TalexDreamSoul/teatea-pension
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add organization settings and invitations

Browse Source
This commit is contained in:
admin
2026-07-02 05:12:35 -07:00
parent a555c9dd23
commit ba8097e583
20 changed files with 2959 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
modules/core/server/auth.ts
View File

@@ -7,7 +7,15 @@ import { jsonFailure } from "@/modules/core/server/api";
import { recordAuditLog } from "@/modules/core/server/audit";
import { getDatabase } from "@/modules/core/server/db";
import { getPermissionsForRole, hasPermission, seedOrganizationRoles } from "@/modules/core/server/permissions";
import { accounts, joinRequests, memberships, organizations, roles, sessions } from "@/modules/core/server/schema";
import {
accounts,
joinRequests,
memberships,
organizationInvitations,
organizations,
roles,
sessions,
} from "@/modules/core/server/schema";
import type { Account, AuthContext, Membership, Organization, Permission, PublicAccount, Session } from "@/modules/core/types";
const SESSION_COOKIE = "teatea_session";
@@ -33,6 +41,14 @@ function toOrganization(row: OrganizationRow): Organization {
name: row.name,
slug: row.slug,
status: row.status,
registrationEnabled: row.registrationEnabled,
oidcEnabled: row.oidcEnabled,
oidcIssuerUrl: row.oidcIssuerUrl,
oidcClientId: row.oidcClientId,
oidcHasClientSecret: row.oidcClientSecret.length > 0,
oidcScopes: row.oidcScopes,
oidcRedirectUri: row.oidcRedirectUri,
oidcAutoProvision: row.oidcAutoProvision,
createdAt: toIsoString(row.createdAt),
updatedAt: toIsoString(row.updatedAt),
};
@@ -251,6 +267,7 @@ export async function createRegistration(input: {
email: string;
password: string;
organizationId?: string;
invitationToken?: string;
}): Promise<{ account: PublicAccount; session?: Session }> {
const database = getDatabase();
const password = hashPassword(input.password);
@@ -263,6 +280,39 @@ export async function createRegistration(input: {
return null;
}
const invitationRows = input.invitationToken
? await transaction
.select({ invitation: organizationInvitations, organization: organizations, role: roles })
.from(organizationInvitations)
.innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
.innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
.where(eq(organizationInvitations.token, input.invitationToken))
.limit(1)
: [];
const invitation = invitationRows[0];
if (input.invitationToken && !invitation) {
throw new Error("邀请链接无效");
}
if (invitation && (invitation.invitation.status !== "active" || invitation.invitation.expiresAt < new Date())) {
throw new Error("邀请链接已失效");
}
const targetOrganizationId = invitation?.invitation.organizationId ?? input.organizationId;
if (targetOrganizationId && !invitation) {
const organizationRows = await transaction
.select()
.from(organizations)
.where(eq(organizations.id, targetOrganizationId))
.limit(1);
const organization = organizationRows[0];
if (!organization) {
throw new Error("机构不存在");
}
if (!organization.registrationEnabled) {
throw new Error("该机构暂未开放注册");
}
}
const accountRows = await transaction
.insert(accounts)
.values({
@@ -270,7 +320,7 @@ export async function createRegistration(input: {
email: normalizedEmail,
passwordHash: password.hash,
passwordSalt: password.salt,
status: input.organizationId ? "pending" : "active",
status: targetOrganizationId && !invitation ? "pending" : "active",
})
.returning();
const account = accountRows[0];
@@ -278,43 +328,63 @@ export async function createRegistration(input: {
throw new Error("账号创建失败");
}
const sessionRows = input.organizationId
if (invitation) {
await transaction.insert(memberships).values({
accountId: account.id,
organizationId: invitation.invitation.organizationId,
roleId: invitation.invitation.roleId,
status: "active",
});
await transaction
.update(organizationInvitations)
.set({
status: "accepted",
acceptedByAccountId: account.id,
acceptedAt: new Date(),
updatedAt: new Date(),
})
.where(eq(organizationInvitations.id, invitation.invitation.id));
}
const sessionRows = targetOrganizationId && !invitation
? []
: await transaction
.insert(sessions)
.values({
accountId: account.id,
activeOrganizationId: invitation?.invitation.organizationId,
expiresAt,
})
.returning();
const session = sessionRows[0];
if (input.organizationId) {
if (targetOrganizationId && !invitation) {
await transaction.insert(joinRequests).values({
accountId: account.id,
organizationId: input.organizationId,
organizationId: targetOrganizationId,
status: "pending",
reason: "公开注册申请加入机构",
});
}
return { account, session };
return { account, organization: invitation?.organization, role: invitation?.role, session };
});
if (!created) {
throw new Error("账号已存在");
}
const publicAccount = toPublicAccount(created.account);
const organization = created.organization ? toOrganization(created.organization) : undefined;
const publicAccount = toPublicAccount(created.account, created.role?.key, organization);
const session = created.session ? toSession(created.session) : undefined;
await recordAuditLog({
actor: publicAccount,
organizationId: input.organizationId,
organizationId: organization?.id ?? input.organizationId,
action: "account.register",
targetType: "account",
targetId: publicAccount.id,
result: "success",
reason: input.organizationId ? "注册账号并申请加入机构" : "注册独立账号",
reason: input.invitationToken ? "通过邀请注册并加入机构" : input.organizationId ? "注册账号并申请加入机构" : "注册独立账号",
});
return { account: publicAccount, session };

