基线:鉴权会话+工作组+工作台三区修复+编排工作区+产品设计文档

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KeDBx2PHLavbURXB8LJJ7m

api-report/apps/api/src/modules/org/contract.d.ts

@@ -1,8 +1,8 @@
 /**
  * module: org —— 对外类型(编码规范 §10.1)。只有类型和常量,没有实现。
  */
-import type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, StaffId } from '@contracts';
-export type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff };
+import type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, StaffId, WorkGroup, WorkGroupBinding } from '@contracts';
+export type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, WorkGroup, WorkGroupBinding };
 /** 员工连同其岗位的读模型 —— 治理台员工管理列表用 */
 export type StaffWithPosition = Staff & {
     readonly position: Position;
@@ -29,6 +29,11 @@ export declare class DisableBlockedError extends Error {
     readonly check: DisableCheck;
     constructor(check: DisableCheck);
 }
+/** 登录结果 —— token 交给 app 层种 cookie;失败一律 undefined,不区分原因 */
+export type IssuedSession = {
+    readonly token: string;
+    readonly expiresAt: string;
+};
 export type OrgService = {
     listStaff(): Promise<{
         staff: StaffWithPosition[];
@@ -46,6 +51,25 @@ export type OrgService = {
     /** 岗位权限校验 —— app 层鉴权中间件读它 */
     authorize(staffId: StaffId, object: GrantObject, action: GrantAction): Promise<boolean>;
     loadSession(account: string): Promise<Session | undefined>;
+    /** 口令核验通过即签发会话;账号不存在 / 已停用 / 未设口令 / 口令错,一律 undefined */
+    login(account: string, password: string): Promise<IssuedSession | undefined>;
+    /** 登出:该 token 立刻作废(服务端表,不是签名 cookie) */
+    logout(token: string): Promise<void>;
+    /** 解析会话 —— 命中即滑动续期;过期或已作废返回 undefined */
+    resolveSession(token: string): Promise<Session | undefined>;
+    /** 设定口令 —— 明文只在此处停留一瞬,落库前即散列 */
+    setPassword(staffId: StaffId, password: string): Promise<void>;
+    /** 建组 / 改组;id 留空即新建 */
+    saveWorkGroup(input: {
+        id?: string;
+        name: string;
+        ownerId: StaffId;
+        members: Readonly<Record<string, StaffId>>;
+    }): Promise<WorkGroup>;
+    /** 某人的工作组 —— 起单时按来源人取,取不到即不装载(全走四策略) */
+    workGroupOf(staffId: StaffId): Promise<WorkGroup | undefined>;
+    /** 装进工作流的快照:改组不改已起的单 */
+    bindingOf(staffId: StaffId): Promise<WorkGroupBinding | undefined>;
     /** 岗位在岗人员 —— 负责人四策略解析的候选集来源(由 process 调用) */
     staffOfPosition(positionCode: string): Promise<StaffWithPosition[]>;
     ensureSeeded(): Promise<void>;