feat: add organization settings and invitations

modules/auth/components/AuthPanel.tsx

@@ -28,6 +28,7 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
   const router = useRouter();
   const searchParams = useSearchParams();
   const redirectTo = searchParams.get("redirectTo") ?? "/app/dashboard";
+  const invitationToken = searchParams.get("invite") ?? "";
   const [message, setMessage] = useState("");
   const [isPending, setIsPending] = useState(false);
   const [hasAccounts, setHasAccounts] = useState<boolean | null>(null);
@@ -117,6 +118,7 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
         password,
         organization,
         organizationId,
+        invitationToken,
       }),
     });
     const result = (await response.json()) as ApiResult<{ account: unknown; pendingApproval?: boolean }>;
@@ -195,7 +197,13 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
                 </label>
               ) : null}
 
-              {mode === "register" && organizations.length > 0 ? (
+              {mode === "register" && invitationToken ? (
+                <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground">
+                  正在使用机构邀请注册，完成后将自动加入机构。
+                </p>
+              ) : null}
+
+              {mode === "register" && !invitationToken && organizations.length > 0 ? (
                 <label className="block space-y-2">
                   <span className="text-sm font-medium">申请加入机构</span>
                   <select

modules/core/server/auth.ts

@@ -7,7 +7,15 @@ import { jsonFailure } from "@/modules/core/server/api";
 import { recordAuditLog } from "@/modules/core/server/audit";
 import { getDatabase } from "@/modules/core/server/db";
 import { getPermissionsForRole, hasPermission, seedOrganizationRoles } from "@/modules/core/server/permissions";
-import { accounts, joinRequests, memberships, organizations, roles, sessions } from "@/modules/core/server/schema";
+import {
+  accounts,
+  joinRequests,
+  memberships,
+  organizationInvitations,
+  organizations,
+  roles,
+  sessions,
+} from "@/modules/core/server/schema";
 import type { Account, AuthContext, Membership, Organization, Permission, PublicAccount, Session } from "@/modules/core/types";
 
 const SESSION_COOKIE = "teatea_session";
@@ -33,6 +41,14 @@ function toOrganization(row: OrganizationRow): Organization {
     name: row.name,
     slug: row.slug,
     status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAutoProvision: row.oidcAutoProvision,
     createdAt: toIsoString(row.createdAt),
     updatedAt: toIsoString(row.updatedAt),
   };
@@ -251,6 +267,7 @@ export async function createRegistration(input: {
   email: string;
   password: string;
   organizationId?: string;
+  invitationToken?: string;
 }): Promise<{ account: PublicAccount; session?: Session }> {
   const database = getDatabase();
   const password = hashPassword(input.password);
@@ -263,6 +280,39 @@ export async function createRegistration(input: {
       return null;
     }
 
+    const invitationRows = input.invitationToken
+      ? await transaction
+          .select({ invitation: organizationInvitations, organization: organizations, role: roles })
+          .from(organizationInvitations)
+          .innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
+          .innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
+          .where(eq(organizationInvitations.token, input.invitationToken))
+          .limit(1)
+      : [];
+    const invitation = invitationRows[0];
+    if (input.invitationToken && !invitation) {
+      throw new Error("邀请链接无效");
+    }
+    if (invitation && (invitation.invitation.status !== "active" || invitation.invitation.expiresAt < new Date())) {
+      throw new Error("邀请链接已失效");
+    }
+
+    const targetOrganizationId = invitation?.invitation.organizationId ?? input.organizationId;
+    if (targetOrganizationId && !invitation) {
+      const organizationRows = await transaction
+        .select()
+        .from(organizations)
+        .where(eq(organizations.id, targetOrganizationId))
+        .limit(1);
+      const organization = organizationRows[0];
+      if (!organization) {
+        throw new Error("机构不存在");
+      }
+      if (!organization.registrationEnabled) {
+        throw new Error("该机构暂未开放注册");
+      }
+    }
+
     const accountRows = await transaction
       .insert(accounts)
       .values({
@@ -270,7 +320,7 @@ export async function createRegistration(input: {
         email: normalizedEmail,
         passwordHash: password.hash,
         passwordSalt: password.salt,
-        status: input.organizationId ? "pending" : "active",
+        status: targetOrganizationId && !invitation ? "pending" : "active",
       })
       .returning();
     const account = accountRows[0];
@@ -278,43 +328,63 @@ export async function createRegistration(input: {
       throw new Error("账号创建失败");
     }
 
