基线:鉴权会话+工作组+工作台三区修复+编排工作区+产品设计文档

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KeDBx2PHLavbURXB8LJJ7m

apps/api/src/modules/org/CONTRACT.md

@@ -1,22 +1,25 @@
 # module: org
 
-职责:      员工与岗位:账号、岗位授权(客体三类 × 动作三种)、停用前置检查、会话装载、
-           岗位在岗人员查询(负责人四策略解析的候选集来源)、种子数据播种
+职责:      员工与岗位:账号、口令与登录会话(ADR-010)、岗位授权(客体三类 × 动作三种)、
+           停用前置检查、岗位在岗人员查询(负责人四策略解析的候选集来源)、
+           工作组(ADR-011:起单时的岗位绑定)、种子数据播种
 不负责:    负责人解析算法本身(见 process)、任务与卡的在途判定(经 InFlightWorkProbe 端口由 app 注入)、
-           鉴权中间件与 cookie 会话(app 层)
+           鉴权中间件与 cookie 的读写(app 层:§4「中间件在 app 层,身份判定读 org 出口」)
 
 公开出口:  index.ts
-  - 类型:`OrgService` `StaffWithPosition` `CreateStaffInput` 与 @contracts 的 `Staff` / `Position` /
-          `Grant` / `GrantObject` / `GrantAction` / `DisableCheck` / `Session` 转出
+  - 类型:`OrgService` `StaffWithPosition` `CreateStaffInput` `IssuedSession` 与 @contracts 的
+          `Staff` / `Position` / `Grant` / `GrantObject` / `GrantAction` / `DisableCheck` / `Session` 转出
   - 错误:`StaffNotFoundError` `PositionNotFoundError` `AccountTakenError` `DisableBlockedError`
-  - 端口类型:`PositionRepository` `StaffRepository` `GrantRepository` `InFlightWorkProbe`
-              `Clock` `IdGenerator`
+  - 端口类型:`PositionRepository` `StaffRepository` `GrantRepository` `SessionRepository`
+              `WorkGroupRepository` `PasswordHasher` `InFlightWorkProbe` `Clock` `IdGenerator`
   - 用例工厂:`createOrgService(deps: OrgServiceDeps): OrgService`
   - 纯函数:`isAuthorized` `actionCovers` `objectCovers`
   - 常量:`POSITION_SEED` `STAFF_SEED` `DEFAULT_LOGIN_ACCOUNT`
   - adapter 工厂(供 app 装配):`createPositionRepository` `createStaffRepository`
-              `createGrantRepository` `objectKeyOf`
-  - Drizzle 表(供 app 迁移与 join):`positionTable` `staffTable` `grantTable`
+              `createGrantRepository` `createSessionRepository` `createWorkGroupRepository` `objectKeyOf`
+  - 口令散列(供 app 装 `PasswordHasher`):`hashPassword` `verifyPassword` `newSessionToken`
+  - Drizzle 表(供 app 迁移与 join):`positionTable` `staffTable` `grantTable` `sessionTable`
+              `workGroupTable`
 
 层级:      L1(编码规范 §4)
 依赖:      @contracts;@shared/db(Drizzle 句柄与 sys schema)
@@ -28,6 +31,17 @@
   - 动作蕴含:治理 ⊃ 写 ⊃ 读;数据客体三级覆盖(域 ⊃ 对象 ⊃ 字段)
   - 停用是全有全无:前置检查未过即抛 `DisableBlockedError`,不做部分执行
   - `authorize` 对停用员工恒 false
-  - `ensureSeeded` 幂等:按 code / account 判存在,已存在则跳过,不覆盖人工改动
+  - `ensureSeeded` 幂等:按 code / account 判存在,已存在则跳过,不覆盖人工改动;
+    唯一例外是**补种口令** —— 已存在但 `password_hash` 为空的员工会被补上初始口令,
+    否则 ADR-010 之前建的账号永远登不进(这不算覆盖人工改动:空不是改动)
+  - **登录失败不区分原因**:账号不存在 / 已停用 / 未设口令 / 口令错,一律 `undefined`;
+    且无论账号是否存在都走一遍散列比对,免得响应时间泄漏账号是否存在
+  - **明文永不落库**:口令只在 `login` / `setPassword` 的入参上停留一瞬,落库前即散列
+  - **会话可即刻作废**:服务端表而非签名 cookie —— `logout` 立刻生效;
+    `disableStaff` 连带 `revokeAllOf`,被停用的人拿旧 cookie 也办不了事
+  - **工作组是绑定不是策略**(ADR-011):它给出岗位的人选,四策略于是无从发问;
+    `bindingOf` 只出成员表快照,在岗与否由调用方(process)核 —— 岗位候选集核不了跨岗位的绑定
 