25
modules/core/server/schema.ts
View File

@@ -29,6 +29,14 @@ export const organizations = pgTable("organizations", {
name: text("name").notNull(),
slug: text("slug").notNull(),
status: organizationStatusEnum("status").notNull().default("active"),
registrationEnabled: boolean("registration_enabled").notNull().default(true),
oidcEnabled: boolean("oidc_enabled").notNull().default(false),
oidcIssuerUrl: text("oidc_issuer_url").notNull().default(""),
oidcClientId: text("oidc_client_id").notNull().default(""),
oidcClientSecret: text("oidc_client_secret").notNull().default(""),
oidcScopes: text("oidc_scopes").notNull().default("openid profile email"),
oidcRedirectUri: text("oidc_redirect_uri").notNull().default(""),
oidcAutoProvision: boolean("oidc_auto_provision").notNull().default(false),
createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
}, (table) => ({
@@ -114,6 +122,23 @@ export const joinRequests = pgTable("join_requests", {
createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
});
export const organizationInvitations = pgTable("organization_invitations", {
id: uuid("id").primaryKey().defaultRandom(),
organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
roleId: uuid("role_id").notNull().references(() => roles.id),
email: text("email").notNull().default(""),
token: text("token").notNull(),
status: text("status").notNull().default("active"),
createdByAccountId: uuid("created_by_account_id").references(() => accounts.id),
acceptedByAccountId: uuid("accepted_by_account_id").references(() => accounts.id),
acceptedAt: timestamp("accepted_at", { withTimezone: true }),
expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
}, (table) => ({
tokenUnique: uniqueIndex("organization_invitations_token_unique").on(table.token),
}));
export const campuses = pgTable("campuses", {
id: uuid("id").primaryKey().defaultRandom(),
organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),

