feat: add organization settings and invitations

.trellis/spec/backend/deployment.md

@@ -0,0 +1,58 @@
+# Deployment Targets
+
+## Scenario: Wulanchabu Server Deployment
+
+### 1. Scope / Trigger
+
+- Trigger: the user asks to deploy this project.
+- Default target: Wulanchabu server, reached through SSH host alias `wlcb1`.
+- This preference is project-specific and should be used for future deployment requests unless the user explicitly names another target.
+
+### 2. Signatures
+
+- SSH entrypoint: `ssh wlcb1`
+- Repository remote: push code to `origin` before deploying.
+- Database migration command: `pnpm db:migrate`
+- Production build command: `pnpm build`
+
+### 3. Contracts
+
+- Required environment on the server:
+  - `DATABASE_URL` must point to the production PostgreSQL database.
+  - Node.js and pnpm must be available.
+- Deployment should run from the server-side checkout for this repository.
+- Code should be pushed to `origin` before server deployment so `wlcb1` deploys committed source.
+
+### 4. Validation & Error Matrix
+
+- Missing `DATABASE_URL` -> deployment is not healthy; setup/login APIs return database configuration failures.
+- Migration failure -> stop deployment and report the failing migration output.
+- Build failure -> stop deployment and report the failing command output.
+- SSH failure -> report that `wlcb1` could not be reached.
+
+### 5. Good/Base/Bad Cases
+
+- Good: commit locally, push to `origin`, SSH to `wlcb1`, update checkout, install deps, migrate DB, build, restart app.
+- Base: if the server has a project-specific deploy script, run that script after pushing.
+- Bad: deploy uncommitted local files, deploy to a different host by default, or skip migrations after schema changes.
+
+### 6. Tests Required
+
+- `pnpm lint`
+- `pnpm type-check`
+- `pnpm build`
+- After deploy, verify the app responds and `/api/auth/bootstrap` returns a structured JSON response.
+
+### 7. Wrong vs Correct
+
+#### Wrong
+
+```bash
+ssh some-other-host
+```
+
+#### Correct
+
+```bash
+ssh wlcb1
+```

.trellis/spec/backend/index.md

@@ -21,6 +21,7 @@
 | [authentication.md](./authentication.md)             | better-auth, sessions, OAuth, protected procedures | Auth-related features              |
 | [logging.md](./logging.md)                           | Structured logging, Sentry tracing, telemetry      | Debugging, observability           |
 | [local-json-mvp.md](./local-json-mvp.md)             | Local JSON persistence/session/API contracts before database adoption | Single-repo MVP features without DB/oRPC deps |
+| [deployment.md](./deployment.md)                     | Wulanchabu deployment target and validation contract | Deploying this project             |
 | [performance.md](./performance.md)                   | Concurrency, caching, batch processing, streaming  | Performance optimization           |
 | [ai-sdk-integration.md](./ai-sdk-integration.md)     | Vercel AI SDK, tool calling, prompt patterns       | AI-powered features                |
 | [quality.md](./quality.md)                           | Pre-commit checklist for backend code              | Before committing                  |

.trellis/spec/backend/local-json-mvp.md

@@ -22,6 +22,8 @@
 - Default data file: `.data/teatea.json`.
 - Override key: `TEATEA_DATA_DIR` points to the directory containing `teatea.json`.
 - `.data/` must stay ignored; it may contain account hashes and session IDs.
+- Routes or layouts that read local JSON state or session cookies must opt out of static prerendering with `export const dynamic = "force-dynamic"`.
+- API JSON responses backed by local JSON state or session cookies must include `Cache-Control: no-store`.
 - API response shape:
 
 ```ts
@@ -51,6 +53,7 @@ type ApiResult<T extends Record<string, unknown>> =
 - Good: UI submits to Route Handler, Route Handler validates input, calls `requirePermission`, mutates data through `updateData`, writes audit log, returns `ApiResult`.
 - Base: Server Component reads data directly via `readData` after session/permission checks.
 - Bad: UI or route handler reads `.data/teatea.json` directly, bypasses `requirePermission`, or stores auth state in localStorage.
+- Bad: `/app/*`, `/login`, or `/setup` is prerendered as static content and caches a redirect based on build-time empty data.
 
 ### 6. Tests Required
 
@@ -60,6 +63,8 @@ type ApiResult<T extends Record<string, unknown>> =
 - Manual or automated integration assertions:
   - first setup creates admin and cookie session
   - protected app route redirects without cookie
+  - protected app route renders with a valid cookie after setup and does not return a cached `/setup` redirect
+  - auth/bootstrap/session API responses include `Cache-Control: no-store`
   - CRUD mutation persists across reload/API list
   - denied permission returns 403 and writes an audit log
 
@@ -84,3 +89,28 @@ cookieStore.set({
 });
 ```
 
+#### Wrong
+
+```ts
+export default async function AppLayout({ children }: AppLayoutProps) {
+  const bootstrap = await getBootstrapState();
+  if (bootstrap.setupRequired) {
+    redirect("/setup");
+  }
+  return children;
+}
+```
+
+#### Correct
+
+```ts
+export const dynamic = "force-dynamic";
+
+export default async function AppLayout({ children }: AppLayoutProps) {
+  const bootstrap = await getBootstrapState();
+  if (bootstrap.setupRequired) {
+    redirect("/setup");
+  }
+  return children;
+}
+```

app/(app)/app/beds/page.tsx

@@ -1,21 +1,234 @@
-import { BedDouble } from "lucide-react";
+import { redirect } from "next/navigation";
+import { BedDouble, DoorOpen, History, Wrench } from "lucide-react";
 
-import { ModulePage } from "@/modules/shared/components/ModulePage";
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+
+export default async function BedsPage(): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "facility:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const data = await readData();
+  const organizationId = context.organization?.id;
+  const rooms = organizationId ? data.rooms.filter((room) => room.organizationId === organizationId) : data.rooms;
+  const beds = organizationId ? data.beds.filter((bed) => bed.organizationId === organizationId) : data.beds;
+  const admissions = organizationId
+    ? data.admissions.filter((admission) => admission.organizationId === organizationId)
+    : data.admissions;
+
+  const occupiedBeds = beds.filter((bed) => bed.status === "occupied").length;
+  const maintenanceBeds = beds.filter((bed) => bed.status === "maintenance").length;
+  const occupancyRate = beds.length > 0 ? Math.round((occupiedBeds / beds.length) * 100) : 0;
 
-export default function BedsPage(): React.ReactElement {
   return (
-    <ModulePage
-      title="床位房间"
-      eyebrow="房间与床位状态"
-      description="维护楼栋、楼层、房间、床位编号和空闲、占用、维修状态流转。"
-      icon={BedDouble}
-      phase="一期"
-      metrics={[
-        { label: "总床位", value: "154", detail: "护理区 96 张，康复区 58 张" },
-        { label: "占用率", value: "82%", detail: "低于阈值时支持入住调度" },
-        { label: "维修床位", value: "3", detail: "维修完成后恢复可用" },
-      ]}
-      workflows={["维护楼栋与房间", "新增床位编号", "入住时占用床位", "退住或维修后释放床位"]}
-    />
+    <div className="mx-auto flex w-full max-w-7xl flex-col gap-5">
+      <section className="flex flex-col gap-4 border-b pb-5 lg:flex-row lg:items-end lg:justify-between">
+        <div>
+          <Badge variant="success">Facility + Admission</Badge>
+          <h1 className="mt-3 text-3xl font-semibold tracking-normal">床位房间</h1>
+          <p className="mt-2 text-sm text-muted-foreground">房间主数据、床位状态、当前占用和入住历史。</p>
+        </div>
+      </section>
+
+      <section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0">
+            <div>
+              <CardDescription>房间</CardDescription>
+              <CardTitle className="mt-2 text-3xl">{rooms.length}</CardTitle>
+            </div>
+            <DoorOpen className="size-5 text-primary" aria-hidden="true" />
+          </CardHeader>
+        </Card>
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0">
+            <div>
+              <CardDescription>床位</CardDescription>
+              <CardTitle className="mt-2 text-3xl">{beds.length}</CardTitle>
+            </div>
+            <BedDouble className="size-5 text-primary" aria-hidden="true" />
+          </CardHeader>
+          <CardContent className="pt-0">
+            <p className="text-sm text-muted-foreground">占用率 {occupancyRate}%</p>
+          </CardContent>
+        </Card>
+        <Card className={maintenanceBeds > 0 ? "border-amber-200 bg-amber-50/70" : undefined}>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0">
+            <div>
+              <CardDescription className={maintenanceBeds > 0 ? "text-amber-700" : undefined}>维修床位</CardDescription>
+              <CardTitle className={maintenanceBeds > 0 ? "mt-2 text-3xl text-amber-700" : "mt-2 text-3xl"}>
+                {maintenanceBeds}
+              </CardTitle>
+            </div>
+            <Wrench className={maintenanceBeds > 0 ? "size-5 text-amber-700" : "size-5 text-primary"} aria-hidden="true" />
+          </CardHeader>
+        </Card>
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0">
+            <div>
+              <CardDescription>入住历史</CardDescription>
+              <CardTitle className="mt-2 text-3xl">{admissions.length}</CardTitle>
+            </div>
+            <History className="size-5 text-primary" aria-hidden="true" />
+          </CardHeader>
+        </Card>
+      </section>
+
+      <section className="grid gap-4 xl:grid-cols-[0.9fr_1.1fr]">
+        <Card>
+          <CardHeader>
+            <CardTitle>房间台账</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <div className="overflow-x-auto rounded-md border">
+              <table className="w-full min-w-[620px] text-sm">
+                <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                  <tr>
+                    <th className="px-4 py-3 font-medium">房间</th>
+                    <th className="px-4 py-3 font-medium">编号</th>
+                    <th className="px-4 py-3 font-medium">容量</th>
+                    <th className="px-4 py-3 font-medium">床位</th>
+                    <th className="px-4 py-3 font-medium">状态</th>
+                  </tr>
+                </thead>
+                <tbody className="divide-y bg-card">
+                  {rooms.map((room) => (
+                    <tr key={room.id}>
+                      <td className="px-4 py-3 font-medium">{room.name}</td>
+                      <td className="px-4 py-3 text-muted-foreground">{room.code}</td>
+                      <td className="px-4 py-3">{room.capacity}</td>
+                      <td className="px-4 py-3">
+                        {room.occupiedBedCount}/{room.bedCount}
+                      </td>
+                      <td className="px-4 py-3">
+                        <Badge variant={room.status === "active" ? "success" : "danger"}>{room.status}</Badge>
+                      </td>
+                    </tr>
+                  ))}
+                  {rooms.length === 0 ? (
+                    <tr>
+                      <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                        暂无房间，请通过 /api/facilities/rooms 创建
+                      </td>
+                    </tr>
+                  ) : null}
+                </tbody>
+              </table>
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>床位状态</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <div className="overflow-x-auto rounded-md border">
+              <table className="w-full min-w-[700px] text-sm">
+                <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                  <tr>
+                    <th className="px-4 py-3 font-medium">房间</th>
+                    <th className="px-4 py-3 font-medium">床位</th>
+                    <th className="px-4 py-3 font-medium">状态</th>
+                    <th className="px-4 py-3 font-medium">当前老人</th>
+                    <th className="px-4 py-3 font-medium">备注</th>
+                  </tr>
+                </thead>
+                <tbody className="divide-y bg-card">
+                  {beds.map((bed) => (
+                    <tr key={bed.id}>
+                      <td className="px-4 py-3">{bed.roomName}</td>
+                      <td className="px-4 py-3 font-medium">{bed.code}</td>
+                      <td className="px-4 py-3">
+                        <Badge
+                          variant={
+                            bed.status === "available"
+                              ? "success"
+                              : bed.status === "occupied"
+                                ? "secondary"
+                                : bed.status === "maintenance"
+                                  ? "warning"
+                                  : "danger"
+                          }
+                        >
+                          {bed.status}
+                        </Badge>
+                      </td>
+                      <td className="px-4 py-3">{bed.currentElderName ?? "-"}</td>
+                      <td className="px-4 py-3 text-muted-foreground">{bed.notes || "-"}</td>
+                    </tr>
+                  ))}
+                  {beds.length === 0 ? (
+                    <tr>
+                      <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                        暂无床位，请通过 /api/facilities/beds 创建
+                      </td>
+                    </tr>
+                  ) : null}
+                </tbody>
+              </table>
+            </div>
+          </CardContent>
+        </Card>
+      </section>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>入住与换床历史</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="overflow-x-auto rounded-md border">
+            <table className="w-full min-w-[820px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">老人</th>
+                  <th className="px-4 py-3 font-medium">床位</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 font-medium">入住时间</th>
+                  <th className="px-4 py-3 font-medium">结束时间</th>
+                  <th className="px-4 py-3 font-medium">备注</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {admissions.map((admission) => (
+                  <tr key={admission.id}>
+                    <td className="px-4 py-3 font-medium">{admission.elderName}</td>
+                    <td className="px-4 py-3">
+                      {admission.roomName}-{admission.bedCode}
+                    </td>
+                    <td className="px-4 py-3">
+                      <Badge variant={admission.status === "active" ? "success" : "secondary"}>{admission.status}</Badge>
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">
+                      {new Date(admission.admittedAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">
+                      {admission.dischargedAt ? new Date(admission.dischargedAt).toLocaleString("zh-CN") : "-"}
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">{admission.notes || "-"}</td>
+                  </tr>
+                ))}
+                {admissions.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={6}>
+                      暂无入住历史
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
   );
 }

app/(app)/app/layout.tsx

@@ -3,6 +3,8 @@ import { redirect } from "next/navigation";
 import { getBootstrapState, getCurrentAuthContext } from "@/modules/core/server/auth";
 import { AppShell } from "@/modules/shared/components/AppShell";
 
+export const dynamic = "force-dynamic";
+
 type AppLayoutProps = {
   children: React.ReactNode;
 };

app/(app)/app/loading.tsx

@@ -0,0 +1,7 @@
+export default function AppLoading(): React.ReactElement {
+  return (
+    <div className="fixed inset-x-0 top-0 z-50 h-1 overflow-hidden bg-secondary">
+      <div className="loading-progress h-full bg-primary" />
+    </div>
+  );
+}

app/(app)/app/settings/audit/page.tsx

@@ -0,0 +1,100 @@
+import { redirect } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+import { TableToolbar } from "@/modules/settings/components/TableToolbar";
+import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+
+type AuditPageProps = {
+  searchParams?: Promise<SearchParams>;
+};
+
+export default async function AuditPage({ searchParams }: AuditPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "audit:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const params = (await searchParams) ?? {};
+  const query = getSearchParam(params, "q");
+  const page = getPage(params);
+  const data = await readData();
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredLogs = data.auditLogs.filter((log) =>
+    [log.actorEmail ?? "系统", log.action, log.targetType, log.targetId ?? "", log.result, log.reason]
+      .join(" ")
+      .toLowerCase()
+      .includes(normalizedQuery),
+  );
+  const pageCount = getPageCount(filteredLogs.length);
+  const visibleLogs = paginate(filteredLogs, page);
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant="success">Audit</Badge>
+        <h2 className="mt-3 text-xl font-semibold">审计日志</h2>
+        <p className="mt-1 text-sm text-muted-foreground">关键操作、拒绝访问和故障处理留痕。</p>
+      </section>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>审计列表</CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <TableToolbar
+            page={Math.min(page, pageCount)}
+            pageCount={pageCount}
+            pathname="/app/settings/audit"
+            query={query}
+            searchPlaceholder="搜索操作者、动作、对象、结果"
+            total={filteredLogs.length}
+          />
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[900px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">时间</th>
+                  <th className="px-4 py-3 font-medium">操作者</th>
+                  <th className="px-4 py-3 font-medium">动作</th>
+                  <th className="px-4 py-3 font-medium">对象</th>
+                  <th className="px-4 py-3 font-medium">结果</th>
+                  <th className="px-4 py-3 font-medium">原因</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {visibleLogs.map((log) => (
+                  <tr className="table-row-enter hover:bg-secondary/45" key={log.id}>
+                    <td className="px-4 py-3 text-muted-foreground">{new Date(log.timestamp).toLocaleString("zh-CN")}</td>
+                    <td className="px-4 py-3">{log.actorEmail ?? "系统"}</td>
+                    <td className="px-4 py-3">{log.action}</td>
+                    <td className="px-4 py-3 text-muted-foreground">
+                      {log.targetType}
+                      {log.targetId ? ` / ${log.targetId.slice(0, 8)}` : ""}
+                    </td>
+                    <td className="px-4 py-3">{log.result}</td>
+                    <td className="px-4 py-3 text-muted-foreground">{log.reason}</td>
+                  </tr>
+                ))}
+                {visibleLogs.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={6}>
+                      暂无匹配审计
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(app)/app/settings/layout.tsx

@@ -0,0 +1,14 @@
+type SettingsLayoutProps = {
+  children: React.ReactNode;
+};
+
+export default function SettingsLayout({ children }: SettingsLayoutProps): React.ReactElement {
+  return (
+    <div className="mx-auto flex w-full max-w-7xl flex-col gap-5">
+      <section className="border-b pb-4">
+        <h1 className="text-2xl font-semibold tracking-normal">系统设置</h1>
+      </section>
+      {children}
+    </div>
+  );
+}

app/(app)/app/settings/organizations/[id]/page.tsx

@@ -0,0 +1,173 @@
+import Link from "next/link";
+import { notFound, redirect } from "next/navigation";
+import { ArrowLeft, Building2, Users } from "lucide-react";
+
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext, toPublicAccount } from "@/modules/core/server/auth";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+import { OrganizationDetailClient } from "@/modules/settings/components/OrganizationDetailClient";
+
+type OrganizationDetailPageProps = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+export default async function OrganizationDetailPage({
+  params,
+}: OrganizationDetailPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "organization:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const { id } = await params;
+  const data = await readData();
+  const organization = data.organizations.find((item) => item.id === id);
+  if (!organization) {
+    notFound();
+  }
+
+  if (context.organization?.id && context.organization.id !== organization.id) {
+    redirect("/app/settings/organizations");
+  }
+
+  const roles = await getRoleDefinitions(organization.id);
+  const organizationMemberships = data.memberships.filter((membership) => membership.organizationId === organization.id);
+  const accountById = new Map(data.accounts.map((account) => [account.id, account]));
+  const members = organizationMemberships
+    .map((membership) => {
+      const account = accountById.get(membership.accountId);
+      if (!account) {
+        return null;
+      }
+
+      return {
+        account: toPublicAccount(account, membership.roleKey, organization),
+        membership,
+      };
+    })
+    .filter((item): item is NonNullable<typeof item> => item !== null);
+  const invitations = data.organizationInvitations.filter((invitation) => invitation.organizationId === organization.id);
+  const pendingRequests = data.joinRequests.filter(
+    (request) => request.organizationId === organization.id && request.status === "pending",
+  );
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section className="flex flex-col gap-4 border-b pb-5 lg:flex-row lg:items-end lg:justify-between">
+        <div>
+          <Button asChild size="sm" variant="outline">
+            <Link href="/app/settings/organizations">
+              <ArrowLeft className="size-4" aria-hidden="true" />
+              返回机构列表
+            </Link>
+          </Button>
+          <div className="mt-5 flex items-center gap-3">
+            <span className="inline-flex size-11 items-center justify-center rounded-md bg-secondary text-primary">
+              <Building2 className="size-5" aria-hidden="true" />
+            </span>
+            <div>
+              <h2 className="text-2xl font-semibold">{organization.name}</h2>
+              <p className="text-sm text-muted-foreground">{organization.slug}</p>
+            </div>
+          </div>
+        </div>
+        <div className="flex flex-wrap gap-2">
+          <Badge variant={organization.status === "active" ? "success" : "danger"}>
+            {organization.status === "active" ? "启用" : "停用"}
+          </Badge>
+          <Badge variant={organization.registrationEnabled ? "success" : "secondary"}>
+            {organization.registrationEnabled ? "开放注册" : "关闭注册"}
+          </Badge>
+          <Badge variant={organization.oidcEnabled ? "success" : "secondary"}>
+            {organization.oidcEnabled ? "OIDC 已启用" : "OIDC 未启用"}
+          </Badge>
+        </div>
+      </section>
+
+      <section className="grid gap-4 md:grid-cols-4">
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{members.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">成员</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{roles.filter((role) => role.scope === "organization").length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">机构角色</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{pendingRequests.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">待审批申请</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{invitations.filter((invitation) => invitation.status === "active").length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">有效邀请</CardContent>
+        </Card>
+      </section>
+
+      <OrganizationDetailClient invitations={invitations} organization={organization} roles={roles} />
+
+      <Card>
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <Users className="size-4 text-primary" aria-hidden="true" />
+            机构成员
+          </CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[760px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">账号</th>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">成员状态</th>
+                  <th className="px-4 py-3 font-medium">账号状态</th>
+                  <th className="px-4 py-3 text-right font-medium">加入时间</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {members.map(({ account, membership }) => (
+                  <tr className="hover:bg-secondary/45" key={membership.id}>
+                    <td className="px-4 py-3">
+                      <p className="font-medium">{account.name}</p>
+                      <p className="text-xs text-muted-foreground">{account.email}</p>
+                    </td>
+                    <td className="px-4 py-3">{membership.roleLabel}</td>
+                    <td className="px-4 py-3">{membership.status}</td>
+                    <td className="px-4 py-3">{account.status}</td>
+                    <td className="px-4 py-3 text-right text-muted-foreground">
+                      {new Date(membership.createdAt).toLocaleString("zh-CN")}
+                    </td>
+                  </tr>
+                ))}
+                {members.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                      暂无成员
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(app)/app/settings/organizations/page.tsx

@@ -0,0 +1,110 @@
+import { redirect } from "next/navigation";
+import Link from "next/link";
+
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+import {
+  OrganizationManagementClient,
+  OrganizationRowActions,
+} from "@/modules/settings/components/OrganizationManagementClient";
+import { TableToolbar } from "@/modules/settings/components/TableToolbar";
+import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+
+type OrganizationsPageProps = {
+  searchParams?: Promise<SearchParams>;
+};
+
+export default async function OrganizationsPage({ searchParams }: OrganizationsPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "organization:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const params = (await searchParams) ?? {};
+  const query = getSearchParam(params, "q");
+  const page = getPage(params);
+  const data = await readData();
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredOrganizations = data.organizations.filter((organization) =>
+    [organization.name, organization.slug, organization.status].join(" ").toLowerCase().includes(normalizedQuery),
+  );
+  const pageCount = getPageCount(filteredOrganizations.length);
+  const visibleOrganizations = paginate(filteredOrganizations, page);
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant="success">Organizations</Badge>
+        <h2 className="mt-3 text-xl font-semibold">机构管理</h2>
+        <p className="mt-1 text-sm text-muted-foreground">多机构租户、启停状态和机构角色初始化。</p>
+      </section>
+
+      {hasPermission(context.permissions, "organization:manage") ? <OrganizationManagementClient /> : null}
+
+      <Card>
+        <CardHeader>
+          <CardTitle>机构列表</CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <TableToolbar
+            page={Math.min(page, pageCount)}
+            pageCount={pageCount}
+            pathname="/app/settings/organizations"
+            query={query}
+            searchPlaceholder="搜索机构名称、标识、状态"
+            total={filteredOrganizations.length}
+          />
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[820px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">机构</th>
+                  <th className="px-4 py-3 font-medium">Slug</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 text-right font-medium">创建时间</th>
+                  <th className="px-4 py-3 text-right font-medium">操作</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {visibleOrganizations.map((organization) => (
+                  <tr className="table-row-enter hover:bg-secondary/45" key={organization.id}>
+                    <td className="px-4 py-3">
+                      <Link
+                        className="font-medium text-primary underline-offset-4 hover:underline"
+                        href={`/app/settings/organizations/${organization.id}`}
+                      >
+                        {organization.name}
+                      </Link>
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">{organization.slug}</td>
+                    <td className="px-4 py-3">{organization.status === "active" ? "启用" : "停用"}</td>
+                    <td className="px-4 py-3 text-right text-muted-foreground">
+                      {new Date(organization.createdAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3">
+                      <OrganizationRowActions organization={organization} />
+                    </td>
+                  </tr>
+                ))}
+                {visibleOrganizations.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                      暂无匹配机构
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(app)/app/settings/page.tsx

@@ -1,26 +1,5 @@
 import { redirect } from "next/navigation";
 
-import { getCurrentAuthContext, toPublicAccount } from "@/modules/core/server/auth";
-import { hasPermission, ROLE_DEFINITIONS } from "@/modules/core/server/permissions";
-import { readData } from "@/modules/core/server/store";
-import { SettingsOverview } from "@/modules/settings/components/SettingsOverview";
-
 export default async function SettingsPage(): Promise<React.ReactElement> {
-  const context = await getCurrentAuthContext();
-  if (!context) {
-    redirect("/login");
-  }
-
-  if (!hasPermission(context.account.role, "account:read")) {
-    redirect("/app/dashboard");
-  }
-
-  const data = await readData();
-  return (
-    <SettingsOverview
-      accounts={data.accounts.map((account) => toPublicAccount(account))}
-      roles={ROLE_DEFINITIONS}
-      auditLogs={data.auditLogs.slice(0, 100)}
-    />
-  );
+  redirect("/app/settings/users");
 }

app/(app)/app/settings/roles/page.tsx

@@ -0,0 +1,101 @@
+import { redirect } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { getRoleDefinitions, hasPermission, PERMISSION_DEFINITIONS } from "@/modules/core/server/permissions";
+import { RoleManagementClient, RoleRowActions } from "@/modules/settings/components/RoleManagementClient";
+import { TableToolbar } from "@/modules/settings/components/TableToolbar";
+import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+
+type RolesPageProps = {
+  searchParams?: Promise<SearchParams>;
+};
+
+export default async function RolesPage({ searchParams }: RolesPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "role:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const params = (await searchParams) ?? {};
+  const query = getSearchParam(params, "q");
+  const page = getPage(params);
+  const roles = await getRoleDefinitions(context.organization?.id);
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredRoles = roles.filter((role) =>
+    [role.label, role.key, role.description, role.scope, ...role.permissions].join(" ").toLowerCase().includes(normalizedQuery),
+  );
+  const pageCount = getPageCount(filteredRoles.length);
+  const visibleRoles = paginate(filteredRoles, page);
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant="success">RBAC</Badge>
+        <h2 className="mt-3 text-xl font-semibold">角色权限</h2>
+        <p className="mt-1 text-sm text-muted-foreground">系统权限点、内置角色和机构自定义角色。</p>
+      </section>
+
+      {hasPermission(context.permissions, "role:manage") ? <RoleManagementClient permissions={PERMISSION_DEFINITIONS} /> : null}
+
+      <Card>
+        <CardHeader>
+          <CardTitle>角色列表</CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <TableToolbar
+            page={Math.min(page, pageCount)}
+            pageCount={pageCount}
+            pathname="/app/settings/roles"
+            query={query}
+            searchPlaceholder="搜索角色、权限、说明"
+            total={filteredRoles.length}
+          />
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[980px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">范围</th>
+                  <th className="px-4 py-3 font-medium">类型</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 font-medium">权限</th>
+                  <th className="px-4 py-3 text-right font-medium">操作</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {visibleRoles.map((role) => (
+                  <tr className="table-row-enter align-top hover:bg-secondary/45" key={role.id}>
+                    <td className="px-4 py-3">
+                      <p className="font-medium">{role.label}</p>
+                      <p className="text-xs text-muted-foreground">{role.description}</p>
+                    </td>
+                    <td className="px-4 py-3">{role.scope === "platform" ? "平台" : "机构"}</td>
+                    <td className="px-4 py-3">{role.isSystem ? "内置" : "自定义"}</td>
+                    <td className="px-4 py-3">{role.isEnabled ? "启用" : "停用"}</td>
+                    <td className="px-4 py-3 text-muted-foreground">{role.permissions.join(", ") || "-"}</td>
+                    <td className="px-4 py-3">
+                      <RoleRowActions permissions={PERMISSION_DEFINITIONS} role={role} />
+                    </td>
+                  </tr>
+                ))}
+                {visibleRoles.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={6}>
+                      暂无匹配角色
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(app)/app/settings/status/page.tsx

