feat: add system configuration platform

app/api/settings/accounts/route.ts

@@ -1,7 +1,22 @@
+import { and, eq } from "drizzle-orm";
+
 import { jsonSuccess } from "@/modules/core/server/api";
-import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { hashPassword, normalizeEmail, requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { jsonFailure, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { getDatabase } from "@/modules/core/server/db";
+import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
 import { readData } from "@/modules/core/server/store";
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
 export async function GET(): Promise<Response> {
   const auth = await requirePermission("account:read", {
     action: "account.list",
@@ -18,3 +33,93 @@ export async function GET(): Promise<Response> {
   });
 }
 
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("account:manage", {
+    action: "account.create",
+    targetType: "account",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const email = readString(body, "email");
+  const password = readString(body, "password");
+  const roleId = readString(body, "roleId");
+  const organizationId = readString(body, "organizationId") || auth.context.organization?.id;
+
+  if (!name || !email || !password || !roleId || !organizationId) {
+    return jsonFailure("姓名、邮箱、密码、机构和角色不能为空");
+  }
+
+  const database = getDatabase();
+  const passwordHash = hashPassword(password);
+  const created = await database.transaction(async (transaction) => {
+    const organizationRows = await transaction.select().from(organizations).where(eq(organizations.id, organizationId)).limit(1);
+    const organization = organizationRows[0];
+    if (!organization) {
+      throw new Error("机构不存在");
+    }
+
+    const roleRows = await transaction
+      .select()
+      .from(roles)
+      .where(and(eq(roles.id, roleId), eq(roles.organizationId, organizationId)))
+      .limit(1);
+    const role = roleRows[0];
+    if (!role) {
+      throw new Error("角色不存在");
+    }
+
+    const accountRows = await transaction
+      .insert(accounts)
+      .values({
+        name,
+        email: normalizeEmail(email),
+        passwordHash: passwordHash.hash,
+        passwordSalt: passwordHash.salt,
+        status: "active",
+      })
+      .returning();
+    const account = accountRows[0];
+    if (!account) {
+      throw new Error("账号创建失败");
+    }
+
+    await transaction.insert(memberships).values({
+      accountId: account.id,
+      organizationId,
+      roleId,
+      status: "active",
+    });
+
+    return { account, organization, role };
+  });
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "account.create",
+    targetType: "account",
+    targetId: created.account.id,
+    result: "success",
+    reason: `创建机构用户：${created.account.email}`,
+  });
+
+  return jsonSuccess("账号已创建", {
+    account: toPublicAccount(created.account, created.role.key, {
+      id: created.organization.id,
+      name: created.organization.name,
+      slug: created.organization.slug,
+      status: created.organization.status,
+      createdAt: created.organization.createdAt.toISOString(),
+      updatedAt: created.organization.updatedAt.toISOString(),
+    }),
+  }, 201);
+}