-影响半径:  index/contract/port 未变 → 对外零影响
+影响半径:  contract 增 `login` / `logout` / `resolveSession` / `setPassword` 与 `IssuedSession`;
+           port 增 `SessionRepository` / `PasswordHasher`,`StaffRepository` 增两个口令读写方法;
+           下游只有 app(装配 + 鉴权中间件),depcruise 已反查确认

apps/api/src/modules/org/__tests__/password.test.ts

@@ -0,0 +1,56 @@
+/**
+ * 口令散列(ADR-010)—— 守的是「明文不可逆、比对不早退、坏串不抛错」。
+ */
+import { describe, expect, it } from 'vitest';
+import { hashPassword, newSessionToken, verifyPassword } from '../internal/adapter/password.ts';
+
+describe('hashPassword / verifyPassword', () => {
+  it('散列串自描述参数,且不含明文', async () => {
+    const hash = await hashPassword('jcai-dev-2026');
+    expect(hash.split('$')).toHaveLength(6);
+    expect(hash.startsWith('scrypt$16384$8$1$')).toBe(true);
+    expect(hash).not.toContain('jcai-dev-2026');
+  });
+
+  it('同一口令两次散列不同 —— 盐是随机的', async () => {
+    expect(await hashPassword('same')).not.toBe(await hashPassword('same'));
+  });
+
+  it('对的口令过,错的不过', async () => {
+    const hash = await hashPassword('correct horse');
+    expect(await verifyPassword('correct horse', hash)).toBe(true);
+    expect(await verifyPassword('correct hors', hash)).toBe(false);
+    expect(await verifyPassword('', hash)).toBe(false);
+  });
+
+  it('未设口令(null / undefined)一律不过,不抛错', async () => {
+    // 「账号存在但没口令」不能变成一条能登进去的缝
+    expect(await verifyPassword('anything', null)).toBe(false);
+    expect(await verifyPassword('anything', undefined)).toBe(false);
+  });
+
+  it('坏串一律不过,不抛错 —— 登录失败的原因不外泄', async () => {
+    for (const bad of ['', 'plaintext', 'scrypt$x$8$1$aa$bb', 'bcrypt$16384$8$1$aa$bb', 'scrypt$16384$8$1$aa']) {
+      expect(await verifyPassword('anything', bad)).toBe(false);
+    }
+  });
+
+  it('按记录自己的参数重算 —— 日后调参不必迁移旧记录', async () => {
+    // 用一组非默认参数造串,再以默认参数的实现去验:能过才说明读的是串里的参数
+    const legacy = 'scrypt$1024$8$1$c2FsdHNhbHQ$';
+    expect(legacy.split('$')[1]).toBe('1024');
+    // 空 hash 段应判假(下面单独覆盖),这里只确认解析不炸
+    expect(await verifyPassword('x', legacy)).toBe(false);
+  });
+});
+
+describe('newSessionToken', () => {
+  it('不透明、够长、每次不同 —— 不编码任何身份信息', () => {
+    const a = newSessionToken();
+    const b = newSessionToken();
+    expect(a).not.toBe(b);
+    // 32 字节 base64url ≈ 43 字符
+    expect(a.length).toBeGreaterThanOrEqual(43);
+    expect(a).toMatch(/^[A-Za-z0-9_-]+$/);
+  });
+});

apps/api/src/modules/org/contract.ts

@@ -1,9 +1,9 @@
 /**
  * module: org —— 对外类型(编码规范 §10.1)。只有类型和常量,没有实现。
  */
-import type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, StaffId } from '@contracts';
+import type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, StaffId, WorkGroup, WorkGroupBinding } from '@contracts';
 
-export type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff };
+export type { DisableCheck, Grant, GrantAction, GrantObject, Position, Session, Staff, WorkGroup, WorkGroupBinding };
 
 /** 员工连同其岗位的读模型 —— 治理台员工管理列表用 */
 export type StaffWithPosition = Staff & { readonly position: Position };
@@ -43,6 +43,12 @@ export class DisableBlockedError extends Error {
   }
 }
 