@@ -0,0 +1,138 @@
+import { redirect } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { checkDatabaseConnection } from "@/modules/core/server/db";
+import { getCurrentAuthContext } from "@/modules/core/server/auth";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+import { IncidentStatusActions } from "@/modules/settings/components/IncidentStatusActions";
+import { TableToolbar } from "@/modules/settings/components/TableToolbar";
+import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+
+type StatusPageProps = {
+  searchParams?: Promise<SearchParams>;
+};
+
+export default async function StatusPage({ searchParams }: StatusPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "incident:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const params = (await searchParams) ?? {};
+  const query = getSearchParam(params, "q");
+  const page = getPage(params);
+  const [data, databaseHealth] = await Promise.all([readData(), checkDatabaseConnection()]);
+  const canManageIncidents = hasPermission(context.permissions, "incident:manage");
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredIncidents = data.incidents.filter((incident) =>
+    [incident.title, incident.description, incident.source, incident.severity, incident.status]
+      .join(" ")
+      .toLowerCase()
+      .includes(normalizedQuery),
+  );
+  const pageCount = getPageCount(filteredIncidents.length);
+  const visibleIncidents = paginate(filteredIncidents, page);
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant={databaseHealth.ok ? "success" : "danger"}>{databaseHealth.ok ? "Healthy" : "Degraded"}</Badge>
+        <h2 className="mt-3 text-xl font-semibold">运行状态</h2>
+        <p className="mt-1 text-sm text-muted-foreground">{databaseHealth.reason}</p>
+      </section>
+
+      <section className="grid gap-4 md:grid-cols-4">
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{data.organizations.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">机构</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{data.accounts.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">账号</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{data.beds.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">床位</CardContent>
+        </Card>
+        <Card>
+          <CardHeader>
+            <CardTitle className="text-3xl">{data.incidents.length}</CardTitle>
+          </CardHeader>
+          <CardContent className="pt-0 text-sm text-muted-foreground">故障事件</CardContent>
+        </Card>
+      </section>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>故障中心</CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <TableToolbar
+            page={Math.min(page, pageCount)}
+            pageCount={pageCount}
+            pathname="/app/settings/status"
+            query={query}
+            searchPlaceholder="搜索故障标题、来源、状态"
+            total={filteredIncidents.length}
+          />
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[960px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">标题</th>
+                  <th className="px-4 py-3 font-medium">严重级别</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 font-medium">来源</th>
+                  <th className="px-4 py-3 text-right font-medium">创建时间</th>
+                  <th className="px-4 py-3 text-right font-medium">操作</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {visibleIncidents.map((incident) => (
+                  <tr className="table-row-enter align-top hover:bg-secondary/45" key={incident.id}>
+                    <td className="px-4 py-3">
+                      <p className="font-medium">{incident.title}</p>
+                      <p className="text-xs text-muted-foreground">{incident.description}</p>
+                    </td>
+                    <td className="px-4 py-3">{incident.severity}</td>
+                    <td className="px-4 py-3">{incident.status}</td>
+                    <td className="px-4 py-3 text-muted-foreground">{incident.source}</td>
+                    <td className="px-4 py-3 text-right text-muted-foreground">
+                      {new Date(incident.createdAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3">
+                      {canManageIncidents ? (
+                        <IncidentStatusActions incident={incident} />
+                      ) : (
+                        <span className="block text-right text-xs text-muted-foreground">只读</span>
+                      )}
+                    </td>
+                  </tr>
+                ))}
+                {visibleIncidents.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={6}>
+                      暂无匹配故障
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(app)/app/settings/users/page.tsx

@@ -0,0 +1,140 @@
+import { redirect } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { getCurrentAuthContext, toPublicAccount } from "@/modules/core/server/auth";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
+import { readData } from "@/modules/core/server/store";
+import { ROLE_LABELS } from "@/modules/core/types";
+import type { RoleId } from "@/modules/core/types";
+import { TableToolbar } from "@/modules/settings/components/TableToolbar";
+import { UserAccountActions, UserManagementClient } from "@/modules/settings/components/UserManagementClient";
+import { getPage, getPageCount, getSearchParam, paginate, type SearchParams } from "@/modules/settings/lib/pagination";
+
+type UsersPageProps = {
+  searchParams?: Promise<SearchParams>;
+};
+
+function formatRoleLabel(role: string): string {
+  if (role in ROLE_LABELS) {
+    return ROLE_LABELS[role as RoleId];
+  }
+
+  return role;
+}
+
+export default async function UsersPage({ searchParams }: UsersPageProps): Promise<React.ReactElement> {
+  const context = await getCurrentAuthContext();
+  if (!context) {
+    redirect("/login");
+  }
+
+  if (!hasPermission(context.permissions, "account:read")) {
+    redirect("/app/dashboard");
+  }
+
+  const params = (await searchParams) ?? {};
+  const query = getSearchParam(params, "q");
+  const page = getPage(params);
+  const data = await readData();
+  const roles = await getRoleDefinitions(context.organization?.id);
+  const roleById = new Map(roles.map((role) => [role.id, role]));
+  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
+  const accounts = data.accounts.map((account) => {
+    const membership = context.organization?.id
+      ? data.memberships.find(
+          (item) => item.accountId === account.id && item.organizationId === context.organization?.id && item.status === "active",
+        )
+      : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
+    const organization = membership ? organizationById.get(membership.organizationId) : undefined;
+    const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
+
+    return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
+  });
+  const normalizedQuery = query.trim().toLowerCase();
+  const filteredAccounts = accounts.filter((account) =>
+    [account.name, account.email, account.status, String(account.role), account.organization ?? ""]
+      .join(" ")
+      .toLowerCase()
+      .includes(normalizedQuery),
+  );
+  const pageCount = getPageCount(filteredAccounts.length);
+  const visibleAccounts = paginate(filteredAccounts, page);
+
+  return (
+    <div className="flex flex-col gap-5">
+      <section>
+        <Badge variant="success">Accounts</Badge>
+        <h2 className="mt-3 text-xl font-semibold">用户管理</h2>
+        <p className="mt-1 text-sm text-muted-foreground">账号创建、机构加入审批、角色分配和账号列表。</p>
+      </section>
+
+      <UserManagementClient organizations={data.organizations} roles={roles} joinRequests={data.joinRequests} />
+
+      <Card>
+        <CardHeader>
+          <CardTitle>账号列表</CardTitle>
+        </CardHeader>
+        <CardContent className="p-0">
+          <TableToolbar
+            page={Math.min(page, pageCount)}
+            pageCount={pageCount}
+            pathname="/app/settings/users"
+            query={query}
+            searchPlaceholder="搜索姓名、邮箱、角色、状态"
+            total={filteredAccounts.length}
+          />
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[920px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">账号</th>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">机构</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 text-right font-medium">创建时间</th>
+                  <th className="px-4 py-3 text-right font-medium">操作</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {visibleAccounts.map((account) => (
+                  <tr className="table-row-enter hover:bg-secondary/45" key={account.id}>
+                    <td className="px-4 py-3">
+                      <p className="font-medium">{account.name}</p>
+                      <p className="text-xs text-muted-foreground">{account.email}</p>
+                    </td>
+                    <td className="px-4 py-3">{formatRoleLabel(account.role)}</td>
+                    <td className="px-4 py-3 text-muted-foreground">{account.organization ?? "-"}</td>
+                    <td className="px-4 py-3">
+                      <Badge variant={account.status === "active" ? "success" : account.status === "pending" ? "warning" : "danger"}>
+                        {account.status === "active" ? "启用" : account.status === "pending" ? "待审批" : "停用"}
+                      </Badge>
+                    </td>
+                    <td className="px-4 py-3 text-right text-muted-foreground">
+                      {new Date(account.createdAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3">
+                      <UserAccountActions
+                        account={account}
+                        currentAccountId={context.account.id}
+                        organizations={data.organizations}
+                        roles={roles}
+                      />
+                    </td>
+                  </tr>
+                ))}
+                {visibleAccounts.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={6}>
+                      暂无匹配账号
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

app/(auth)/login/page.tsx

@@ -1,5 +1,7 @@
 import { AuthPanel } from "@/modules/auth/components/AuthPanel";
 
+export const dynamic = "force-dynamic";
+
 export default function LoginPage(): React.ReactElement {
   return <AuthPanel mode="login" />;
 }

app/(auth)/register/page.tsx

@@ -1,5 +1,7 @@
 import { AuthPanel } from "@/modules/auth/components/AuthPanel";
 
+export const dynamic = "force-dynamic";
+
 export default function RegisterPage(): React.ReactElement {
   return <AuthPanel mode="register" />;
 }

app/(auth)/setup/page.tsx

@@ -1,5 +1,7 @@
 import { AuthPanel } from "@/modules/auth/components/AuthPanel";
 
+export const dynamic = "force-dynamic";
+
 export default function SetupPage(): React.ReactElement {
   return <AuthPanel mode="setup" />;
 }

app/api/admissions/route.ts

@@ -0,0 +1,138 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { admissions, beds, elders } from "@/modules/core/server/schema";
+import { readData } from "@/modules/core/server/store";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("admission:read", {
+    action: "admission.list",
+    targetType: "admission",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const data = await readData();
+  const organizationId = auth.context.organization?.id;
+  return jsonSuccess("入住记录已加载", {
+    admissions: organizationId
+      ? data.admissions.filter((admission) => admission.organizationId === organizationId)
+      : data.admissions,
+  });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("admission:manage", {
+    action: "admission.create",
+    targetType: "admission",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后办理入住", 400);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const elderId = readString(body, "elderId");
+  const bedId = readString(body, "bedId");
+  if (!elderId || !bedId) {
+    return jsonFailure("老人和床位不能为空");
+  }
+
+  const database = getDatabase();
+  const admission = await database.transaction(async (transaction) => {
+    const elderRows = await transaction
+      .select()
+      .from(elders)
+      .where(and(eq(elders.id, elderId), eq(elders.organizationId, organizationId)))
+      .limit(1);
+    const elder = elderRows[0];
+    if (!elder) {
+      throw new Error("老人档案不存在");
+    }
+
+    const bedRows = await transaction
+      .select()
+      .from(beds)
+      .where(and(eq(beds.id, bedId), eq(beds.organizationId, organizationId)))
+      .limit(1);
+    const bed = bedRows[0];
+    if (!bed) {
+      throw new Error("床位不存在");
+    }
+    if (bed.status !== "available") {
+      throw new Error("床位不可分配");
+    }
+
+    const activeAdmissions = await transaction
+      .select()
+      .from(admissions)
+      .where(and(eq(admissions.elderId, elderId), eq(admissions.status, "active")));
+    await Promise.all(
+      activeAdmissions.map((activeAdmission) =>
+        transaction
+          .update(admissions)
+          .set({ status: "transferred", dischargedAt: new Date(), updatedAt: new Date() })
+          .where(eq(admissions.id, activeAdmission.id)),
+      ),
+    );
+    await Promise.all(
+      activeAdmissions.map((activeAdmission) =>
+        transaction.update(beds).set({ status: "available", updatedAt: new Date() }).where(eq(beds.id, activeAdmission.bedId)),
+      ),
+    );
+
+    const rows = await transaction
+      .insert(admissions)
+      .values({
+        organizationId,
+        elderId,
+        bedId,
+        status: "active",
+        notes: readString(body, "notes"),
+      })
+      .returning();
+    const row = rows[0];
+    if (!row) {
+      throw new Error("入住记录创建失败");
+    }
+
+    await transaction.update(beds).set({ status: "occupied", updatedAt: new Date() }).where(eq(beds.id, bedId));
+    await transaction.update(elders).set({ status: "active", updatedAt: new Date() }).where(eq(elders.id, elderId));
+    return row;
+  });
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "admission.create",
+    targetType: "admission",
+    targetId: admission.id,
+    result: "success",
+    reason: "办理入住/换床",
+  });
+
+  return jsonSuccess("入住记录已创建", { admission }, 201);
+}

app/api/audit-logs/route.ts

@@ -1,6 +1,6 @@
 import { jsonSuccess } from "@/modules/core/server/api";
+import { listAuditLogs } from "@/modules/core/server/audit";
 import { requirePermission } from "@/modules/core/server/auth";
-import { readData } from "@/modules/core/server/store";
 
 export async function GET(): Promise<Response> {
   const auth = await requirePermission("audit:read", {
@@ -12,9 +12,8 @@ export async function GET(): Promise<Response> {
     return auth.response;
   }
 
-  const data = await readData();
+  const auditLogs = await listAuditLogs({ organizationId: auth.context.organization?.id, limit: 100 });
   return jsonSuccess("审计日志已加载", {
-    auditLogs: data.auditLogs.slice(0, 100),
+    auditLogs,
   });
 }
-

app/api/auth/bootstrap/route.ts

@@ -1,8 +1,16 @@
 import { getBootstrapState } from "@/modules/core/server/auth";
-import { jsonSuccess } from "@/modules/core/server/api";
+import { jsonFailure, jsonSuccess } from "@/modules/core/server/api";
+import { ensureSystemDefaults } from "@/modules/core/server/permissions";
+
+export const dynamic = "force-dynamic";
 
 export async function GET(): Promise<Response> {
-  const state = await getBootstrapState();
-  return jsonSuccess("Bootstrap state loaded", state);
+  try {
+    await ensureSystemDefaults();
+    const state = await getBootstrapState();
+    return jsonSuccess("Bootstrap state loaded", state);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "系统初始化状态读取失败";
+    return jsonFailure(reason, 503);
+  }
 }
-

app/api/auth/login/route.ts

@@ -1,7 +1,6 @@
-import { createSessionRecord, normalizeEmail, setSessionCookie, toPublicAccount, verifyPassword } from "@/modules/core/server/auth";
+import { loginWithPassword, setSessionCookie } from "@/modules/core/server/auth";
 import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
 import { recordAuditLog } from "@/modules/core/server/audit";
-import { updateData } from "@/modules/core/server/store";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -18,45 +17,25 @@ export async function POST(request: Request): Promise<Response> {
     return jsonFailure("请求数据格式无效");
   }
 
-  const email = normalizeEmail(readString(body, "email"));
+  const email = readString(body, "email");
   const password = readString(body, "password");
 
   if (!email || !password) {
     return jsonFailure("邮箱和密码不能为空");
   }
 
-  const result = await updateData((data) => {
-    const account = data.accounts.find((item) => item.email === email);
-    if (!account || account.status !== "active" || !verifyPassword(password, account)) {
-      return null;
-    }
-
-    const session = createSessionRecord(account.id);
-    data.sessions.push(session);
-    return { account, session };
-  });
-
-  if (!result) {
+  try {
+    const result = await loginWithPassword({ email, password });
+    await setSessionCookie(result.session.id);
+    return jsonSuccess("登录成功", { account: result.account });
+  } catch (error) {
     await recordAuditLog({
-      action: "auth.login",
+      action: "account.login",
       targetType: "account",
       result: "failure",
       reason: `登录失败：${email}`,
     });
-    return jsonFailure("账号或密码错误", 401);
+    const reason = error instanceof Error ? error.message : "登录失败";
+    return jsonFailure(reason, 401);
   }
-
-  await setSessionCookie(result.session.id);
-  const account = toPublicAccount(result.account);
-  await recordAuditLog({
-    actor: account,
-    action: "auth.login",
-    targetType: "account",
-    targetId: account.id,
-    result: "success",
-    reason: "登录成功",
-  });
-
-  return jsonSuccess("登录成功", { account });
 }
-

app/api/auth/register/route.ts

@@ -1,7 +1,5 @@
-import { createAccountRecord, createSessionRecord, normalizeEmail, setSessionCookie } from "@/modules/core/server/auth";
+import { createRegistration, setSessionCookie } from "@/modules/core/server/auth";
 import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
-import { recordAuditLog } from "@/modules/core/server/audit";
-import { updateData } from "@/modules/core/server/store";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -21,6 +19,8 @@ export async function POST(request: Request): Promise<Response> {
   const name = readString(body, "name");
   const email = readString(body, "email");
   const password = readString(body, "password");
+  const organizationId = readString(body, "organizationId");
+  const invitationToken = readString(body, "invitationToken");
 
   if (!name || !email || !password) {
     return jsonFailure("姓名、邮箱和密码不能为空");
@@ -30,59 +30,24 @@ export async function POST(request: Request): Promise<Response> {
     return jsonFailure("密码至少需要6位");
   }
 
-  const normalizedEmail = normalizeEmail(email);
-  const created = await updateData((data) => {
-    const exists = data.accounts.some((account) => account.email === normalizedEmail);
-    if (exists) {
-      return null;
-    }
-
-    const account = createAccountRecord({
+  try {
+    const created = await createRegistration({
       name,
       email,
       password,
-      role: "caregiver",
+      organizationId: organizationId || undefined,
+      invitationToken: invitationToken || undefined,
     });
-    const session = createSessionRecord(account.id);
-
-    data.accounts.push(account);
-    data.sessions.push(session);
-
-    return { account, session };
-  });
-
-  if (!created) {
-    return jsonFailure("账号已存在", 409);
+    if (created.session) {
+      await setSessionCookie(created.session.id);
+    }
+    return jsonSuccess(organizationId ? "申请已提交，待机构管理员审批" : "账号已创建", {
+      account: created.account,
+      pendingApproval: !created.session,
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "账号创建失败";
+    const status = reason === "账号已存在" ? 409 : 500;
+    return jsonFailure(reason, status);
   }
-
-  await setSessionCookie(created.session.id);
-  await recordAuditLog({
-    actor: {
-      id: created.account.id,
-      name: created.account.name,
-      email: created.account.email,
-      role: created.account.role,
-      status: created.account.status,
-      createdAt: created.account.createdAt,
-      updatedAt: created.account.updatedAt,
-    },
-    action: "account.register",
-    targetType: "account",
-    targetId: created.account.id,
-    result: "success",
-    reason: "创建照护人员账号",
-  });
-
-  return jsonSuccess("账号已创建", {
-    account: {
-      id: created.account.id,
-      name: created.account.name,
-      email: created.account.email,
-      role: created.account.role,
-      status: created.account.status,
-      createdAt: created.account.createdAt,
-      updatedAt: created.account.updatedAt,
-    },
-  });
 }
-

app/api/auth/session/route.ts

@@ -1,12 +1,15 @@
 import { getCurrentAuthContext } from "@/modules/core/server/auth";
 import { jsonSuccess } from "@/modules/core/server/api";
 
+export const dynamic = "force-dynamic";
+
 export async function GET(): Promise<Response> {
   const context = await getCurrentAuthContext();
 
   return jsonSuccess("Session loaded", {
     account: context?.account ?? null,
+    organization: context?.organization ?? null,
+    membership: context?.membership ?? null,
     permissions: context?.permissions ?? [],
   });
 }
-

app/api/auth/setup/route.ts

@@ -1,7 +1,6 @@
-import { createAccountRecord, createSessionRecord, setSessionCookie } from "@/modules/core/server/auth";
+import { setSessionCookie, setupFirstPlatformAdmin } from "@/modules/core/server/auth";
 import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
-import { recordAuditLog } from "@/modules/core/server/audit";
-import { updateData } from "@/modules/core/server/store";
+import { ensureSystemDefaults } from "@/modules/core/server/permissions";
 
 function readString(source: Record<string, unknown>, key: string): string {
   const value = source[key];
@@ -31,60 +30,14 @@ export async function POST(request: Request): Promise<Response> {
     return jsonFailure("密码至少需要6位");
   }
 
-  const created = await updateData((data) => {
-    if (data.accounts.length > 0) {
-      return null;
-    }
-
-    const account = createAccountRecord({
-      name,
-      email,
-      password,
-      role: "admin",
-      organization,
-    });
-    const session = createSessionRecord(account.id);
-
-    data.accounts.push(account);
-    data.sessions.push(session);
-
-    return { account, session };
-  });
-
-  if (!created) {
-    return jsonFailure("系统已完成初始化", 409);
+  try {
+    await ensureSystemDefaults();
+    const created = await setupFirstPlatformAdmin({ organization, name, email, password });
+    await setSessionCookie(created.session.id);
+    return jsonSuccess("初始化完成", { account: created.account });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "初始化失败";
+    const status = reason === "系统已完成初始化" ? 409 : 500;
+    return jsonFailure(reason, status);
   }
-
-  await setSessionCookie(created.session.id);
-  await recordAuditLog({
-    actor: {
-      id: created.account.id,
-      name: created.account.name,
-      email: created.account.email,
-      role: created.account.role,
-      organization: created.account.organization,
-      status: created.account.status,
-      createdAt: created.account.createdAt,
-      updatedAt: created.account.updatedAt,
-    },
-    action: "account.setup",
-    targetType: "account",
-    targetId: created.account.id,
-    result: "success",
-    reason: "初始化管理员账号",
-  });
-
-  return jsonSuccess("初始化完成", {
-    account: {
-      id: created.account.id,
-      name: created.account.name,
-      email: created.account.email,
-      role: created.account.role,
-      organization: created.account.organization,
-      status: created.account.status,
-      createdAt: created.account.createdAt,
-      updatedAt: created.account.updatedAt,
-    },
-  });
 }
-

app/api/elders/[id]/route.ts

@@ -1,8 +1,11 @@
-import { validateElderInput } from "@/modules/elders/types";
+import { and, eq } from "drizzle-orm";
+
 import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
 import { recordAuditLog } from "@/modules/core/server/audit";
 import { requirePermission } from "@/modules/core/server/auth";
-import { updateData } from "@/modules/core/server/store";
+import { getDatabase } from "@/modules/core/server/db";
+import { admissions, beds, elders } from "@/modules/core/server/schema";
+import { validateElderInput } from "@/modules/elders/types";
 
 type RouteContext = {
   params: Promise<{
@@ -22,41 +25,66 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
     return auth.response;
   }
 
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后更新老人档案", 400);
+  }
+
   const input = validateElderInput(await readJsonBody(request));
   if (!input.success) {
     return jsonFailure(input.reason);
   }
 
-  const updated = await updateData((data) => {
-    const elder = data.elders.find((item) => item.id === id);
-    if (!elder) {
-      return null;
-    }
+  const database = getDatabase();
+  const updated = await database
+    .update(elders)
+    .set({
+      name: input.data.name,
+      gender: input.data.gender,
+      age: input.data.age,
+      careLevel: input.data.careLevel,
+      status: input.data.status,
+      primaryContact: input.data.primaryContact,
+      phone: input.data.phone,
+      medicalNotes: input.data.medicalNotes,
+      updatedAt: new Date(),
+    })
+    .where(and(eq(elders.id, id), eq(elders.organizationId, organizationId)))
+    .returning();
+  const elder = updated[0];
 
-    const nextElder = {
-      ...elder,
-      ...input.data,
-      updatedAt: new Date().toISOString(),
-    };
-
-    data.elders = data.elders.map((item) => (item.id === id ? nextElder : item));
-    return nextElder;
-  });
-
-  if (!updated) {
+  if (!elder) {
     return jsonFailure("老人档案不存在", 404);
   }
 
   await recordAuditLog({
     actor: auth.context.account,
+    organizationId,
     action: "elder.update",
     targetType: "elder",
-    targetId: updated.id,
+    targetId: elder.id,
     result: "success",
-    reason: `更新老人档案：${updated.name}`,
+    reason: `更新老人档案：${elder.name}`,
   });
 
-  return jsonSuccess("老人档案已更新", { elder: updated });
+  return jsonSuccess("老人档案已更新", {
+    elder: {
+      id: elder.id,
+      organizationId: elder.organizationId,
+      name: elder.name,
+      gender: elder.gender,
+      age: elder.age,
+      careLevel: elder.careLevel,
+      room: "",
+      bed: "",
+      status: elder.status,
+      primaryContact: elder.primaryContact,
+      phone: elder.phone,
+      medicalNotes: elder.medicalNotes,
+      createdAt: elder.createdAt.toISOString(),
+      updatedAt: elder.updatedAt.toISOString(),
+    },
+  });
 }
 
 export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
@@ -71,13 +99,43 @@ export async function DELETE(_request: Request, context: RouteContext): Promise<
     return auth.response;
   }
 
-  const deleted = await updateData((data) => {
-    const elder = data.elders.find((item) => item.id === id);
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后删除老人档案", 400);
+  }
+
+  const database = getDatabase();
+  const deleted = await database.transaction(async (transaction) => {
+    const elderRows = await transaction
+      .select()
+      .from(elders)
+      .where(and(eq(elders.id, id), eq(elders.organizationId, organizationId)))
+      .limit(1);
+    const elder = elderRows[0];
     if (!elder) {
       return null;
     }
 
-    data.elders = data.elders.filter((item) => item.id !== id);
+    const activeAdmissions = await transaction
+      .select()
+      .from(admissions)
+      .where(and(eq(admissions.elderId, id), eq(admissions.status, "active")));
+
+    await Promise.all(
+      activeAdmissions.map((admission) =>
+        transaction
+        .update(admissions)
+        .set({ status: "discharged", dischargedAt: new Date(), updatedAt: new Date() })
+          .where(eq(admissions.id, admission.id)),
+      ),
+    );
+    await Promise.all(
+      activeAdmissions.map((admission) =>
+        transaction.update(beds).set({ status: "available", updatedAt: new Date() }).where(eq(beds.id, admission.bedId)),
+      ),
+    );
+
+    await transaction.delete(elders).where(eq(elders.id, id));
     return elder;
   });
 
@@ -87,6 +145,7 @@ export async function DELETE(_request: Request, context: RouteContext): Promise<
 
   await recordAuditLog({
     actor: auth.context.account,
+    organizationId,
     action: "elder.delete",
     targetType: "elder",
     targetId: deleted.id,
@@ -94,6 +153,5 @@ export async function DELETE(_request: Request, context: RouteContext): Promise<
     reason: `删除老人档案：${deleted.name}`,
   });
 
-  return jsonSuccess("老人档案已删除", { elder: deleted });
+  return jsonSuccess("老人档案已删除", { elder: { id: deleted.id, name: deleted.name } });
 }
-

app/api/elders/route.ts

@@ -1,11 +1,34 @@
 import { randomUUID } from "node:crypto";
 
-import type { Elder } from "@/modules/elders/types";
-import { validateElderInput } from "@/modules/elders/types";
+import { and, desc, eq } from "drizzle-orm";
+
 import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
 import { recordAuditLog } from "@/modules/core/server/audit";
 import { requirePermission } from "@/modules/core/server/auth";
-import { readData, updateData } from "@/modules/core/server/store";
+import { getDatabase } from "@/modules/core/server/db";
+import { admissions, beds, elders } from "@/modules/core/server/schema";
+import { validateElderInput } from "@/modules/elders/types";
+import type { Elder } from "@/modules/elders/types";
+
+function toElder(row: typeof elders.$inferSelect, bedLabel?: { room: string; bed: string; bedId: string }): Elder {
+  return {
+    id: row.id,
+    organizationId: row.organizationId,
+    name: row.name,
+    gender: row.gender,
+    age: row.age,
+    careLevel: row.careLevel,
+    room: bedLabel?.room ?? "",
+    bed: bedLabel?.bed ?? "",
+    bedId: bedLabel?.bedId,
+    status: row.status,
+    primaryContact: row.primaryContact,
+    phone: row.phone,
+    medicalNotes: row.medicalNotes,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
 
 export async function GET(): Promise<Response> {
   const auth = await requirePermission("elder:read", {
@@ -17,8 +40,19 @@ export async function GET(): Promise<Response> {
     return auth.response;
   }
 
-  const data = await readData();
-  return jsonSuccess("老人档案已加载", { elders: data.elders });
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看老人档案", 400);
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .select()
+    .from(elders)
+    .where(eq(elders.organizationId, organizationId))
+    .orderBy(desc(elders.createdAt));
+
+  return jsonSuccess("老人档案已加载", { elders: rows.map((row) => toElder(row)) });
 }
 
 export async function POST(request: Request): Promise<Response> {
@@ -31,24 +65,72 @@ export async function POST(request: Request): Promise<Response> {
     return auth.response;
   }
 
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后新增老人档案", 400);
+  }
+
   const input = validateElderInput(await readJsonBody(request));
   if (!input.success) {
     return jsonFailure(input.reason);
   }
 
-  const now = new Date().toISOString();
-  const elder: Elder = {
-    ...input.data,
-    id: randomUUID(),
-    createdAt: now,
-    updatedAt: now,
-  };
+  const database = getDatabase();
+  const created = await database.transaction(async (transaction) => {
+    const elderId = randomUUID();
+    const elderRows = await transaction
+      .insert(elders)
+      .values({
+        id: elderId,
+        organizationId,
+        name: input.data.name,
+        gender: input.data.gender,
+        age: input.data.age,
+        careLevel: input.data.careLevel,
+        status: input.data.status,
+        primaryContact: input.data.primaryContact,
+        phone: input.data.phone,
+        medicalNotes: input.data.medicalNotes,
+      })
+      .returning();
+    const elder = elderRows[0];
+    if (!elder) {
+      throw new Error("老人档案创建失败");
+    }
 
