feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/integration/config/config.module.ts

@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import {
+  IntegrationConfig,
+  IntegrationConfigDetail,
+} from '../entities/integration-config.entity';
+import { IntegrationConfigService } from './integration-config.service';
+import { IntegrationConfigController } from './integration-config.controller';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([IntegrationConfig, IntegrationConfigDetail])],
+  controllers: [IntegrationConfigController],
+  providers: [IntegrationConfigService],
+  exports: [IntegrationConfigService],
+})
+export class IntegrationConfigModule {}

apps/server/src/integration/config/dto/config.dto.ts

@@ -0,0 +1,29 @@
+/** 钉钉配置 */
+export interface DingTalkThirdConfig {
+  agentId: string; // AppKey
+  appSecret: string; // AppSecret
+  corpId: string; // CorpId
+  startEnable: boolean; // 是否启用同步
+  appId?: string; // 内部应用ID，用于消息推送（可选）
+}
+
+/** 企微配置 */
+export interface WeComThirdConfig {
+  agentId: string;
+  appSecret: string;
+  corpId: string;
+  startEnable: boolean;
+}
+
+/** 对外返回的配置（脱敏后，不含 appSecret） */
+export interface ThirdConfigBaseDTO<T = unknown> {
+  type: string;
+  verify?: boolean;
+  config: T;
+}
+
+/** 保存配置的请求体 */
+export interface SaveConfigRequest {
+  type: 'WECOM' | 'DINGTALK';
+  config: DingTalkThirdConfig | WeComThirdConfig;
+}

apps/server/src/integration/config/integration-config.controller.ts

@@ -0,0 +1,46 @@
+import { Controller, Get, Post, Body, Param, UseGuards } from '@nestjs/common';
+import { JwtAuthGuard } from '../../auth/guards/jwt-auth.guard';
+import { RequirePermission } from '../../auth/decorators/permission.decorator';
+import { IntegrationConfigService } from './integration-config.service';
+import type { SaveConfigRequest } from './dto/config.dto';
+
+@Controller('integration/config')
+@UseGuards(JwtAuthGuard)
+export class IntegrationConfigController {
+  constructor(private readonly service: IntegrationConfigService) {}
+
+  /** 获取全部配置（脱敏） */
+  @Get()
+  @RequirePermission('integration:read')
+  async getConfigs() {
+    const data = await this.service.getThirdConfig();
+    return { success: true, data };
+  }
+
+  /** 按类型获取单个配置 */
+  @Get(':type')
+  @RequirePermission('integration:read')
+  async getConfig(@Param('type') type: string) {
+    const data = await this.service.getConfigByType(type.toUpperCase());
+    if (!data) {
+      return { success: false, message: `未找到 ${type} 的配置` };
+    }
+    return { success: true, data };
+  }
+
+  /** 保存配置 */
+  @Post()
+  @RequirePermission('integration:read')
+  async saveConfig(@Body() body: SaveConfigRequest) {
+    await this.service.saveConfig(body);
+    return { success: true, message: '配置已保存' };
+  }
+
+  /** 测试连接 */
+  @Post('test')
+  @RequirePermission('integration:read')
+  async testConnection(@Body() body: SaveConfigRequest) {
+    const success = await this.service.testConnection(body.type, body.config);
+    return { success, message: success ? '连接成功' : '连接失败，请检查配置信息' };
+  }
+}