+/** 登录结果 —— token 交给 app 层种 cookie;失败一律 undefined,不区分原因 */
+export type IssuedSession = {
+  readonly token: string;
+  readonly expiresAt: string;
+};
+
 export type OrgService = {
   listStaff(): Promise<{ staff: StaffWithPosition[]; positions: Position[] }>;
   getStaff(staffId: StaffId): Promise<StaffWithPosition>;
@@ -57,6 +63,32 @@ export type OrgService = {
   /** 岗位权限校验 —— app 层鉴权中间件读它 */
   authorize(staffId: StaffId, object: GrantObject, action: GrantAction): Promise<boolean>;
   loadSession(account: string): Promise<Session | undefined>;
+
+  /* ── 登录会话(ADR-010)—— 中间件在 app 层,身份判定读这里 ───────────── */
+
+  /** 口令核验通过即签发会话;账号不存在 / 已停用 / 未设口令 / 口令错,一律 undefined */
+  login(account: string, password: string): Promise<IssuedSession | undefined>;
+  /** 登出:该 token 立刻作废(服务端表,不是签名 cookie) */
+  logout(token: string): Promise<void>;
+  /** 解析会话 —— 命中即滑动续期;过期或已作废返回 undefined */
+  resolveSession(token: string): Promise<Session | undefined>;
+  /** 设定口令 —— 明文只在此处停留一瞬,落库前即散列 */
+  setPassword(staffId: StaffId, password: string): Promise<void>;
+
+  /* ── 工作组(ADR-011)—— 起单时的岗位绑定,不是第五种策略 ────────────── */
+
+  /** 建组 / 改组;id 留空即新建 */
+  saveWorkGroup(input: {
+    id?: string;
+    name: string;
+    ownerId: StaffId;
+    members: Readonly<Record<string, StaffId>>;
+  }): Promise<WorkGroup>;
+  /** 某人的工作组 —— 起单时按来源人取,取不到即不装载(全走四策略) */
+  workGroupOf(staffId: StaffId): Promise<WorkGroup | undefined>;
+  /** 装进工作流的快照:改组不改已起的单 */
+  bindingOf(staffId: StaffId): Promise<WorkGroupBinding | undefined>;
+
   /** 岗位在岗人员 —— 负责人四策略解析的候选集来源(由 process 调用) */
   staffOfPosition(positionCode: string): Promise<StaffWithPosition[]>;
   ensureSeeded(): Promise<void>;

apps/api/src/modules/org/index.ts

@@ -7,11 +7,14 @@ export type {
   Grant,
   GrantAction,
   GrantObject,
+  IssuedSession,
   OrgService,
   Position,
   Session,
   Staff,
   StaffWithPosition,
+  WorkGroup,
+  WorkGroupBinding,
 } from './contract.ts';
 export {
   AccountTakenError,
@@ -25,8 +28,11 @@ export type {
   GrantRepository,
   IdGenerator,
   InFlightWorkProbe,
+  PasswordHasher,
   PositionRepository,
+  SessionRepository,
   StaffRepository,
+  WorkGroupRepository,
 } from './port.ts';
 
 export type { OrgServiceDeps } from './internal/usecase/org-service.ts';
@@ -38,7 +44,10 @@ export { DEFAULT_LOGIN_ACCOUNT, POSITION_SEED, STAFF_SEED } from './internal/dom
 export {
   createGrantRepository,
   createPositionRepository,
+  createSessionRepository,
   createStaffRepository,
+  createWorkGroupRepository,
   objectKeyOf,
 } from './internal/adapter/org-repository.ts';
-export { grantTable, positionTable, staffTable } from './internal/adapter/org-schema.ts';
+export { hashPassword, newSessionToken, verifyPassword } from './internal/adapter/password.ts';
+export { grantTable, positionTable, sessionTable, staffTable, workGroupTable } from './internal/adapter/org-schema.ts';

apps/api/src/modules/org/internal/adapter/org-repository.ts

@@ -1,12 +1,12 @@
 /**
  * org 的仓储 adapter —— Drizzle 只准出现在 adapter 与 app(编码规范 §5.3 / §11.4)。
  */
-import { and, eq } from 'drizzle-orm';
-import type { Grant, GrantObject, Position, PositionId, Staff, StaffId } from '@contracts';
-import { grantSchema, positionIdSchema, positionSchema, staffSchema } from '@contracts';
+import { and, eq, gt } from 'drizzle-orm';
+import type { Grant, GrantObject, Position, PositionId, Staff, StaffId, WorkGroup } from '@contracts';
+import { grantSchema, positionIdSchema, positionSchema, staffIdSchema, staffSchema, workGroupSchema } from '@contracts';
 import type { Db } from '@shared/db.ts';
-import type { GrantRepository, PositionRepository, StaffRepository } from '../../port.ts';
-import { grantTable, positionTable, staffTable } from './org-schema.ts';
+import type { GrantRepository, PositionRepository, SessionRepository, StaffRepository, WorkGroupRepository } from '../../port.ts';
+import { grantTable, positionTable, sessionTable, staffTable, workGroupTable } from './org-schema.ts';
 