-    const sessionRows = input.organizationId
+    if (invitation) {
+      await transaction.insert(memberships).values({
+        accountId: account.id,
+        organizationId: invitation.invitation.organizationId,
+        roleId: invitation.invitation.roleId,
+        status: "active",
+      });
+      await transaction
+        .update(organizationInvitations)
+        .set({
+          status: "accepted",
+          acceptedByAccountId: account.id,
+          acceptedAt: new Date(),
+          updatedAt: new Date(),
+        })
+        .where(eq(organizationInvitations.id, invitation.invitation.id));
+    }
+
+    const sessionRows = targetOrganizationId && !invitation
       ? []
       : await transaction
           .insert(sessions)
           .values({
             accountId: account.id,
+            activeOrganizationId: invitation?.invitation.organizationId,
             expiresAt,
           })
           .returning();
     const session = sessionRows[0];
 
-    if (input.organizationId) {
+    if (targetOrganizationId && !invitation) {
       await transaction.insert(joinRequests).values({
         accountId: account.id,
-        organizationId: input.organizationId,
+        organizationId: targetOrganizationId,
         status: "pending",
         reason: "公开注册申请加入机构",
       });
     }
 
-    return { account, session };
+    return { account, organization: invitation?.organization, role: invitation?.role, session };
   });
 
   if (!created) {
     throw new Error("账号已存在");
   }
 
-  const publicAccount = toPublicAccount(created.account);
+  const organization = created.organization ? toOrganization(created.organization) : undefined;
+  const publicAccount = toPublicAccount(created.account, created.role?.key, organization);
   const session = created.session ? toSession(created.session) : undefined;
   await recordAuditLog({
     actor: publicAccount,
-    organizationId: input.organizationId,
+    organizationId: organization?.id ?? input.organizationId,
     action: "account.register",
     targetType: "account",
     targetId: publicAccount.id,
     result: "success",
-    reason: input.organizationId ? "注册账号并申请加入机构" : "注册独立账号",
+    reason: input.invitationToken ? "通过邀请注册并加入机构" : input.organizationId ? "注册账号并申请加入机构" : "注册独立账号",
   });
 
   return { account: publicAccount, session };

modules/core/server/schema.ts

@@ -29,6 +29,14 @@ export const organizations = pgTable("organizations", {
   name: text("name").notNull(),
   slug: text("slug").notNull(),
   status: organizationStatusEnum("status").notNull().default("active"),
+  registrationEnabled: boolean("registration_enabled").notNull().default(true),
+  oidcEnabled: boolean("oidc_enabled").notNull().default(false),
+  oidcIssuerUrl: text("oidc_issuer_url").notNull().default(""),
+  oidcClientId: text("oidc_client_id").notNull().default(""),
+  oidcClientSecret: text("oidc_client_secret").notNull().default(""),
+  oidcScopes: text("oidc_scopes").notNull().default("openid profile email"),
+  oidcRedirectUri: text("oidc_redirect_uri").notNull().default(""),
+  oidcAutoProvision: boolean("oidc_auto_provision").notNull().default(false),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
   updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
 }, (table) => ({
@@ -114,6 +122,23 @@ export const joinRequests = pgTable("join_requests", {
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 });
 
+export const organizationInvitations = pgTable("organization_invitations", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  roleId: uuid("role_id").notNull().references(() => roles.id),
+  email: text("email").notNull().default(""),
+  token: text("token").notNull(),
+  status: text("status").notNull().default("active"),
+  createdByAccountId: uuid("created_by_account_id").references(() => accounts.id),
+  acceptedByAccountId: uuid("accepted_by_account_id").references(() => accounts.id),
+  acceptedAt: timestamp("accepted_at", { withTimezone: true }),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  tokenUnique: uniqueIndex("organization_invitations_token_unique").on(table.token),
+}));
+
 export const campuses = pgTable("campuses", {
   id: uuid("id").primaryKey().defaultRandom(),
   organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),