-  await updateData((data) => {
-    data.elders = [elder, ...data.elders];
+    if (input.data.bedId) {
+      const bedRows = await transaction
+        .select()
+        .from(beds)
+        .where(and(eq(beds.id, input.data.bedId), eq(beds.organizationId, organizationId)))
+        .limit(1);
+      const bed = bedRows[0];
+      if (!bed) {
+        throw new Error("床位不存在");
+      }
+      if (bed.status !== "available") {
+        throw new Error("床位不可分配");
+      }
+
+      await transaction
+        .insert(admissions)
+        .values({
+          organizationId,
+          elderId: elder.id,
+          bedId: bed.id,
+          status: "active",
+          notes: "新增档案时办理入住",
+        });
+      await transaction.update(beds).set({ status: "occupied", updatedAt: new Date() }).where(eq(beds.id, bed.id));
+    }
+
+    return elder;
   });
+
+  const elder = toElder(created);
   await recordAuditLog({
     actor: auth.context.account,
+    organizationId,
     action: "elder.create",
     targetType: "elder",
     targetId: elder.id,
@@ -58,4 +140,3 @@ export async function POST(request: Request): Promise<Response> {
 
   return jsonSuccess("老人档案已创建", { elder }, 201);
 }
-

app/api/facilities/beds/route.ts

@@ -0,0 +1,106 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { beds, rooms } from "@/modules/core/server/schema";
+import { readData } from "@/modules/core/server/store";
+import type { BedStatus } from "@/modules/core/types";
+
+const BED_STATUS_VALUES: BedStatus[] = ["available", "occupied", "maintenance", "disabled"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readBedStatus(value: string): BedStatus {
+  return BED_STATUS_VALUES.find((status) => status === value) ?? "available";
+}
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("facility:read", {
+    action: "bed.list",
+    targetType: "bed",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const data = await readData();
+  const organizationId = auth.context.organization?.id;
+  return jsonSuccess("床位列表已加载", {
+    beds: organizationId ? data.beds.filter((bed) => bed.organizationId === organizationId) : data.beds,
+  });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("facility:manage", {
+    action: "bed.create",
+    targetType: "bed",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护床位", 400);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const roomId = readString(body, "roomId");
+  const code = readString(body, "code");
+  if (!roomId || !code) {
+    return jsonFailure("房间和床位编号不能为空");
+  }
+
+  const database = getDatabase();
+  const roomRows = await database
+    .select()
+    .from(rooms)
+    .where(and(eq(rooms.id, roomId), eq(rooms.organizationId, organizationId)))
+    .limit(1);
+  const room = roomRows[0];
+  if (!room) {
+    return jsonFailure("房间不存在", 404);
+  }
+
+  const createdRows = await database
+    .insert(beds)
+    .values({
+      organizationId,
+      roomId,
+      code,
+      status: readBedStatus(readString(body, "status")),
+      notes: readString(body, "notes"),
+    })
+    .returning();
+  const bed = createdRows[0];
+  if (!bed) {
+    return jsonFailure("床位创建失败", 500);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "bed.create",
+    targetType: "bed",
+    targetId: bed.id,
+    result: "success",
+    reason: `新增床位：${room.name}-${bed.code}`,
+  });
+
+  return jsonSuccess("床位已创建", { bed }, 201);
+}

app/api/facilities/rooms/route.ts

@@ -0,0 +1,140 @@
+import { randomUUID } from "node:crypto";
+
+import { eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { campuses, buildings, floors, rooms } from "@/modules/core/server/schema";
+import { readData } from "@/modules/core/server/store";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readPositiveNumber(source: Record<string, unknown>, key: string, fallback: number): number {
+  const value = source[key];
+  const numeric = typeof value === "number" ? value : Number(value);
+  return Number.isInteger(numeric) && numeric > 0 ? numeric : fallback;
+}
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("facility:read", {
+    action: "room.list",
+    targetType: "room",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const data = await readData();
+  const organizationId = auth.context.organization?.id;
+  return jsonSuccess("房间列表已加载", {
+    rooms: organizationId ? data.rooms.filter((room) => room.organizationId === organizationId) : data.rooms,
+  });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("facility:manage", {
+    action: "room.create",
+    targetType: "room",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护房间", 400);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const roomName = readString(body, "name");
+  const roomCode = readString(body, "code");
+  if (!roomName || !roomCode) {
+    return jsonFailure("房间名称和编号不能为空");
+  }
+
+  const database = getDatabase();
+  const createdRows = await database.transaction(async (transaction) => {
+    const campusRows = await transaction.select().from(campuses).where(eq(campuses.organizationId, organizationId)).limit(1);
+    const campus =
+      campusRows[0] ??
+      (
+        await transaction
+          .insert(campuses)
+          .values({ organizationId, name: "默认院区", address: "" })
+          .returning()
+      )[0];
+    if (!campus) {
+      throw new Error("院区初始化失败");
+    }
+
+    const buildingRows = await transaction.select().from(buildings).where(eq(buildings.campusId, campus.id)).limit(1);
+    const building =
+      buildingRows[0] ??
+      (
+        await transaction
+          .insert(buildings)
+          .values({ organizationId, campusId: campus.id, name: "默认楼栋" })
+          .returning()
+      )[0];
+    if (!building) {
+      throw new Error("楼栋初始化失败");
+    }
+
+    const floorRows = await transaction.select().from(floors).where(eq(floors.buildingId, building.id)).limit(1);
+    const floor =
+      floorRows[0] ??
+      (
+        await transaction
+          .insert(floors)
+          .values({ organizationId, buildingId: building.id, name: "默认楼层", level: 1 })
+          .returning()
+      )[0];
+    if (!floor) {
+      throw new Error("楼层初始化失败");
+    }
+
+    return await transaction
+      .insert(rooms)
+      .values({
+        id: randomUUID(),
+        organizationId,
+        floorId: floor.id,
+        name: roomName,
+        code: roomCode,
+        capacity: readPositiveNumber(body, "capacity", 1),
+      })
+      .returning();
+  });
+
+  const room = createdRows[0];
+  if (!room) {
+    return jsonFailure("房间创建失败", 500);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "room.create",
+    targetType: "room",
+    targetId: room.id,
+    result: "success",
+    reason: `新增房间：${room.name}`,
+  });
+
+  return jsonSuccess("房间已创建", { room }, 201);
+}

app/api/organizations/[id]/invitations/route.ts

@@ -0,0 +1,103 @@
+import { randomBytes } from "node:crypto";
+
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { organizationInvitations, organizations, roles } from "@/modules/core/server/schema";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function createInvitationToken(): string {
+  return randomBytes(24).toString("base64url");
+}
+
+export async function POST(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "organizationInvitation.create",
+    targetType: "organization",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const activeOrganizationId = auth.context.organization?.id;
+  if (activeOrganizationId && activeOrganizationId !== id) {
+    return jsonFailure("不能为其他机构创建邀请", 403);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const email = readString(body, "email");
+  const roleId = readString(body, "roleId");
+  if (!roleId) {
+    return jsonFailure("请选择邀请角色");
+  }
+
+  const database = getDatabase();
+  const organizationRows = await database.select().from(organizations).where(eq(organizations.id, id)).limit(1);
+  const organization = organizationRows[0];
+  if (!organization) {
+    return jsonFailure("机构不存在", 404);
+  }
+
+  const roleRows = await database
+    .select()
+    .from(roles)
+    .where(and(eq(roles.id, roleId), eq(roles.organizationId, id), eq(roles.isEnabled, true)))
+    .limit(1);
+  const role = roleRows[0];
+  if (!role) {
+    return jsonFailure("角色不存在", 404);
+  }
+
+  const rows = await database
+    .insert(organizationInvitations)
+    .values({
+      organizationId: id,
+      roleId: role.id,
+      email,
+      token: createInvitationToken(),
+      status: "active",
+      createdByAccountId: auth.context.account.id,
+      expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+    })
+    .returning();
+  const invitation = rows[0];
+  if (!invitation) {
+    return jsonFailure("邀请创建失败", 500);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: id,
+    action: "organizationInvitation.create",
+    targetType: "organizationInvitation",
+    targetId: invitation.id,
+    result: "success",
+    reason: `创建机构邀请：${email || "通用邀请"}`,
+  });
+
+  return jsonSuccess("邀请已创建", { invitation }, 201);
+}

app/api/organizations/[id]/route.ts

@@ -0,0 +1,211 @@
+import { eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { organizations } from "@/modules/core/server/schema";
+import type { OrganizationStatus } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const ORGANIZATION_STATUSES: OrganizationStatus[] = ["active", "disabled"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readBoolean(source: Record<string, unknown>, key: string): boolean | null {
+  const value = source[key];
+  return typeof value === "boolean" ? value : null;
+}
+
+function readStatus(value: unknown): OrganizationStatus | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+
+  return ORGANIZATION_STATUSES.find((status) => status === value) ?? null;
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("organization:manage", {
+    action: "organization.update",
+    targetType: "organization",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const slug = readString(body, "slug");
+  const oidcIssuerUrl = readString(body, "oidcIssuerUrl");
+  const oidcClientId = readString(body, "oidcClientId");
+  const oidcClientSecret = readString(body, "oidcClientSecret");
+  const oidcScopes = readString(body, "oidcScopes");
+  const oidcRedirectUri = readString(body, "oidcRedirectUri");
+  const status = "status" in body ? readStatus(body.status) : null;
+  if ("status" in body && !status) {
+    return jsonFailure("机构状态无效");
+  }
+  const registrationEnabled = "registrationEnabled" in body ? readBoolean(body, "registrationEnabled") : null;
+  const oidcEnabled = "oidcEnabled" in body ? readBoolean(body, "oidcEnabled") : null;
+  const oidcAutoProvision = "oidcAutoProvision" in body ? readBoolean(body, "oidcAutoProvision") : null;
+  if ("registrationEnabled" in body && registrationEnabled === null) {
+    return jsonFailure("注册开关无效");
+  }
+  if ("oidcEnabled" in body && oidcEnabled === null) {
+    return jsonFailure("OIDC开关无效");
+  }
+  if ("oidcAutoProvision" in body && oidcAutoProvision === null) {
+    return jsonFailure("OIDC自动开户配置无效");
+  }
+
+  if (
+    !name &&
+    !slug &&
+    !status &&
+    registrationEnabled === null &&
+    oidcEnabled === null &&
+    !oidcIssuerUrl &&
+    !oidcClientId &&
+    !oidcClientSecret &&
+    !oidcScopes &&
+    !oidcRedirectUri &&
+    oidcAutoProvision === null
+  ) {
+    return jsonFailure("请至少填写一个要更新的字段");
+  }
+
+  const updateValues: {
+    name?: string;
+    slug?: string;
+    status?: OrganizationStatus;
+    registrationEnabled?: boolean;
+    oidcEnabled?: boolean;
+    oidcIssuerUrl?: string;
+    oidcClientId?: string;
+    oidcClientSecret?: string;
+    oidcScopes?: string;
+    oidcRedirectUri?: string;
+    oidcAutoProvision?: boolean;
+    updatedAt: Date;
+  } = {
+    updatedAt: new Date(),
+  };
+
+  if (name) {
+    updateValues.name = name;
+  }
+  if (slug) {
+    updateValues.slug = slug;
+  }
+  if (status) {
+    updateValues.status = status;
+  }
+  if (registrationEnabled !== null) {
+    updateValues.registrationEnabled = registrationEnabled;
+  }
+  if (oidcEnabled !== null) {
+    updateValues.oidcEnabled = oidcEnabled;
+  }
+  if (oidcIssuerUrl) {
+    updateValues.oidcIssuerUrl = oidcIssuerUrl;
+  }
+  if (oidcClientId) {
+    updateValues.oidcClientId = oidcClientId;
+  }
+  if (oidcClientSecret) {
+    updateValues.oidcClientSecret = oidcClientSecret;
+  }
+  if (oidcScopes) {
+    updateValues.oidcScopes = oidcScopes;
+  }
+  if (oidcRedirectUri) {
+    updateValues.oidcRedirectUri = oidcRedirectUri;
+  }
+  if (oidcAutoProvision !== null) {
+    updateValues.oidcAutoProvision = oidcAutoProvision;
+  }
+
+  const database = getDatabase();
+  try {
+    const rows = await database.update(organizations).set(updateValues).where(eq(organizations.id, id)).returning();
+    const organization = rows[0];
+    if (!organization) {
+      return jsonFailure("机构不存在", 404);
+    }
+
+    await recordAuditLog({
+      actor: auth.context.account,
+      organizationId: organization.id,
+      action: "organization.update",
+      targetType: "organization",
+      targetId: organization.id,
+      result: "success",
+      reason: `更新机构：${organization.name}`,
+    });
+
+    return jsonSuccess("机构已更新", { organization });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    if (message.includes("organizations_slug_unique")) {
+      return jsonFailure("机构标识已存在", 409);
+    }
+
+    return jsonFailure("机构更新失败", 500);
+  }
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("organization:manage", {
+    action: "organization.disable",
+    targetType: "organization",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .update(organizations)
+    .set({ status: "disabled", updatedAt: new Date() })
+    .where(eq(organizations.id, id))
+    .returning();
+  const organization = rows[0];
+  if (!organization) {
+    return jsonFailure("机构不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: organization.id,
+    action: "organization.disable",
+    targetType: "organization",
+    targetId: organization.id,
+    result: "success",
+    reason: `停用机构：${organization.name}`,
+  });
+
+  return jsonSuccess("机构已停用", { organization });
+}

app/api/organizations/route.ts

@@ -0,0 +1,101 @@
+import { eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { seedOrganizationRoles } from "@/modules/core/server/permissions";
+import { organizations } from "@/modules/core/server/schema";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function createSlug(name: string): string {
+  const base = name
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
+
+  return base.length > 0 ? base : `org-${Date.now()}`;
+}
+
+export async function GET(): Promise<Response> {
+  const database = getDatabase();
+  const rows = await database.select().from(organizations).where(eq(organizations.status, "active"));
+
+  return jsonSuccess("机构列表已加载", {
+    organizations: rows
+      .filter((organization) => organization.registrationEnabled)
+      .map((organization) => ({
+        id: organization.id,
+        name: organization.name,
+        slug: organization.slug,
+        status: organization.status,
+        registrationEnabled: organization.registrationEnabled,
+        oidcEnabled: organization.oidcEnabled,
+        oidcIssuerUrl: "",
+        oidcClientId: "",
+        oidcHasClientSecret: organization.oidcClientSecret.length > 0,
+        oidcScopes: organization.oidcScopes,
+        oidcRedirectUri: organization.oidcRedirectUri,
+        oidcAutoProvision: organization.oidcAutoProvision,
+        createdAt: organization.createdAt.toISOString(),
+        updatedAt: organization.updatedAt.toISOString(),
+      })),
+  });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("organization:manage", {
+    action: "organization.create",
+    targetType: "organization",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  if (!name) {
+    return jsonFailure("机构名称不能为空");
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .insert(organizations)
+    .values({
+      name,
+      slug: readString(body, "slug") || createSlug(name),
+      status: "active",
+    })
+    .returning();
+  const organization = rows[0];
+  if (!organization) {
+    return jsonFailure("机构创建失败", 500);
+  }
+
+  await seedOrganizationRoles(organization.id);
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: organization.id,
+    action: "organization.create",
+    targetType: "organization",
+    targetId: organization.id,
+    result: "success",
+    reason: `创建机构：${organization.name}`,
+  });
+
+  return jsonSuccess("机构已创建", { organization }, 201);
+}

app/api/settings/accounts/[id]/route.ts

@@ -0,0 +1,248 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { hasPermission } from "@/modules/core/server/permissions";
+import { accounts, memberships, organizations, roles, sessions } from "@/modules/core/server/schema";
+import type { AccountStatus, Organization } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const ACCOUNT_STATUSES: AccountStatus[] = ["active", "disabled", "pending"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readStatus(value: unknown): AccountStatus | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+
+  return ACCOUNT_STATUSES.find((status) => status === value) ?? null;
+}
+
+function toOrganization(row: typeof organizations.$inferSelect): Organization {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAutoProvision: row.oidcAutoProvision,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "account.update",
+    targetType: "account",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const status = "status" in body ? readStatus(body.status) : null;
+  const roleId = readString(body, "roleId");
+  const requestedOrganizationId = readString(body, "organizationId");
+  const organizationId = requestedOrganizationId || auth.context.organization?.id;
+
+  if ("status" in body && !status) {
+    return jsonFailure("账号状态无效");
+  }
+
+  if (!name && !status && !roleId) {
+    return jsonFailure("请至少填写一个要更新的字段");
+  }
+
+  if (id === auth.context.account.id && status === "disabled") {
+    return jsonFailure("不能停用当前登录账号", 400);
+  }
+
+  const canManagePlatform = hasPermission(auth.context.permissions, "platform:manage");
+  if (!canManagePlatform && requestedOrganizationId && requestedOrganizationId !== auth.context.organization?.id) {
+    return jsonFailure("权限不足", 403);
+  }
+
+  const database = getDatabase();
+  const targetAccountRows = await database.select().from(accounts).where(eq(accounts.id, id)).limit(1);
+  const targetAccount = targetAccountRows[0];
+  if (!targetAccount) {
+    return jsonFailure("账号不存在", 404);
+  }
+
+  if (roleId && !organizationId) {
+    return jsonFailure("请选择机构后分配角色", 400);
+  }
+
+  const organizationRows = organizationId
+    ? await database.select().from(organizations).where(eq(organizations.id, organizationId)).limit(1)
+    : [];
+  const organization = organizationRows[0];
+  if (roleId && !organization) {
+    return jsonFailure("机构不存在", 404);
+  }
+
+  try {
+    await database.transaction(async (transaction) => {
+      if (name || status) {
+        const updateValues: {
+          name?: string;
+          status?: AccountStatus;
+          updatedAt: Date;
+        } = {
+          updatedAt: new Date(),
+        };
+        if (name) {
+          updateValues.name = name;
+        }
+        if (status) {
+          updateValues.status = status;
+        }
+
+        await transaction.update(accounts).set(updateValues).where(eq(accounts.id, id));
+        if (status === "disabled") {
+          await transaction.delete(sessions).where(eq(sessions.accountId, id));
+        }
+      }
+
+      if (roleId && organizationId) {
+        const roleRows = await transaction
+          .select()
+          .from(roles)
+          .where(and(eq(roles.id, roleId), eq(roles.organizationId, organizationId), eq(roles.isEnabled, true)))
+          .limit(1);
+        const role = roleRows[0];
+        if (!role) {
+          throw new Error("角色不存在");
+        }
+
+        const membershipRows = await transaction
+          .select()
+          .from(memberships)
+          .where(and(eq(memberships.accountId, id), eq(memberships.organizationId, organizationId)))
+          .limit(1);
+        const membership = membershipRows[0];
+
+        if (membership) {
+          await transaction
+            .update(memberships)
+            .set({ roleId, status: "active", updatedAt: new Date() })
+            .where(eq(memberships.id, membership.id));
+        } else {
+          await transaction.insert(memberships).values({
+            accountId: id,
+            organizationId,
+            roleId,
+            status: "active",
+          });
+        }
+      }
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "账号更新失败";
+    return jsonFailure(reason, reason === "角色不存在" ? 404 : 400);
+  }
+
+  const updatedAccountRows = await database.select().from(accounts).where(eq(accounts.id, id)).limit(1);
+  const updatedAccount = updatedAccountRows[0];
+  if (!updatedAccount) {
+    return jsonFailure("账号不存在", 404);
+  }
+
+  const membershipRows = organizationId
+    ? await database
+        .select({ membership: memberships, role: roles })
+        .from(memberships)
+        .innerJoin(roles, eq(roles.id, memberships.roleId))
+        .where(and(eq(memberships.accountId, id), eq(memberships.organizationId, organizationId)))
+        .limit(1)
+    : [];
+  const membership = membershipRows[0];
+  const publicAccount = toPublicAccount(
+    updatedAccount,
+    membership?.role.key,
+    organization ? toOrganization(organization) : undefined,
+  );
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "account.update",
+    targetType: "account",
+    targetId: updatedAccount.id,
+    result: "success",
+    reason: `更新账号：${updatedAccount.email}`,
+  });
+
+  return jsonSuccess("账号已更新", { account: publicAccount });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "account.disable",
+    targetType: "account",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  if (id === auth.context.account.id) {
+    return jsonFailure("不能停用当前登录账号", 400);
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .update(accounts)
+    .set({ status: "disabled", updatedAt: new Date() })
+    .where(eq(accounts.id, id))
+    .returning();
+  const account = rows[0];
+  if (!account) {
+    return jsonFailure("账号不存在", 404);
+  }
+  await database.delete(sessions).where(eq(sessions.accountId, id));
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: auth.context.organization?.id,
+    action: "account.disable",
+    targetType: "account",
+    targetId: account.id,
+    result: "success",
+    reason: `停用账号：${account.email}`,
+  });
+
+  return jsonSuccess("账号已停用", { account: toPublicAccount(account) });
+}

app/api/settings/accounts/route.ts

@@ -1,7 +1,22 @@
-import { jsonSuccess } from "@/modules/core/server/api";
-import { requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { hashPassword, normalizeEmail, requirePermission, toPublicAccount } from "@/modules/core/server/auth";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { getDatabase } from "@/modules/core/server/db";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
+import { accounts, memberships, organizations, roles } from "@/modules/core/server/schema";
 import { readData } from "@/modules/core/server/store";
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
 export async function GET(): Promise<Response> {
   const auth = await requirePermission("account:read", {
     action: "account.list",
@@ -13,8 +28,147 @@ export async function GET(): Promise<Response> {
   }
 
   const data = await readData();
+  const canReadAllAccounts = hasPermission(auth.context.permissions, "platform:manage");
+  const organizationId = auth.context.organization?.id;
+  const roleDefinitions = await getRoleDefinitions(organizationId);
+  const roleById = new Map(roleDefinitions.map((role) => [role.id, role]));
+  const organizationById = new Map(data.organizations.map((organization) => [organization.id, organization]));
+  const scopedAccountIds =
+    organizationId && !canReadAllAccounts
+      ? new Set(
+          data.memberships
+            .filter((membership) => membership.organizationId === organizationId)
+            .map((membership) => membership.accountId),
+        )
+      : null;
+
   return jsonSuccess("账号列表已加载", {
-    accounts: data.accounts.map((account) => toPublicAccount(account)),
+    accounts: data.accounts
+      .filter((account) => !scopedAccountIds || scopedAccountIds.has(account.id))
+      .map((account) => {
+        const membership = organizationId
+          ? data.memberships.find(
+              (item) => item.accountId === account.id && item.organizationId === organizationId && item.status === "active",
+            )
+          : data.memberships.find((item) => item.accountId === account.id && item.status === "active");
+        const organization = membership ? organizationById.get(membership.organizationId) : undefined;
+        const platformRole = account.platformRoleId ? roleById.get(account.platformRoleId) : undefined;
+
+        return toPublicAccount(account, platformRole?.key ?? membership?.roleKey, organization);
+      }),
   });
 }
 
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("account:manage", {
+    action: "account.create",
+    targetType: "account",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const name = readString(body, "name");
+  const email = readString(body, "email");
+  const password = readString(body, "password");
+  const roleId = readString(body, "roleId");
+  const organizationId = readString(body, "organizationId") || auth.context.organization?.id;
+
+  if (!name || !email || !password || !roleId || !organizationId) {
+    return jsonFailure("姓名、邮箱、密码、机构和角色不能为空");
+  }
+
+  const database = getDatabase();
+  const passwordHash = hashPassword(password);
+  try {
+    const created = await database.transaction(async (transaction) => {
+    const normalizedEmail = normalizeEmail(email);
+    const existingAccountRows = await transaction
+      .select({ id: accounts.id })
+      .from(accounts)
+      .where(eq(accounts.email, normalizedEmail))
+      .limit(1);
+    if (existingAccountRows.length > 0) {
+      throw new Error("账号已存在");
+    }
+
+    const organizationRows = await transaction.select().from(organizations).where(eq(organizations.id, organizationId)).limit(1);
+    const organization = organizationRows[0];
+    if (!organization) {
+      throw new Error("机构不存在");
+    }
+
+    const roleRows = await transaction
+      .select()
+      .from(roles)
+      .where(and(eq(roles.id, roleId), eq(roles.organizationId, organizationId)))
+      .limit(1);
+    const role = roleRows[0];
+    if (!role) {
+      throw new Error("角色不存在");
+    }
+
+    const accountRows = await transaction
+      .insert(accounts)
+      .values({
+        name,
+        email: normalizedEmail,
+        passwordHash: passwordHash.hash,
+        passwordSalt: passwordHash.salt,
+        status: "active",
+      })
+      .returning();
+    const account = accountRows[0];
+    if (!account) {
+      throw new Error("账号创建失败");
+    }
+
+    await transaction.insert(memberships).values({
+      accountId: account.id,
+      organizationId,
+      roleId,
+      status: "active",
+    });
+
+      return { account, organization, role };
+    });
+
+    await recordAuditLog({
+      actor: auth.context.account,
+      organizationId,
+      action: "account.create",
+      targetType: "account",
+      targetId: created.account.id,
+      result: "success",
+      reason: `创建机构用户：${created.account.email}`,
+    });
+
+    return jsonSuccess("账号已创建", {
+      account: toPublicAccount(created.account, created.role.key, {
+        id: created.organization.id,
+        name: created.organization.name,
+        slug: created.organization.slug,
+        status: created.organization.status,
+        registrationEnabled: created.organization.registrationEnabled,
+        oidcEnabled: created.organization.oidcEnabled,
+        oidcIssuerUrl: created.organization.oidcIssuerUrl,
+        oidcClientId: created.organization.oidcClientId,
+        oidcHasClientSecret: created.organization.oidcClientSecret.length > 0,
+        oidcScopes: created.organization.oidcScopes,
+        oidcRedirectUri: created.organization.oidcRedirectUri,
+        oidcAutoProvision: created.organization.oidcAutoProvision,
+        createdAt: created.organization.createdAt.toISOString(),
+        updatedAt: created.organization.updatedAt.toISOString(),
+      }),
+    }, 201);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "账号创建失败";
+    return jsonFailure(reason, reason === "账号已存在" ? 409 : 400);
+  }
+}

app/api/settings/join-requests/[id]/route.ts

@@ -0,0 +1,146 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { accounts, joinRequests, memberships, roles } from "@/modules/core/server/schema";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("account:manage", {
+    action: "joinRequest.review",
+    targetType: "joinRequest",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const decision = readString(body, "decision");
+  if (decision !== "approved" && decision !== "rejected") {
+    return jsonFailure("审批结果无效");
+  }
+
+  const database = getDatabase();
+  const reviewed = await database.transaction(async (transaction) => {
+    const requestRows = await transaction
+      .select()
+      .from(joinRequests)
+      .where(eq(joinRequests.id, id))
+      .limit(1);
+    const joinRequest = requestRows[0];
+    if (!joinRequest) {
+      return null;
+    }
+
+    const activeOrganizationId = auth.context.organization?.id;
+    if (activeOrganizationId && joinRequest.organizationId !== activeOrganizationId) {
+      throw new Error("不能审批其他机构的申请");
+    }
+
+    if (joinRequest.status !== "pending") {
+      throw new Error("申请已处理");
+    }
+
+    let roleId = readString(body, "roleId");
+    if (decision === "approved" && !roleId) {
+      const defaultRoleRows = await transaction
+        .select()
+        .from(roles)
+        .where(and(eq(roles.organizationId, joinRequest.organizationId), eq(roles.key, "caregiver")))
+        .limit(1);
+      const defaultRole = defaultRoleRows[0];
+      if (!defaultRole) {
+        throw new Error("默认角色不存在");
+      }
+      roleId = defaultRole.id;
+    }
+
+    if (decision === "approved") {
+      const roleRows = await transaction
+        .select()
+        .from(roles)
+        .where(and(eq(roles.id, roleId), eq(roles.organizationId, joinRequest.organizationId)))
+        .limit(1);
+      const role = roleRows[0];
+      if (!role) {
+        throw new Error("审批角色不存在");
+      }
+
+      await transaction
+        .insert(memberships)
+        .values({
+          accountId: joinRequest.accountId,
+          organizationId: joinRequest.organizationId,
+          roleId: role.id,
+          status: "active",
+        })
+        .onConflictDoUpdate({
+          target: [memberships.accountId, memberships.organizationId],
+          set: {
+            roleId: role.id,
+            status: "active",
+            updatedAt: new Date(),
+          },
+        });
+      await transaction
+        .update(accounts)
+        .set({ status: "active", updatedAt: new Date() })
+        .where(eq(accounts.id, joinRequest.accountId));
+    }
+
+    const updatedRows = await transaction
+      .update(joinRequests)
+      .set({
+        status: decision,
+        reviewedByAccountId: auth.context.account.id,
+        reviewedAt: new Date(),
+      })
+      .where(eq(joinRequests.id, joinRequest.id))
+      .returning();
+    const updated = updatedRows[0];
+    if (!updated) {
+      throw new Error("申请审批失败");
+    }
+
+    return updated;
+  });
+
+  if (!reviewed) {
+    return jsonFailure("加入申请不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: reviewed.organizationId,
+    action: "joinRequest.review",
+    targetType: "joinRequest",
+    targetId: reviewed.id,
+    result: "success",
+    reason: decision === "approved" ? "通过加入申请" : "拒绝加入申请",
+  });
+
+  return jsonSuccess("加入申请已处理", { joinRequest: reviewed });
+}