 /** 授权客体的规范化串 —— 主键的一部分,保证同一客体不重复授权 */
 export function objectKeyOf(object: GrantObject): string {
@@ -93,6 +93,41 @@ export function createStaffRepository(db: Db): StaffRepository {
     async setState(id: StaffId, state) {
       await db.update(staffTable).set({ state }).where(eq(staffTable.id, id));
     },
+    async passwordHashOf(account: string) {
+      const rows = await db
+        .select({ hash: staffTable.passwordHash })
+        .from(staffTable)
+        .where(eq(staffTable.account, account))
+        .limit(1);
+      return rows[0]?.hash ?? undefined;
+    },
+    async setPasswordHash(id: StaffId, hash: string) {
+      await db.update(staffTable).set({ passwordHash: hash }).where(eq(staffTable.id, id));
+    },
+  };
+}
+
+/** 会话仓储 —— 过期由 `expires_at` 判定,读时顺带滑动续期(ADR-010) */
+export function createSessionRepository(db: Db): SessionRepository {
+  return {
+    async issue({ token, staffId, expiresAt }) {
+      await db.insert(sessionTable).values({ id: token, staffId, expiresAt });
+    },
+    async touch(token: string, now: Date, expiresAt: Date) {
+      const rows = await db
+        .update(sessionTable)
+        .set({ lastSeenAt: now, expiresAt })
+        .where(and(eq(sessionTable.id, token), gt(sessionTable.expiresAt, now)))
+        .returning({ staffId: sessionTable.staffId });
+      const row = rows[0];
+      return row === undefined ? undefined : { staffId: staffIdSchema.parse(row.staffId) };
+    },
+    async revoke(token: string) {
+      await db.delete(sessionTable).where(eq(sessionTable.id, token));
+    },
+    async revokeAllOf(staffId: StaffId) {
+      await db.delete(sessionTable).where(eq(sessionTable.staffId, staffId));
+    },
   };
 }
 
@@ -130,3 +165,28 @@ export function createGrantRepository(db: Db): GrantRepository {
     },
   };
 }
+
+/** 工作组仓储(ADR-011)—— 成员表整块存 jsonb,键是岗位 code */
+export function createWorkGroupRepository(db: Db): WorkGroupRepository {
+  const toGroup = (row: typeof workGroupTable.$inferSelect): WorkGroup =>
+    workGroupSchema.parse({ id: row.id, name: row.name, ownerId: row.ownerId, members: row.members });
+
+  return {
+    async listByOwner(ownerId: StaffId) {
+      const rows = await db.select().from(workGroupTable).where(eq(workGroupTable.ownerId, ownerId));
+      return rows.map(toGroup);
+    },
+    async upsert(group: WorkGroup) {
+      const [row] = await db
+        .insert(workGroupTable)
+        .values({ id: group.id, name: group.name, ownerId: group.ownerId, members: group.members })
+        .onConflictDoUpdate({
+          target: workGroupTable.id,
+          set: { name: group.name, ownerId: group.ownerId, members: group.members },
+        })
+        .returning();
+      if (row === undefined) throw new Error('工作组写入未返回行');
+      return toGroup(row);
+    },
+  };
+}

apps/api/src/modules/org/internal/adapter/org-schema.ts

@@ -27,11 +27,31 @@ export const staffTable = sys.table(
       .notNull()
       .references(() => positionTable.id),
     state: text('state').notNull().default('active'),
+    /** 口令散列(ADR-010):`scrypt$N$r$p$salt$hash`,明文永不落库 */
+    passwordHash: text('password_hash'),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
   },
   (t) => [uniqueIndex('staff_account_key').on(t.account), index('staff_position_idx').on(t.positionId)],
 );
 
