feat: add emergency incident workspace

app/(app)/app/[organizationSlug]/emergency/page.tsx

@@ -1,5 +1,5 @@
 import EmergencyPage from "../../emergency/page";
 
-export default function ScopedEmergencyPage(): React.ReactElement {
+export default async function ScopedEmergencyPage(): Promise<React.ReactElement> {
   return EmergencyPage();
 }

app/(app)/app/emergency/page.tsx

@@ -1,15 +1,26 @@
-import { ShieldAlert } from "lucide-react";
+import { redirect } from "next/navigation";
 
-import { ModulePage } from "@/modules/shared/components/ModulePage";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { EmergencyWorkspaceClient } from "@/modules/emergency/components/EmergencyWorkspaceClient";
+import { listEmergencyIncidentData } from "@/modules/emergency/server/operations";
+import { getWorkspaceHref } from "@/modules/shared/lib/workspace-routing";
 
-export default function EmergencyPage(): React.ReactElement {
-  return (
-    <ModulePage
-      title="安全应急"
-      eyebrow="紧急呼叫与事件处理"
-      description="待接入紧急呼叫、接警派发、事件处理、完成归档和通知数据源。"
-      icon={ShieldAlert}
-      phase="待接入"
-    />
-  );
+export default async function EmergencyPage(): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "incident:read")) {
+    redirect(getWorkspaceHref(context.organization?.slug, "/dashboard"));
+  }
+
+  const organizationId = context.organization?.id;
+  if (!organizationId) {
+    redirect(getWorkspaceHref(context.organization?.slug, "/dashboard"));
+  }
+
+  const data = await listEmergencyIncidentData(organizationId);
+  return <EmergencyWorkspaceClient canManage={hasPermission(context.permissions, "incident:manage")} initialData={data} />;
 }

app/api/emergency/emergency-routes.test.ts

@@ -0,0 +1,248 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import type { AuthContext } from "@/modules/core/types";
+import type { EmergencyIncident, EmergencyIncidentData } from "@/modules/emergency/types";
+import {
+  createEmergencyIncident,
+  listEmergencyIncidentData,
+  updateEmergencyIncidentStatus,
+} from "@/modules/emergency/server/operations";
+
+vi.mock("@/modules/core/server/auth", () => ({
+  requirePermission: vi.fn(),
+}));
+
+vi.mock("@/modules/core/server/audit", () => ({
+  recordAuditLog: vi.fn(),
+}));
+
+vi.mock("@/modules/emergency/server/operations", () => ({
+  createEmergencyIncident: vi.fn(),
+  isEmergencyMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listEmergencyIncidentData: vi.fn(),
+  updateEmergencyIncidentStatus: vi.fn(),
+}));
+
+const account: AuthContext["account"] = {
+  id: "account-1",
+  name: "Admin",
+  email: "admin@example.com",
+  avatarUrl: "",
+  role: "org_admin",
+  status: "active",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+function createAuthContext(overrides: Partial<AuthContext> = {}): AuthContext {
+  return {
+    account,
+    organization: {
+      id: "org-1",
+      name: "Demo Org",
+      slug: "demo-org",
+      status: "active",
+      registrationEnabled: true,
+      oidcEnabled: false,
+      oidcIssuerUrl: "",
+      oidcClientId: "",
+      oidcHasClientSecret: false,
+      oidcScopes: "openid profile email",
+      oidcRedirectUri: "",
+      oidcAvatarClaim: "picture",
+      oidcAutoProvision: false,
+      createdAt: "2026-07-02T00:00:00.000Z",
+      updatedAt: "2026-07-02T00:00:00.000Z",
+    },
+    organizations: [],
+    permissions: ["incident:read", "incident:manage"],
+    session: {
+      id: "session-1",
+      accountId: "account-1",
+      activeOrganizationId: "org-1",
+      createdAt: "2026-07-02T00:00:00.000Z",
+      expiresAt: "2026-07-09T00:00:00.000Z",
+    },
+    ...overrides,
+  };
+}
+
+const incident: EmergencyIncident = {
+  id: "incident-1",
+  organizationId: "org-1",
+  severity: "critical",
+  status: "open",
+  title: "夜间跌倒风险",
+  description: "重点照护房巡检发现老人离床。",
+  source: "人工上报",
+  acknowledgedAt: undefined,
+  acknowledgedByAccountId: undefined,
+  acknowledgedByName: undefined,
+  resolvedAt: undefined,
+  resolvedByAccountId: undefined,
+  resolvedByName: undefined,
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+const emergencyData: EmergencyIncidentData = {
+  incidents: [incident],
+  metrics: {
+    open: 1,
+    acknowledged: 0,
+    critical: 1,
+    resolvedToday: 0,
+  },
+};
+
+function allowAuth(): void {
+  vi.mocked(requirePermission).mockResolvedValue({
+    success: true,
+    context: createAuthContext(),
+  });
+}
+
+function jsonRequest(body: Record<string, unknown>): Request {
+  return new Request("http://localhost/api/emergency/incidents", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+async function readJson(response: Response): Promise<Record<string, unknown>> {
+  return (await response.json()) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  allowAuth();
+});
+
+describe("emergency incident API routes", () => {
+  it("loads emergency incidents for the active organization", async () => {
+    vi.mocked(listEmergencyIncidentData).mockResolvedValue(emergencyData);
+
+    const { GET } = await import("./incidents/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(body.data).toEqual(emergencyData);
+    expect(listEmergencyIncidentData).toHaveBeenCalledWith("org-1");
+  });
+
+  it("returns permission failures before loading incidents", async () => {
+    const denied = Response.json({ success: false, reason: "权限不足" }, { status: 403 });
+    vi.mocked(requirePermission).mockResolvedValue({ success: false, response: denied });
+
+    const { GET } = await import("./incidents/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(403);
+    expect(body.reason).toBe("权限不足");
+    expect(listEmergencyIncidentData).not.toHaveBeenCalled();
+  });
+
+  it("requires an active organization before loading incidents", async () => {
+    vi.mocked(requirePermission).mockResolvedValue({
+      success: true,
+      context: createAuthContext({ organization: undefined }),
+    });
+
+    const { GET } = await import("./incidents/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("请选择机构后查看应急事件");
+    expect(listEmergencyIncidentData).not.toHaveBeenCalled();
+  });
+
+  it("creates a manual emergency incident", async () => {
+    vi.mocked(createEmergencyIncident).mockResolvedValue(incident);
+
+    const { POST } = await import("./incidents/route");
+    const response = await POST(
+      jsonRequest({
+        severity: "critical",
+        title: "夜间跌倒风险",
+        description: "重点照护房巡检发现老人离床。",
+        source: "人工上报",
+      }),
+    );
+    const body = await readJson(response);
+
+    expect(response.status).toBe(201);
+    expect(body.success).toBe(true);
+    expect(createEmergencyIncident).toHaveBeenCalledWith(expect.objectContaining({ organizationId: "org-1" }));
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "emergency.incident.create" }));
+  });
+
+  it("rejects invalid create input", async () => {
+    const { POST } = await import("./incidents/route");
+    const response = await POST(jsonRequest({ severity: "critical", title: "" }));
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("事件标题和描述不能为空");
+    expect(createEmergencyIncident).not.toHaveBeenCalled();
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+
+  it("updates incident status", async () => {
+    vi.mocked(updateEmergencyIncidentStatus).mockResolvedValue({
+      ...incident,
+      status: "acknowledged",
+      acknowledgedAt: "2026-07-02T01:00:00.000Z",
+      acknowledgedByAccountId: "account-1",
+      acknowledgedByName: "Admin",
+      updatedAt: "2026-07-02T01:00:00.000Z",
+    });
+
+    const { PATCH } = await import("./incidents/[id]/route");
+    const response = await PATCH(jsonRequest({ status: "acknowledged" }), {
+      params: Promise.resolve({ id: "incident-1" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(updateEmergencyIncidentStatus).toHaveBeenCalledWith(expect.objectContaining({ accountId: "account-1", id: "incident-1", organizationId: "org-1" }));
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "emergency.incident.update" }));
+  });
+
+  it("rejects invalid incident status", async () => {
+    const { PATCH } = await import("./incidents/[id]/route");
+    const response = await PATCH(jsonRequest({ status: "triaged" }), {
+      params: Promise.resolve({ id: "incident-1" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("事件状态无效");
+    expect(updateEmergencyIncidentStatus).not.toHaveBeenCalled();
+  });
+
+  it("returns structured failures for missing or cross-organization incidents", async () => {
+    vi.mocked(updateEmergencyIncidentStatus).mockResolvedValue({
+      success: false,
+      reason: "应急事件不存在",
+      status: 404,
+    });
+
+    const { PATCH } = await import("./incidents/[id]/route");
+    const response = await PATCH(jsonRequest({ status: "acknowledged" }), {
+      params: Promise.resolve({ id: "incident-from-other-org" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("应急事件不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+});

