feat: add system configuration platform

app/api/settings/accounts/route.ts

@@ -1,7 +1,22 @@
+import { and, eq } from "drizzle-orm";
+
 import { jsonSuccess } from "@/modules/core/server/api";
-import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { hashPassword, normalizeEmail, requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { jsonFailure, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { getDatabase } from "@/modules/core/server/db";
+import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
 import { readData } from "@/modules/core/server/store";
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
 export async function GET(): Promise<Response> {
   const auth = await requirePermission("account:read", {
     action: "account.list",
@@ -18,3 +33,93 @@ export async function GET(): Promise<Response> {
   });
 }
 
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("account:manage", {
+    action: "account.create",
+    targetType: "account",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const email = readString(body, "email");
+  const password = readString(body, "password");
+  const roleId = readString(body, "roleId");
+  const organizationId = readString(body, "organizationId") || auth.context.organization?.id;
+
+  if (!name || !email || !password || !roleId || !organizationId) {
+    return jsonFailure("姓名、邮箱、密码、机构和角色不能为空");
+  }
+
+  const database = getDatabase();
+  const passwordHash = hashPassword(password);
+  const created = await database.transaction(async (transaction) => {
+    const organizationRows = await transaction.select().from(organizations).where(eq(organizations.id, organizationId)).limit(1);
+    const organization = organizationRows[0];
+    if (!organization) {
+      throw new Error("机构不存在");
+    }
+
+    const roleRows = await transaction
+      .select()
+      .from(roles)
+      .where(and(eq(roles.id, roleId), eq(roles.organizationId, organizationId)))
+      .limit(1);
+    const role = roleRows[0];
+    if (!role) {
+      throw new Error("角色不存在");
+    }
+
+    const accountRows = await transaction
+      .insert(accounts)
+      .values({
+        name,
+        email: normalizeEmail(email),
+        passwordHash: passwordHash.hash,
+        passwordSalt: passwordHash.salt,
+        status: "active",
+      })
+      .returning();
+    const account = accountRows[0];
+    if (!account) {
+      throw new Error("账号创建失败");
+    }
+
+    await transaction.insert(memberships).values({
+      accountId: account.id,
+      organizationId,
+      roleId,
+      status: "active",
+    });
+
+    return { account, organization, role };
+  });
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "account.create",
+    targetType: "account",
+    targetId: created.account.id,
+    result: "success",
+    reason: `创建机构用户：${created.account.email}`,
+  });
+
+  return jsonSuccess("账号已创建", {
+    account: toPublicAccount(created.account, created.role.key, {
+      id: created.organization.id,
+      name: created.organization.name,
+      slug: created.organization.slug,
+      status: created.organization.status,
+      createdAt: created.organization.createdAt.toISOString(),
+      updatedAt: created.organization.updatedAt.toISOString(),
+    }),
+  }, 201);
+}

app/api/settings/permissions/route.ts

@@ -0,0 +1,16 @@
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { PERMISSION_DEFINITIONS } from "@/modules/core/server/permissions";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("permission:read", {
+    action: "permission.list",
+    targetType: "permission",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  return jsonSuccess("权限点已加载", { permissions: PERMISSION_DEFINITIONS });
+}

app/api/settings/roles/route.ts

@@ -1,9 +1,32 @@
 import { jsonSuccess } from "@/modules/core/server/api";
+import { jsonFailure, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
 import { requirePermission } from "@/modules/core/server/auth";
-import { ROLE_DEFINITIONS } from "@/modules/core/server/permissions";
+import { getDatabase } from "@/modules/core/server/db";
+import { getRoleDefinitions } from "@/modules/core/server/permissions";
+import { rolePermissions, roles } from "@/modules/core/server/schema";
+import type { Permission } from "@/modules/core/types";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readPermissionArray(source: Record<string, unknown>): Permission[] {
+  const value = source.permissions;
+  if (!Array.isArray(value)) {
+    return [];
+  }
+
+  return value.filter((item): item is Permission => typeof item === "string");
+}
 
 export async function GET(): Promise<Response> {
-  const auth = await requirePermission("account:read", {
+  const auth = await requirePermission("role:read", {
     action: "role.list",
     targetType: "role",
   });
@@ -12,6 +35,85 @@ export async function GET(): Promise<Response> {
     return auth.response;
   }
 
-  return jsonSuccess("角色列表已加载", { roles: ROLE_DEFINITIONS });
+  const roles = await getRoleDefinitions(auth.context.organization?.id);
+  return jsonSuccess("角色列表已加载", { roles });
 }
 
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("role:manage", {
+    action: "role.create",
+    targetType: "role",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后创建角色", 400);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const label = readString(body, "label");
+  const key = readString(body, "key") || label.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+  const description = readString(body, "description");
+  const permissions = readPermissionArray(body);
+
+  if (!label || !key) {
+    return jsonFailure("角色名称不能为空");
+  }
+
+  const database = getDatabase();
+  const created = await database.transaction(async (transaction) => {
+    const rows = await transaction
+      .insert(roles)
+      .values({
+        key,
+        organizationId,
+        scope: "organization",
+        label,
+        description: description || "机构自定义角色",
+        isSystem: false,
+        isEnabled: true,
+      })
+      .returning();
+    const role = rows[0];
+    if (!role) {
+      throw new Error("角色创建失败");
+    }
+
+    if (permissions.length > 0) {
+      await transaction.insert(rolePermissions).values(
+        permissions.map((permissionId) => ({
+          roleId: role.id,
+          permissionId,
+        })),
+      );
+    }
+
+    return role;
+  });
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "role.create",
+    targetType: "role",
+    targetId: created.id,
+    result: "success",
+    reason: `创建自定义角色：${created.label}`,
+  });
+
+  const roleRows = await getRoleDefinitions(organizationId);
+  const role = roleRows.find((item) => item.id === created.id);
+  if (!role) {
+    return jsonFailure("角色创建后读取失败", 500);
+  }
+
+  return jsonSuccess("角色已创建", { role }, 201);
+}