统一鉴权中心接入(ADR-012):org 重写为 Keycloak 身份 + 角色→端;中间件按路由归属统一判;口令/会话/岗位授权退役;迁移 0032

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw

apps/api/src/app/routes/governance.ts

@@ -1,107 +1,108 @@
 /**
  * 治理台路由组装(编码规范 §3:治理台九功能不设后端 governance 模块 ——
  * 每个功能是对应模块的管理用例 + 本文件的路由组装)。
+ * 端级授权由 server.ts 的鉴权中间件按路由归属统一判(ADR-012),这里不再各写守卫。
  */
 import type { Hono } from 'hono';
-import type { ApiError, GovernanceFunction } from '@contracts';
+import type { ApiError } from '@contracts';
 import {
-  createStaffRoute,
-  disableStaffCheckRoute,
-  disableStaffRoute,
-  listGrantsRoute,
+  deleteLlmInstanceRoute,
+  deleteRoleAccessRoute,
   listLlmInstancesRoute,
+  listLlmProvidersRoute,
+  listRoleAccessRoute,
   listStaffRoute,
   listWorkGroupsRoute,
-  positionIdSchema,
-  listLlmProvidersRoute,
   LLM_PROVIDERS,
-  deleteLlmInstanceRoute,
   probeLlmDraftRoute,
   probeLlmInstanceRoute,
   saveWorkGroupRoute,
-  setGrantsRoute,
+  setRoleAccessRoute,
+  setStaffPositionRoute,
   staffIdSchema,
+  staffInFlightRoute,
+  syncStaffRoute,
   upsertLlmInstanceRoute,
 } from '@contracts';
-import { DisableBlockedError } from '@modules/org';
+import { AccessLockoutError, PositionNotFoundError, StaffNotFoundError } from '@modules/org';
 import { PROVIDER_PROFILES } from '@modules/llm';
 import type { Container } from '../container.ts';
 import type { AppEnv } from '../http-env.ts';
 
-/** 治理动作要过岗位授权(客体 = 治理功能,动作 = 治理) */
-function requireGovern(container: Container, fn: GovernanceFunction) {
-  return async (account: string): Promise<ApiError | undefined> => {
-    const staff = await container.org.findByAccount(account);
-    if (staff === undefined) return { code: 'unauthenticated', message: '会话无效' };
-    const ok = await container.org.authorize(staff.id, { kind: 'governance', function: fn }, 'govern');
-    return ok ? undefined : { code: 'forbidden', message: `岗位 ${staff.position.code} 无「${fn}」治理权` };
-  };
-}
-
 export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container): void {
-  const guardStaff = requireGovern(container, 'staff');
-  const guardSystem = requireGovern(container, 'system');
+  /* ── 员工管理:名册来自鉴权中心,这里只管岗位与同步(ADR-012) ─────────── */
 
-  /* ── 员工管理 ─────────────────────────────────────────────────────── */
+  app.get(listStaffRoute.path, async (c) => c.json(await container.org.listStaff()));
 
-  app.get(listStaffRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    return c.json(await container.org.listStaff());
-  });
+  /** 从 Keycloak Admin API 同步名册;没配 provisioning 就回 configured:false(界面不撒谎) */
+  app.post(syncStaffRoute.path, async (c) => c.json(await container.org.syncRoster()));
 
-  app.post(createStaffRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    const parsed = createStaffRoute.body.safeParse(await c.req.json());
+  app.put(setStaffPositionRoute.path, async (c) => {
+    const staffId = staffIdSchema.parse(c.req.param('staffId'));
+    const parsed = setStaffPositionRoute.body.safeParse(await c.req.json());
     if (!parsed.success) {
       const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
       return c.json(body, 400);
     }
-    return c.json(await container.org.createStaff(parsed.data));
-  });
-
-  app.get(disableStaffCheckRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    const staffId = staffIdSchema.parse(c.req.param('staffId'));
-    return c.json(await container.org.checkDisable(staffId));
-  });
-
-  app.post(disableStaffRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    const staffId = staffIdSchema.parse(c.req.param('staffId'));
     try {
-      await container.org.disableStaff(staffId);
-      return c.json({ ok: true, check: await container.org.checkDisable(staffId) });
+      return c.json(await container.org.setPosition(staffId, parsed.data.positionId));
     } catch (error) {
-      if (error instanceof DisableBlockedError) {
-        // 停用前置检查未过:在途任务与待答卡须先改派完毕(OS 02)
-        const body: ApiError = { code: 'precondition-failed', message: error.message, detail: error.check };
-        return c.json(body, 412);
+      if (error instanceof StaffNotFoundError || error instanceof PositionNotFoundError) {
+        const body: ApiError = { code: 'not-found', message: error.message };
+        return c.json(body, 404);
       }
       throw error;
     }
   });
 
