizationId } : {}),
+    listSettingsMemberships(organizationId ? { organizationId } : {}),
+    listSettingsOrganizations(organizationId ? { organizationId } : {}),
+    getRoleDefinitions(auth.context.organization?.id),
+  ]);
  const roleById = new Map(roleDefinitions.map((role) => [role.id, role]));
-  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
-  const scopedAccountIds =
-    organizationId && !canReadAllAccounts
-      ? new Set(
-          data.memberships
-            .filter((membership) => membership.organizationId === organizationId)
-            .map((membership) => membership.accountId),
-        )
-      : null;
+  const organizationById = new Map(organizationRows.map((organization) => [organization.id, organization]));

  return jsonSuccess("账号列表已加载", {
-    accounts: data.accounts
-      .filter((account) => !scopedAccountIds || scopedAccountIds.has(account.id))
-      .map((account) => {
-        const membership = organizationId
-          ? data.memberships.find(
-              (item) => item.accountId === account.id && item.organizationId === organizationId && item.status === "active",
+    accounts: accountRows.map((account) => {
+      const membership = auth.context.organization?.id
+        ? membershipRows.find(
+            (item) =>
+              item.accountId === account.id && item.organizationId === auth.context.organization?.id && item.status === "active",
            )
-          : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
+        : membershipRows.find((item) => item.accountId === account.id && item.status === "active");
      const organization = membership ? organizationById.get(membership.organizationId) : undefined;
      const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;

--- a/app/api/settings/join-requests/route.ts
+++ b/app/api/settings/join-requests/route.ts
@@ -1,6 +1,6 @@
 import { jsonSuccess } from "@/modules/core/server/api";
 import { requirePermission } from "@/modules/core/server/auth";
-import { readData } from "@/modules/core/server/store";
+import { listSettingsJoinRequests } from "@/modules/core/server/settings";

 export async function GET(): Promise<Response> {
  const auth = await requirePermission("account:read", {
@@ -12,12 +12,9 @@ export async function GET(): Promise<Response> {
    return auth.response;
  }

-  const data = await readData();
-  const organizationId = auth.context.organization?.id;
+  const organizationId = auth.context.account.platformRoleId ? undefined : auth.context.organization?.id;