app/api/settings/join-requests/route.ts

@@ -0,0 +1,23 @@
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { readData } from "@/modules/core/server/store";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("account:read", {
+    action: "joinRequest.list",
+    targetType: "joinRequest",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const data = await readData();
+  const organizationId = auth.context.organization?.id;
+
+  return jsonSuccess("加入申请已加载", {
+    joinRequests: organizationId
+      ? data.joinRequests.filter((request) => request.organizationId === organizationId)
+      : data.joinRequests,
+  });
+}

app/api/settings/permissions/route.ts

@@ -0,0 +1,16 @@
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { PERMISSION_DEFINITIONS } from "@/modules/core/server/permissions";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("permission:read", {
+    action: "permission.list",
+    targetType: "permission",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  return jsonSuccess("权限点已加载", { permissions: PERMISSION_DEFINITIONS });
+}

app/api/settings/roles/[id]/route.ts

@@ -0,0 +1,218 @@
+import { eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { getRoleDefinitions, hasPermission } from "@/modules/core/server/permissions";
+import { rolePermissions, roles } from "@/modules/core/server/schema";
+import { PERMISSIONS } from "@/modules/core/types";
+import type { Permission } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const PERMISSION_SET = new Set<string>(PERMISSIONS);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readBoolean(source: Record<string, unknown>, key: string): boolean | null {
+  const value = source[key];
+  return typeof value === "boolean" ? value : null;
+}
+
+function readPermissionArray(source: Record<string, unknown>): Permission[] | null {
+  const value = source.permissions;
+  if (!Array.isArray(value)) {
+    return null;
+  }
+
+  const permissions = value.filter((item): item is string => typeof item === "string");
+  if (permissions.length !== value.length || permissions.some((permission) => !PERMISSION_SET.has(permission))) {
+    return null;
+  }
+
+  return permissions as Permission[];
+}
+
+function createRoleKey(label: string): string {
+  return label.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
+}
+
+async function getEditableRole(id: string, organizationId: string | undefined, canManagePlatform: boolean) {
+  const database = getDatabase();
+  const rows = await database.select().from(roles).where(eq(roles.id, id)).limit(1);
+  const role = rows[0];
+  if (!role) {
+    return { success: false as const, response: jsonFailure("角色不存在", 404) };
+  }
+
+  if (role.isSystem) {
+    return { success: false as const, response: jsonFailure("内置角色不可编辑", 400) };
+  }
+
+  if (!canManagePlatform && role.organizationId !== organizationId) {
+    return { success: false as const, response: jsonFailure("角色不存在", 404) };
+  }
+
+  return { success: true as const, role };
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("role:manage", {
+    action: "role.update",
+    targetType: "role",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const organizationId = auth.context.organization?.id;
+  const editable = await getEditableRole(id, organizationId, hasPermission(auth.context.permissions, "platform:manage"));
+  if (!editable.success) {
+    return editable.response;
+  }
+
+  const label = readString(body, "label");
+  const key = readString(body, "key") || (label ? createRoleKey(label) : "");
+  const description = readString(body, "description");
+  const isEnabled = "isEnabled" in body ? readBoolean(body, "isEnabled") : null;
+  if ("isEnabled" in body && isEnabled === null) {
+    return jsonFailure("角色状态无效");
+  }
+
+  const permissions = "permissions" in body ? readPermissionArray(body) : null;
+  if ("permissions" in body && permissions === null) {
+    return jsonFailure("权限列表无效");
+  }
+
+  if (!label && !key && !description && isEnabled === null && permissions === null) {
+    return jsonFailure("请至少填写一个要更新的字段");
+  }
+
+  const updateValues: {
+    label?: string;
+    key?: string;
+    description?: string;
+    isEnabled?: boolean;
+    updatedAt: Date;
+  } = {
+    updatedAt: new Date(),
+  };
+
+  if (label) {
+    updateValues.label = label;
+  }
+  if (key) {
+    updateValues.key = key;
+  }
+  if (description) {
+    updateValues.description = description;
+  }
+  if (isEnabled !== null) {
+    updateValues.isEnabled = isEnabled;
+  }
+
+  const database = getDatabase();
+  try {
+    await database.transaction(async (transaction) => {
+      await transaction.update(roles).set(updateValues).where(eq(roles.id, id));
+      if (permissions) {
+        await transaction.delete(rolePermissions).where(eq(rolePermissions.roleId, id));
+        if (permissions.length > 0) {
+          await transaction.insert(rolePermissions).values(
+            permissions.map((permissionId) => ({
+              roleId: id,
+              permissionId,
+            })),
+          );
+        }
+      }
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "";
+    if (message.includes("roles_key_organization_unique")) {
+      return jsonFailure("角色标识已存在", 409);
+    }
+
+    return jsonFailure("角色更新失败", 500);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: editable.role.organizationId ?? organizationId,
+    action: "role.update",
+    targetType: "role",
+    targetId: id,
+    result: "success",
+    reason: `更新角色：${label || editable.role.label}`,
+  });
+
+  const roleRows = await getRoleDefinitions(editable.role.organizationId ?? organizationId);
+  const role = roleRows.find((item) => item.id === id);
+  if (!role) {
+    return jsonFailure("角色更新后读取失败", 500);
+  }
+
+  return jsonSuccess("角色已更新", { role });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("role:manage", {
+    action: "role.disable",
+    targetType: "role",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  const editable = await getEditableRole(id, organizationId, hasPermission(auth.context.permissions, "platform:manage"));
+  if (!editable.success) {
+    return editable.response;
+  }
+
+  const database = getDatabase();
+  const rows = await database
+    .update(roles)
+    .set({ isEnabled: false, updatedAt: new Date() })
+    .where(eq(roles.id, id))
+    .returning();
+  const role = rows[0];
+  if (!role) {
+    return jsonFailure("角色不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: role.organizationId ?? organizationId,
+    action: "role.disable",
+    targetType: "role",
+    targetId: role.id,
+    result: "success",
+    reason: `停用角色：${role.label}`,
+  });
+
+  return jsonSuccess("角色已停用", { role });
+}

app/api/settings/roles/route.ts

@@ -1,9 +1,32 @@
 import { jsonSuccess } from "@/modules/core/server/api";
+import { jsonFailure, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
 import { requirePermission } from "@/modules/core/server/auth";
-import { ROLE_DEFINITIONS } from "@/modules/core/server/permissions";
+import { getDatabase } from "@/modules/core/server/db";
+import { getRoleDefinitions } from "@/modules/core/server/permissions";
+import { rolePermissions, roles } from "@/modules/core/server/schema";
+import type { Permission } from "@/modules/core/types";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readString(source: Record<string, unknown>, key: string): string {
+  const value = source[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function readPermissionArray(source: Record<string, unknown>): Permission[] {
+  const value = source.permissions;
+  if (!Array.isArray(value)) {
+    return [];
+  }
+
+  return value.filter((item): item is Permission => typeof item === "string");
+}
 
 export async function GET(): Promise<Response> {
-  const auth = await requirePermission("account:read", {
+  const auth = await requirePermission("role:read", {
     action: "role.list",
     targetType: "role",
   });
@@ -12,6 +35,85 @@ export async function GET(): Promise<Response> {
     return auth.response;
   }
 
-  return jsonSuccess("角色列表已加载", { roles: ROLE_DEFINITIONS });
+  const roles = await getRoleDefinitions(auth.context.organization?.id);
+  return jsonSuccess("角色列表已加载", { roles });
 }
 
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("role:manage", {
+    action: "role.create",
+    targetType: "role",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后创建角色", 400);
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const label = readString(body, "label");
+  const key = readString(body, "key") || label.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+  const description = readString(body, "description");
+  const permissions = readPermissionArray(body);
+
+  if (!label || !key) {
+    return jsonFailure("角色名称不能为空");
+  }
+
+  const database = getDatabase();
+  const created = await database.transaction(async (transaction) => {
+    const rows = await transaction
+      .insert(roles)
+      .values({
+        key,
+        organizationId,
+        scope: "organization",
+        label,
+        description: description || "机构自定义角色",
+        isSystem: false,
+        isEnabled: true,
+      })
+      .returning();
+    const role = rows[0];
+    if (!role) {
+      throw new Error("角色创建失败");
+    }
+
+    if (permissions.length > 0) {
+      await transaction.insert(rolePermissions).values(
+        permissions.map((permissionId) => ({
+          roleId: role.id,
+          permissionId,
+        })),
+      );
+    }
+
+    return role;
+  });
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "role.create",
+    targetType: "role",
+    targetId: created.id,
+    result: "success",
+    reason: `创建自定义角色：${created.label}`,
+  });
+
+  const roleRows = await getRoleDefinitions(organizationId);
+  const role = roleRows.find((item) => item.id === created.id);
+  if (!role) {
+    return jsonFailure("角色创建后读取失败", 500);
+  }
+
+  return jsonSuccess("角色已创建", { role }, 201);
+}

app/api/system/incidents/[id]/route.ts

@@ -0,0 +1,85 @@
+import { and, eq } from "drizzle-orm";
+
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { getDatabase } from "@/modules/core/server/db";
+import { systemIncidents } from "@/modules/core/server/schema";
+import type { IncidentStatus } from "@/modules/core/types";
+
+type RouteContext = {
+  params: Promise<{
+    id: string;
+  }>;
+};
+
+const INCIDENT_STATUSES: IncidentStatus[] = ["open", "acknowledged", "resolved", "closed"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function readStatus(value: unknown): IncidentStatus | null {
+  if (typeof value !== "string") {
+    return null;
+  }
+
+  return INCIDENT_STATUSES.find((status) => status === value) ?? null;
+}
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("incident:manage", {
+    action: "incident.update",
+    targetType: "incident",
+    targetId: id,
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const body = await readJsonBody(request);
+  if (!isRecord(body)) {
+    return jsonFailure("请求数据格式无效");
+  }
+
+  const status = readStatus(body.status);
+  if (!status) {
+    return jsonFailure("故障状态无效");
+  }
+
+  const database = getDatabase();
+  const organizationId = auth.context.organization?.id;
+  const updateValues = {
+    status,
+    updatedAt: new Date(),
+    acknowledgedByAccountId: status === "acknowledged" ? auth.context.account.id : undefined,
+    acknowledgedAt: status === "acknowledged" ? new Date() : undefined,
+    resolvedByAccountId: status === "resolved" || status === "closed" ? auth.context.account.id : undefined,
+    resolvedAt: status === "resolved" || status === "closed" ? new Date() : undefined,
+  };
+  const rows = organizationId
+    ? await database
+        .update(systemIncidents)
+        .set(updateValues)
+        .where(and(eq(systemIncidents.id, id), eq(systemIncidents.organizationId, organizationId)))
+        .returning()
+    : await database.update(systemIncidents).set(updateValues).where(eq(systemIncidents.id, id)).returning();
+  const incident = rows[0];
+  if (!incident) {
+    return jsonFailure("故障事件不存在", 404);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId: incident.organizationId ?? undefined,
+    action: "incident.update",
+    targetType: "incident",
+    targetId: incident.id,
+    result: "success",
+    reason: `故障状态更新为：${status}`,
+  });
+
+  return jsonSuccess("故障事件已更新", { incident });
+}

app/api/system/status/route.ts

@@ -0,0 +1,49 @@
+import { desc } from "drizzle-orm";
+
+import { jsonSuccess } from "@/modules/core/server/api";
+import { requirePermission } from "@/modules/core/server/auth";
+import { checkDatabaseConnection, getDatabase } from "@/modules/core/server/db";
+import { accounts, beds, elders, organizations, systemIncidents } from "@/modules/core/server/schema";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("incident:read", {
+    action: "system.status",
+    targetType: "systemStatus",
+  });
+
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const health = await checkDatabaseConnection();
+  const database = getDatabase();
+  const [organizationRows, accountRows, elderRows, bedRows, incidentRows] = await Promise.all([
+    database.select({ id: organizations.id }).from(organizations),
+    database.select({ id: accounts.id }).from(accounts),
+    database.select({ id: elders.id }).from(elders),
+    database.select({ id: beds.id }).from(beds),
+    database.select().from(systemIncidents).orderBy(desc(systemIncidents.createdAt)).limit(20),
+  ]);
+
+  return jsonSuccess("系统运行状态已加载", {
+    health,
+    metrics: {
+      organizations: organizationRows.length,
+      accounts: accountRows.length,
+      elders: elderRows.length,
+      beds: bedRows.length,
+      incidents: incidentRows.length,
+    },
+    incidents: incidentRows.map((incident) => ({
+      id: incident.id,
+      organizationId: incident.organizationId,
+      severity: incident.severity,
+      status: incident.status,
+      title: incident.title,
+      description: incident.description,
+      source: incident.source,
+      createdAt: incident.createdAt.toISOString(),
+      updatedAt: incident.updatedAt.toISOString(),
+    })),
+  });
+}

app/globals.css

@@ -79,3 +79,45 @@ a,
 ::selection {
   background: color-mix(in oklch, var(--primary) 22%, transparent);
 }
+
+@keyframes page-enter {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+
+@keyframes loading-progress {
+  0% {
+    transform: translateX(-100%);
+  }
+  55% {
+    transform: translateX(-18%);
+  }
+  100% {
+    transform: translateX(100%);
+  }
+}
+
+.page-enter {
+  animation: page-enter 180ms ease-out both;
+}
+
+.table-row-enter {
+  animation: page-enter 160ms ease-out both;
+}
+
+.loading-progress {
+  width: 55%;
+  animation: loading-progress 900ms ease-in-out infinite;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .page-enter,
+  .table-row-enter,
+  .loading-progress {
+    animation: none;
+  }
+}

drizzle.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./modules/core/server/schema.ts",
+  out: "./drizzle",
+  dbCredentials: {
+    url: process.env.DATABASE_URL ?? "",
+  },
+});

drizzle/0000_bouncy_micromax.sql

@@ -0,0 +1,235 @@
+CREATE TYPE "public"."account_status" AS ENUM('active', 'disabled', 'pending');--> statement-breakpoint
+CREATE TYPE "public"."admission_status" AS ENUM('active', 'transferred', 'discharged');--> statement-breakpoint
+CREATE TYPE "public"."audit_result" AS ENUM('success', 'denied', 'failure');--> statement-breakpoint
+CREATE TYPE "public"."bed_status" AS ENUM('available', 'occupied', 'maintenance', 'disabled');--> statement-breakpoint
+CREATE TYPE "public"."care_level" AS ENUM('self-care', 'semi-assisted', 'assisted', 'intensive');--> statement-breakpoint
+CREATE TYPE "public"."elder_status" AS ENUM('active', 'pending', 'discharged');--> statement-breakpoint
+CREATE TYPE "public"."gender" AS ENUM('male', 'female', 'other');--> statement-breakpoint
+CREATE TYPE "public"."incident_severity" AS ENUM('info', 'warning', 'critical');--> statement-breakpoint
+CREATE TYPE "public"."incident_status" AS ENUM('open', 'acknowledged', 'resolved', 'closed');--> statement-breakpoint
+CREATE TYPE "public"."join_request_status" AS ENUM('pending', 'approved', 'rejected');--> statement-breakpoint
+CREATE TYPE "public"."membership_status" AS ENUM('active', 'disabled', 'pending');--> statement-breakpoint
+CREATE TYPE "public"."organization_status" AS ENUM('active', 'disabled');--> statement-breakpoint
+CREATE TYPE "public"."role_scope" AS ENUM('platform', 'organization');--> statement-breakpoint
+CREATE TABLE "accounts" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"platform_role_id" uuid,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"password_hash" text NOT NULL,
+	"password_salt" text NOT NULL,
+	"status" "account_status" DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "admissions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"elder_id" uuid NOT NULL,
+	"bed_id" uuid NOT NULL,
+	"status" "admission_status" DEFAULT 'active' NOT NULL,
+	"admitted_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"discharged_at" timestamp with time zone,
+	"notes" text DEFAULT '' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "audit_logs" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid,
+	"timestamp" timestamp with time zone DEFAULT now() NOT NULL,
+	"actor_account_id" uuid,
+	"actor_email" text,
+	"action" text NOT NULL,
+	"target_type" text NOT NULL,
+	"target_id" text,
+	"result" "audit_result" NOT NULL,
+	"reason" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "beds" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"room_id" uuid NOT NULL,
+	"code" text NOT NULL,
+	"status" "bed_status" DEFAULT 'available' NOT NULL,
+	"notes" text DEFAULT '' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "buildings" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"campus_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "campuses" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"address" text DEFAULT '' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "elders" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"gender" "gender" NOT NULL,
+	"age" integer NOT NULL,
+	"care_level" "care_level" NOT NULL,
+	"status" "elder_status" DEFAULT 'pending' NOT NULL,
+	"primary_contact" text NOT NULL,
+	"phone" text NOT NULL,
+	"medical_notes" text DEFAULT '' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "floors" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"building_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"level" integer NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "join_requests" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"account_id" uuid NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"status" "join_request_status" DEFAULT 'pending' NOT NULL,
+	"reason" text DEFAULT '' NOT NULL,
+	"reviewed_by_account_id" uuid,
+	"reviewed_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "memberships" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"account_id" uuid NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"role_id" uuid NOT NULL,
+	"status" "membership_status" DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "organizations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"name" text NOT NULL,
+	"slug" text NOT NULL,
+	"status" "organization_status" DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "permissions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"label" text NOT NULL,
+	"category" text NOT NULL,
+	"description" text NOT NULL,
+	"is_enabled" boolean DEFAULT true NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "role_permissions" (
+	"role_id" uuid NOT NULL,
+	"permission_id" text NOT NULL,
+	CONSTRAINT "role_permissions_role_id_permission_id_pk" PRIMARY KEY("role_id","permission_id")
+);
+--> statement-breakpoint
+CREATE TABLE "roles" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"key" text NOT NULL,
+	"organization_id" uuid,
+	"scope" "role_scope" NOT NULL,
+	"label" text NOT NULL,
+	"description" text NOT NULL,
+	"is_system" boolean DEFAULT false NOT NULL,
+	"is_enabled" boolean DEFAULT true NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "rooms" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"floor_id" uuid NOT NULL,
+	"name" text NOT NULL,
+	"code" text NOT NULL,
+	"capacity" integer DEFAULT 1 NOT NULL,
+	"status" "organization_status" DEFAULT 'active' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "sessions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"account_id" uuid NOT NULL,
+	"active_organization_id" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "system_incidents" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid,
+	"severity" "incident_severity" NOT NULL,
+	"status" "incident_status" DEFAULT 'open' NOT NULL,
+	"title" text NOT NULL,
+	"description" text NOT NULL,
+	"source" text NOT NULL,
+	"acknowledged_by_account_id" uuid,
+	"acknowledged_at" timestamp with time zone,
+	"resolved_by_account_id" uuid,
+	"resolved_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "accounts" ADD CONSTRAINT "accounts_platform_role_id_roles_id_fk" FOREIGN KEY ("platform_role_id") REFERENCES "public"."roles"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "admissions" ADD CONSTRAINT "admissions_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "admissions" ADD CONSTRAINT "admissions_elder_id_elders_id_fk" FOREIGN KEY ("elder_id") REFERENCES "public"."elders"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "admissions" ADD CONSTRAINT "admissions_bed_id_beds_id_fk" FOREIGN KEY ("bed_id") REFERENCES "public"."beds"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_actor_account_id_accounts_id_fk" FOREIGN KEY ("actor_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "beds" ADD CONSTRAINT "beds_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "beds" ADD CONSTRAINT "beds_room_id_rooms_id_fk" FOREIGN KEY ("room_id") REFERENCES "public"."rooms"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "buildings" ADD CONSTRAINT "buildings_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "buildings" ADD CONSTRAINT "buildings_campus_id_campuses_id_fk" FOREIGN KEY ("campus_id") REFERENCES "public"."campuses"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "campuses" ADD CONSTRAINT "campuses_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "elders" ADD CONSTRAINT "elders_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "floors" ADD CONSTRAINT "floors_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "floors" ADD CONSTRAINT "floors_building_id_buildings_id_fk" FOREIGN KEY ("building_id") REFERENCES "public"."buildings"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD CONSTRAINT "join_requests_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD CONSTRAINT "join_requests_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD CONSTRAINT "join_requests_reviewed_by_account_id_accounts_id_fk" FOREIGN KEY ("reviewed_by_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "role_permissions" ADD CONSTRAINT "role_permissions_permission_id_permissions_id_fk" FOREIGN KEY ("permission_id") REFERENCES "public"."permissions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "roles" ADD CONSTRAINT "roles_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "rooms" ADD CONSTRAINT "rooms_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "rooms" ADD CONSTRAINT "rooms_floor_id_floors_id_fk" FOREIGN KEY ("floor_id") REFERENCES "public"."floors"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_account_id_accounts_id_fk" FOREIGN KEY ("account_id") REFERENCES "public"."accounts"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_active_organization_id_organizations_id_fk" FOREIGN KEY ("active_organization_id") REFERENCES "public"."organizations"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "system_incidents" ADD CONSTRAINT "system_incidents_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "system_incidents" ADD CONSTRAINT "system_incidents_acknowledged_by_account_id_accounts_id_fk" FOREIGN KEY ("acknowledged_by_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "system_incidents" ADD CONSTRAINT "system_incidents_resolved_by_account_id_accounts_id_fk" FOREIGN KEY ("resolved_by_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "accounts_email_unique" ON "accounts" USING btree ("email");--> statement-breakpoint
+CREATE UNIQUE INDEX "beds_code_room_unique" ON "beds" USING btree ("room_id","code");--> statement-breakpoint
+CREATE UNIQUE INDEX "memberships_account_organization_unique" ON "memberships" USING btree ("account_id","organization_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "organizations_slug_unique" ON "organizations" USING btree ("slug");--> statement-breakpoint
+CREATE UNIQUE INDEX "roles_key_organization_unique" ON "roles" USING btree ("key","organization_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "rooms_code_organization_unique" ON "rooms" USING btree ("organization_id","code");

drizzle/0001_tired_queen_noir.sql

@@ -0,0 +1,28 @@
+CREATE TABLE "organization_invitations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"organization_id" uuid NOT NULL,
+	"role_id" uuid NOT NULL,
+	"email" text DEFAULT '' NOT NULL,
+	"token" text NOT NULL,
+	"status" text DEFAULT 'active' NOT NULL,
+	"created_by_account_id" uuid,
+	"accepted_by_account_id" uuid,
+	"accepted_at" timestamp with time zone,
+	"expires_at" timestamp with time zone NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "registration_enabled" boolean DEFAULT true NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_enabled" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_issuer_url" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_client_id" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_client_secret" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_scopes" text DEFAULT 'openid profile email' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_redirect_uri" text DEFAULT '' NOT NULL;--> statement-breakpoint
+ALTER TABLE "organizations" ADD COLUMN "oidc_auto_provision" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "organization_invitations" ADD CONSTRAINT "organization_invitations_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "organization_invitations" ADD CONSTRAINT "organization_invitations_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "organization_invitations" ADD CONSTRAINT "organization_invitations_created_by_account_id_accounts_id_fk" FOREIGN KEY ("created_by_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "organization_invitations" ADD CONSTRAINT "organization_invitations_accepted_by_account_id_accounts_id_fk" FOREIGN KEY ("accepted_by_account_id") REFERENCES "public"."accounts"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "organization_invitations_token_unique" ON "organization_invitations" USING btree ("token");

drizzle/meta/_journal.json

@@ -0,0 +1,20 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1782975351852,
+      "tag": "0000_bouncy_micromax",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1782994149630,
+      "tag": "0001_tired_queen_noir",
+      "breakpoints": true
+    }
+  ]
+}

modules/auth/components/AuthPanel.tsx

@@ -10,6 +10,7 @@ import { Button } from "@/components/ui/button";
 import { Card } from "@/components/ui/card";
 import { Input } from "@/components/ui/input";
 import type { ApiResult } from "@/modules/core/server/api";
+import type { Organization } from "@/modules/core/types";
 
 type AuthMode = "login" | "register" | "setup";
 
@@ -27,9 +28,11 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
   const router = useRouter();
   const searchParams = useSearchParams();
   const redirectTo = searchParams.get("redirectTo") ?? "/app/dashboard";
+  const invitationToken = searchParams.get("invite") ?? "";
   const [message, setMessage] = useState("");
   const [isPending, setIsPending] = useState(false);
   const [hasAccounts, setHasAccounts] = useState<boolean | null>(null);
+  const [organizations, setOrganizations] = useState<Organization[]>([]);
 
   const copy = modeCopy[mode];
   const isSetup = mode === "setup";
@@ -39,17 +42,23 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
     let isMounted = true;
 
     async function loadState(): Promise<void> {
-      const [bootstrapResponse, sessionResponse] = await Promise.all([
+      const [bootstrapResponse, sessionResponse, organizationsResponse] = await Promise.all([
         fetch("/api/auth/bootstrap"),
         fetch("/api/auth/session"),
+        fetch("/api/organizations"),
       ]);
       const bootstrap = (await bootstrapResponse.json()) as ApiResult<{ setupRequired: boolean }>;
       const session = (await sessionResponse.json()) as ApiResult<{ account: unknown | null }>;
+      const organizationsResult = (await organizationsResponse.json()) as ApiResult<{ organizations: Organization[] }>;
 
       if (!isMounted || !bootstrap.success || !session.success) {
         return;
       }
 
+      if (organizationsResult.success) {
+        setOrganizations(organizationsResult.organizations);
+      }
+
       const initialized = !bootstrap.setupRequired;
       setHasAccounts(initialized);
 
@@ -97,6 +106,7 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
     const email = String(formData.get("email") ?? "");
     const password = String(formData.get("password") ?? "");
     const organization = String(formData.get("organization") ?? "");
+    const organizationId = String(formData.get("organizationId") ?? "");
 
     const endpoint = isLogin ? "/api/auth/login" : isSetup ? "/api/auth/setup" : "/api/auth/register";
     const response = await fetch(endpoint, {
@@ -107,9 +117,11 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
         email,
         password,
         organization,
+        organizationId,
+        invitationToken,
       }),
     });
-    const result = (await response.json()) as ApiResult<{ account: unknown }>;
+    const result = (await response.json()) as ApiResult<{ account: unknown; pendingApproval?: boolean }>;
     setIsPending(false);
 
     if (!result.success) {
@@ -117,6 +129,11 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
       return;
     }
 
+    if (result.pendingApproval) {
+      setMessage(result.reason);
+      return;
+    }
+
     router.refresh();
     router.replace(isLogin ? redirectTo : "/app/dashboard");
   }
@@ -180,6 +197,29 @@ function AuthPanelContent({ mode }: AuthPanelProps): React.ReactElement {
                 </label>
               ) : null}
 
+              {mode === "register" && invitationToken ? (
+                <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground">
+                  正在使用机构邀请注册，完成后将自动加入机构。
+                </p>
+              ) : null}
+
+              {mode === "register" && !invitationToken && organizations.length > 0 ? (
+                <label className="block space-y-2">
+                  <span className="text-sm font-medium">申请加入机构</span>
+                  <select
+                    className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                    name="organizationId"
+                  >
+                    <option value="">暂不加入机构</option>
+                    {organizations.map((organization) => (
+                      <option key={organization.id} value={organization.id}>
+                        {organization.name}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+              ) : null}
+
               {!isLogin ? (
                 <label className="block space-y-2">
                   <span className="text-sm font-medium">姓名</span>

modules/core/server/api.ts

@@ -15,11 +15,27 @@ export function jsonSuccess<T extends Record<string, unknown>>(
   payload: T,
   status = 200,
 ): Response {
-  return Response.json({ success: true, reason, ...payload }, { status });
+  return Response.json(
+    { success: true, reason, ...payload },
+    {
+      status,
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
 }
 
 export function jsonFailure(reason: string, status = 400): Response {
-  return Response.json({ success: false, reason }, { status });
+  return Response.json(
+    { success: false, reason },
+    {
+      status,
+      headers: {
+        "Cache-Control": "no-store",
+      },
+    },
+  );
 }
 
 export async function readJsonBody(request: Request): Promise<unknown> {
@@ -29,4 +45,3 @@ export async function readJsonBody(request: Request): Promise<unknown> {
     return null;
   }
 }
-

modules/core/server/audit.ts

@@ -1,10 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { desc, eq } from "drizzle-orm";
 