modules/core/server/store.ts

@@ -9,6 +9,7 @@ import {
   elders,
   joinRequests,
   memberships,
+  organizationInvitations,
   organizations,
   roles,
   rooms,
@@ -23,6 +24,7 @@ import type {
   JoinRequest,
   Membership,
   Organization,
+  OrganizationInvitation,
   Room,
   Session,
   SystemIncident,
@@ -40,6 +42,7 @@ export async function readData(): Promise<AppData> {
     accountRows,
     membershipRows,
     joinRequestRows,
+    invitationRows,
     sessionRows,
     elderRows,
     roomRows,
@@ -62,6 +65,16 @@ export async function readData(): Promise<AppData> {
       .innerJoin(accounts, eq(accounts.id, joinRequests.accountId))
       .innerJoin(organizations, eq(organizations.id, joinRequests.organizationId))
       .orderBy(desc(joinRequests.createdAt)),
+    database
+      .select({
+        invitation: organizationInvitations,
+        organizationName: organizations.name,
+        roleLabel: roles.label,
+      })
+      .from(organizationInvitations)
+      .innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
+      .innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
+      .orderBy(desc(organizationInvitations.createdAt)),
     database.select().from(sessions).orderBy(desc(sessions.createdAt)),
     database.select().from(elders).orderBy(desc(elders.createdAt)),
     database.select().from(rooms).orderBy(desc(rooms.createdAt)),
@@ -112,6 +125,14 @@ export async function readData(): Promise<AppData> {
     name: row.name,
     slug: row.slug,
     status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAutoProvision: row.oidcAutoProvision,
     createdAt: iso(row.createdAt),
     updatedAt: iso(row.updatedAt),
   }));
@@ -158,6 +179,23 @@ export async function readData(): Promise<AppData> {
     createdAt: iso(row.request.createdAt),
   }));
 
+  const organizationInvitationsData: OrganizationInvitation[] = invitationRows.map((row) => ({
+    id: row.invitation.id,
+    organizationId: row.invitation.organizationId,
+    organizationName: row.organizationName,
+    roleId: row.invitation.roleId,
+    roleLabel: row.roleLabel,
+    email: row.invitation.email,
+    token: row.invitation.token,
+    status: row.invitation.status as OrganizationInvitation["status"],
+    createdByAccountId: row.invitation.createdByAccountId ?? undefined,
+    acceptedByAccountId: row.invitation.acceptedByAccountId ?? undefined,
+    acceptedAt: row.invitation.acceptedAt ? iso(row.invitation.acceptedAt) : undefined,
+    expiresAt: iso(row.invitation.expiresAt),
+    createdAt: iso(row.invitation.createdAt),
+    updatedAt: iso(row.invitation.updatedAt),
+  }));
+
   const sessionsData: Session[] = sessionRows.map((row) => ({
     id: row.id,
     accountId: row.accountId,
@@ -243,6 +281,7 @@ export async function readData(): Promise<AppData> {
     accounts: accountsData,
     memberships: membershipsData,
     joinRequests: joinRequestsData,
+    organizationInvitations: organizationInvitationsData,
     sessions: sessionsData,
     elders: eldersData,
     rooms: roomsData,

modules/core/types.ts

@@ -68,6 +68,14 @@ export type Organization = {
   name: string;
   slug: string;
   status: OrganizationStatus;
+  registrationEnabled: boolean;
+  oidcEnabled: boolean;
+  oidcIssuerUrl: string;
+  oidcClientId: string;
+  oidcHasClientSecret: boolean;
+  oidcScopes: string;
+  oidcRedirectUri: string;
+  oidcAutoProvision: boolean;
   createdAt: string;
   updatedAt: string;
 };
@@ -102,6 +110,25 @@ export type JoinRequest = {
   createdAt: string;
 };
 
+export type OrganizationInvitationStatus = "active" | "accepted" | "revoked" | "expired";
+
+export type OrganizationInvitation = {
+  id: string;
+  organizationId: string;
+  organizationName: string;
+  roleId: string;
+  roleLabel: string;
+  email: string;
+  token: string;
+  status: OrganizationInvitationStatus;
+  createdByAccountId?: string;
+  acceptedByAccountId?: string;
+  acceptedAt?: string;
+  expiresAt: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
 export type Account = {
   id: string;
   platformRoleId?: string;
@@ -206,6 +233,7 @@ export type AppData = {
   accounts: Account[];
   memberships: Membership[];
   joinRequests: JoinRequest[];
+  organizationInvitations: OrganizationInvitation[];
   sessions: Session[];
   elders: Elder[];
   rooms: Room[];