  return jsonSuccess("加入申请已加载", {
-    joinRequests: organizationId
-      ? data.joinRequests.filter((request) => request.organizationId === organizationId)
-      : data.joinRequests,
+    joinRequests: await listSettingsJoinRequests(organizationId ? { organizationId } : {}),
  });
 }
--- a/modules/core/server/settings.ts
+++ b/modules/core/server/settings.ts
@@ -0,0 +1,228 @@
+import { desc, eq, sql } from "drizzle-orm";
+
+import { getDatabase } from "@/modules/core/server/db";
+import {
+  accounts,
+  beds,
+  joinRequests,
+  memberships,
+  organizationInvitations,
+  organizations,
+  roles,
+  systemIncidents,
+} from "@/modules/core/server/schema";
+import type {
+  Account,
+  JoinRequest,
+  Membership,
+  Organization,
+  OrganizationInvitation,
+  SystemIncident,
+} from "@/modules/core/types";
+
+function iso(value: Date): string {
+  return value.toISOString();
+}
+
+function toOrganization(row: typeof organizations.$inferSelect): Organization {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAvatarClaim: row.oidcAvatarClaim,
+    oidcAutoProvision: row.oidcAutoProvision,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  };
+}
+
+function toAccount(row: typeof accounts.$inferSelect): Account {
+  return {
+    id: row.id,
+    platformRoleId: row.platformRoleId ?? undefined,
+    name: row.name,
+    email: row.email,
+    avatarUrl: row.avatarUrl,
+    role: row.platformRoleId ?? "viewer",
+    passwordHash: row.passwordHash,
+    passwordSalt: row.passwordSalt,
+    status: row.status,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  };
+}
+
+function toMembership(row: typeof memberships.$inferSelect, role: typeof roles.$inferSelect): Membership {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    organizationId: row.organizationId,
+    roleId: row.roleId,
+    roleKey: role.key,
+    roleLabel: role.label,
+    status: row.status,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  };
+}
+
+function toJoinRequest(row: {
+  accountEmail: string;
+  accountName: string;
+  organizationName: string;
+  request: typeof joinRequests.$inferSelect;
+}): JoinRequest {
+  return {
+    id: row.request.id,
+    accountId: row.request.accountId,
+    accountName: row.accountName,
+    accountEmail: row.accountEmail,
+    organizationId: row.request.organizationId,
+    organizationName: row.organizationName,
+    status: row.request.status,
+    reason: row.request.reason,
+    reviewedByAccountId: row.request.reviewedByAccountId ?? undefined,
+    reviewedAt: row.request.reviewedAt ? iso(row.request.reviewedAt) : undefined,
+    createdAt: iso(row.request.createdAt),
+  };
+}
+
+function toOrganizationInvitation(row: {
+  invitation: typeof organizationInvitations.$inferSelect;
+  organizationName: string;
+  roleLabel: string;
+}): OrganizationInvitation {
+  return {
+    id: row.invitation.id,
+    organizationId: row.invitation.organizationId,
+    organizationName: row.organizationName,
+    roleId: row.invitation.roleId,
+    roleLabel: row.roleLabel,
+    email: row.invitation.email,
+    token: row.invitation.token,
+    status: row.invitation.status as OrganizationInvitation["status"],
+    createdByAccountId: row.invitation.createdByAccountId ?? undefined,
+    acceptedByAccountId: row.invitation.acceptedByAccountId ?? undefined,
+    acceptedAt: row.invitation.acceptedAt ? iso(row.invitation.acceptedAt) : undefined,
+    expiresAt: iso(row.invitation.expiresAt),
+    createdAt: iso(row.invitation.createdAt),
+    updatedAt: iso(row.invitation.updatedAt),
+  };
+}
+
+function toSystemIncident(row: typeof systemIncidents.$inferSelect): SystemIncident {
+  return {
+    id: row.id,
+    organizationId: row.organizationId ?? undefined,
+    severity: row.severity,
+    status: row.status,
+    title: row.title,
+    description: row.description,
+    source: row.source,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  };
+}
+
+export async function listSettingsOrganizations(params: { organizationId?: string } = {}): Promise<Organization[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select()
+    .from(organizations)
+    .where(params.organizationId ? eq(organizations.id, params.organizationId) : sql`true`)
+    .orderBy(desc(organizations.createdAt));
+
+  return rows.map(toOrganization);
+}
+
+export async function listSettingsAccounts(params: { organizationId?: string } = {}): Promise<Account[]> {
+  const database = getDatabase();
+  const rows = params.organizationId
+    ? await database
+        .select({ account: accounts })
+        .from(accounts)
+        .innerJoin(memberships, eq(memberships.accountId, accounts.id))
+        .where(eq(memberships.organizationId, params.organizationId))
+        .orderBy(desc(accounts.createdAt))
+    : await database.select({ account: accounts }).from(accounts).orderBy(desc(accounts.createdAt));
+
+  return rows.map((row) => toAccount(row.account));
+}
+
+export async function listSettingsMemberships(params: { organizationId?: string } = {}): Promise<Membership[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select({ membership: memberships, role: roles })
+    .from(memberships)
+    .innerJoin(roles, eq(roles.id, memberships.roleId))
+    .where(params.organizationId ? eq(memberships.organizationId, params.organizationId) : sql`true`)
+    .orderBy(desc(memberships.createdAt));
+
+  return rows.map((row) => toMembership(row.membership, row.role));
+}
+
+export async function listSettingsJoinRequests(params: { organizationId?: string } = {}): Promise<JoinRequest[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select({
+      request: joinRequests,
+      accountName: accounts.name,
+      accountEmail: accounts.email,
+      organizationName: organizations.name,
+    })
+    .from(joinRequests)
+    .innerJoin(accounts, eq(accounts.id, joinRequests.accountId))
+    .innerJoin(organizations, eq(organizations.id, joinRequests.organizationId))
+    .where(params.organizationId ? eq(joinRequests.organizationId, params.organizationId) : sql`true`)
+    .orderBy(desc(joinRequests.createdAt));
+
+  return rows.map(toJoinRequest);
+}
+
+export async function listSettingsOrganizationInvitations(
+  params: { organizationId?: string } = {},
+): Promise<OrganizationInvitation[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select({
+      invitation: organizationInvitations,
+      organizationName: organizations.name,
+      roleLabel: roles.label,
+    })
+    .from(organizationInvitations)
+    .innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
+    .innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
+    .where(params.organizationId ? eq(organizationInvitations.organizationId, params.organizationId) : sql`true`)
+    .orderBy(desc(organizationInvitations.createdAt));
+
+  return rows.map(toOrganizationInvitation);
+}
+
+export async function listSettingsIncidents(params: { organizationId?: string } = {}): Promise<SystemIncident[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select()
+    .from(systemIncidents)
+    .where(params.organizationId ? eq(systemIncidents.organizationId, params.organizationId) : sql`true`)
+    .orderBy(desc(systemIncidents.createdAt));
+
+  return rows.map(toSystemIncident);
+}
+
+export async function countSettingsBeds(params: { organizationId?: string } = {}): Promise<number> {
+  const database = getDatabase();
+  const rows = await database
+    .select({ count: sql<number>`count(*)::int` })
+    .from(beds)
+    .where(params.organizationId ? eq(beds.organizationId, params.organizationId) : sql`true`);
+
+  return rows[0]?.count ?? 0;
+}
--- a/modules/settings/components/OrganizationManagementClient.tsx
+++ b/modules/settings/components/OrganizationManagementClient.tsx
@@ -73,7 +73,13 @@ export function OrganizationManagementClient(): React.ReactElement {
      >
        <form className="grid gap-4" onSubmit={handleSubmit}>
          <Input label="机构名称" name="name" placeholder="机构名称" required />
-          <Input label="机构标识" name="slug" placeholder="可留空" />
+          <Input
+            label="机构标识"
+            name="slug"
+            pattern="[a-z0-9][a-z0-9-]{1,47}"
+            placeholder="sunrise-care"
+            required
+          />
          {message ? (
            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
              {message}
@@ -196,7 +202,13 @@ export function OrganizationRowActions({
      >
        <form className="grid gap-4" onSubmit={handleSubmit}>
          <Input defaultValue={organization.name} label="机构名称" name="name" required />
-          <Input defaultValue={organization.slug} label="机构标识" name="slug" required />
+          <Input
+            defaultValue={organization.slug}
+            label="机构标识"
+            name="slug"
+            pattern="[a-z0-9][a-z0-9-]{1,47}"
+            required
+          />
          <Select
            defaultValue={organization.status}
            label="状态"
--- a/modules/shared/components/ModulePage.tsx
+++ b/modules/shared/components/ModulePage.tsx
@@ -1,8 +1,7 @@
 import type { LucideIcon } from "lucide-react";
-import { Database, ExternalLink } from "lucide-react";
+import { Database } from "lucide-react";