+/**
+ * 会话(ADR-010)—— 服务端表而非签名 cookie:**登出必须立刻失效**,
+ * 且停用员工时要能一并踢掉在途会话。id 即 token,不透明随机串。
+ */
+export const sessionTable = sys.table(
+  'session',
+  {
+    id: text('id').primaryKey(),
+    staffId: text('staff_id')
+      .notNull()
+      .references(() => staffTable.id, { onDelete: 'cascade' }),
+    issuedAt: timestamp('issued_at', { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    lastSeenAt: timestamp('last_seen_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [index('session_staff_idx').on(t.staffId), index('session_expires_idx').on(t.expiresAt)],
+);
+
 export const grantTable = sys.table(
   'position_grant',
   {
@@ -46,3 +66,21 @@ export const grantTable = sys.table(
   },
   (t) => [primaryKey({ columns: [t.positionId, t.objectKey, t.action] })],
 );
+
+/**
+ * 工作组(ADR-011)—— 一组「岗位 code → 员工 id」的绑定。
+ * 起单时按来源人取其组、快照进工作流;这里存的是**当前**成员表,可改。
+ */
+export const workGroupTable = sys.table(
+  'work_group',
+  {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    ownerId: text('owner_id')
+      .notNull()
+      .references(() => staffTable.id, { onDelete: 'cascade' }),
+    members: jsonb('members').notNull().default({}),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [index('work_group_owner_idx').on(t.ownerId)],
+);

apps/api/src/modules/org/internal/adapter/password.ts

@@ -0,0 +1,61 @@
+/**
+ * 口令散列(ADR-010)—— Node 内置 scrypt,零第三方依赖。
+ *
+ * 串格式自描述:`scrypt$N$r$p$<salt-b64url>$<hash-b64url>`。
+ * 参数写进串里,日后调参不必迁移旧记录:比对时按**该记录自己的**参数重算。
+ * 明文永不落库,比对走 `timingSafeEqual`(等长常数时间,不因前缀相同而早退)。
+ */
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+
+/** 默认代价参数:N=16384 约 16MB 内存、单次 ~50ms —— 内网 ≤50 人足够 */
+const N = 16_384;
+const R = 8;
+const P = 1;
+const KEY_LEN = 32;
+const SALT_LEN = 16;
+
+const b64 = (buf: Buffer) => buf.toString('base64url');
+
+function derive(password: string, salt: Buffer, n: number, r: number, p: number): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    // maxmem 需随 N 抬高:默认 32MB 挡不住 N=16384(约需 128*N*r ≈ 16MB,留两倍余量)
+    scrypt(password, salt, KEY_LEN, { N: n, r, p, maxmem: 256 * n * r }, (error, key) => {
+      if (error !== null) reject(error);
+      else resolve(key);
+    });
+  });
+}
+
+export async function hashPassword(password: string): Promise<string> {
+  const salt = randomBytes(SALT_LEN);
+  const hash = await derive(password, salt, N, R, P);
+  return `scrypt$${N}$${R}$${P}$${b64(salt)}$${b64(hash)}`;
+}
+
+/**
+ * 比对。存的串不合格式 / 员工尚未设口令 → 一律 false,不抛错:
+ * 登录失败的原因不外泄(账号不存在、未设口令、口令错,对外都是同一句话)。
+ */
+export async function verifyPassword(password: string, stored: string | null | undefined): Promise<boolean> {
+  if (stored === null || stored === undefined) return false;
+  const parts = stored.split('$');
+  if (parts.length !== 6 || parts[0] !== 'scrypt') return false;
+
+  const [, nRaw, rRaw, pRaw, saltRaw, hashRaw] = parts;
+  const n = Number(nRaw);
+  const r = Number(rRaw);
+  const p = Number(pRaw);
+  if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+
+  const expected = Buffer.from(hashRaw ?? '', 'base64url');
+  if (expected.length === 0) return false;
+
+  const actual = await derive(password, Buffer.from(saltRaw ?? '', 'base64url'), n, r, p).catch(() => undefined);
+  if (actual === undefined || actual.length !== expected.length) return false;
+  return timingSafeEqual(actual, expected);
+}
+
+/** 会话 token —— 32 字节密码学随机,不透明(不编码任何身份信息) */
+export function newSessionToken(): string {
+  return b64(randomBytes(32));
+}

apps/api/src/modules/org/internal/domain/seed-data.ts

@@ -9,6 +9,12 @@ export const POSITION_SEED = [
   { code: 'FAE', name: '现场应用', note: '替代选型' },
   { code: 'PRM', name: '采购/寻源', note: '渠道寻源' },
   { code: 'OP', name: '运营', note: '运营支持' },
+  /*
+   * 测试岗(ADR-011):测试账号单独占一个岗位,**不混进五个业务岗**。
+   * 混进去会让轮值把真单派到测试账号头上;单列则彼此不打扰 ——
+   * 测试账号靠**工作组绑定**接管整条流的每个岗位,不靠自己占岗。
+   */
+  { code: 'TEST', name: '测试', note: '测试账号专用岗;整条流经工作组绑定落到本人' },
 ] as const;
 
 export const STAFF_SEED = [
@@ -17,6 +23,9 @@ export const STAFF_SEED = [
   { account: 'wangziming', name: '王梓名', position: 'FAE' },
   { account: 'linpeixuan', name: '林佩萱', position: 'PRM' },
   { account: 'liyuanchu', name: '李元初', position: 'OP' },
+  // 两个测试账号:各自一个「全岗位指向自己」的工作组,起单即整条流归自己
+  { account: 'AI', name: 'AI', position: 'TEST' },
+  { account: 'Chaihao', name: '柴浩', position: 'TEST' },
 ] as const;
 