modules/settings/components/OrganizationDetailClient.tsx

@@ -0,0 +1,255 @@
+"use client";
+
+import { FormEvent, useState } from "react";
+import { Copy, LinkIcon, Save, Send } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { Organization, OrganizationInvitation, RoleDefinition } from "@/modules/core/types";
+
+type OrganizationDetailClientProps = {
+  invitations: OrganizationInvitation[];
+  organization: Organization;
+  roles: RoleDefinition[];
+};
+
+function getInviteHref(token: string): string {
+  return `/register?invite=${encodeURIComponent(token)}`;
+}
+
+export function OrganizationDetailClient({
+  invitations,
+  organization,
+  roles,
+}: OrganizationDetailClientProps): React.ReactElement {
+  const router = useRouter();
+  const [settingsMessage, setSettingsMessage] = useState("");
+  const [inviteMessage, setInviteMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+  const organizationRoles = roles.filter((role) => role.scope === "organization" && role.organizationId === organization.id && role.isEnabled);
+  const defaultRoleId = organizationRoles.find((role) => role.key === "caregiver")?.id ?? organizationRoles[0]?.id ?? "";
+
+  async function handleSettingsSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setSettingsMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch(`/api/organizations/${organization.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        registrationEnabled: formData.get("registrationEnabled") === "on",
+        oidcEnabled: formData.get("oidcEnabled") === "on",
+        oidcIssuerUrl: String(formData.get("oidcIssuerUrl") ?? ""),
+        oidcClientId: String(formData.get("oidcClientId") ?? ""),
+        oidcClientSecret: String(formData.get("oidcClientSecret") ?? ""),
+        oidcScopes: String(formData.get("oidcScopes") ?? ""),
+        oidcRedirectUri: String(formData.get("oidcRedirectUri") ?? ""),
+        oidcAutoProvision: formData.get("oidcAutoProvision") === "on",
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ organization: Organization }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setSettingsMessage(result.reason);
+      return;
+    }
+
+    setSettingsMessage(result.reason);
+    router.refresh();
+  }
+
+  async function handleInviteSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setInviteMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch(`/api/organizations/${organization.id}/invitations`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        email: String(formData.get("email") ?? ""),
+        roleId: String(formData.get("roleId") ?? ""),
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ invitation: OrganizationInvitation }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setInviteMessage(result.reason);
+      return;
+    }
+
+    setInviteMessage(`${result.reason}：${getInviteHref(result.invitation.token)}`);
+    event.currentTarget.reset();
+    router.refresh();
+  }
+
+  return (
+    <div className="grid gap-5 xl:grid-cols-[0.95fr_1.05fr]">
+      <Card>
+        <CardHeader>
+          <CardTitle>机构访问配置</CardTitle>
+          <CardDescription>控制公开注册、OIDC 登录入口和自动开户策略。</CardDescription>
+        </CardHeader>
+        <CardContent>
+          <form className="grid gap-4" onSubmit={handleSettingsSubmit}>
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">开放公开注册</span>
+                <span className="block text-xs text-muted-foreground">关闭后，注册页不再展示该机构；邀请链接仍可使用。</span>
+              </span>
+              <input defaultChecked={organization.registrationEnabled} name="registrationEnabled" type="checkbox" />
+            </label>
+
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">启用 OIDC 登录</span>
+                <span className="block text-xs text-muted-foreground">保存标准 OIDC 配置，后续登录入口按该开关展示。</span>
+              </span>
+              <input defaultChecked={organization.oidcEnabled} name="oidcEnabled" type="checkbox" />
+            </label>
+
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Issuer URL</span>
+                <Input defaultValue={organization.oidcIssuerUrl} name="oidcIssuerUrl" placeholder="https://idp.example.com" />
+              </label>
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Client ID</span>
+                <Input defaultValue={organization.oidcClientId} name="oidcClientId" />
+              </label>
+            </div>
+
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Client Secret</span>