-  app.get(listGrantsRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    const positionId = positionIdSchema.parse(c.req.param('positionId'));
-    return c.json({ grants: await container.org.listGrants(positionId) });
+  /** 此人身上还挂着什么 —— 原「停用前置检查」降为只读信息;停用在 Keycloak 做 */
+  app.get(staffInFlightRoute.path, async (c) => {
+    const staffId = staffIdSchema.parse(c.req.param('staffId'));
+    try {
+      return c.json(await container.org.inFlightOf(staffId));
+    } catch (error) {
+      if (error instanceof StaffNotFoundError) {
+        const body: ApiError = { code: 'not-found', message: error.message };
+        return c.json(body, 404);
+      }
+      throw error;
+    }
   });
 
-  app.post(setGrantsRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    const positionId = positionIdSchema.parse(c.req.param('positionId'));
-    const parsed = setGrantsRoute.body.safeParse(await c.req.json());
+  /* ── 角色 → 端(ADR-012) ─────────────────────────────────────────────── */
+
+  app.get(listRoleAccessRoute.path, async (c) => c.json(await container.org.listRoleAccess()));
+
+  /** 锁死不变量不过(改完没人能进运营中心)→ 409 */
+  app.put(setRoleAccessRoute.path, async (c) => {
+    const role = c.req.param('role');
+    const parsed = setRoleAccessRoute.body.safeParse(await c.req.json());
     if (!parsed.success) {
       const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
       return c.json(body, 400);
     }
-    return c.json({ grants: await container.org.setGrants(positionId, parsed.data.grants) });
+    try {
+      return c.json(await container.org.setRoleAccess(role, parsed.data.ends));
+    } catch (error) {
+      if (error instanceof AccessLockoutError) {
+        const body: ApiError = { code: 'conflict', message: error.message };
+        return c.json(body, 409);
+      }
+      throw error;
+    }
+  });
+
+  app.delete(deleteRoleAccessRoute.path, async (c) => {
+    try {
+      await container.org.deleteRoleAccess(c.req.param('role'));
+      return c.json({ ok: true });
+    } catch (error) {
+      if (error instanceof AccessLockoutError) {
+        const body: ApiError = { code: 'conflict', message: error.message };
+        return c.json(body, 409);
+      }
+      throw error;
+    }
   });
 
   /* ── 员工管理 · 工作组(ADR-011) ──────────────────────────────────── */
@@ -111,8 +112,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
    * `ownerName` 一并带出:前端要显示的是「柴浩的组」,不是一串 id。
    */
   app.get(listWorkGroupsRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
     const { staff } = await container.org.listStaff();
     const found = await Promise.all(
       staff.map(async (s) => {
@@ -129,8 +128,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
    * 改组**不影响在途**:装进工作流的是起单时的快照。
    */
   app.put(saveWorkGroupRoute.path, async (c) => {
-    const denied = await guardStaff(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
     const parsed = saveWorkGroupRoute.body.safeParse(await c.req.json());
     if (!parsed.success) {
       const body: ApiError = { code: 'validation-failed', message: '工作组不合 schema', detail: parsed.error.issues };
@@ -149,10 +146,8 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
   /* ── 系统管理 · LLM 实例 ──────────────────────────────────────────── */
 
   /** Provider 档案:默认端点与出参口径 —— 建实例的表单据它预填(唯一真相在服务端) */
-  app.get(listLlmProvidersRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    return c.json({
+  app.get(listLlmProvidersRoute.path, (c) =>
+    c.json({
       providers: LLM_PROVIDERS.map((provider) => {
         const profile = PROVIDER_PROFILES[provider];
         return {
@@ -162,18 +157,12 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
           structuredOutput: profile.structuredOutput,
         };
       }),
-    });
-  });
+    }),
+  );
 
-  app.get(listLlmInstancesRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    return c.json({ instances: await container.llm.list() });
-  });
+  app.get(listLlmInstancesRoute.path, async (c) => c.json({ instances: await container.llm.list() }));
 
   app.post(upsertLlmInstanceRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
     const parsed = upsertLlmInstanceRoute.body.safeParse(await c.req.json());
     if (!parsed.success) {
       const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
@@ -184,8 +173,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
 
   /** 删实例:被活动声明着的用途名不许删(409)—— 反查放这一层,llm 不该知道活动的存在 */
   app.delete(deleteLlmInstanceRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
     const id = c.req.param('id');
     const target = (await container.llm.list()).find((i) => i.id === id);
     if (target === undefined) {
@@ -208,8 +195,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
 
   /** 测试连接(草稿):只测不存 —— 必须排在 `/:id/probe` 之前,否则会被那条路由吃掉 */
   app.post(probeLlmDraftRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
     const parsed = probeLlmDraftRoute.body.safeParse(await c.req.json());
     if (!parsed.success) {
       const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
@@ -218,9 +203,5 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
     return c.json(await container.llm.probeDraft(parsed.data));
   });
 
-  app.post(probeLlmInstanceRoute.path, async (c) => {
-    const denied = await guardSystem(c.get('account'));
-    if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
-    return c.json(await container.llm.probe(c.req.param('id')));
-  });
+  app.post(probeLlmInstanceRoute.path, async (c) => c.json(await container.llm.probe(c.req.param('id'))));
 }