 /** 登录者 = 冯兵(BD);MVP 单组织 cookie session(编码规范 §4 鉴权定调) */
@@ -30,6 +39,18 @@ export type StaffSeed = (typeof STAFF_SEED)[number];
  * 任务负责人与被征答人对所涉内容**天然可见**,不靠这里授权(OS 02)。
  */
 export const POSITION_GRANT_SEED: Readonly<Record<string, ReadonlyArray<{ fn: string; action: 'read' | 'write' | 'govern' }>>> = {
+  /** 测试岗与 PM 同权:一个人要走完整条流,还得在治理台看过程 */
+  TEST: [
+    { fn: 'task', action: 'govern' },
+    { fn: 'staff', action: 'govern' },
+    { fn: 'process', action: 'govern' },
+    { fn: 'trigger', action: 'govern' },
+    { fn: 'activity', action: 'govern' },
+    { fn: 'tool', action: 'govern' },
+    { fn: 'data', action: 'govern' },
+    { fn: 'memory', action: 'govern' },
+    { fn: 'system', action: 'govern' },
+  ],
   PM: [
     { fn: 'task', action: 'govern' },
     { fn: 'staff', action: 'govern' },
@@ -59,3 +80,12 @@ export const POSITION_GRANT_SEED: Readonly<Record<string, ReadonlyArray<{ fn: st
     { fn: 'memory', action: 'read' },
   ],
 };
+
+/**
+ * 测试账号的**独立工作组**(ADR-011)—— 所有岗位都指向本人。
+ * 起单即整条流(A1…A7 + 审批点)全部落到自己工位,一个人从头走到尾。
+ */
+export const SOLO_GROUP_ACCOUNTS = ['AI', 'Chaihao'] as const;
+
+/** 组要覆盖的岗位 = 业务五岗(测试岗自身不出现在流程包里) */
+export const SOLO_GROUP_POSITIONS = ['PM', 'BD', 'FAE', 'PRM', 'OP'] as const;

apps/api/src/modules/org/internal/usecase/org-service.ts

@@ -5,6 +5,7 @@ import type { Grant, GrantAction, GrantObject, Position, PositionId, Session, St
 import { governanceFunctionSchema, positionIdSchema, staffIdSchema } from '@contracts';
 import type {
   CreateStaffInput,
+  IssuedSession,
   OrgService,
   StaffWithPosition,
 } from '../../contract.ts';
@@ -15,24 +16,37 @@ import {
   StaffNotFoundError,
 } from '../../contract.ts';
 import type {
+  Clock,
   GrantRepository,
   IdGenerator,
   InFlightWorkProbe,
+  PasswordHasher,
   PositionRepository,
+  SessionRepository,
   StaffRepository,
+  WorkGroupRepository,
 } from '../../port.ts';
 import { isAuthorized } from '../domain/authorization.ts';
 import { buildDisableCheck } from '../domain/disable-check.ts';
-import { POSITION_GRANT_SEED, POSITION_SEED, STAFF_SEED } from '../domain/seed-data.ts';
+import { POSITION_GRANT_SEED, POSITION_SEED, SOLO_GROUP_ACCOUNTS, SOLO_GROUP_POSITIONS, STAFF_SEED } from '../domain/seed-data.ts';
 
 export type OrgServiceDeps = {
   readonly positions: PositionRepository;
   readonly staff: StaffRepository;
   readonly grants: GrantRepository;
+  readonly sessions: SessionRepository;
+  readonly workGroups: WorkGroupRepository;
+  readonly passwords: PasswordHasher;
   readonly inFlight: InFlightWorkProbe;
+  readonly clock: Clock;
   readonly ids: IdGenerator;
+  /** 种子口令 —— 由 app 从环境读入,源码不写任何真实口令(ADR-010) */
+  readonly seedPassword: string;
 };
 