+              <Input
+                name="oidcClientSecret"
+                placeholder={organization.oidcHasClientSecret ? "已配置，留空则不修改" : "未配置"}
+                type="password"
+              />
+            </label>
+
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Scopes</span>
+                <Input defaultValue={organization.oidcScopes} name="oidcScopes" placeholder="openid profile email" />
+              </label>
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Redirect URI</span>
+                <Input defaultValue={organization.oidcRedirectUri} name="oidcRedirectUri" placeholder="/api/auth/oidc/callback" />
+              </label>
+            </div>
+
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">OIDC 自动开户</span>
+                <span className="block text-xs text-muted-foreground">首次 OIDC 登录时自动创建账号并进入本机构。</span>
+              </span>
+              <input defaultChecked={organization.oidcAutoProvision} name="oidcAutoProvision" type="checkbox" />
+            </label>
+
+            {settingsMessage ? (
+              <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+                {settingsMessage}
+              </p>
+            ) : null}
+
+            <Button className="w-fit" disabled={isPending} type="submit">
+              <Save className="size-4" aria-hidden="true" />
+              保存配置
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>机构邀请</CardTitle>
+          <CardDescription>生成邀请链接后发送给成员；可限定邮箱，也可生成通用邀请。</CardDescription>
+        </CardHeader>
+        <CardContent className="grid gap-4">
+          <form className="grid gap-3 md:grid-cols-[1fr_1fr_auto]" onSubmit={handleInviteSubmit}>
+            <Input name="email" placeholder="邮箱，可留空" type="email" />
+            <select
+              className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+              defaultValue={defaultRoleId}
+              name="roleId"
+              required
+            >
+              {organizationRoles.map((role) => (
+                <option key={role.id} value={role.id}>
+                  {role.label}
+                </option>
+              ))}
+            </select>
+            <Button disabled={isPending || !defaultRoleId} type="submit">
+              <Send className="size-4" aria-hidden="true" />
+              生成邀请
+            </Button>
+          </form>
+          {inviteMessage ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {inviteMessage}
+            </p>
+          ) : null}
+
+          <div className="overflow-x-auto rounded-md border">
+            <table className="w-full min-w-[720px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">对象</th>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 font-medium">有效期</th>
+                  <th className="px-4 py-3 text-right font-medium">链接</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {invitations.map((invitation) => (
+                  <tr className="hover:bg-secondary/45" key={invitation.id}>
+                    <td className="px-4 py-3">{invitation.email || "通用邀请"}</td>
+                    <td className="px-4 py-3">{invitation.roleLabel}</td>
+                    <td className="px-4 py-3">
+                      <Badge variant={invitation.status === "active" ? "success" : "secondary"}>{invitation.status}</Badge>
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">
+                      {new Date(invitation.expiresAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3 text-right">
+                      <Button
+                        onClick={() => void navigator.clipboard.writeText(getInviteHref(invitation.token))}
+                        size="sm"
+                        type="button"
+                        variant="outline"
+                      >
+                        <Copy className="size-4" aria-hidden="true" />
+                        复制
+                      </Button>
+                    </td>
+                  </tr>
+                ))}
+                {invitations.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                      暂无邀请
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+          <div className="flex items-center gap-2 text-xs text-muted-foreground">
+            <LinkIcon className="size-4" aria-hidden="true" />
+            邀请链接使用 `/register?invite=...`，注册后自动加入机构。
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