+import { getDatabase } from "@/modules/core/server/db";
+import { auditLogs } from "@/modules/core/server/schema";
 import type { AuditLog, AuditResult, PublicAccount } from "@/modules/core/types";
-import { updateData } from "@/modules/core/server/store";
 
 type AuditInput = {
   actor?: PublicAccount;
+  organizationId?: string;
   action: string;
   targetType: string;
   targetId?: string;
@@ -12,13 +14,27 @@ type AuditInput = {
   reason: string;
 };
 
-export async function recordAuditLog(input: AuditInput): Promise<AuditLog> {
-  const timestamp = new Date().toISOString();
+function toAuditLog(row: typeof auditLogs.$inferSelect): AuditLog {
+  return {
+    id: row.id,
+    organizationId: row.organizationId ?? undefined,
+    timestamp: row.timestamp.toISOString(),
+    actorAccountId: row.actorAccountId ?? undefined,
+    actorEmail: row.actorEmail ?? undefined,
+    action: row.action,
+    targetType: row.targetType,
+    targetId: row.targetId ?? undefined,
+    result: row.result,
+    reason: row.reason,
+  };
+}
 
-  return await updateData((data) => {
-    const nextLog: AuditLog = {
-      id: randomUUID(),
-      timestamp,
+export async function recordAuditLog(input: AuditInput): Promise<AuditLog> {
+  const database = getDatabase();
+  const rows = await database
+    .insert(auditLogs)
+    .values({
+      organizationId: input.organizationId,
       actorAccountId: input.actor?.id,
       actorEmail: input.actor?.email,
       action: input.action,
@@ -26,10 +42,27 @@ export async function recordAuditLog(input: AuditInput): Promise<AuditLog> {
       targetId: input.targetId,
       result: input.result,
       reason: input.reason,
-    };
+    })
+    .returning();
+  const row = rows[0];
+  if (!row) {
+    throw new Error("审计日志写入失败");
+  }
 
-    data.auditLogs = [nextLog, ...data.auditLogs].slice(0, 500);
-    return nextLog;
-  });
+  return toAuditLog(row);
 }
 
+export async function listAuditLogs(params: { organizationId?: string; limit?: number }): Promise<AuditLog[]> {
+  const database = getDatabase();
+  const limit = params.limit ?? 100;
+  const rows = params.organizationId
+    ? await database
+        .select()
+        .from(auditLogs)
+        .where(eq(auditLogs.organizationId, params.organizationId))
+        .orderBy(desc(auditLogs.timestamp))
+        .limit(limit)
+    : await database.select().from(auditLogs).orderBy(desc(auditLogs.timestamp)).limit(limit);
+
+  return rows.map(toAuditLog);
+}

modules/core/server/auth.ts

@@ -1,30 +1,99 @@
-import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 
+import { and, eq, gt, isNull } from "drizzle-orm";
 import { cookies } from "next/headers";
 
-import type { Account, AuthContext, Permission, PublicAccount, RoleId, Session } from "@/modules/core/types";
 import { jsonFailure } from "@/modules/core/server/api";
 import { recordAuditLog } from "@/modules/core/server/audit";
-import { getPermissionsForRole, hasPermission } from "@/modules/core/server/permissions";
-import { readData, updateData } from "@/modules/core/server/store";
+import { getDatabase } from "@/modules/core/server/db";
+import { getPermissionsForRole, hasPermission, seedOrganizationRoles } from "@/modules/core/server/permissions";
+import {
+  accounts,
+  joinRequests,
+  memberships,
+  organizationInvitations,
+  organizations,
+  roles,
+  sessions,
+} from "@/modules/core/server/schema";
+import type { Account, AuthContext, Membership, Organization, Permission, PublicAccount, Session } from "@/modules/core/types";
 
 const SESSION_COOKIE = "teatea_session";
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
 
+type AccountRow = typeof accounts.$inferSelect;
+type OrganizationRow = typeof organizations.$inferSelect;
+type MembershipRow = typeof memberships.$inferSelect;
+type RoleRow = typeof roles.$inferSelect;
+type SessionRow = typeof sessions.$inferSelect;
+
 export function normalizeEmail(email: string): string {
   return email.trim().toLowerCase();
 }
 
-export function toPublicAccount(account: Account): PublicAccount {
+function toIsoString(value: Date): string {
+  return value.toISOString();
+}
+
+function toOrganization(row: OrganizationRow): Organization {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAutoProvision: row.oidcAutoProvision,
+    createdAt: toIsoString(row.createdAt),
+    updatedAt: toIsoString(row.updatedAt),
+  };
+}
+
+function toSession(row: SessionRow): Session {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    activeOrganizationId: row.activeOrganizationId ?? undefined,
+    createdAt: toIsoString(row.createdAt),
+    expiresAt: toIsoString(row.expiresAt),
+  };
+}
+
+function toMembership(row: MembershipRow, role: RoleRow): Membership {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    organizationId: row.organizationId,
+    roleId: row.roleId,
+    roleKey: role.key,
+    roleLabel: role.label,
+    status: row.status,
+    createdAt: toIsoString(row.createdAt),
+    updatedAt: toIsoString(row.updatedAt),
+  };
+}
+
+export function toPublicAccount(account: AccountRow | Account, roleKey?: string, organization?: Organization): PublicAccount {
+  const fallbackRole = "role" in account ? account.role : "viewer";
+  const fallbackOrganization = "organization" in account ? account.organization : undefined;
+  const fallbackOrganizationId = "organizationId" in account ? account.organizationId : undefined;
+
   return {
     id: account.id,
+    platformRoleId: "platformRoleId" in account ? account.platformRoleId ?? undefined : undefined,
     name: account.name,
     email: account.email,
-    role: account.role,
-    organization: account.organization,
+    role: roleKey ?? fallbackRole,
+    organization: organization?.name ?? fallbackOrganization,
+    organizationId: organization?.id ?? fallbackOrganizationId,
     status: account.status,
-    createdAt: account.createdAt,
-    updatedAt: account.updatedAt,
+    createdAt: typeof account.createdAt === "string" ? account.createdAt : toIsoString(account.createdAt),
+    updatedAt: typeof account.updatedAt === "string" ? account.updatedAt : toIsoString(account.updatedAt),
   };
 }
 
@@ -38,7 +107,7 @@ export function hashPassword(password: string, salt = randomBytes(16).toString("
   };
 }
 
-export function verifyPassword(password: string, account: Account): boolean {
+export function verifyPassword(password: string, account: Pick<AccountRow, "passwordHash" | "passwordSalt">): boolean {
   const candidate = Buffer.from(hashPassword(password, account.passwordSalt).hash, "hex");
   const stored = Buffer.from(account.passwordHash, "hex");
 
@@ -49,40 +118,14 @@ export function verifyPassword(password: string, account: Account): boolean {
   return timingSafeEqual(candidate, stored);
 }
 
-export function createAccountRecord(input: {
-  name: string;
-  email: string;
-  password: string;
-  role: RoleId;
-  organization?: string;
-}): Account {
-  const now = new Date().toISOString();
-  const password = hashPassword(input.password);
+function createSlug(name: string): string {
+  const base = name
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "");
 
-  return {
-    id: randomUUID(),
-    name: input.name.trim(),
-    email: normalizeEmail(input.email),
-    role: input.role,
-    organization: input.organization?.trim(),
-    passwordHash: password.hash,
-    passwordSalt: password.salt,
-    status: "active",
-    createdAt: now,
-    updatedAt: now,
-  };
-}
-
-export function createSessionRecord(accountId: string): Session {
-  const now = new Date();
-  const expiresAt = new Date(now.getTime() + SESSION_MAX_AGE_SECONDS * 1000);
-
-  return {
-    id: randomUUID(),
-    accountId,
-    createdAt: now.toISOString(),
-    expiresAt: expiresAt.toISOString(),
-  };
+  return base.length > 0 ? base : `org-${Date.now()}`;
 }
 
 export async function setSessionCookie(sessionId: string): Promise<void> {
@@ -103,8 +146,307 @@ export async function clearSessionCookie(): Promise<void> {
 }
 
 export async function getBootstrapState(): Promise<{ setupRequired: boolean }> {
-  const data = await readData();
-  return { setupRequired: data.accounts.length === 0 };
+  const database = getDatabase();
+  const existingAccounts = await database.select({ id: accounts.id }).from(accounts).limit(1);
+  return { setupRequired: existingAccounts.length === 0 };
+}
+
+export async function setupFirstPlatformAdmin(input: {
+  organization: string;
+  name: string;
+  email: string;
+  password: string;
+}): Promise<{ account: PublicAccount; session: Session }> {
+  const database = getDatabase();
+  const password = hashPassword(input.password);
+  const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_SECONDS * 1000);
+
+  const created = await database.transaction(async (transaction) => {
+    const existingAccounts = await transaction.select({ id: accounts.id }).from(accounts).limit(1);
+    if (existingAccounts.length > 0) {
+      return null;
+    }
+
+    const platformRoleRows = await transaction
+      .select()
+      .from(roles)
+      .where(and(eq(roles.key, "platform_admin"), isNull(roles.organizationId)))
+      .limit(1);
+    const platformRole = platformRoleRows[0];
+    if (!platformRole) {
+      throw new Error("平台超管角色未初始化，请先运行数据库初始化");
+    }
+
+    const organizationRows = await transaction
+      .insert(organizations)
+      .values({
+        name: input.organization.trim(),
+        slug: createSlug(input.organization),
+      })
+      .returning();
+    const organization = organizationRows[0];
+    if (!organization) {
+      throw new Error("机构初始化失败");
+    }
+
+    const accountRows = await transaction
+      .insert(accounts)
+      .values({
+        platformRoleId: platformRole.id,
+        name: input.name.trim(),
+        email: normalizeEmail(input.email),
+        passwordHash: password.hash,
+        passwordSalt: password.salt,
+        status: "active",
+      })
+      .returning();
+    const account = accountRows[0];
+    if (!account) {
+      throw new Error("账号初始化失败");
+    }
+
+    const sessionRows = await transaction
+      .insert(sessions)
+      .values({
+        accountId: account.id,
+        activeOrganizationId: organization.id,
+        expiresAt,
+      })
+      .returning();
+    const session = sessionRows[0];
+    if (!session) {
+      throw new Error("会话初始化失败");
+    }
+
+    return { account, organization, platformRole, session };
+  });
+
+  if (!created) {
+    throw new Error("系统已完成初始化");
+  }
+
+  await seedOrganizationRoles(created.organization.id);
+  const databaseAfterSeed = getDatabase();
+  const orgAdminRows = await databaseAfterSeed
+    .select()
+    .from(roles)
+    .where(and(eq(roles.organizationId, created.organization.id), eq(roles.key, "org_admin")))
+    .limit(1);
+  const orgAdminRole = orgAdminRows[0];
+  if (orgAdminRole) {
+    await databaseAfterSeed
+      .insert(memberships)
+      .values({
+        accountId: created.account.id,
+        organizationId: created.organization.id,
+        roleId: orgAdminRole.id,
+        status: "active",
+      })
+      .onConflictDoNothing();
+  }
+
+  const organization = toOrganization(created.organization);
+  const publicAccount = toPublicAccount(created.account, created.platformRole.key, organization);
+  const session = toSession(created.session);
+
+  await recordAuditLog({
+    actor: publicAccount,
+    organizationId: organization.id,
+    action: "account.setup",
+    targetType: "account",
+    targetId: publicAccount.id,
+    result: "success",
+    reason: "初始化平台超管与首个机构",
+  });
+
+  return { account: publicAccount, session };
+}
+
+export async function createRegistration(input: {
+  name: string;
+  email: string;
+  password: string;
+  organizationId?: string;
+  invitationToken?: string;
+}): Promise<{ account: PublicAccount; session?: Session }> {
+  const database = getDatabase();
+  const password = hashPassword(input.password);
+  const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_SECONDS * 1000);
+
+  const created = await database.transaction(async (transaction) => {
+    const normalizedEmail = normalizeEmail(input.email);
+    const existing = await transaction.select({ id: accounts.id }).from(accounts).where(eq(accounts.email, normalizedEmail));
+    if (existing.length > 0) {
+      return null;
+    }
+
+    const invitationRows = input.invitationToken
+      ? await transaction
+          .select({ invitation: organizationInvitations, organization: organizations, role: roles })
+          .from(organizationInvitations)
+          .innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
+          .innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
+          .where(eq(organizationInvitations.token, input.invitationToken))
+          .limit(1)
+      : [];
+    const invitation = invitationRows[0];
+    if (input.invitationToken && !invitation) {
+      throw new Error("邀请链接无效");
+    }
+    if (invitation && (invitation.invitation.status !== "active" || invitation.invitation.expiresAt < new Date())) {
+      throw new Error("邀请链接已失效");
+    }
+
+    const targetOrganizationId = invitation?.invitation.organizationId ?? input.organizationId;
+    if (targetOrganizationId && !invitation) {
+      const organizationRows = await transaction
+        .select()
+        .from(organizations)
+        .where(eq(organizations.id, targetOrganizationId))
+        .limit(1);
+      const organization = organizationRows[0];
+      if (!organization) {
+        throw new Error("机构不存在");
+      }
+      if (!organization.registrationEnabled) {
+        throw new Error("该机构暂未开放注册");
+      }
+    }
+
+    const accountRows = await transaction
+      .insert(accounts)
+      .values({
+        name: input.name.trim(),
+        email: normalizedEmail,
+        passwordHash: password.hash,
+        passwordSalt: password.salt,
+        status: targetOrganizationId && !invitation ? "pending" : "active",
+      })
+      .returning();
+    const account = accountRows[0];
+    if (!account) {
+      throw new Error("账号创建失败");
+    }
+
+    if (invitation) {
+      await transaction.insert(memberships).values({
+        accountId: account.id,
+        organizationId: invitation.invitation.organizationId,
+        roleId: invitation.invitation.roleId,
+        status: "active",
+      });
+      await transaction
+        .update(organizationInvitations)
+        .set({
+          status: "accepted",
+          acceptedByAccountId: account.id,
+          acceptedAt: new Date(),
+          updatedAt: new Date(),
+        })
+        .where(eq(organizationInvitations.id, invitation.invitation.id));
+    }
+
+    const sessionRows = targetOrganizationId && !invitation
+      ? []
+      : await transaction
+          .insert(sessions)
+          .values({
+            accountId: account.id,
+            activeOrganizationId: invitation?.invitation.organizationId,
+            expiresAt,
+          })
+          .returning();
+    const session = sessionRows[0];
+
+    if (targetOrganizationId && !invitation) {
+      await transaction.insert(joinRequests).values({
+        accountId: account.id,
+        organizationId: targetOrganizationId,
+        status: "pending",
+        reason: "公开注册申请加入机构",
+      });
+    }
+
+    return { account, organization: invitation?.organization, role: invitation?.role, session };
+  });
+
+  if (!created) {
+    throw new Error("账号已存在");
+  }
+
+  const organization = created.organization ? toOrganization(created.organization) : undefined;
+  const publicAccount = toPublicAccount(created.account, created.role?.key, organization);
+  const session = created.session ? toSession(created.session) : undefined;
+  await recordAuditLog({
+    actor: publicAccount,
+    organizationId: organization?.id ?? input.organizationId,
+    action: "account.register",
+    targetType: "account",
+    targetId: publicAccount.id,
+    result: "success",
+    reason: input.invitationToken ? "通过邀请注册并加入机构" : input.organizationId ? "注册账号并申请加入机构" : "注册独立账号",
+  });
+
+  return { account: publicAccount, session };
+}
+
+export async function loginWithPassword(input: {
+  email: string;
+  password: string;
+}): Promise<{ account: PublicAccount; session: Session }> {
+  const database = getDatabase();
+  const accountRows = await database
+    .select()
+    .from(accounts)
+    .where(eq(accounts.email, normalizeEmail(input.email)))
+    .limit(1);
+  const account = accountRows[0];
+
+  if (!account || account.status !== "active" || !verifyPassword(input.password, account)) {
+    throw new Error("邮箱或密码错误");
+  }
+
+  const membershipRows = await database
+    .select({ membership: memberships, organization: organizations, role: roles })
+    .from(memberships)
+    .innerJoin(organizations, eq(organizations.id, memberships.organizationId))
+    .innerJoin(roles, eq(roles.id, memberships.roleId))
+    .where(and(eq(memberships.accountId, account.id), eq(memberships.status, "active"), eq(roles.isEnabled, true)))
+    .limit(1);
+  const membership = membershipRows[0];
+  const expiresAt = new Date(Date.now() + SESSION_MAX_AGE_SECONDS * 1000);
+  const sessionRows = await database
+    .insert(sessions)
+    .values({
+      accountId: account.id,
+      activeOrganizationId: membership?.organization.id,
+      expiresAt,
+    })
+    .returning();
+  const sessionRow = sessionRows[0];
+  if (!sessionRow) {
+    throw new Error("会话创建失败");
+  }
+
+  const platformRoleRows = account.platformRoleId
+    ? await database.select().from(roles).where(eq(roles.id, account.platformRoleId)).limit(1)
+    : [];
+  const platformRole = platformRoleRows[0];
+  const organization = membership ? toOrganization(membership.organization) : undefined;
+  const publicAccount = toPublicAccount(account, platformRole?.key ?? membership?.role.key, organization);
+  const session = toSession(sessionRow);
+
+  await recordAuditLog({
+    actor: publicAccount,
+    organizationId: organization?.id,
+    action: "account.login",
+    targetType: "account",
+    targetId: account.id,
+    result: "success",
+    reason: "账号登录",
+  });
+
+  return { account: publicAccount, session };
 }
 
 export async function getCurrentAuthContext(): Promise<AuthContext | null> {
@@ -115,20 +457,55 @@ export async function getCurrentAuthContext(): Promise<AuthContext | null> {
     return null;
   }
 
-  const data = await readData();
-  const session = data.sessions.find((item) => item.id === sessionId);
-  if (!session || Date.parse(session.expiresAt) <= Date.now()) {
+  const database = getDatabase();
+  const rows = await database
+    .select({ session: sessions, account: accounts })
+    .from(sessions)
+    .innerJoin(accounts, eq(accounts.id, sessions.accountId))
+    .where(and(eq(sessions.id, sessionId), gt(sessions.expiresAt, new Date())))
+    .limit(1);
+  const row = rows[0];
+  if (!row || row.account.status === "disabled") {
     return null;
   }
 
-  const account = data.accounts.find((item) => item.id === session.accountId);
-  if (!account || account.status !== "active") {
-    return null;
-  }
+  const session = toSession(row.session);
+  const platformRoleRows = row.account.platformRoleId
+    ? await database.select().from(roles).where(and(eq(roles.id, row.account.platformRoleId), eq(roles.isEnabled, true))).limit(1)
+    : [];
+  const platformRole = platformRoleRows[0];
+  const organizationRows = row.session.activeOrganizationId
+    ? await database.select().from(organizations).where(eq(organizations.id, row.session.activeOrganizationId)).limit(1)
+    : [];
+  const organizationRow = organizationRows[0];
+  const membershipRows = organizationRow
+    ? await database
+        .select({ membership: memberships, role: roles })
+        .from(memberships)
+        .innerJoin(roles, eq(roles.id, memberships.roleId))
+        .where(
+          and(
+            eq(memberships.accountId, row.account.id),
+            eq(memberships.organizationId, organizationRow.id),
+            eq(memberships.status, "active"),
+            eq(roles.isEnabled, true),
+          ),
+        )
+        .limit(1)
+    : [];
+  const membershipRow = membershipRows[0];
+
+  const platformPermissions = platformRole ? await getPermissionsForRole(platformRole.id) : [];
+  const organizationPermissions = membershipRow ? await getPermissionsForRole(membershipRow.role.id) : [];
+  const permissions = [...new Set([...platformPermissions, ...organizationPermissions])];
+  const organization = organizationRow ? toOrganization(organizationRow) : undefined;
+  const membership = membershipRow ? toMembership(membershipRow.membership, membershipRow.role) : undefined;
 
   return {
-    account: toPublicAccount(account),
-    permissions: getPermissionsForRole(account.role),
+    account: toPublicAccount(row.account, platformRole?.key ?? membership?.roleKey, organization),
+    organization,
+    membership,
+    permissions,
     session,
   };
 }
@@ -139,9 +516,8 @@ export async function removeCurrentSession(): Promise<PublicAccount | null> {
   const sessionId = cookieStore.get(SESSION_COOKIE)?.value;
 
   if (sessionId) {
-    await updateData((data) => {
-      data.sessions = data.sessions.filter((item) => item.id !== sessionId);
-    });
+    const database = getDatabase();
+    await database.delete(sessions).where(eq(sessions.id, sessionId));
   }
 
   await clearSessionCookie();
@@ -162,6 +538,7 @@ type DeniedAuditContext = {
   action: string;
   targetType: string;
   targetId?: string;
+  organizationId?: string;
 };
 
 export async function requirePermission(
@@ -172,6 +549,7 @@ export async function requirePermission(
 
   if (!context) {
     await recordAuditLog({
+      organizationId: auditContext.organizationId,
       action: auditContext.action,
       targetType: auditContext.targetType,
       targetId: auditContext.targetId,
@@ -185,9 +563,10 @@ export async function requirePermission(
     };
   }
 
-  if (!hasPermission(context.account.role, permission)) {
+  if (!hasPermission(context.permissions, permission)) {
     await recordAuditLog({
       actor: context.account,
+      organizationId: auditContext.organizationId ?? context.organization?.id,
       action: auditContext.action,
       targetType: auditContext.targetType,
       targetId: auditContext.targetId,

modules/core/server/db.ts

@@ -0,0 +1,37 @@
+import "server-only";
+
+import { sql } from "drizzle-orm";
+import { drizzle, type PostgresJsDatabase } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+
+import * as schema from "@/modules/core/server/schema";
+
+export type AppDatabase = PostgresJsDatabase<typeof schema>;
+
+let cachedDatabase: AppDatabase | null = null;
+let cachedClient: postgres.Sql | null = null;
+
+export function getDatabase(): AppDatabase {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    throw new Error("DATABASE_URL is required for database-backed system configuration");
+  }
+
+  if (!cachedDatabase) {
+    cachedClient = postgres(databaseUrl, { max: 1 });
+    cachedDatabase = drizzle(cachedClient, { schema });
+  }
+
+  return cachedDatabase;
+}
+
+export async function checkDatabaseConnection(): Promise<{ ok: boolean; reason: string }> {
+  try {
+    const database = getDatabase();
+    await database.execute(sql`select 1`);
+    return { ok: true, reason: "数据库连接正常" };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "数据库连接失败";
+    return { ok: false, reason };
+  }
+}

modules/core/server/permissions.ts

@@ -1,15 +1,97 @@
-import type { Permission, RoleDefinition, RoleId } from "@/modules/core/types";
-import { ROLE_LABELS } from "@/modules/core/types";
+import { and, eq, inArray, isNull, or } from "drizzle-orm";
 
-export const ROLE_DEFINITIONS: RoleDefinition[] = [
+import { getDatabase } from "@/modules/core/server/db";
+import { permissions, rolePermissions, roles } from "@/modules/core/server/schema";
+import type { Permission, RoleDefinition, RoleId } from "@/modules/core/types";
+import { PERMISSIONS, ROLE_LABELS } from "@/modules/core/types";
+
+type PermissionDefinition = {
+  id: Permission;
+  label: string;
+  category: string;
+  description: string;
+};
+
+export const PERMISSION_DEFINITIONS: PermissionDefinition[] = [
+  { id: "platform:manage", label: "平台管理", category: "平台", description: "管理平台级配置和跨机构操作。" },
+  { id: "organization:read", label: "查看机构", category: "机构", description: "查看机构、院区和租户信息。" },
+  { id: "organization:manage", label: "管理机构", category: "机构", description: "创建、编辑和停用机构。" },
+  { id: "account:read", label: "查看用户", category: "用户", description: "查看账号、成员和申请。" },
+  { id: "account:manage", label: "管理用户", category: "用户", description: "创建、审批、启停和分配用户。" },
+  { id: "role:read", label: "查看角色", category: "权限", description: "查看角色和权限矩阵。" },
+  { id: "role:manage", label: "管理角色", category: "权限", description: "创建自定义角色并配置权限组合。" },
+  { id: "permission:read", label: "查看权限", category: "权限", description: "查看系统注册权限点。" },
+  { id: "audit:read", label: "查看审计", category: "审计", description: "查看关键操作审计日志。" },
+  { id: "incident:read", label: "查看故障", category: "运维", description: "查看系统健康和故障中心。" },
+  { id: "incident:manage", label: "处理故障", category: "运维", description: "确认、处理和关闭故障事件。" },
+  { id: "facility:read", label: "查看房间床位", category: "床位", description: "查看房间、床位和占用状态。" },
+  { id: "facility:manage", label: "管理房间床位", category: "床位", description: "维护院区、房间、床位和床位状态。" },
+  { id: "admission:read", label: "查看入住", category: "入住", description: "查看入住、换床、退住历史。" },
+  { id: "admission:manage", label: "管理入住", category: "入住", description: "办理入住、换床和退住。" },
+  { id: "elder:read", label: "查看老人档案", category: "老人", description: "查看老人基础档案。" },
+  { id: "elder:create", label: "新增老人档案", category: "老人", description: "创建老人档案。" },
+  { id: "elder:update", label: "更新老人档案", category: "老人", description: "更新老人档案和照护信息。" },
+  { id: "elder:delete", label: "删除老人档案", category: "老人", description: "删除老人档案。" },
+];
+
+type SeedRole = {
+  key: RoleId;
+  scope: "platform" | "organization";
+  description: string;
+  permissions: Permission[];
+};
+
+export const SYSTEM_ROLE_DEFINITIONS: SeedRole[] = [
   {
-    id: "admin",
-    label: ROLE_LABELS.admin,
-    description: "管理账号、权限、审计日志与全部业务数据。",
+    key: "platform_admin",
+    scope: "platform",
+    description: "平台最高权限，管理所有机构、角色、审计和故障中心。",
+    permissions: [...PERMISSIONS],
+  },
+  {
+    key: "platform_operator",
+    scope: "platform",
+    description: "平台运营角色，管理机构和跨机构用户配置。",
     permissions: [
+      "organization:read",
+      "organization:manage",
       "account:read",
       "account:manage",
+      "role:read",
+      "permission:read",
       "audit:read",
+      "incident:read",
+    ],
+  },
+  {
+    key: "platform_auditor",
+    scope: "platform",
+    description: "平台审计角色，只读查看机构、审计和故障。",
+    permissions: ["organization:read", "account:read", "role:read", "permission:read", "audit:read", "incident:read"],
+  },
+  {
+    key: "platform_ops",
+    scope: "platform",
+    description: "平台运维角色，处理系统故障和运行状态。",
+    permissions: ["organization:read", "audit:read", "incident:read", "incident:manage"],
+  },
+  {
+    key: "org_admin",
+    scope: "organization",
+    description: "机构管理员，管理本机构用户、角色、房间床位、入住和审计。",
+    permissions: [
+      "organization:read",
+      "account:read",
+      "account:manage",
+      "role:read",
+      "role:manage",
+      "permission:read",
+      "audit:read",
+      "incident:read",
+      "facility:read",
+      "facility:manage",
+      "admission:read",
+      "admission:manage",
       "elder:read",
       "elder:create",
       "elder:update",
@@ -17,43 +99,164 @@ export const ROLE_DEFINITIONS: RoleDefinition[] = [
     ],
   },
   {
-    id: "manager",
-    label: ROLE_LABELS.manager,
-    description: "处理运营业务，可查看账号与审计日志，不管理账号角色。",
-    permissions: ["account:read", "audit:read", "elder:read", "elder:create", "elder:update", "elder:delete"],
+    key: "manager",
+    scope: "organization",
+    description: "运营主管，处理老人档案、床位入住和审计查看。",
+    permissions: [
+      "account:read",
+      "role:read",
+      "audit:read",
+      "facility:read",
+      "facility:manage",
+      "admission:read",
+      "admission:manage",
+      "elder:read",
+      "elder:create",
+      "elder:update",
+      "elder:delete",
+    ],
   },
   {
-    id: "caregiver",
-    label: ROLE_LABELS.caregiver,
-    description: "查看老人档案并维护照护相关信息。",
-    permissions: ["elder:read", "elder:update"],
+    key: "caregiver",
+    scope: "organization",
+    description: "照护人员，查看床位和维护老人照护信息。",
+    permissions: ["facility:read", "admission:read", "elder:read", "elder:update"],
   },
   {
-    id: "viewer",
-    label: ROLE_LABELS.viewer,
-    description: "只读查看老人档案。",
-    permissions: ["elder:read"],
+    key: "viewer",
+    scope: "organization",
+    description: "只读访客，查看老人、床位和入住信息。",
+    permissions: ["facility:read", "admission:read", "elder:read"],
   },
 ];
 