 import { Badge } from "@/components/ui/badge";
-import { LinkButton } from "@/components/ui/button";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";

 type ModulePageProps = {
@@ -13,12 +12,6 @@ type ModulePageProps = {
  phase: "待接入" | "二期预留" | "三期预留";
 };

-const realWorkspaceLinks = [
-  { href: "/app/dashboard", label: "运营看板" },
-  { href: "/app/elders", label: "老人档案" },
-  { href: "/app/beds", label: "床位房间" },
-];
-
 export function ModulePage({ title, eyebrow, description, icon: Icon, phase }: ModulePageProps): React.ReactElement {
  return (
    <div className="mx-auto flex w-full max-w-7xl flex-col gap-6">
@@ -38,45 +31,19 @@ export function ModulePage({ title, eyebrow, description, icon: Icon, phase }: M
        </div>
      </section>

-      <section className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_24rem]">
-        <Card>
+      <section>
+        <Card className="max-w-3xl">
          <CardHeader>
            <CardTitle className="flex items-center gap-2 text-base">
              <Database className="size-5 text-primary" aria-hidden="true" />
-              数据状态
+              未接入真实数据源
            </CardTitle>
-            <CardDescription>当前模块未接入真实业务数据源。</CardDescription>
+            <CardDescription>当前模块暂不展示业务记录、统计指标或流程入口。</CardDescription>
          </CardHeader>
          <CardContent>
-            <dl className="grid gap-3 text-sm">
-              <div className="flex items-center justify-between gap-4 border-b pb-3">
-                <dt className="text-muted-foreground">业务记录</dt>
-                <dd className="font-medium">暂不展示</dd>
-              </div>
-              <div className="flex items-center justify-between gap-4 border-b pb-3">
-                <dt className="text-muted-foreground">统计指标</dt>
-                <dd className="font-medium">暂不展示</dd>
-              </div>
-              <div className="flex items-center justify-between gap-4">
-                <dt className="text-muted-foreground">待办流程</dt>
-                <dd className="font-medium">待真实流程接入</dd>
-              </div>
-            </dl>
-          </CardContent>
-        </Card>
-
-        <Card>
-          <CardHeader>
-            <CardTitle className="text-base">已接入工作区</CardTitle>
-            <CardDescription>以下页面展示真实系统数据。</CardDescription>
-          </CardHeader>
-          <CardContent className="grid gap-2">
-            {realWorkspaceLinks.map((link) => (
-              <LinkButton className="w-full justify-between" href={link.href} key={link.href} variant="outline">
-                {link.label}
-                <ExternalLink className="size-4" aria-hidden="true" />
-              </LinkButton>
-            ))}
+            <p className="text-sm text-muted-foreground">
+              接入对应的 Drizzle 查询和操作 API 前，这里只保留模块位置，不渲染未落库记录或伪造待办。
+            </p>
          </CardContent>
        </Card>
      </section>