XiaChangSong/BPOS-TMP-REPO
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

统一鉴权中心接入(ADR-012):org 重写为 Keycloak 身份 + 角色→端;中间件按路由归属统一判;口令/会话/岗位授权退役;迁移 0032

Browse Source 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw
This commit is contained in:
xcs
2026-08-25 17:40:55 +08:00
co-authored by Claude Opus 5
parent 81a185cd61
commit dd31b91829
38 changed files with 1236 additions and 1485 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/app/routes/desk.ts
+13 -18
View File
@@ -41,6 +41,7 @@ function rowsOf<T>(result: unknown): T[] {
const rows = (result as { rows?: unknown }).rows;
return Array.isArray(rows) ? (rows as T[]) : [];
}
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
import { coerceToColumn, missingReadings, rowLabel } from '../wiring/engines.ts';
import { orderChat } from '../chat-order.ts';
@@ -846,12 +847,6 @@ export function gateOf(
}
export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): void {
/** 当前登录者;缺会话即 401 */
async function me(account: string) {
const staff = await container.org.findByAccount(account);
return staff;
}
/** 任务卡 —— 一条 = 一个活动的一次运行;序位取自工作流的节点实例 */
async function toCard(task: Awaited<ReturnType<Container['task']['get']>>): Promise<TaskCard> {
let position = 1;
@@ -949,7 +944,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
}
app.get(listTasksRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -960,7 +955,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.get(taskDetailRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1192,7 +1187,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 否则再读回来成 `FileDoc` 给前端渲 —— 读得回来才证明那份文件是真的。
*/
app.get(openAssetFileRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1298,7 +1293,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(saveTableRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1337,7 +1332,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
/** 回传:与后端回传校验**同 schema** —— 前端提交校验用的也是它 */
app.post(replyWorkOrderRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1431,7 +1426,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 与工单回传同一条规矩:校验用**同 schema**,拒收由 human-tool 判定并给出违规明细。
*/
app.post(replyChatCardRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1556,7 +1551,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 只许改**自己负责的那一单**的记录 —— 别人的单轮不到你替他标已读。
*/
app.post(markCommReadRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1615,7 +1610,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(sayRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1630,7 +1625,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.get(listMessagesRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1686,7 +1681,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
/** 确认起单(触发确认链路第 5 步)—— 幂等;只有被点名的确认人按得动 */
app.post(confirmTriggerPendingRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1710,7 +1705,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(markMessageReadRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1725,7 +1720,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 由 message 经统一入口写回来源任务;调用与回传全程在任务侧留痕。
*/
app.post(answerMessageRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);