-export function getRoleDefinition(role: RoleId): RoleDefinition {
-  const roleDefinition = ROLE_DEFINITIONS.find((item) => item.id === role);
-  if (roleDefinition) {
-    return roleDefinition;
+export async function ensureSystemDefaults(): Promise<void> {
+  const database = getDatabase();
+
+  await database
+    .insert(permissions)
+    .values(PERMISSION_DEFINITIONS)
+    .onConflictDoUpdate({
+      target: permissions.id,
+      set: {
+        label: permissions.label,
+        category: permissions.category,
+        description: permissions.description,
+        isEnabled: true,
+      },
+    });
+
+  const existingRoles = await database.select().from(roles).where(isNull(roles.organizationId));
+  const existingRoleKeys = new Set(existingRoles.map((role) => role.key));
+  const seedRoles = SYSTEM_ROLE_DEFINITIONS.filter((role) => role.scope === "platform" && !existingRoleKeys.has(role.key));
+
+  if (seedRoles.length > 0) {
+    await database.insert(roles).values(
+      seedRoles.map((role) => ({
+        key: role.key,
+        scope: role.scope,
+        label: ROLE_LABELS[role.key],
+        description: role.description,
+        isSystem: true,
+        isEnabled: true,
+      })),
+    );
   }
 
-  return {
-    id: "viewer",
-    label: ROLE_LABELS.viewer,
-    description: "只读查看老人档案。",
-    permissions: ["elder:read"],
-  };
+  const platformRoles = await database.select().from(roles).where(isNull(roles.organizationId));
+  const inserts = platformRoles.flatMap((role) => {
+    const definition = SYSTEM_ROLE_DEFINITIONS.find((item) => item.key === role.key);
+    if (!definition) {
+      return [];
+    }
+
+    return definition.permissions.map((permissionId) => ({
+      roleId: role.id,
+      permissionId,
+    }));
+  });
+
+  if (inserts.length > 0) {
+    await database.insert(rolePermissions).values(inserts).onConflictDoNothing();
+  }
 }
 
-export function getPermissionsForRole(role: RoleId): Permission[] {
-  return [...getRoleDefinition(role).permissions];
+export async function seedOrganizationRoles(organizationId: string): Promise<void> {
+  const database = getDatabase();
+  const organizationRoles = SYSTEM_ROLE_DEFINITIONS.filter((role) => role.scope === "organization");
+
+  await database
+    .insert(roles)
+    .values(
+      organizationRoles.map((role) => ({
+        key: role.key,
+        organizationId,
+        scope: role.scope,
+        label: ROLE_LABELS[role.key],
+        description: role.description,
+        isSystem: true,
+        isEnabled: true,
+      })),
+    )
+    .onConflictDoNothing();
+
+  const seededRoles = await database
+    .select()
+    .from(roles)
+    .where(and(eq(roles.organizationId, organizationId), inArray(roles.key, organizationRoles.map((role) => role.key))));
+
+  const inserts = seededRoles.flatMap((role) => {
+    const definition = SYSTEM_ROLE_DEFINITIONS.find((item) => item.key === role.key);
+    if (!definition) {
+      return [];
+    }
+
+    return definition.permissions.map((permissionId) => ({ roleId: role.id, permissionId }));
+  });
+
+  if (inserts.length > 0) {
+    await database.insert(rolePermissions).values(inserts).onConflictDoNothing();
+  }
 }
 
-export function hasPermission(role: RoleId, permission: Permission): boolean {
-  return getRoleDefinition(role).permissions.includes(permission);
+export async function getRoleDefinitions(organizationId?: string): Promise<RoleDefinition[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select()
+    .from(roles)
+    .where(organizationId ? or(isNull(roles.organizationId), eq(roles.organizationId, organizationId)) : isNull(roles.organizationId));
+
+  const roleIds = rows.map((role) => role.id);
+  const permissionRows =
+    roleIds.length > 0
+      ? await database.select().from(rolePermissions).where(inArray(rolePermissions.roleId, roleIds))
+      : [];
+
+  return rows.map((role) => ({
+    id: role.id,
+    key: role.key,
+    label: role.label,
+    description: role.description,
+    scope: role.scope,
+    organizationId: role.organizationId ?? undefined,
+    isSystem: role.isSystem,
+    isEnabled: role.isEnabled,
+    permissions: permissionRows
+      .filter((permission) => permission.roleId === role.id)
+      .map((permission) => permission.permissionId as Permission),
+  }));
+}
+
+export async function getPermissionsForRole(roleId: string): Promise<Permission[]> {
+  const database = getDatabase();
+  const rows = await database
+    .select({ permissionId: rolePermissions.permissionId })
+    .from(rolePermissions)
+    .innerJoin(roles, eq(roles.id, rolePermissions.roleId))
+    .where(and(eq(rolePermissions.roleId, roleId), eq(roles.isEnabled, true)));
+  return rows.map((row) => row.permissionId as Permission);
+}
+
+export function hasPermission(permissionsList: readonly Permission[], permission: Permission): boolean {
+  return permissionsList.includes(permission);
 }

modules/core/server/schema.ts

@@ -0,0 +1,252 @@
+import {
+  boolean,
+  integer,
+  pgEnum,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  uuid,
+} from "drizzle-orm/pg-core";
+
+export const accountStatusEnum = pgEnum("account_status", ["active", "disabled", "pending"]);
+export const organizationStatusEnum = pgEnum("organization_status", ["active", "disabled"]);
+export const roleScopeEnum = pgEnum("role_scope", ["platform", "organization"]);
+export const membershipStatusEnum = pgEnum("membership_status", ["active", "disabled", "pending"]);
+export const bedStatusEnum = pgEnum("bed_status", ["available", "occupied", "maintenance", "disabled"]);
+export const elderStatusEnum = pgEnum("elder_status", ["active", "pending", "discharged"]);
+export const careLevelEnum = pgEnum("care_level", ["self-care", "semi-assisted", "assisted", "intensive"]);
+export const genderEnum = pgEnum("gender", ["male", "female", "other"]);
+export const admissionStatusEnum = pgEnum("admission_status", ["active", "transferred", "discharged"]);
+export const auditResultEnum = pgEnum("audit_result", ["success", "denied", "failure"]);
+export const incidentStatusEnum = pgEnum("incident_status", ["open", "acknowledged", "resolved", "closed"]);
+export const incidentSeverityEnum = pgEnum("incident_severity", ["info", "warning", "critical"]);
+export const joinRequestStatusEnum = pgEnum("join_request_status", ["pending", "approved", "rejected"]);
+
+export const organizations = pgTable("organizations", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull(),
+  status: organizationStatusEnum("status").notNull().default("active"),
+  registrationEnabled: boolean("registration_enabled").notNull().default(true),
+  oidcEnabled: boolean("oidc_enabled").notNull().default(false),
+  oidcIssuerUrl: text("oidc_issuer_url").notNull().default(""),
+  oidcClientId: text("oidc_client_id").notNull().default(""),
+  oidcClientSecret: text("oidc_client_secret").notNull().default(""),
+  oidcScopes: text("oidc_scopes").notNull().default("openid profile email"),
+  oidcRedirectUri: text("oidc_redirect_uri").notNull().default(""),
+  oidcAutoProvision: boolean("oidc_auto_provision").notNull().default(false),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  slugUnique: uniqueIndex("organizations_slug_unique").on(table.slug),
+}));
+
+export const permissions = pgTable("permissions", {
+  id: text("id").primaryKey(),
+  label: text("label").notNull(),
+  category: text("category").notNull(),
+  description: text("description").notNull(),
+  isEnabled: boolean("is_enabled").notNull().default(true),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const roles = pgTable("roles", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  key: text("key").notNull(),
+  organizationId: uuid("organization_id").references(() => organizations.id, { onDelete: "cascade" }),
+  scope: roleScopeEnum("scope").notNull(),
+  label: text("label").notNull(),
+  description: text("description").notNull(),
+  isSystem: boolean("is_system").notNull().default(false),
+  isEnabled: boolean("is_enabled").notNull().default(true),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  roleKeyUnique: uniqueIndex("roles_key_organization_unique").on(table.key, table.organizationId),
+}));
+
+export const rolePermissions = pgTable("role_permissions", {
+  roleId: uuid("role_id").notNull().references(() => roles.id, { onDelete: "cascade" }),
+  permissionId: text("permission_id").notNull().references(() => permissions.id, { onDelete: "cascade" }),
+}, (table) => ({
+  pk: primaryKey({ columns: [table.roleId, table.permissionId] }),
+}));
+
+export const accounts = pgTable("accounts", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  platformRoleId: uuid("platform_role_id").references(() => roles.id),
+  name: text("name").notNull(),
+  email: text("email").notNull(),
+  passwordHash: text("password_hash").notNull(),
+  passwordSalt: text("password_salt").notNull(),
+  status: accountStatusEnum("status").notNull().default("active"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  emailUnique: uniqueIndex("accounts_email_unique").on(table.email),
+}));
+
+export const memberships = pgTable("memberships", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  accountId: uuid("account_id").notNull().references(() => accounts.id, { onDelete: "cascade" }),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  roleId: uuid("role_id").notNull().references(() => roles.id),
+  status: membershipStatusEnum("status").notNull().default("active"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  accountOrganizationUnique: uniqueIndex("memberships_account_organization_unique").on(
+    table.accountId,
+    table.organizationId,
+  ),
+}));
+
+export const sessions = pgTable("sessions", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  accountId: uuid("account_id").notNull().references(() => accounts.id, { onDelete: "cascade" }),
+  activeOrganizationId: uuid("active_organization_id").references(() => organizations.id),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+});
+
+export const joinRequests = pgTable("join_requests", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  accountId: uuid("account_id").notNull().references(() => accounts.id, { onDelete: "cascade" }),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  status: joinRequestStatusEnum("status").notNull().default("pending"),
+  reason: text("reason").notNull().default(""),
+  reviewedByAccountId: uuid("reviewed_by_account_id").references(() => accounts.id),
+  reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const organizationInvitations = pgTable("organization_invitations", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  roleId: uuid("role_id").notNull().references(() => roles.id),
+  email: text("email").notNull().default(""),
+  token: text("token").notNull(),
+  status: text("status").notNull().default("active"),
+  createdByAccountId: uuid("created_by_account_id").references(() => accounts.id),
+  acceptedByAccountId: uuid("accepted_by_account_id").references(() => accounts.id),
+  acceptedAt: timestamp("accepted_at", { withTimezone: true }),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  tokenUnique: uniqueIndex("organization_invitations_token_unique").on(table.token),
+}));
+
+export const campuses = pgTable("campuses", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  address: text("address").notNull().default(""),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const buildings = pgTable("buildings", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  campusId: uuid("campus_id").notNull().references(() => campuses.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const floors = pgTable("floors", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  buildingId: uuid("building_id").notNull().references(() => buildings.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  level: integer("level").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const rooms = pgTable("rooms", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  floorId: uuid("floor_id").notNull().references(() => floors.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  code: text("code").notNull(),
+  capacity: integer("capacity").notNull().default(1),
+  status: organizationStatusEnum("status").notNull().default("active"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  roomCodeUnique: uniqueIndex("rooms_code_organization_unique").on(table.organizationId, table.code),
+}));
+
+export const beds = pgTable("beds", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  roomId: uuid("room_id").notNull().references(() => rooms.id, { onDelete: "cascade" }),
+  code: text("code").notNull(),
+  status: bedStatusEnum("status").notNull().default("available"),
+  notes: text("notes").notNull().default(""),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+}, (table) => ({
+  bedCodeUnique: uniqueIndex("beds_code_room_unique").on(table.roomId, table.code),
+}));
+
+export const elders = pgTable("elders", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  gender: genderEnum("gender").notNull(),
+  age: integer("age").notNull(),
+  careLevel: careLevelEnum("care_level").notNull(),
+  status: elderStatusEnum("status").notNull().default("pending"),
+  primaryContact: text("primary_contact").notNull(),
+  phone: text("phone").notNull(),
+  medicalNotes: text("medical_notes").notNull().default(""),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const admissions = pgTable("admissions", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").notNull().references(() => organizations.id, { onDelete: "cascade" }),
+  elderId: uuid("elder_id").notNull().references(() => elders.id, { onDelete: "cascade" }),
+  bedId: uuid("bed_id").notNull().references(() => beds.id),
+  status: admissionStatusEnum("status").notNull().default("active"),
+  admittedAt: timestamp("admitted_at", { withTimezone: true }).notNull().defaultNow(),
+  dischargedAt: timestamp("discharged_at", { withTimezone: true }),
+  notes: text("notes").notNull().default(""),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
+export const auditLogs = pgTable("audit_logs", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").references(() => organizations.id, { onDelete: "cascade" }),
+  timestamp: timestamp("timestamp", { withTimezone: true }).notNull().defaultNow(),
+  actorAccountId: uuid("actor_account_id").references(() => accounts.id),
+  actorEmail: text("actor_email"),
+  action: text("action").notNull(),
+  targetType: text("target_type").notNull(),
+  targetId: text("target_id"),
+  result: auditResultEnum("result").notNull(),
+  reason: text("reason").notNull(),
+});
+
+export const systemIncidents = pgTable("system_incidents", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  organizationId: uuid("organization_id").references(() => organizations.id, { onDelete: "cascade" }),
+  severity: incidentSeverityEnum("severity").notNull(),
+  status: incidentStatusEnum("status").notNull().default("open"),
+  title: text("title").notNull(),
+  description: text("description").notNull(),
+  source: text("source").notNull(),
+  acknowledgedByAccountId: uuid("acknowledged_by_account_id").references(() => accounts.id),
+  acknowledgedAt: timestamp("acknowledged_at", { withTimezone: true }),
+  resolvedByAccountId: uuid("resolved_by_account_id").references(() => accounts.id),
+  resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+});

modules/core/server/store.ts

@@ -1,63 +1,301 @@
-import { promises as fs } from "node:fs";
-import path from "node:path";
+import { desc, eq, sql } from "drizzle-orm";
 
-import type { AppData } from "@/modules/core/types";
+import { listAuditLogs } from "@/modules/core/server/audit";
+import { getDatabase } from "@/modules/core/server/db";
+import {
+  accounts,
+  admissions,
+  beds,
+  elders,
+  joinRequests,
+  memberships,
+  organizationInvitations,
+  organizations,
+  roles,
+  rooms,
+  sessions,
+  systemIncidents,
+} from "@/modules/core/server/schema";
+import type {
+  Account,
+  Admission,
+  AppData,
+  FacilityBed,
+  JoinRequest,
+  Membership,
+  Organization,
+  OrganizationInvitation,
+  Room,
+  Session,
+  SystemIncident,
+} from "@/modules/core/types";
+import type { Elder } from "@/modules/elders/types";
 
-const DATA_DIR = process.env.TEATEA_DATA_DIR ?? path.join(process.cwd(), ".data");
-const DATA_FILE = path.join(DATA_DIR, "teatea.json");
-
-function createEmptyData(): AppData {
-  return {
-    accounts: [],
-    sessions: [],
-    elders: [],
-    auditLogs: [],
-  };
-}
-
-function normalizeData(data: Partial<AppData>): AppData {
-  return {
-    accounts: Array.isArray(data.accounts) ? data.accounts : [],
-    sessions: Array.isArray(data.sessions) ? data.sessions : [],
-    elders: Array.isArray(data.elders) ? data.elders : [],
-    auditLogs: Array.isArray(data.auditLogs) ? data.auditLogs : [],
-  };
-}
-
-function isMissingFileError(error: unknown): boolean {
-  return (
-    typeof error === "object" &&
-    error !== null &&
-    "code" in error &&
-    (error as { code?: unknown }).code === "ENOENT"
-  );
+function iso(value: Date): string {
+  return value.toISOString();
 }
 
 export async function readData(): Promise<AppData> {
-  try {
-    const raw = await fs.readFile(DATA_FILE, "utf8");
-    const parsed = JSON.parse(raw) as Partial<AppData>;
-    return normalizeData(parsed);
-  } catch (error) {
-    if (isMissingFileError(error)) {
-      return createEmptyData();
+  const database = getDatabase();
+  const [
+    organizationRows,
+    accountRows,
+    membershipRows,
+    joinRequestRows,
+    invitationRows,
+    sessionRows,
+    elderRows,
+    roomRows,
+    bedRows,
+    admissionRows,
+    auditLogRows,
+    incidentRows,
+  ] = await Promise.all([
+    database.select().from(organizations).orderBy(desc(organizations.createdAt)),
+    database.select().from(accounts).orderBy(desc(accounts.createdAt)),
+    database.select({ membership: memberships, role: roles }).from(memberships).innerJoin(roles, eq(roles.id, memberships.roleId)),
+    database
+      .select({
+        request: joinRequests,
+        accountName: accounts.name,
+        accountEmail: accounts.email,
+        organizationName: organizations.name,
+      })
+      .from(joinRequests)
+      .innerJoin(accounts, eq(accounts.id, joinRequests.accountId))
+      .innerJoin(organizations, eq(organizations.id, joinRequests.organizationId))
+      .orderBy(desc(joinRequests.createdAt)),
+    database
+      .select({
+        invitation: organizationInvitations,
+        organizationName: organizations.name,
+        roleLabel: roles.label,
+      })
+      .from(organizationInvitations)
+      .innerJoin(organizations, eq(organizations.id, organizationInvitations.organizationId))
+      .innerJoin(roles, eq(roles.id, organizationInvitations.roleId))
+      .orderBy(desc(organizationInvitations.createdAt)),
+    database.select().from(sessions).orderBy(desc(sessions.createdAt)),
+    database.select().from(elders).orderBy(desc(elders.createdAt)),
+    database.select().from(rooms).orderBy(desc(rooms.createdAt)),
+    database
+      .select({
+        bed: beds,
+        roomName: rooms.name,
+        currentElderName: sql<string | null>`(
+          select ${elders.name}
+          from ${admissions}
+          inner join ${elders} on ${elders.id} = ${admissions.elderId}
+          where ${admissions.bedId} = ${beds.id} and ${admissions.status} = 'active'
+          limit 1
+        )`,
+      })
+      .from(beds)
+      .innerJoin(rooms, eq(rooms.id, beds.roomId))
+      .orderBy(desc(beds.createdAt)),
+    database
+      .select({
+        admission: admissions,
+        elderName: elders.name,
+        bedCode: beds.code,
+        roomName: rooms.name,
+      })
+      .from(admissions)
+      .innerJoin(elders, eq(elders.id, admissions.elderId))
+      .innerJoin(beds, eq(beds.id, admissions.bedId))
+      .innerJoin(rooms, eq(rooms.id, beds.roomId))
+      .orderBy(desc(admissions.admittedAt)),
+    listAuditLogs({ limit: 100 }),
+    database.select().from(systemIncidents).orderBy(desc(systemIncidents.createdAt)),
+  ]);
+
+  const roleById = new Map(membershipRows.map((row) => [row.membership.id, row.role]));
+  const bedCounts = new Map<string, { total: number; occupied: number }>();
+  for (const row of bedRows) {
+    const current = bedCounts.get(row.bed.roomId) ?? { total: 0, occupied: 0 };
+    current.total += 1;
+    if (row.bed.status === "occupied") {
+      current.occupied += 1;
     }
-
-    throw error;
+    bedCounts.set(row.bed.roomId, current);
   }
+
+  const organizationsData: Organization[] = organizationRows.map((row) => ({
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    status: row.status,
+    registrationEnabled: row.registrationEnabled,
+    oidcEnabled: row.oidcEnabled,
+    oidcIssuerUrl: row.oidcIssuerUrl,
+    oidcClientId: row.oidcClientId,
+    oidcHasClientSecret: row.oidcClientSecret.length > 0,
+    oidcScopes: row.oidcScopes,
+    oidcRedirectUri: row.oidcRedirectUri,
+    oidcAutoProvision: row.oidcAutoProvision,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  }));
+
+  const accountsData: Account[] = accountRows.map((row) => ({
+    id: row.id,
+    platformRoleId: row.platformRoleId ?? undefined,
+    name: row.name,
+    email: row.email,
+    role: row.platformRoleId ?? "viewer",
+    passwordHash: row.passwordHash,
+    passwordSalt: row.passwordSalt,
+    status: row.status,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  }));
+
+  const membershipsData: Membership[] = membershipRows.map((row) => {
+    const role = roleById.get(row.membership.id) ?? row.role;
+    return {
+      id: row.membership.id,
+      accountId: row.membership.accountId,
+      organizationId: row.membership.organizationId,
+      roleId: row.membership.roleId,
+      roleKey: role.key,
+      roleLabel: role.label,
+      status: row.membership.status,
+      createdAt: iso(row.membership.createdAt),
+      updatedAt: iso(row.membership.updatedAt),
+    };
+  });
+
+  const joinRequestsData: JoinRequest[] = joinRequestRows.map((row) => ({
+    id: row.request.id,
+    accountId: row.request.accountId,
+    accountName: row.accountName,
+    accountEmail: row.accountEmail,
+    organizationId: row.request.organizationId,
+    organizationName: row.organizationName,
+    status: row.request.status,
+    reason: row.request.reason,
+    reviewedByAccountId: row.request.reviewedByAccountId ?? undefined,
+    reviewedAt: row.request.reviewedAt ? iso(row.request.reviewedAt) : undefined,
+    createdAt: iso(row.request.createdAt),
+  }));
+
+  const organizationInvitationsData: OrganizationInvitation[] = invitationRows.map((row) => ({
+    id: row.invitation.id,
+    organizationId: row.invitation.organizationId,
+    organizationName: row.organizationName,
+    roleId: row.invitation.roleId,
+    roleLabel: row.roleLabel,
+    email: row.invitation.email,
+    token: row.invitation.token,
+    status: row.invitation.status as OrganizationInvitation["status"],
+    createdByAccountId: row.invitation.createdByAccountId ?? undefined,
+    acceptedByAccountId: row.invitation.acceptedByAccountId ?? undefined,
+    acceptedAt: row.invitation.acceptedAt ? iso(row.invitation.acceptedAt) : undefined,
+    expiresAt: iso(row.invitation.expiresAt),
+    createdAt: iso(row.invitation.createdAt),
+    updatedAt: iso(row.invitation.updatedAt),
+  }));
+
+  const sessionsData: Session[] = sessionRows.map((row) => ({
+    id: row.id,
+    accountId: row.accountId,
+    activeOrganizationId: row.activeOrganizationId ?? undefined,
+    createdAt: iso(row.createdAt),
+    expiresAt: iso(row.expiresAt),
+  }));
+
+  const eldersData: Elder[] = elderRows.map((row) => ({
+    id: row.id,
+    organizationId: row.organizationId,
+    name: row.name,
+    gender: row.gender,
+    age: row.age,
+    careLevel: row.careLevel,
+    room: "",
+    bed: "",
+    status: row.status,
+    primaryContact: row.primaryContact,
+    phone: row.phone,
+    medicalNotes: row.medicalNotes,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  }));
+
+  const roomsData: Room[] = roomRows.map((row) => {
+    const counts = bedCounts.get(row.id) ?? { total: 0, occupied: 0 };
+    return {
+      id: row.id,
+      organizationId: row.organizationId,
+      name: row.name,
+      code: row.code,
+      capacity: row.capacity,
+      status: row.status,
+      bedCount: counts.total,
+      occupiedBedCount: counts.occupied,
+      createdAt: iso(row.createdAt),
+      updatedAt: iso(row.updatedAt),
+    };
+  });
+
+  const bedsData: FacilityBed[] = bedRows.map((row) => ({
+    id: row.bed.id,
+    organizationId: row.bed.organizationId,
+    roomId: row.bed.roomId,
+    roomName: row.roomName,
+    code: row.bed.code,
+    status: row.bed.status,
+    notes: row.bed.notes,
+    currentElderName: row.currentElderName ?? undefined,
+    createdAt: iso(row.bed.createdAt),
+    updatedAt: iso(row.bed.updatedAt),
+  }));
+
+  const admissionsData: Admission[] = admissionRows.map((row) => ({
+    id: row.admission.id,
+    organizationId: row.admission.organizationId,
+    elderId: row.admission.elderId,
+    elderName: row.elderName,
+    bedId: row.admission.bedId,
+    bedCode: row.bedCode,
+    roomName: row.roomName,
+    status: row.admission.status,
+    admittedAt: iso(row.admission.admittedAt),
+    dischargedAt: row.admission.dischargedAt ? iso(row.admission.dischargedAt) : undefined,
+    notes: row.admission.notes,
+  }));
+
+  const incidentsData: SystemIncident[] = incidentRows.map((row) => ({
+    id: row.id,
+    organizationId: row.organizationId ?? undefined,
+    severity: row.severity,
+    status: row.status,
+    title: row.title,
+    description: row.description,
+    source: row.source,
+    createdAt: iso(row.createdAt),
+    updatedAt: iso(row.updatedAt),
+  }));
+
+  return {
+    organizations: organizationsData,
+    accounts: accountsData,
+    memberships: membershipsData,
+    joinRequests: joinRequestsData,
+    organizationInvitations: organizationInvitationsData,
+    sessions: sessionsData,
+    elders: eldersData,
+    rooms: roomsData,
+    beds: bedsData,
+    admissions: admissionsData,
+    auditLogs: auditLogRows,
+    incidents: incidentsData,
+  };
 }
 
-export async function writeData(data: AppData): Promise<void> {
-  await fs.mkdir(DATA_DIR, { recursive: true });
-  const temporaryFile = `${DATA_FILE}.tmp`;
-  await fs.writeFile(temporaryFile, JSON.stringify(data, null, 2), "utf8");
-  await fs.rename(temporaryFile, DATA_FILE);
+export async function writeData(): Promise<void> {
+  throw new Error("writeData is not available after PostgreSQL migration");
 }
 
-export async function updateData<T>(mutator: (data: AppData) => T): Promise<T> {
-  const data = await readData();
-  const result = mutator(data);
-  await writeData(data);
-  return result;
+export async function updateData<T>(): Promise<T> {
+  throw new Error("updateData is not available after PostgreSQL migration");
 }
-

modules/core/types.ts

@@ -1,19 +1,44 @@
 import type { Elder } from "@/modules/elders/types";
 
-export const ROLE_IDS = ["admin", "manager", "caregiver", "viewer"] as const;
+export const ROLE_IDS = [
+  "platform_admin",
+  "platform_operator",
+  "platform_auditor",
+  "platform_ops",
+  "org_admin",
+  "manager",
+  "caregiver",
+  "viewer",
+] as const;
 export type RoleId = (typeof ROLE_IDS)[number];
 
 export const ROLE_LABELS: Record<RoleId, string> = {
-  admin: "系统管理员",
+  platform_admin: "平台超管",
+  platform_operator: "平台运营",
+  platform_auditor: "平台审计",
+  platform_ops: "平台运维",
+  org_admin: "机构管理员",
   manager: "运营主管",
   caregiver: "照护人员",
   viewer: "只读访客",
 };
 
 export const PERMISSIONS = [
+  "platform:manage",
+  "organization:read",
+  "organization:manage",
   "account:read",
   "account:manage",
+  "role:read",
+  "role:manage",
+  "permission:read",
   "audit:read",
+  "incident:read",
+  "incident:manage",
+  "facility:read",
+  "facility:manage",
+  "admission:read",
+  "admission:manage",
   "elder:read",
   "elder:create",
   "elder:update",
@@ -23,20 +48,95 @@ export const PERMISSIONS = [
 export type Permission = (typeof PERMISSIONS)[number];
 
 export type RoleDefinition = {
-  id: RoleId;
+  id: string;
+  key: RoleId | string;
   label: string;
   description: string;
+  scope: "platform" | "organization";
+  organizationId?: string;
+  isSystem: boolean;
+  isEnabled: boolean;
   permissions: Permission[];
 };
 