+/** 会话有效期 12 小时,每次命中滑动续期 */
+const SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+
 export function createOrgService(deps: OrgServiceDeps): OrgService {
   async function positionMap(): Promise<Map<string, Position>> {
     const all = await deps.positions.list();
@@ -78,13 +92,16 @@ export function createOrgService(deps: OrgServiceDeps): OrgService {
       const positionId = positionIdSchema.parse(input.positionId);
       const position = await deps.positions.findById(positionId);
       if (!position) throw new PositionNotFoundError(input.positionId);
-      return deps.staff.insert({
+      const created = await deps.staff.insert({
         id: staffIdSchema.parse(deps.ids.next()),
         account: input.account,
         name: input.name,
         positionId,
         state: 'active',
       });
+      // 新员工带初始口令建档 —— 不留「有账号但登不进」的半成品
+      await deps.staff.setPasswordHash(created.id, await deps.passwords.hash(deps.seedPassword));
+      return created;
     },
 
     async checkDisable(staffId) {
@@ -102,6 +119,8 @@ export function createOrgService(deps: OrgServiceDeps): OrgService {
       const check = await this.checkDisable(staffId);
       if (check.blocked) throw new DisableBlockedError(check);
       await deps.staff.setState(staffId, 'disabled');
+      // 停用即踢会话:否则被停用的人凭旧 cookie 还能继续办事(ADR-010)
+      await deps.sessions.revokeAllOf(staffId);
     },
 
     async listGrants(positionId) {
@@ -128,6 +147,73 @@ export function createOrgService(deps: OrgServiceDeps): OrgService {
       return { staff, position, grants };
     },
 
+    /**
+     * 登录 —— 失败一律 undefined,**不区分原因**:
+     * 账号不存在 / 已停用 / 未设口令 / 口令错,对外都是同一句话,不外泄账号是否存在。
+     */
+    async login(account, password): Promise<IssuedSession | undefined> {
+      const staff = await deps.staff.findByAccount(account);
+      const stored = await deps.staff.passwordHashOf(account);
+      // 无论账号是否存在都走一遍散列比对:否则响应时间会泄漏账号是否存在
+      const ok = await deps.passwords.verify(password, stored);
+      if (!ok || staff === undefined || staff.state !== 'active') return undefined;
+
+      const token = deps.passwords.newToken();
+      const expiresAt = new Date(deps.clock.now().getTime() + SESSION_TTL_MS);
+      await deps.sessions.issue({ token, staffId: staff.id, expiresAt });
+      return { token, expiresAt: expiresAt.toISOString() };
+    },
+
+    async logout(token) {
+      await deps.sessions.revoke(token);
+    },
+
+    async resolveSession(token): Promise<Session | undefined> {
+      const now = deps.clock.now();
+      const hit = await deps.sessions.touch(token, now, new Date(now.getTime() + SESSION_TTL_MS));
+      if (hit === undefined) return undefined;
+      const staff = await deps.staff.findById(hit.staffId);
+      // 会话还在但人已停用 —— 立刻作废,不给旧 cookie 留缝
+      if (staff === undefined || staff.state !== 'active') {
+        await deps.sessions.revoke(token);
+        return undefined;
+      }
+      const position = await deps.positions.findById(staff.positionId);
+      if (!position) throw new PositionNotFoundError(staff.positionId);
+      const grants = await deps.grants.listByPosition(staff.positionId);
+      return { staff, position, grants };
+    },
+
+    async setPassword(staffId, password) {
+      const staff = await deps.staff.findById(staffId);
+      if (!staff) throw new StaffNotFoundError(staffId);
+      await deps.staff.setPasswordHash(staffId, await deps.passwords.hash(password));
+    },
+
+    /* ── 工作组(ADR-011)—— 起单时的岗位绑定,不是第五种策略 ────────── */
+
+    async saveWorkGroup(input) {
+      const staff = await deps.staff.findById(input.ownerId);
+      if (!staff) throw new StaffNotFoundError(input.ownerId);
+      return deps.workGroups.upsert({
+        id: input.id ?? deps.ids.next(),
+        name: input.name,
+        ownerId: input.ownerId,
+        members: { ...input.members },
+      });
+    },
+
+    async workGroupOf(staffId) {
+      // 一人一组:多组时取稳定的第一条(选组这一步 MVP 不做,见 debt)
+      const groups = await deps.workGroups.listByOwner(staffId);
+      return [...groups].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))[0];
+    },
+
+    async bindingOf(staffId) {
+      const group = await this.workGroupOf(staffId);
+      return group === undefined ? undefined : { ...group.members };
+    },
+
     async staffOfPosition(positionCode) {
       const position = await deps.positions.findByCode(positionCode);
       if (!position) throw new PositionNotFoundError(positionCode);
@@ -152,16 +238,39 @@ export function createOrgService(deps: OrgServiceDeps): OrgService {
 