modules/shared/components/AppShell.tsx

@@ -28,84 +28,106 @@ type NavItem = {
   icon: LucideIcon;
 };
 
-const navItems: NavItem[] = [
+type NavGroup = {
+  label: string;
+  items: NavItem[];
+};
+
+const navGroups: NavGroup[] = [
   {
-    href: "/app/dashboard",
-    label: "运营看板",
-    icon: LayoutDashboard,
+    label: "运营",
+    items: [
+      {
+        href: "/app/dashboard",
+        label: "运营看板",
+        icon: LayoutDashboard,
+      },
+      {
+        href: "/app/elders",
+        label: "老人档案",
+        icon: Users,
+      },
+      {
+        href: "/app/beds",
+        label: "床位房间",
+        icon: BedDouble,
+      },
+      {
+        href: "/app/health",
+        label: "健康照护",
+        icon: HeartPulse,
+      },
+      {
+        href: "/app/care",
+        label: "护理服务",
+        icon: ClipboardCheck,
+      },
+      {
+        href: "/app/emergency",
+        label: "安全应急",
+        icon: ShieldAlert,
+      },
+    ],
   },
   {
-    href: "/app/elders",
-    label: "老人档案",
-    icon: Users,
+    label: "协同",
+    items: [
+      {
+        href: "/app/devices",
+        label: "设备运维",
+        icon: Wrench,
+      },
+      {
+        href: "/app/notices",
+        label: "公告通知",
+        icon: Bell,
+      },
+      {
+        href: "/app/alerts",
+        label: "规则预警",
+        icon: Radio,
+      },
+      {
+        href: "/app/family",
+        label: "家属服务",
+        icon: TabletSmartphone,
+      },
+    ],
   },
   {
-    href: "/app/beds",
-    label: "床位房间",
-    icon: BedDouble,
-  },
-  {
-    href: "/app/health",
-    label: "健康照护",
-    icon: HeartPulse,
-  },
-  {
-    href: "/app/care",
-    label: "护理服务",
-    icon: ClipboardCheck,
-  },
-  {
-    href: "/app/emergency",
-    label: "安全应急",
-    icon: ShieldAlert,
-  },
-  {
-    href: "/app/devices",
-    label: "设备运维",
-    icon: Wrench,
-  },
-  {
-    href: "/app/notices",
-    label: "公告通知",
-    icon: Bell,
-  },
-  {
-    href: "/app/alerts",
-    label: "规则预警",
-    icon: Radio,
-  },
-  {
-    href: "/app/family",
-    label: "家属服务",
-    icon: TabletSmartphone,
-  },
-  {
-    href: "/app/settings/organizations",
-    label: "机构管理",
-    icon: Building2,
-  },
-  {
-    href: "/app/settings/users",
-    label: "用户管理",
-    icon: Users,
-  },
-  {
-    href: "/app/settings/roles",
-    label: "角色权限",
-    icon: Settings,
-  },
-  {
-    href: "/app/settings/audit",
-    label: "审计日志",
-    icon: ListChecks,
-  },
-  {
-    href: "/app/settings/status",
-    label: "运行状态",
-    icon: Wrench,
+    label: "系统设置",
+    items: [
+      {
+        href: "/app/settings/organizations",
+        label: "机构管理",
+        icon: Building2,
+      },
+      {
+        href: "/app/settings/users",
+        label: "用户管理",
+        icon: Users,
+      },
+      {
+        href: "/app/settings/roles",
+        label: "角色权限",
+        icon: Settings,
+      },
+      {
+        href: "/app/settings/audit",
+        label: "审计日志",
+        icon: ListChecks,
+      },
+      {
+        href: "/app/settings/status",
+        label: "运行状态",
+        icon: Wrench,
+      },
+    ],
   },
 ];
 
+const navItems: NavItem[] = navGroups.flatMap((group) => group.items);
+
 type AppShellProps = {
   children: React.ReactNode;
   account: PublicAccount;
@@ -129,22 +151,29 @@ export function AppShell({ children, account, permissions }: AppShellProps): Rea
           </Link>
 
           <nav className="min-h-0 flex-1 overflow-y-auto px-3 py-4" aria-label="主导航">
-            <ul className="space-y-1">
-              {navItems.map((item) => (
-                <li key={item.href}>
-                  <Link
-                    href={item.href}
-                    className="group flex min-h-11 items-center gap-3 rounded-md px-3 text-sm transition-colors hover:bg-secondary"
-                  >
-                    <item.icon
-                      className="size-4 shrink-0 text-muted-foreground group-hover:text-primary"
-                      aria-hidden="true"
-                    />
-                    <span className="min-w-0 truncate font-medium">{item.label}</span>
-                  </Link>
-                </li>
+            <div className="space-y-5">
+              {navGroups.map((group) => (
+                <section key={group.label}>
+                  <p className="px-3 pb-2 text-xs font-semibold text-muted-foreground">{group.label}</p>
+                  <ul className="space-y-1">
+                    {group.items.map((item) => (
+                      <li key={item.href}>
+                        <Link
+                          href={item.href}
+                          className="group flex min-h-11 items-center gap-3 rounded-md px-3 text-sm transition-colors hover:bg-secondary"
+                        >
+                          <item.icon
+                            className="size-4 shrink-0 text-muted-foreground group-hover:text-primary"
+                            aria-hidden="true"
+                          />
+                          <span className="min-w-0 truncate font-medium">{item.label}</span>
+                        </Link>
+                      </li>
+                    ))}
+                  </ul>
+                </section>
               ))}
-            </ul>
+            </div>
           </nav>
         </div>
       </aside>