app/api/emergency/incidents/[id]/route.ts

@@ -0,0 +1,56 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { isEmergencyMutationFailure, updateEmergencyIncidentStatus } from "@/modules/emergency/server/operations";
+import { validateEmergencyIncidentStatusUpdateInput } from "@/modules/emergency/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("incident:manage", {
+    action: "emergency.incident.update",
+    targetType: "incident",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后处理应急事件", 400);
+  }
+
+  const input = validateEmergencyIncidentStatusUpdateInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const incident = await updateEmergencyIncidentStatus({
+    ...input.data,
+    id,
+    organizationId,
+    accountId: auth.context.account.id,
+  });
+  if (isEmergencyMutationFailure(incident)) {
+    return jsonFailure(incident.reason, incident.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "emergency.incident.update",
+    targetType: "incident",
+    targetId: incident.id,
+    result: "success",
+    reason: `处理应急事件：${incident.title}`,
+  });
+
+  return jsonSuccess("应急事件已更新", { incident });
+}

app/api/emergency/incidents/route.ts

@@ -0,0 +1,62 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createEmergencyIncident, isEmergencyMutationFailure, listEmergencyIncidentData } from "@/modules/emergency/server/operations";
+import { validateEmergencyIncidentCreateInput } from "@/modules/emergency/types";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("incident:read", {
+    action: "emergency.incident.list",
+    targetType: "incident",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看应急事件", 400);
+  }
+
+  const data = await listEmergencyIncidentData(organizationId);
+  return jsonSuccess("应急事件已加载", { data });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("incident:manage", {
+    action: "emergency.incident.create",
+    targetType: "incident",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后创建应急事件", 400);
+  }
+
+  const input = validateEmergencyIncidentCreateInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const incident = await createEmergencyIncident({ ...input.data, organizationId });
+  if (isEmergencyMutationFailure(incident)) {
+    return jsonFailure(incident.reason, incident.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "emergency.incident.create",
+    targetType: "incident",
+    targetId: incident.id,
+    result: "success",
+    reason: `创建应急事件：${incident.title}`,
+  });
+
+  return jsonSuccess("应急事件已创建", { incident }, 201);
+}