       for (const seed of STAFF_SEED) {
         const existing = await deps.staff.findByAccount(seed.account);
-        if (existing) continue;
+        if (existing) {
+          // 补种口令:ADR-010 之前建的员工没有 password_hash,不补就永远登不进
+          const hash = await deps.staff.passwordHashOf(seed.account);
+          if (hash === undefined) {
+            await deps.staff.setPasswordHash(existing.id, await deps.passwords.hash(deps.seedPassword));
+          }
+          continue;
+        }
         const positionId = byCode.get(seed.position);
         if (!positionId) throw new PositionNotFoundError(seed.position);
-        await deps.staff.insert({
+        const created = await deps.staff.insert({
           id: staffIdSchema.parse(deps.ids.next()),
           account: seed.account,
           name: seed.name,
           positionId,
           state: 'active',
         });
+        // 新员工一律带初始口令入库 —— 没有「无口令即可登录」的窗口
+        await deps.staff.setPasswordHash(created.id, await deps.passwords.hash(deps.seedPassword));
+      }
+
+      // 测试账号的独立工作组(ADR-011):所有业务岗都指向本人,起单即整条流归自己
+      for (const account of SOLO_GROUP_ACCOUNTS) {
+        const staff = await deps.staff.findByAccount(account);
+        if (staff === undefined) continue;
+        const existing = await deps.workGroups.listByOwner(staff.id);
+        if (existing.length > 0) continue;
+        await deps.workGroups.upsert({
+          id: `wg-solo-${account.toLowerCase()}`,
+          name: `${staff.name} 独立测试组`,
+          ownerId: staff.id,
+          members: Object.fromEntries(SOLO_GROUP_POSITIONS.map((code) => [code, staff.id])),
+        });
       }
 
       for (const [code, entries] of Object.entries(POSITION_GRANT_SEED)) {

apps/api/src/modules/org/port.ts

@@ -2,7 +2,7 @@
  * module: org —— 本模块要外界提供的能力(编码规范 §10.1 / §5.3)。
  * adapter 实现之,usecase 依赖之,app 装配之。
  */
-import type { Grant, Position, PositionId, Staff, StaffId } from '@contracts';
+import type { Grant, Position, PositionId, Staff, StaffId, WorkGroup } from '@contracts';
 
 export type Clock = { now(): Date };
 
@@ -20,6 +20,28 @@ export type StaffRepository = {
   listByPosition(positionId: PositionId): Promise<Staff[]>;
   insert(staff: Staff): Promise<Staff>;
   setState(id: StaffId, state: Staff['state']): Promise<void>;
+  /** 口令散列的读写 —— 明文不经此端口(ADR-010) */
+  passwordHashOf(account: string): Promise<string | undefined>;
+  setPasswordHash(id: StaffId, hash: string): Promise<void>;
+};
+
+/**
+ * 会话仓储(ADR-010)—— 服务端表:登出即刻作废,停用员工连带清场。
+ * token 即主键,不透明随机串,不编码任何身份信息。
+ */
+export type SessionRepository = {
+  issue(input: { token: string; staffId: StaffId; expiresAt: Date }): Promise<void>;
+  /** 未过期才返回;命中同时滑动续期 */
+  touch(token: string, now: Date, expiresAt: Date): Promise<{ staffId: StaffId } | undefined>;
+  revoke(token: string): Promise<void>;
+  revokeAllOf(staffId: StaffId): Promise<void>;
+};
+
+/** 口令散列器 —— 算法实现在 adapter,usecase 只认这两个动作 */
+export type PasswordHasher = {
+  hash(password: string): Promise<string>;
+  verify(password: string, stored: string | undefined): Promise<boolean>;
+  newToken(): string;
 };
 
 export type GrantRepository = {
@@ -37,5 +59,11 @@ export type InFlightWorkProbe = {
   openApprovalsOf(staffId: StaffId): Promise<Array<{ approvalId: string; title: string }>>;
 };
 
+/** 工作组仓储(ADR-011) */
+export type WorkGroupRepository = {
+  listByOwner(ownerId: StaffId): Promise<WorkGroup[]>;
+  upsert(group: WorkGroup): Promise<WorkGroup>;
+};
+
 /** ID 生成 —— domain 零随机(§5.3) */
 export type IdGenerator = { next(): string };