-export type AccountStatus = "active" | "disabled";
+export type AccountStatus = "active" | "disabled" | "pending";
+
+export type OrganizationStatus = "active" | "disabled";
+
+export type Organization = {
+  id: string;
+  name: string;
+  slug: string;
+  status: OrganizationStatus;
+  registrationEnabled: boolean;
+  oidcEnabled: boolean;
+  oidcIssuerUrl: string;
+  oidcClientId: string;
+  oidcHasClientSecret: boolean;
+  oidcScopes: string;
+  oidcRedirectUri: string;
+  oidcAutoProvision: boolean;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type MembershipStatus = "active" | "disabled" | "pending";
+
+export type Membership = {
+  id: string;
+  accountId: string;
+  organizationId: string;
+  roleId: string;
+  roleKey: string;
+  roleLabel: string;
+  status: MembershipStatus;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type JoinRequestStatus = "pending" | "approved" | "rejected";
+
+export type JoinRequest = {
+  id: string;
+  accountId: string;
+  accountName: string;
+  accountEmail: string;
+  organizationId: string;
+  organizationName: string;
+  status: JoinRequestStatus;
+  reason: string;
+  reviewedByAccountId?: string;
+  reviewedAt?: string;
+  createdAt: string;
+};
+
+export type OrganizationInvitationStatus = "active" | "accepted" | "revoked" | "expired";
+
+export type OrganizationInvitation = {
+  id: string;
+  organizationId: string;
+  organizationName: string;
+  roleId: string;
+  roleLabel: string;
+  email: string;
+  token: string;
+  status: OrganizationInvitationStatus;
+  createdByAccountId?: string;
+  acceptedByAccountId?: string;
+  acceptedAt?: string;
+  expiresAt: string;
+  createdAt: string;
+  updatedAt: string;
+};
 
 export type Account = {
   id: string;
+  platformRoleId?: string;
   name: string;
   email: string;
-  role: RoleId;
+  role: RoleId | string;
   organization?: string;
+  organizationId?: string;
   passwordHash: string;
   passwordSalt: string;
   status: AccountStatus;
@@ -49,6 +149,7 @@ export type PublicAccount = Omit<Account, "passwordHash" | "passwordSalt">;
 export type Session = {
   id: string;
   accountId: string;
+  activeOrganizationId?: string;
   createdAt: string;
   expiresAt: string;
 };
@@ -57,6 +158,7 @@ export type AuditResult = "success" | "denied" | "failure";
 
 export type AuditLog = {
   id: string;
+  organizationId?: string;
   timestamp: string;
   actorAccountId?: string;
   actorEmail?: string;
@@ -67,16 +169,84 @@ export type AuditLog = {
   reason: string;
 };
 
+export type BedStatus = "available" | "occupied" | "maintenance" | "disabled";
+
+export type FacilityBed = {
+  id: string;
+  organizationId: string;
+  roomId: string;
+  roomName: string;
+  code: string;
+  status: BedStatus;
+  notes: string;
+  currentElderName?: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type Room = {
+  id: string;
+  organizationId: string;
+  name: string;
+  code: string;
+  capacity: number;
+  status: OrganizationStatus;
+  bedCount: number;
+  occupiedBedCount: number;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type AdmissionStatus = "active" | "transferred" | "discharged";
+
+export type Admission = {
+  id: string;
+  organizationId: string;
+  elderId: string;
+  elderName: string;
+  bedId: string;
+  bedCode: string;
+  roomName: string;
+  status: AdmissionStatus;
+  admittedAt: string;
+  dischargedAt?: string;
+  notes: string;
+};
+
+export type IncidentSeverity = "info" | "warning" | "critical";
+export type IncidentStatus = "open" | "acknowledged" | "resolved" | "closed";
+
+export type SystemIncident = {
+  id: string;
+  organizationId?: string;
+  severity: IncidentSeverity;
+  status: IncidentStatus;
+  title: string;
+  description: string;
+  source: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
 export type AppData = {
+  organizations: Organization[];
   accounts: Account[];
+  memberships: Membership[];
+  joinRequests: JoinRequest[];
+  organizationInvitations: OrganizationInvitation[];
   sessions: Session[];
   elders: Elder[];
+  rooms: Room[];
+  beds: FacilityBed[];
+  admissions: Admission[];
   auditLogs: AuditLog[];
+  incidents: SystemIncident[];
 };
 
 export type AuthContext = {
   account: PublicAccount;
+  organization?: Organization;
+  membership?: Membership;
   permissions: Permission[];
   session: Session;
 };
-

modules/elders/types.ts

@@ -28,12 +28,14 @@ export const ELDER_STATUS_LABELS: Record<ElderStatus, string> = {
 
 export type Elder = {
   id: string;
+  organizationId?: string;
   name: string;
   gender: Gender;
   age: number;
   careLevel: CareLevel;
   room: string;
   bed: string;
+  bedId?: string;
   status: ElderStatus;
   primaryContact: string;
   phone: string;
@@ -73,6 +75,16 @@ function readRequiredString(
   return { success: true, data: value.trim() };
 }
 
+function readOptionalString(source: Record<string, unknown>, key: string): string | undefined {
+  const value = source[key];
+  if (typeof value !== "string") {
+    return undefined;
+  }
+
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
 function readEnum<T extends string>(
   source: Record<string, unknown>,
   key: keyof ElderInput,
@@ -128,15 +140,9 @@ export function validateElderInput(value: unknown): ValidationResult<ElderInput>
     return careLevel;
   }
 
-  const room = readRequiredString(value, "room", "房间");
-  if (!room.success) {
-    return room;
-  }
-
-  const bed = readRequiredString(value, "bed", "床位");
-  if (!bed.success) {
-    return bed;
-  }
+  const room = readOptionalString(value, "room") ?? "";
+  const bed = readOptionalString(value, "bed") ?? "";
+  const bedId = readOptionalString(value, "bedId");
 
   const status = readEnum(value, "status", ELDER_STATUS_VALUES, "状态");
   if (!status.success) {
@@ -163,8 +169,9 @@ export function validateElderInput(value: unknown): ValidationResult<ElderInput>
       gender: gender.data,
       age: age.data,
       careLevel: careLevel.data,
-      room: room.data,
-      bed: bed.data,
+      room,
+      bed,
+      bedId,
       status: status.data,
       primaryContact: primaryContact.data,
       phone: phone.data,
@@ -172,4 +179,3 @@ export function validateElderInput(value: unknown): ValidationResult<ElderInput>
     },
   };
 }
-

modules/settings/components/IncidentStatusActions.tsx

@@ -0,0 +1,84 @@
+"use client";
+
+import { CheckCheck, CircleCheck, CircleDot } from "lucide-react";
+import type { LucideIcon } from "lucide-react";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+
+import { Button } from "@/components/ui/button";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { IncidentStatus, SystemIncident } from "@/modules/core/types";
+
+type IncidentStatusActionsProps = {
+  incident: SystemIncident;
+};
+
+type StatusAction = {
+  label: string;
+  status: IncidentStatus;
+  icon: LucideIcon;
+};
+
+const STATUS_ACTIONS: Record<IncidentStatus, StatusAction[]> = {
+  open: [
+    { label: "确认", status: "acknowledged", icon: CircleDot },
+    { label: "解决", status: "resolved", icon: CircleCheck },
+  ],
+  acknowledged: [
+    { label: "解决", status: "resolved", icon: CircleCheck },
+    { label: "关闭", status: "closed", icon: CheckCheck },
+  ],
+  resolved: [{ label: "关闭", status: "closed", icon: CheckCheck }],
+  closed: [],
+};
+
+export function IncidentStatusActions({ incident }: IncidentStatusActionsProps): React.ReactElement {
+  const router = useRouter();
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+  const actions = STATUS_ACTIONS[incident.status];
+
+  async function updateStatus(status: IncidentStatus): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/system/incidents/${incident.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ status }),
+    });
+    const result = (await response.json()) as ApiResult<{ incident: SystemIncident }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    router.refresh();
+  }
+
+  if (actions.length === 0) {
+    return <span className="block text-right text-xs text-muted-foreground">已关闭</span>;
+  }
+
+  return (
+    <div className="grid justify-end gap-2">
+      <div className="flex items-center justify-end gap-2">
+        {actions.map((action) => (
+          <Button
+            disabled={isPending}
+            key={action.status}
+            onClick={() => void updateStatus(action.status)}
+            size="sm"
+            type="button"
+            variant="outline"
+          >
+            <action.icon className="size-4" aria-hidden="true" />
+            {action.label}
+          </Button>
+        ))}
+      </div>
+      {message ? <p className="text-right text-xs text-destructive">{message}</p> : null}
+    </div>
+  );
+}

modules/settings/components/OrganizationDetailClient.tsx

@@ -0,0 +1,255 @@
+"use client";
+
+import { FormEvent, useState } from "react";
+import { Copy, LinkIcon, Save, Send } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { Organization, OrganizationInvitation, RoleDefinition } from "@/modules/core/types";
+
+type OrganizationDetailClientProps = {
+  invitations: OrganizationInvitation[];
+  organization: Organization;
+  roles: RoleDefinition[];
+};
+
+function getInviteHref(token: string): string {
+  return `/register?invite=${encodeURIComponent(token)}`;
+}
+
+export function OrganizationDetailClient({
+  invitations,
+  organization,
+  roles,
+}: OrganizationDetailClientProps): React.ReactElement {
+  const router = useRouter();
+  const [settingsMessage, setSettingsMessage] = useState("");
+  const [inviteMessage, setInviteMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+  const organizationRoles = roles.filter((role) => role.scope === "organization" && role.organizationId === organization.id && role.isEnabled);
+  const defaultRoleId = organizationRoles.find((role) => role.key === "caregiver")?.id ?? organizationRoles[0]?.id ?? "";
+
+  async function handleSettingsSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setSettingsMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch(`/api/organizations/${organization.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        registrationEnabled: formData.get("registrationEnabled") === "on",
+        oidcEnabled: formData.get("oidcEnabled") === "on",
+        oidcIssuerUrl: String(formData.get("oidcIssuerUrl") ?? ""),
+        oidcClientId: String(formData.get("oidcClientId") ?? ""),
+        oidcClientSecret: String(formData.get("oidcClientSecret") ?? ""),
+        oidcScopes: String(formData.get("oidcScopes") ?? ""),
+        oidcRedirectUri: String(formData.get("oidcRedirectUri") ?? ""),
+        oidcAutoProvision: formData.get("oidcAutoProvision") === "on",
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ organization: Organization }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setSettingsMessage(result.reason);
+      return;
+    }
+
+    setSettingsMessage(result.reason);
+    router.refresh();
+  }
+
+  async function handleInviteSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setInviteMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch(`/api/organizations/${organization.id}/invitations`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        email: String(formData.get("email") ?? ""),
+        roleId: String(formData.get("roleId") ?? ""),
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ invitation: OrganizationInvitation }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setInviteMessage(result.reason);
+      return;
+    }
+
+    setInviteMessage(`${result.reason}：${getInviteHref(result.invitation.token)}`);
+    event.currentTarget.reset();
+    router.refresh();
+  }
+
+  return (
+    <div className="grid gap-5 xl:grid-cols-[0.95fr_1.05fr]">
+      <Card>
+        <CardHeader>
+          <CardTitle>机构访问配置</CardTitle>
+          <CardDescription>控制公开注册、OIDC 登录入口和自动开户策略。</CardDescription>
+        </CardHeader>
+        <CardContent>
+          <form className="grid gap-4" onSubmit={handleSettingsSubmit}>
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">开放公开注册</span>
+                <span className="block text-xs text-muted-foreground">关闭后，注册页不再展示该机构；邀请链接仍可使用。</span>
+              </span>
+              <input defaultChecked={organization.registrationEnabled} name="registrationEnabled" type="checkbox" />
+            </label>
+
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">启用 OIDC 登录</span>
+                <span className="block text-xs text-muted-foreground">保存标准 OIDC 配置，后续登录入口按该开关展示。</span>
+              </span>
+              <input defaultChecked={organization.oidcEnabled} name="oidcEnabled" type="checkbox" />
+            </label>
+
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Issuer URL</span>
+                <Input defaultValue={organization.oidcIssuerUrl} name="oidcIssuerUrl" placeholder="https://idp.example.com" />
+              </label>
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Client ID</span>
+                <Input defaultValue={organization.oidcClientId} name="oidcClientId" />
+              </label>
+            </div>
+
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">Client Secret</span>
+              <Input
+                name="oidcClientSecret"
+                placeholder={organization.oidcHasClientSecret ? "已配置，留空则不修改" : "未配置"}
+                type="password"
+              />
+            </label>
+
+            <div className="grid gap-3 md:grid-cols-2">
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Scopes</span>
+                <Input defaultValue={organization.oidcScopes} name="oidcScopes" placeholder="openid profile email" />
+              </label>
+              <label className="grid gap-2 text-sm">
+                <span className="font-medium">Redirect URI</span>
+                <Input defaultValue={organization.oidcRedirectUri} name="oidcRedirectUri" placeholder="/api/auth/oidc/callback" />
+              </label>
+            </div>
+
+            <label className="flex items-center justify-between gap-4 rounded-md border p-3 text-sm">
+              <span>
+                <span className="block font-medium">OIDC 自动开户</span>
+                <span className="block text-xs text-muted-foreground">首次 OIDC 登录时自动创建账号并进入本机构。</span>
+              </span>
+              <input defaultChecked={organization.oidcAutoProvision} name="oidcAutoProvision" type="checkbox" />
+            </label>
+
+            {settingsMessage ? (
+              <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+                {settingsMessage}
+              </p>
+            ) : null}
+
+            <Button className="w-fit" disabled={isPending} type="submit">
+              <Save className="size-4" aria-hidden="true" />
+              保存配置
+            </Button>
+          </form>
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>机构邀请</CardTitle>
+          <CardDescription>生成邀请链接后发送给成员；可限定邮箱，也可生成通用邀请。</CardDescription>
+        </CardHeader>
+        <CardContent className="grid gap-4">
+          <form className="grid gap-3 md:grid-cols-[1fr_1fr_auto]" onSubmit={handleInviteSubmit}>
+            <Input name="email" placeholder="邮箱，可留空" type="email" />
+            <select
+              className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+              defaultValue={defaultRoleId}
+              name="roleId"
+              required
+            >
+              {organizationRoles.map((role) => (
+                <option key={role.id} value={role.id}>
+                  {role.label}
+                </option>
+              ))}
+            </select>
+            <Button disabled={isPending || !defaultRoleId} type="submit">
+              <Send className="size-4" aria-hidden="true" />
+              生成邀请
+            </Button>
+          </form>
+          {inviteMessage ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {inviteMessage}
+            </p>
+          ) : null}
+
+          <div className="overflow-x-auto rounded-md border">
+            <table className="w-full min-w-[720px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">对象</th>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 font-medium">有效期</th>
+                  <th className="px-4 py-3 text-right font-medium">链接</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {invitations.map((invitation) => (
+                  <tr className="hover:bg-secondary/45" key={invitation.id}>
+                    <td className="px-4 py-3">{invitation.email || "通用邀请"}</td>
+                    <td className="px-4 py-3">{invitation.roleLabel}</td>
+                    <td className="px-4 py-3">
+                      <Badge variant={invitation.status === "active" ? "success" : "secondary"}>{invitation.status}</Badge>
+                    </td>
+                    <td className="px-4 py-3 text-muted-foreground">
+                      {new Date(invitation.expiresAt).toLocaleString("zh-CN")}
+                    </td>
+                    <td className="px-4 py-3 text-right">
+                      <Button
+                        onClick={() => void navigator.clipboard.writeText(getInviteHref(invitation.token))}
+                        size="sm"
+                        type="button"
+                        variant="outline"
+                      >
+                        <Copy className="size-4" aria-hidden="true" />
+                        复制
+                      </Button>
+                    </td>
+                  </tr>
+                ))}
+                {invitations.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                      暂无邀请
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+          <div className="flex items-center gap-2 text-xs text-muted-foreground">
+            <LinkIcon className="size-4" aria-hidden="true" />
+            邀请链接使用 `/register?invite=...`，注册后自动加入机构。
+          </div>
+        </CardContent>
+      </Card>
+    </div>
+  );
+}

modules/settings/components/OrganizationManagementClient.tsx

@@ -0,0 +1,194 @@
+"use client";
+
+import { FormEvent, useState } from "react";
+import { Pencil, Plus, Power } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Dialog } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { Organization } from "@/modules/core/types";
+
+export function OrganizationManagementClient(): React.ReactElement {
+  const router = useRouter();
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch("/api/organizations", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        name: String(formData.get("name") ?? ""),
+        slug: String(formData.get("slug") ?? ""),
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ organization: Organization }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    event.currentTarget.reset();
+    router.refresh();
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>新增机构</CardTitle>
+        <CardDescription>创建后会自动初始化机构内置角色。</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form className="grid gap-3 md:grid-cols-[1fr_1fr_auto]" onSubmit={handleSubmit}>
+          <Input name="name" placeholder="机构名称" required />
+          <Input name="slug" placeholder="机构标识，可留空" />
+          <Button disabled={isPending} type="submit">
+            <Plus className="size-4" aria-hidden="true" />
+            新增机构
+          </Button>
+        </form>
+        {message ? (
+          <p className="mt-3 rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+            {message}
+          </p>
+        ) : null}
+      </CardContent>
+    </Card>
+  );
+}
+
+type OrganizationRowActionsProps = {
+  organization: Organization;
+};
+
+export function OrganizationRowActions({ organization }: OrganizationRowActionsProps): React.ReactElement {
+  const router = useRouter();
+  const [isEditOpen, setIsEditOpen] = useState(false);
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  async function updateOrganization(payload: Record<string, string>): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/organizations/${organization.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+    const result = (await response.json()) as ApiResult<{ organization: Organization }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    setIsEditOpen(false);
+    router.refresh();
+  }
+
+  async function disableOrganization(): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/organizations/${organization.id}`, {
+      method: "DELETE",
+    });
+    const result = (await response.json()) as ApiResult<{ organization: Organization }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    router.refresh();
+  }
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    const formData = new FormData(event.currentTarget);
+    await updateOrganization({
+      name: String(formData.get("name") ?? ""),
+      slug: String(formData.get("slug") ?? ""),
+      status: String(formData.get("status") ?? ""),
+    });
+  }
+
+  return (
+    <div className="flex items-center justify-end gap-2">
+      <Button onClick={() => setIsEditOpen(true)} size="sm" type="button" variant="outline">
+        <Pencil className="size-4" aria-hidden="true" />
+        编辑
+      </Button>
+      {organization.status === "disabled" ? (
+        <Button
+          disabled={isPending}
+          onClick={() => void updateOrganization({ status: "active" })}
+          size="sm"
+          type="button"
+          variant="outline"
+        >
+          <Power className="size-4" aria-hidden="true" />
+          启用
+        </Button>
+      ) : (
+        <Button disabled={isPending} onClick={() => void disableOrganization()} size="sm" type="button" variant="destructive">
+          <Power className="size-4" aria-hidden="true" />
+          停用
+        </Button>
+      )}
+      <Dialog
+        description="编辑机构名称、唯一标识和启停状态。"
+        onClose={() => setIsEditOpen(false)}
+        open={isEditOpen}
+        title="编辑机构"
+      >
+        <form className="grid gap-4" onSubmit={handleSubmit}>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">机构名称</span>
+            <Input defaultValue={organization.name} name="name" required />
+          </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">机构标识</span>
+            <Input defaultValue={organization.slug} name="slug" required />
+          </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">状态</span>
+            <select
+              className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+              defaultValue={organization.status}
+              name="status"
+            >
+              <option value="active">启用</option>
+              <option value="disabled">停用</option>
+            </select>
+          </label>
+          {message ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {message}
+            </p>
+          ) : null}
+          <div className="flex justify-end gap-2">
+            <Button onClick={() => setIsEditOpen(false)} type="button" variant="outline">
+              取消
+            </Button>
+            <Button disabled={isPending} type="submit">
+              保存
+            </Button>
+          </div>
+        </form>
+      </Dialog>
+    </div>
+  );
+}

modules/settings/components/RoleManagementClient.tsx

@@ -0,0 +1,251 @@
+"use client";
+
+import { FormEvent, useState } from "react";
+import { Pencil, Plus, Power } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Dialog } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { Permission, RoleDefinition } from "@/modules/core/types";
+
+type PermissionDefinition = {
+  id: Permission;
+  label: string;
+  category: string;
+  description: string;
+};
+
+type RoleManagementClientProps = {
+  permissions: PermissionDefinition[];
+};
+
+export function RoleManagementClient({ permissions }: RoleManagementClientProps): React.ReactElement {
+  const router = useRouter();
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setMessage("");
+    setIsPending(true);
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch("/api/settings/roles", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        label: String(formData.get("label") ?? ""),
+        key: String(formData.get("key") ?? ""),
+        description: String(formData.get("description") ?? ""),
+        permissions: formData.getAll("permissions").map(String),
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ role: RoleDefinition }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    event.currentTarget.reset();
+    router.refresh();
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>新增角色</CardTitle>
+        <CardDescription>角色由系统注册权限点组合而成。</CardDescription>
+      </CardHeader>
+      <CardContent>
+        <form className="grid gap-4" onSubmit={handleSubmit}>
+          <div className="grid gap-3 md:grid-cols-3">
+            <Input name="label" placeholder="角色名称" required />
+            <Input name="key" placeholder="角色标识，可留空" />
+            <Input name="description" placeholder="角色说明" />
+          </div>
+          <div className="grid gap-2 sm:grid-cols-2 xl:grid-cols-3">
+            {permissions.map((permission) => (
+              <label className="flex items-start gap-2 rounded-md border p-3 text-sm" key={permission.id}>
+                <input className="mt-1" name="permissions" type="checkbox" value={permission.id} />
+                <span>
+                  <span className="block font-medium">{permission.label}</span>
+                  <span className="block text-xs text-muted-foreground">{permission.id}</span>
+                </span>
+              </label>
+            ))}
+          </div>
+          <Button className="w-fit" disabled={isPending} type="submit">
+            <Plus className="size-4" aria-hidden="true" />
+            新增角色
+          </Button>
+        </form>
+        {message ? (
+          <p className="mt-3 rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+            {message}
+          </p>
+        ) : null}
+      </CardContent>
+    </Card>
+  );
+}
+
+type RoleRowActionsProps = {
+  permissions: PermissionDefinition[];
+  role: RoleDefinition;
+};
+
+export function RoleRowActions({ permissions, role }: RoleRowActionsProps): React.ReactElement {
+  const router = useRouter();
+  const [isEditOpen, setIsEditOpen] = useState(false);
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  async function updateRole(payload: Record<string, string | boolean | string[]>): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/settings/roles/${role.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+    const result = (await response.json()) as ApiResult<{ role: RoleDefinition }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    setIsEditOpen(false);
+    router.refresh();
+  }
+
+  async function disableRole(): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/settings/roles/${role.id}`, {
+      method: "DELETE",
+    });
+    const result = (await response.json()) as ApiResult<{ role: RoleDefinition }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    router.refresh();
+  }
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    const formData = new FormData(event.currentTarget);
+    await updateRole({
+      label: String(formData.get("label") ?? ""),
+      key: String(formData.get("key") ?? ""),
+      description: String(formData.get("description") ?? ""),
+      isEnabled: String(formData.get("isEnabled") ?? "") === "true",
+      permissions: formData.getAll("permissions").map(String),
+    });
+  }
+
+  if (role.isSystem) {
+    return <span className="block text-right text-xs text-muted-foreground">内置只读</span>;
+  }
+
+  return (
+    <div className="flex items-center justify-end gap-2">
+      <Button onClick={() => setIsEditOpen(true)} size="sm" type="button" variant="outline">
+        <Pencil className="size-4" aria-hidden="true" />
+        编辑
+      </Button>
+      {role.isEnabled ? (
+        <Button disabled={isPending} onClick={() => void disableRole()} size="sm" type="button" variant="destructive">
+          <Power className="size-4" aria-hidden="true" />
+          停用
+        </Button>
+      ) : (
+        <Button
+          disabled={isPending}
+          onClick={() => void updateRole({ isEnabled: true })}
+          size="sm"
+          type="button"
+          variant="outline"
+        >
+          <Power className="size-4" aria-hidden="true" />
+          启用
+        </Button>
+      )}
+      <Dialog
+        description="编辑自定义角色的名称、说明、状态和权限点。"
+        onClose={() => setIsEditOpen(false)}
+        open={isEditOpen}
+        title="编辑角色"
+      >
+        <form className="grid gap-4" onSubmit={handleSubmit}>
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">角色名称</span>
+              <Input defaultValue={role.label} name="label" required />
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">角色标识</span>
+              <Input defaultValue={role.key} name="key" required />
+            </label>
+          </div>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">角色说明</span>
+            <Input defaultValue={role.description} name="description" />
+          </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">状态</span>
+            <select
+              className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+              defaultValue={String(role.isEnabled)}
+              name="isEnabled"
+            >
+              <option value="true">启用</option>
+              <option value="false">停用</option>
+            </select>
+          </label>
+          <div className="grid gap-2 sm:grid-cols-2 xl:grid-cols-3">
+            {permissions.map((permission) => (
+              <label className="flex items-start gap-2 rounded-md border p-3 text-sm" key={permission.id}>
+                <input
+                  className="mt-1"
+                  defaultChecked={role.permissions.includes(permission.id)}
+                  name="permissions"
+                  type="checkbox"
+                  value={permission.id}
+                />
+                <span>
+                  <span className="block font-medium">{permission.label}</span>
+                  <span className="block text-xs text-muted-foreground">{permission.id}</span>
+                </span>
+              </label>
+            ))}
+          </div>
+          {message ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {message}
+            </p>
+          ) : null}
+          <div className="flex justify-end gap-2">
+            <Button onClick={() => setIsEditOpen(false)} type="button" variant="outline">
+              取消
+            </Button>
+            <Button disabled={isPending} type="submit">
+              保存
+            </Button>
+          </div>
+        </form>
+      </Dialog>
+    </div>
+  );
+}

modules/settings/components/SettingsOverview.tsx

@@ -1,23 +1,51 @@
-import { Activity, AlertTriangle, ShieldCheck, Users } from "lucide-react";
+import { Activity, Building2, Server, ShieldCheck, Users } from "lucide-react";
 
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
-import type { AuditLog, PublicAccount, RoleDefinition } from "@/modules/core/types";
+import type {
+  AuditLog,
+  JoinRequest,
+  Membership,
+  Organization,
+  PublicAccount,
+  RoleDefinition,
+  SystemIncident,
+} from "@/modules/core/types";
 import { ROLE_LABELS } from "@/modules/core/types";
+import { UserManagementClient } from "@/modules/settings/components/UserManagementClient";
+import type { RoleId } from "@/modules/core/types";
 
 type SettingsOverviewProps = {
   accounts: PublicAccount[];
   roles: RoleDefinition[];
   auditLogs: AuditLog[];
+  organizations: Organization[];
+  memberships: Membership[];
+  joinRequests: JoinRequest[];
+  incidents: SystemIncident[];
 };
 
+function formatRoleLabel(role: string): string {
+  if (role in ROLE_LABELS) {
+    return ROLE_LABELS[role as RoleId];
+  }
+
+  return role;
+}
+
 export function SettingsOverview({
   accounts,
   roles,
   auditLogs,
+  organizations,
+  memberships,
+  joinRequests,
+  incidents,
 }: SettingsOverviewProps): React.ReactElement {
   const activeAccountCount = accounts.filter((account) => account.status === "active").length;
   const disabledAccountCount = accounts.length - activeAccountCount;
+  const activeOrganizationCount = organizations.filter((organization) => organization.status === "active").length;
+  const openIncidentCount = incidents.filter((incident) => incident.status === "open").length;
   const deniedAuditCount = auditLogs.filter((log) => log.result === "denied").length;
   const failureAuditCount = auditLogs.filter((log) => log.result === "failure").length;
   const successAuditCount = auditLogs.filter((log) => log.result === "success").length;
@@ -33,12 +61,24 @@ export function SettingsOverview({
   return (
     <div className="mx-auto flex w-full max-w-7xl flex-col gap-5">
       <section className="border-b pb-5">
-        <Badge variant="success">RBAC + Audit</Badge>
-        <h1 className="mt-3 text-3xl font-semibold tracking-normal">权限设置</h1>
-        <p className="mt-2 text-sm text-muted-foreground">内置角色、账号状态和关键操作审计。</p>
+        <Badge variant="success">System configuration</Badge>
+        <h1 className="mt-3 text-3xl font-semibold tracking-normal">系统设置</h1>
+        <p className="mt-2 text-sm text-muted-foreground">机构、用户、角色、权限、审计和故障中心。</p>
       </section>
 