39
modules/core/server/store.ts
View File

@@ -9,6 +9,7 @@ import {
elders,
joinRequests,
memberships,
organizationInvitations,
organizations,
roles,
rooms,
@@ -23,6 +24,7 @@ import type {
JoinRequest,
Membership,
Organization,
OrganizationInvitation,
Room,
Session,
SystemIncident,
@@ -40,6 +42,7 @@ export async function readData(): Promise<AppData> {
accountRows,
membershipRows,
joinRequestRows,
invitationRows,
sessionRows,
elderRows,
roomRows,
@@ -62,6 +65,16 @@ export async function readData(): Promise<AppData> {
.innerJoin(accounts, eq(accounts.id, joinRequests.accountId))
.innerJoin(organizations, eq(organizations.id, joinRequests.organizationId))
.orderBy(desc(joinRequests.createdAt)),
database
.select({
invitation: organizationInvitations,
organizationName: organizations.name,
roleLabel: roles.label,
})
.from(organizationInvitations)
.innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
.innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
.orderBy(desc(organizationInvitations.createdAt)),
database.select().from(sessions).orderBy(desc(sessions.createdAt)),
database.select().from(elders).orderBy(desc(elders.createdAt)),
database.select().from(rooms).orderBy(desc(rooms.createdAt)),
@@ -112,6 +125,14 @@ export async function readData(): Promise<AppData> {
name: row.name,
slug: row.slug,
status: row.status,
registrationEnabled: row.registrationEnabled,
oidcEnabled: row.oidcEnabled,
oidcIssuerUrl: row.oidcIssuerUrl,
oidcClientId: row.oidcClientId,
oidcHasClientSecret: row.oidcClientSecret.length > 0,
oidcScopes: row.oidcScopes,
oidcRedirectUri: row.oidcRedirectUri,
oidcAutoProvision: row.oidcAutoProvision,
createdAt: iso(row.createdAt),
updatedAt: iso(row.updatedAt),
}));
@@ -158,6 +179,23 @@ export async function readData(): Promise<AppData> {
createdAt: iso(row.request.createdAt),
}));
const organizationInvitationsData: OrganizationInvitation[] = invitationRows.map((row) => ({
id: row.invitation.id,
organizationId: row.invitation.organizationId,
organizationName: row.organizationName,
roleId: row.invitation.roleId,
roleLabel: row.roleLabel,
email: row.invitation.email,
token: row.invitation.token,
status: row.invitation.status as OrganizationInvitation["status"],
createdByAccountId: row.invitation.createdByAccountId ?? undefined,
acceptedByAccountId: row.invitation.acceptedByAccountId ?? undefined,
acceptedAt: row.invitation.acceptedAt ? iso(row.invitation.acceptedAt) : undefined,
expiresAt: iso(row.invitation.expiresAt),
createdAt: iso(row.invitation.createdAt),
updatedAt: iso(row.invitation.updatedAt),
}));
const sessionsData: Session[] = sessionRows.map((row) => ({
id: row.id,
accountId: row.accountId,
@@ -243,6 +281,7 @@ export async function readData(): Promise<AppData> {
accounts: accountsData,
memberships: membershipsData,
joinRequests: joinRequestsData,
organizationInvitations: organizationInvitationsData,
sessions: sessionsData,
elders: eldersData,
rooms: roomsData,

28
modules/core/types.ts
View File

@@ -68,6 +68,14 @@ export type Organization = {
name: string;
slug: string;
status: OrganizationStatus;
registrationEnabled: boolean;
oidcEnabled: boolean;
oidcIssuerUrl: string;
oidcClientId: string;
oidcHasClientSecret: boolean;
oidcScopes: string;
oidcRedirectUri: string;
oidcAutoProvision: boolean;
createdAt: string;
updatedAt: string;
};
@@ -102,6 +110,25 @@ export type JoinRequest = {
createdAt: string;
};
export type OrganizationInvitationStatus = "active" | "accepted" | "revoked" | "expired";
export type OrganizationInvitation = {
id: string;
organizationId: string;
organizationName: string;
roleId: string;
roleLabel: string;
email: string;
token: string;
status: OrganizationInvitationStatus;
createdByAccountId?: string;
acceptedByAccountId?: string;
acceptedAt?: string;
expiresAt: string;
createdAt: string;
updatedAt: string;
};
export type Account = {
id: string;
platformRoleId?: string;
@@ -206,6 +233,7 @@ export type AppData = {
accounts: Account[];
memberships: Membership[];
joinRequests: JoinRequest[];
organizationInvitations: OrganizationInvitation[];
sessions: Session[];
elders: Elder[];
rooms: Room[];