       <section className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
+        <Card>
+          <CardHeader className="flex flex-row items-center justify-between space-y-0">
+            <div>
+              <CardDescription>机构租户</CardDescription>
+              <CardTitle className="mt-2 text-3xl">{organizations.length}</CardTitle>
+            </div>
+            <Building2 className="size-5 text-primary" aria-hidden="true" />
+          </CardHeader>
+          <CardContent className="pt-0">
+            <p className="text-sm text-muted-foreground">启用 {activeOrganizationCount} 个，多租户数据隔离</p>
+          </CardContent>
+        </Card>
         <Card>
           <CardHeader className="flex flex-row items-center justify-between space-y-0">
             <div>
@@ -63,16 +103,20 @@ export function SettingsOverview({
             <p className="text-sm text-muted-foreground">累计覆盖 {totalPermissionCount} 项权限</p>
           </CardContent>
         </Card>
-        <Card className="border-red-200 bg-red-50/70">
+        <Card className={openIncidentCount > 0 ? "border-red-200 bg-red-50/70" : undefined}>
           <CardHeader className="flex flex-row items-center justify-between space-y-0">
             <div>
-              <CardDescription className="text-red-700">红色审计</CardDescription>
-              <CardTitle className="mt-2 text-3xl text-red-700">{deniedAuditCount + failureAuditCount}</CardTitle>
+              <CardDescription className={openIncidentCount > 0 ? "text-red-700" : undefined}>故障事件</CardDescription>
+              <CardTitle className={openIncidentCount > 0 ? "mt-2 text-3xl text-red-700" : "mt-2 text-3xl"}>
+                {openIncidentCount}
+              </CardTitle>
             </div>
-            <AlertTriangle className="size-5 text-red-600" aria-hidden="true" />
+            <Server className={openIncidentCount > 0 ? "size-5 text-red-600" : "size-5 text-primary"} aria-hidden="true" />
           </CardHeader>
           <CardContent className="pt-0">
-            <p className="text-sm text-red-700">拒绝 {deniedAuditCount} 条，失败 {failureAuditCount} 条</p>
+            <p className={openIncidentCount > 0 ? "text-sm text-red-700" : "text-sm text-muted-foreground"}>
+              总计 {incidents.length} 条，开放 {openIncidentCount} 条
+            </p>
           </CardContent>
         </Card>
         <Card>
@@ -99,6 +143,10 @@ export function SettingsOverview({
               <span className="text-sm text-red-700">红色：拒绝/失败审计</span>
               <Badge variant="danger">{deniedAuditCount + failureAuditCount}</Badge>
             </div>
+            <div className="flex items-center justify-between rounded-md border border-red-200 bg-red-50 p-3">
+              <span className="text-sm text-red-700">开放故障</span>
+              <Badge variant="danger">{openIncidentCount}</Badge>
+            </div>
             <div className="flex items-center justify-between rounded-md border border-amber-200 bg-amber-50 p-3">
               <span className="text-sm text-amber-700">黄色：停用账号</span>
               <Badge variant="warning">{disabledAccountCount}</Badge>
@@ -134,10 +182,82 @@ export function SettingsOverview({
         </Card>
       </section>
 
+      <UserManagementClient organizations={organizations} roles={roles} joinRequests={joinRequests} />
+
       <section className="grid gap-4 xl:grid-cols-[0.9fr_1.1fr]">
         <Card>
           <CardHeader>
-            <CardTitle>内置角色</CardTitle>
+            <CardTitle>机构租户</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <div className="overflow-x-auto rounded-md border">
+              <table className="w-full min-w-[560px] text-sm">
+                <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                  <tr>
+                    <th className="px-4 py-3 font-medium">机构</th>
+                    <th className="px-4 py-3 font-medium">Slug</th>
+                    <th className="px-4 py-3 font-medium">状态</th>
+                    <th className="px-4 py-3 text-right font-medium">创建时间</th>
+                  </tr>
+                </thead>
+                <tbody className="divide-y bg-card">
+                  {organizations.map((organization) => (
+                    <tr key={organization.id}>
+                      <td className="px-4 py-3 font-medium">{organization.name}</td>
+                      <td className="px-4 py-3 text-muted-foreground">{organization.slug}</td>
+                      <td className="px-4 py-3">
+                        <Badge variant={organization.status === "active" ? "success" : "danger"}>
+                          {organization.status === "active" ? "启用" : "停用"}
+                        </Badge>
+                      </td>
+                      <td className="px-4 py-3 text-right text-muted-foreground">
+                        {new Date(organization.createdAt).toLocaleString("zh-CN")}
+                      </td>
+                    </tr>
+                  ))}
+                  {organizations.length === 0 ? (
+                    <tr>
+                      <td className="px-4 py-8 text-center text-muted-foreground" colSpan={4}>
+                        暂无机构
+                      </td>
+                    </tr>
+                  ) : null}
+                </tbody>
+              </table>
+            </div>
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>故障中心</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-3">
+            {incidents.slice(0, 6).map((incident) => (
+              <div key={incident.id} className="rounded-md border p-3">
+                <div className="flex items-center justify-between gap-3">
+                  <p className="font-medium">{incident.title}</p>
+                  <Badge
+                    variant={incident.severity === "critical" ? "danger" : incident.severity === "warning" ? "warning" : "secondary"}
+                  >
+                    {incident.status}
+                  </Badge>
+                </div>
+                <p className="mt-2 text-sm text-muted-foreground">{incident.description}</p>
+                <p className="mt-2 text-xs text-muted-foreground">
+                  {incident.source} / {new Date(incident.createdAt).toLocaleString("zh-CN")}
+                </p>
+              </div>
+            ))}
+            {incidents.length === 0 ? <p className="text-sm text-muted-foreground">暂无故障事件</p> : null}
+          </CardContent>
+        </Card>
+      </section>
+
+      <section className="grid gap-4 xl:grid-cols-[0.9fr_1.1fr]">
+        <Card>
+          <CardHeader>
+            <CardTitle>角色与权限</CardTitle>
           </CardHeader>
           <CardContent className="space-y-3">
             {roles.map((role) => (
@@ -181,10 +301,10 @@ export function SettingsOverview({
                         <p className="font-medium">{account.name}</p>
                         <p className="text-xs text-muted-foreground">{account.email}</p>
                       </td>
-                      <td className="px-4 py-3">{ROLE_LABELS[account.role]}</td>
+                      <td className="px-4 py-3">{formatRoleLabel(account.role)}</td>
                       <td className="px-4 py-3">
-                        <Badge variant={account.status === "active" ? "success" : "danger"}>
-                          {account.status === "active" ? "启用" : "停用"}
+                        <Badge variant={account.status === "active" ? "success" : account.status === "pending" ? "warning" : "danger"}>
+                          {account.status === "active" ? "启用" : account.status === "pending" ? "待审批" : "停用"}
                         </Badge>
                       </td>
                       <td className="px-4 py-3 text-right text-muted-foreground">
@@ -199,6 +319,51 @@ export function SettingsOverview({
         </Card>
       </section>
 
+      <Card>
+        <CardHeader>
+          <CardTitle>机构成员关系</CardTitle>
+        </CardHeader>
+        <CardContent>
+          <div className="overflow-x-auto rounded-md border">
+            <table className="w-full min-w-[720px] text-sm">
+              <thead className="bg-secondary text-left text-xs text-muted-foreground">
+                <tr>
+                  <th className="px-4 py-3 font-medium">账号 ID</th>
+                  <th className="px-4 py-3 font-medium">机构 ID</th>
+                  <th className="px-4 py-3 font-medium">角色</th>
+                  <th className="px-4 py-3 font-medium">状态</th>
+                  <th className="px-4 py-3 text-right font-medium">创建时间</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y bg-card">
+                {memberships.map((membership) => (
+                  <tr key={membership.id}>
+                    <td className="px-4 py-3 text-muted-foreground">{membership.accountId.slice(0, 8)}</td>
+                    <td className="px-4 py-3 text-muted-foreground">{membership.organizationId.slice(0, 8)}</td>
+                    <td className="px-4 py-3">{membership.roleLabel}</td>
+                    <td className="px-4 py-3">
+                      <Badge variant={membership.status === "active" ? "success" : membership.status === "pending" ? "warning" : "danger"}>
+                        {membership.status}
+                      </Badge>
+                    </td>
+                    <td className="px-4 py-3 text-right text-muted-foreground">
+                      {new Date(membership.createdAt).toLocaleString("zh-CN")}
+                    </td>
+                  </tr>
+                ))}
+                {memberships.length === 0 ? (
+                  <tr>
+                    <td className="px-4 py-8 text-center text-muted-foreground" colSpan={5}>
+                      暂无成员关系
+                    </td>
+                  </tr>
+                ) : null}
+              </tbody>
+            </table>
+          </div>
+        </CardContent>
+      </Card>
+
       <Card>
         <CardHeader>
           <CardTitle>审计日志</CardTitle>

modules/settings/components/TableToolbar.tsx

@@ -0,0 +1,62 @@
+import Link from "next/link";
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { buildPageHref } from "@/modules/settings/lib/pagination";
+
+type TableToolbarProps = {
+  actionLabel?: string;
+  page: number;
+  pageCount: number;
+  pathname: string;
+  query: string;
+  searchPlaceholder: string;
+  total: number;
+};
+
+export function TableToolbar({
+  actionLabel,
+  page,
+  pageCount,
+  pathname,
+  query,
+  searchPlaceholder,
+  total,
+}: TableToolbarProps): React.ReactElement {
+  return (
+    <div className="flex flex-col gap-3 border-b p-4 lg:flex-row lg:items-center lg:justify-between">
+      <form className="flex w-full max-w-xl gap-2" action={pathname}>
+        <Input name="q" placeholder={searchPlaceholder} defaultValue={query} />
+        <Button type="submit" variant="outline">
+          搜索
+        </Button>
+      </form>
+      <div className="flex items-center justify-between gap-3 text-sm text-muted-foreground">
+        <span>{actionLabel ?? `共 ${total} 条`}</span>
+        <div className="flex items-center gap-2">
+          {page <= 1 ? (
+            <Button disabled size="sm" variant="outline">
+              上一页
+            </Button>
+          ) : (
+            <Button asChild size="sm" variant="outline">
+              <Link href={buildPageHref(pathname, query, page - 1)}>上一页</Link>
+            </Button>
+          )}
+          <span className="min-w-16 text-center">
+            {page}/{pageCount}
+          </span>
+          {page >= pageCount ? (
+            <Button disabled size="sm" variant="outline">
+              下一页
+            </Button>
+          ) : (
+            <Button asChild size="sm" variant="outline">
+              <Link href={buildPageHref(pathname, query, page + 1)}>下一页</Link>
+            </Button>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}

modules/settings/components/UserManagementClient.tsx

@@ -0,0 +1,406 @@
+"use client";
+
+import { FormEvent, useMemo, useState } from "react";
+import { Check, Pencil, Plus, Power, X } from "lucide-react";
+import { useRouter } from "next/navigation";
+
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { Dialog } from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import type { ApiResult } from "@/modules/core/server/api";
+import type { JoinRequest, Organization, PublicAccount, RoleDefinition } from "@/modules/core/types";
+
+type UserManagementClientProps = {
+  organizations: Organization[];
+  roles: RoleDefinition[];
+  joinRequests: JoinRequest[];
+};
+
+function getOrganizationRoles(roles: RoleDefinition[], organizationId: string): RoleDefinition[] {
+  return roles.filter((role) => role.scope === "organization" && role.organizationId === organizationId && role.isEnabled);
+}
+
+function getDefaultOrganizationId(organizations: Organization[]): string {
+  return organizations[0]?.id ?? "";
+}
+
+export function UserManagementClient({
+  organizations,
+  roles,
+  joinRequests,
+}: UserManagementClientProps): React.ReactElement {
+  const router = useRouter();
+  const [selectedOrganizationId, setSelectedOrganizationId] = useState(() => getDefaultOrganizationId(organizations));
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+
+  const organizationRoles = useMemo(
+    () => getOrganizationRoles(roles, selectedOrganizationId),
+    [roles, selectedOrganizationId],
+  );
+  const pendingJoinRequests = joinRequests.filter((request) => request.status === "pending");
+
+  async function handleCreateAccount(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setMessage("");
+    setIsPending(true);
+
+    const formData = new FormData(event.currentTarget);
+    const response = await fetch("/api/settings/accounts", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        organizationId: String(formData.get("organizationId") ?? ""),
+        roleId: String(formData.get("roleId") ?? ""),
+        name: String(formData.get("name") ?? ""),
+        email: String(formData.get("email") ?? ""),
+        password: String(formData.get("password") ?? ""),
+      }),
+    });
+    const result = (await response.json()) as ApiResult<{ account: unknown }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    event.currentTarget.reset();
+    router.refresh();
+  }
+
+  async function reviewJoinRequest(requestId: string, decision: "approved" | "rejected", roleId: string): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/settings/join-requests/${requestId}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ decision, roleId }),
+    });
+    const result = (await response.json()) as ApiResult<{ joinRequest: unknown }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    router.refresh();
+  }
+
+  return (
+    <section className="grid gap-4 xl:grid-cols-[0.9fr_1.1fr]">
+      <Card>
+        <CardHeader>
+          <CardTitle>创建机构用户</CardTitle>
+          <CardDescription>管理员创建账号后立即分配到机构和角色。</CardDescription>
+        </CardHeader>
+        <CardContent>
+          <form className="grid gap-3" onSubmit={handleCreateAccount}>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">机构</span>
+              <select
+                className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                name="organizationId"
+                onChange={(event) => setSelectedOrganizationId(event.target.value)}
+                value={selectedOrganizationId}
+              >
+                {organizations.map((organization) => (
+                  <option key={organization.id} value={organization.id}>
+                    {organization.name}
+                  </option>
+                ))}
+              </select>
+            </label>
+
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">角色</span>
+              <select
+                className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                name="roleId"
+                required
+              >
+                {organizationRoles.map((role) => (
+                  <option key={role.id} value={role.id}>
+                    {role.label}
+                  </option>
+                ))}
+              </select>
+            </label>
+
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">姓名</span>
+              <Input name="name" required />
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">邮箱</span>
+              <Input name="email" required type="email" />
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">初始密码</span>
+              <Input minLength={6} name="password" required type="password" />
+            </label>
+
+            <Button disabled={isPending || organizationRoles.length === 0} type="submit">
+              <Plus className="size-4" aria-hidden="true" />
+              创建用户
+            </Button>
+          </form>
+          {message ? (
+            <p className="mt-3 rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {message}
+            </p>
+          ) : null}
+        </CardContent>
+      </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>加入申请审批</CardTitle>
+          <CardDescription>公开注册选择机构后进入这里审批。</CardDescription>
+        </CardHeader>
+        <CardContent className="space-y-3">
+          {pendingJoinRequests.map((request) => {
+            const requestRoles = getOrganizationRoles(roles, request.organizationId);
+            const defaultRoleId = requestRoles.find((role) => role.key === "caregiver")?.id ?? requestRoles[0]?.id ?? "";
+
+            return (
+              <div key={request.id} className="rounded-md border p-3">
+                <div className="flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between">
+                  <div>
+                    <p className="font-medium">{request.accountName}</p>
+                    <p className="text-xs text-muted-foreground">{request.accountEmail}</p>
+                    <p className="mt-2 text-sm text-muted-foreground">{request.organizationName}</p>
+                  </div>
+                  <Badge variant="warning">待审批</Badge>
+                </div>
+                <div className="mt-3 grid gap-2 sm:grid-cols-[1fr_auto_auto]">
+                  <select
+                    className="h-10 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                    defaultValue={defaultRoleId}
+                    id={`role-${request.id}`}
+                  >
+                    {requestRoles.map((role) => (
+                      <option key={role.id} value={role.id}>
+                        {role.label}
+                      </option>
+                    ))}
+                  </select>
+                  <Button
+                    disabled={isPending || !defaultRoleId}
+                    onClick={() => {
+                      const element = document.getElementById(`role-${request.id}`);
+                      const roleId = element instanceof HTMLSelectElement ? element.value : defaultRoleId;
+                      void reviewJoinRequest(request.id, "approved", roleId);
+                    }}
+                    size="sm"
+                    type="button"
+                  >
+                    <Check className="size-4" aria-hidden="true" />
+                    通过
+                  </Button>
+                  <Button
+                    disabled={isPending}
+                    onClick={() => void reviewJoinRequest(request.id, "rejected", "")}
+                    size="sm"
+                    type="button"
+                    variant="outline"
+                  >
+                    <X className="size-4" aria-hidden="true" />
+                    拒绝
+                  </Button>
+                </div>
+              </div>
+            );
+          })}
+          {pendingJoinRequests.length === 0 ? <p className="text-sm text-muted-foreground">暂无待审批申请</p> : null}
+        </CardContent>
+      </Card>
+    </section>
+  );
+}
+
+type UserAccountActionsProps = {
+  account: PublicAccount;
+  currentAccountId: string;
+  organizations: Organization[];
+  roles: RoleDefinition[];
+};
+
+export function UserAccountActions({
+  account,
+  currentAccountId,
+  organizations,
+  roles,
+}: UserAccountActionsProps): React.ReactElement {
+  const router = useRouter();
+  const [isEditOpen, setIsEditOpen] = useState(false);
+  const [selectedOrganizationId, setSelectedOrganizationId] = useState(
+    () => account.organizationId ?? getDefaultOrganizationId(organizations),
+  );
+  const [message, setMessage] = useState("");
+  const [isPending, setIsPending] = useState(false);
+  const organizationRoles = useMemo(
+    () => getOrganizationRoles(roles, selectedOrganizationId),
+    [roles, selectedOrganizationId],
+  );
+  const defaultRoleId =
+    organizationRoles.find((role) => role.key === account.role || role.id === account.role)?.id ?? organizationRoles[0]?.id ?? "";
+  const isCurrentAccount = account.id === currentAccountId;
+
+  async function updateAccount(payload: Record<string, string>): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/settings/accounts/${account.id}`, {
+      method: "PATCH",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+    const result = (await response.json()) as ApiResult<{ account: PublicAccount }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    setMessage(result.reason);
+    setIsEditOpen(false);
+    router.refresh();
+  }
+
+  async function disableAccount(): Promise<void> {
+    setMessage("");
+    setIsPending(true);
+    const response = await fetch(`/api/settings/accounts/${account.id}`, {
+      method: "DELETE",
+    });
+    const result = (await response.json()) as ApiResult<{ account: PublicAccount }>;
+    setIsPending(false);
+
+    if (!result.success) {
+      setMessage(result.reason);
+      return;
+    }
+
+    router.refresh();
+  }
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    const formData = new FormData(event.currentTarget);
+    await updateAccount({
+      name: String(formData.get("name") ?? ""),
+      status: String(formData.get("status") ?? ""),
+      organizationId: String(formData.get("organizationId") ?? ""),
+      roleId: String(formData.get("roleId") ?? ""),
+    });
+  }
+
+  return (
+    <div className="flex items-center justify-end gap-2">
+      <Button onClick={() => setIsEditOpen(true)} size="sm" type="button" variant="outline">
+        <Pencil className="size-4" aria-hidden="true" />
+        编辑
+      </Button>
+      {account.status === "disabled" ? (
+        <Button
+          disabled={isPending}
+          onClick={() => void updateAccount({ status: "active" })}
+          size="sm"
+          type="button"
+          variant="outline"
+        >
+          <Power className="size-4" aria-hidden="true" />
+          启用
+        </Button>
+      ) : (
+        <Button
+          disabled={isPending || isCurrentAccount}
+          onClick={() => void disableAccount()}
+          size="sm"
+          type="button"
+          variant="destructive"
+        >
+          <Power className="size-4" aria-hidden="true" />
+          停用
+        </Button>
+      )}
+      <Dialog
+        description="调整账号基础信息、状态和机构角色。"
+        onClose={() => setIsEditOpen(false)}
+        open={isEditOpen}
+        title="编辑用户"
+      >
+        <form className="grid gap-4" onSubmit={handleSubmit}>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">姓名</span>
+            <Input defaultValue={account.name} name="name" required />
+          </label>
+          <label className="grid gap-2 text-sm">
+            <span className="font-medium">状态</span>
+            <select
+              className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+              defaultValue={account.status}
+              disabled={isCurrentAccount}
+              name="status"
+            >
+              <option value="active">启用</option>
+              <option value="disabled">停用</option>
+            </select>
+          </label>
+          <div className="grid gap-3 md:grid-cols-2">
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">机构</span>
+              <select
+                className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                name="organizationId"
+                onChange={(event) => setSelectedOrganizationId(event.target.value)}
+                value={selectedOrganizationId}
+              >
+                {organizations.map((organization) => (
+                  <option key={organization.id} value={organization.id}>
+                    {organization.name}
+                  </option>
+                ))}
+              </select>
+            </label>
+            <label className="grid gap-2 text-sm">
+              <span className="font-medium">角色</span>
+              <select
+                className="h-11 w-full rounded-md border bg-background px-3 text-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-ring"
+                defaultValue={defaultRoleId}
+                disabled={organizationRoles.length === 0}
+                key={selectedOrganizationId}
+                name="roleId"
+              >
+                {organizationRoles.map((role) => (
+                  <option key={role.id} value={role.id}>
+                    {role.label}
+                  </option>
+                ))}
+              </select>
+            </label>
+          </div>
+          {message ? (
+            <p className="rounded-md bg-secondary px-3 py-2 text-sm text-secondary-foreground" role="status">
+              {message}
+            </p>
+          ) : null}
+          <div className="flex justify-end gap-2">
+            <Button onClick={() => setIsEditOpen(false)} type="button" variant="outline">
+              取消
+            </Button>
+            <Button disabled={isPending} type="submit">
+              保存
+            </Button>
+          </div>
+        </form>
+      </Dialog>
+    </div>
+  );
+}

modules/settings/lib/pagination.ts

@@ -0,0 +1,35 @@
+export const SETTINGS_PAGE_SIZE = 8;
+
+export type SearchParams = Record<string, string | string[] | undefined>;
+
+export function getSearchParam(params: SearchParams, key: string): string {
+  const value = params[key];
+  if (Array.isArray(value)) {
+    return value[0] ?? "";
+  }
+
+  return value ?? "";
+}
+
+export function getPage(params: SearchParams): number {
+  const page = Number(getSearchParam(params, "page"));
+  return Number.isInteger(page) && page > 0 ? page : 1;
+}
+
+export function getPageCount(total: number, pageSize = SETTINGS_PAGE_SIZE): number {
+  return Math.max(1, Math.ceil(total / pageSize));
+}
+
+export function paginate<T>(items: T[], page: number, pageSize = SETTINGS_PAGE_SIZE): T[] {
+  const safePage = Math.min(page, getPageCount(items.length, pageSize));
+  return items.slice((safePage - 1) * pageSize, safePage * pageSize);
+}
+
+export function buildPageHref(pathname: string, query: string, page: number): string {
+  const params = new URLSearchParams();
+  if (query.trim()) {
+    params.set("q", query.trim());
+  }
+  params.set("page", String(page));
+  return `${pathname}?${params.toString()}`;
+}

modules/shared/components/AppShell.tsx

@@ -2,10 +2,12 @@ import Link from "next/link";
 import {
   Bell,
   BedDouble,
+  Building2,
   ClipboardCheck,
   HeartPulse,
   Home,
   LayoutDashboard,
+  ListChecks,
   Radio,
   Settings,
   ShieldAlert,
@@ -26,64 +28,106 @@ type NavItem = {
   icon: LucideIcon;
 };
 
-const navItems: NavItem[] = [
+type NavGroup = {
+  label: string;
+  items: NavItem[];
+};
+
+const navGroups: NavGroup[] = [
   {
-    href: "/app/dashboard",
-    label: "运营看板",
-    icon: LayoutDashboard,
+    label: "运营",
+    items: [
+      {
+        href: "/app/dashboard",
+        label: "运营看板",
+        icon: LayoutDashboard,
+      },
+      {
+        href: "/app/elders",
+        label: "老人档案",
+        icon: Users,
+      },
+      {
+        href: "/app/beds",
+        label: "床位房间",
+        icon: BedDouble,
+      },
+      {
+        href: "/app/health",
+        label: "健康照护",
+        icon: HeartPulse,
+      },
+      {
+        href: "/app/care",
+        label: "护理服务",
+        icon: ClipboardCheck,
+      },
+      {
+        href: "/app/emergency",
+        label: "安全应急",
+        icon: ShieldAlert,
+      },
+    ],
   },
   {
-    href: "/app/elders",
-    label: "老人档案",
-    icon: Users,
+    label: "协同",
+    items: [
+      {
+        href: "/app/devices",
+        label: "设备运维",
+        icon: Wrench,
+      },
+      {
+        href: "/app/notices",
+        label: "公告通知",
+        icon: Bell,
+      },
+      {
+        href: "/app/alerts",
+        label: "规则预警",
+        icon: Radio,
+      },
+      {
+        href: "/app/family",
+        label: "家属服务",
+        icon: TabletSmartphone,
+      },
+    ],
   },
   {
-    href: "/app/beds",
-    label: "床位房间",
-    icon: BedDouble,
-  },
-  {
-    href: "/app/health",
-    label: "健康照护",
-    icon: HeartPulse,
-  },
-  {
-    href: "/app/care",
-    label: "护理服务",
-    icon: ClipboardCheck,
-  },
-  {
-    href: "/app/emergency",
-    label: "安全应急",
-    icon: ShieldAlert,
-  },
-  {
-    href: "/app/devices",
-    label: "设备运维",
-    icon: Wrench,
-  },
-  {
-    href: "/app/notices",
-    label: "公告通知",
-    icon: Bell,
-  },
-  {
-    href: "/app/alerts",
-    label: "规则预警",
-    icon: Radio,
-  },
-  {
-    href: "/app/family",
-    label: "家属服务",
-    icon: TabletSmartphone,
-  },
-  {
-    href: "/app/settings",
-    label: "权限设置",
-    icon: Settings,
+    label: "系统设置",
+    items: [
+      {
+        href: "/app/settings/organizations",
+        label: "机构管理",
+        icon: Building2,
+      },
+      {
+        href: "/app/settings/users",
+        label: "用户管理",
+        icon: Users,
+      },
+      {
+        href: "/app/settings/roles",
+        label: "角色权限",
+        icon: Settings,
+      },
+      {
+        href: "/app/settings/audit",
+        label: "审计日志",
+        icon: ListChecks,
+      },
+      {
+        href: "/app/settings/status",
+        label: "运行状态",
+        icon: Wrench,
+      },
+    ],
   },
 ];
 
+const navItems: NavItem[] = navGroups.flatMap((group) => group.items);
+
 type AppShellProps = {
   children: React.ReactNode;
   account: PublicAccount;
@@ -107,22 +151,29 @@ export function AppShell({ children, account, permissions }: AppShellProps): Rea
           </Link>
 
           <nav className="min-h-0 flex-1 overflow-y-auto px-3 py-4" aria-label="主导航">
-            <ul className="space-y-1">
-              {navItems.map((item) => (
-                <li key={item.href}>
-                  <Link
-                    href={item.href}
-                    className="group flex min-h-11 items-center gap-3 rounded-md px-3 text-sm transition-colors hover:bg-secondary"
-                  >
-                    <item.icon
-                      className="size-4 shrink-0 text-muted-foreground group-hover:text-primary"
-                      aria-hidden="true"
-                    />
-                    <span className="min-w-0 truncate font-medium">{item.label}</span>
-                  </Link>
-                </li>
+            <div className="space-y-5">
+              {navGroups.map((group) => (
+                <section key={group.label}>
+                  <p className="px-3 pb-2 text-xs font-semibold text-muted-foreground">{group.label}</p>
+                  <ul className="space-y-1">
+                    {group.items.map((item) => (
+                      <li key={item.href}>
+                        <Link
+                          href={item.href}
+                          className="group flex min-h-11 items-center gap-3 rounded-md px-3 text-sm transition-colors hover:bg-secondary"
+                        >
+                          <item.icon
+                            className="size-4 shrink-0 text-muted-foreground group-hover:text-primary"
+                            aria-hidden="true"
+                          />
+                          <span className="min-w-0 truncate font-medium">{item.label}</span>
+                        </Link>
+                      </li>
+                    ))}
+                  </ul>
+                </section>
               ))}
-            </ul>
+            </div>
           </nav>
         </div>
       </aside>
@@ -150,7 +201,7 @@ export function AppShell({ children, account, permissions }: AppShellProps): Rea
           </div>
         </header>
 
-        <main className="min-h-0 flex-1 overflow-y-auto px-4 py-5 md:px-8">{children}</main>
+        <main className="page-enter min-h-0 flex-1 overflow-y-auto px-4 py-5 md:px-8">{children}</main>
       </div>
     </div>
   );

package.json

@@ -6,6 +6,9 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:studio": "drizzle-kit studio",
     "lint": "eslint app components lib modules next.config.ts eslint.config.mjs",
     "type-check": "tsc --noEmit"
   },
@@ -13,8 +16,10 @@
     "@radix-ui/react-slot": "^1.2.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "drizzle-orm": "^0.45.2",
     "lucide-react": "^0.468.0",
     "next": "^15.0.0",
+    "postgres": "^3.4.9",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "tailwind-merge": "^3.0.0"
@@ -26,10 +31,11 @@
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "drizzle-kit": "^0.31.10",
     "eslint": "^9.0.0",
     "eslint-config-next": "^15.0.0",
     "tailwindcss": "^4.0.0",
-    "typescript-eslint": "^8.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.0.0"
   }
 }