apps/server/src/integration/config/integration-config.service.ts

@@ -0,0 +1,226 @@
+import { Injectable, Logger, BadRequestException, NotFoundException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import {
+  IntegrationConfig,
+  IntegrationConfigDetail,
+} from '../entities/integration-config.entity';
+import {
+  ThirdConfigBaseDTO,
+  DingTalkThirdConfig,
+  WeComThirdConfig,
+  SaveConfigRequest,
+} from './dto/config.dto';
+
+@Injectable()
+export class IntegrationConfigService {
+  private readonly logger = new Logger(IntegrationConfigService.name);
+
+  constructor(
+    @InjectRepository(IntegrationConfig)
+    private readonly configRepo: Repository<IntegrationConfig>,
+    @InjectRepository(IntegrationConfigDetail)
+    private readonly detailRepo: Repository<IntegrationConfigDetail>,
+  ) {}
+
+  /** 获取或创建主配置（全局单例） */
+  private async ensureConfig(): Promise<IntegrationConfig> {
+    let config = await this.configRepo.findOne({ where: { type: 'THIRD' } });
+    if (!config) {
+      config = this.configRepo.create({ type: 'THIRD', isSync: false });
+      await this.configRepo.save(config);
+    }
+    return config;
+  }
+
+  /** DINGTALK -> DINGTALK_SYNC, WECOM -> WECOM_SYNC */
+  private getDetailType(type: string): string {
+    switch (type.toUpperCase()) {
+      case 'WECOM':
+        return 'WECOM_SYNC';
+      case 'DINGTALK':
+        return 'DINGTALK_SYNC';
+      default:
+        throw new BadRequestException(`不支持的第三方类型: ${type}`);
+    }
+  }
+
+  /** 获取所有配置（脱敏，不返回 appSecret） */
+  async getThirdConfig(): Promise<ThirdConfigBaseDTO[]> {
+    const config = await this.ensureConfig();
+    const details = await this.detailRepo.find({ where: { configId: config.id } });
+    return details.map((detail) => ({
+      type: detail.type.includes('WECOM')
+        ? 'WECOM'
+        : detail.type.includes('DINGTALK')
+          ? 'DINGTALK'
+          : detail.type,
+      verify: detail.enable,
+      config: this.parseAndMaskConfig(detail.content),
+    }));
+  }
+
+  /** 按类型获取单个配置（脱敏） */
+  async getConfigByType(type: string): Promise<ThirdConfigBaseDTO | null> {
+    const all = await this.getThirdConfig();
+    return all.find((c) => c.type === type.toUpperCase()) || null;
+  }
+
+  /** 保存/更新配置 */
+  async saveConfig(request: SaveConfigRequest): Promise<void> {
+    const config = await this.ensureConfig();
+    const detailType = this.getDetailType(request.type);
+
+    let existingDetail = await this.detailRepo.findOne({
+      where: { configId: config.id, type: detailType },
+    });
+
+    const finalConfig = { ...request.config } as Record<string, unknown>;
+
+    // 更新时若前端未传 appSecret，则保留旧值
+    if (existingDetail && existingDetail.content) {
+      if (!finalConfig.appSecret) {
+        try {
+          const oldParsed = JSON.parse(existingDetail.content);
+          const oldCfg = oldParsed.config || oldParsed;
+          if (oldCfg.appSecret) finalConfig.appSecret = oldCfg.appSecret;
+        } catch {
+          // ignore
+        }
+      }
+    } else if (!finalConfig.appSecret) {
+      throw new BadRequestException('首次配置必须提供 AppSecret');
+    }
+
+    // 连通性验证
+    const token = await this.getTokenForTest(request.type, finalConfig);
+    const verified = !!token;
+
+    const content = JSON.stringify({
+      type: request.type,
+      verify: verified,
+      config: finalConfig,
+    });
+
+    if (existingDetail) {
+      existingDetail.content = content;
+      existingDetail.enable = verified;
+      await this.detailRepo.save(existingDetail);
+    } else {
+      existingDetail = this.detailRepo.create({
+        configId: config.id,
+        name: '第三方设置',
+        type: detailType,
+        content,
+        enable: verified,
+      });
+      await this.detailRepo.save(existingDetail);
+    }
+    this.logger.log(`第三方配置已保存: ${request.type}, 验证: ${verified}`);
+  }
+
+  /** 测试连接 */
+  async testConnection(
+    type: string,
+    config: DingTalkThirdConfig | WeComThirdConfig,
+  ): Promise<boolean> {
+    try {
+      const token = await this.getTokenForTest(type, config as unknown as Record<string, unknown>);
+      return !!token;
+    } catch (e) {
+      this.logger.error(`连接测试失败: ${(e as Error).message}`);
+      return false;
+    }
+  }
+
+  /** 读同步状态：某类型是否已同步过 */
+  async getSyncStatus(type: string): Promise<boolean> {
+    const config = await this.configRepo.findOne({ where: { type: 'THIRD' } });
+    if (!config || !config.isSync) return false;
+    return config.syncResource === type.toUpperCase();
+  }
+
+  /** 写同步状态 */
+  async setSyncStatus(syncing: boolean, type?: string): Promise<void> {
+    const config = await this.ensureConfig();
+    config.isSync = syncing;
+    if (type) config.syncResource = type.toUpperCase();
+    await this.configRepo.save(config);
+  }
+
+  /**
+   * 供同步逻辑使用：读原始（未脱敏）配置。
+   * 返回 { agentId, appSecret, corpId, appId? } 或 null。
+   */
+  async getRawConfig(type: string): Promise<Record<string, any> | null> {
+    const config = await this.ensureConfig();
+    const detailType = this.getDetailType(type);
+    const detail = await this.detailRepo.findOne({
+      where: { configId: config.id, type: detailType },
+    });
+    if (!detail || !detail.content) return null;
+    try {
+      const parsed = JSON.parse(detail.content);
+      return parsed.config || parsed;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * 供同步逻辑使用：拿一个可用 access_token（未脱敏配置直接用）。
+   * 目前仅实现钉钉。
+   */
+  async getAccessToken(type: string): Promise<string> {
+    const config = await this.getRawConfig(type);
+    if (!config) throw new NotFoundException(`未配置 ${type} 平台信息`);
+    const token = await this.getTokenForTest(type, config);
+    if (!token) throw new BadRequestException(`获取 ${type} access_token 失败`);
+    return token;
+  }
+
+  // ── 私有工具 ──
+
+  /** 用给定配置获取 token（钉钉真实调用，企微暂返回 null） */
+  private async getTokenForTest(
+    type: string,
+    config: Record<string, unknown>,
+  ): Promise<string | null> {
+    try {
+      if (type.toUpperCase() === 'DINGTALK') {
+        const appKey = String(config.agentId || '');
+        const appSecret = String(config.appSecret || '');
+        if (!appKey || !appSecret) return null;
+        return await this.fetchDingTalkToken(appKey, appSecret);
+      }
+      // 企微暂不实现，返回 null
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** 调钉钉新版接口拿 access_token */
+  private async fetchDingTalkToken(appKey: string, appSecret: string): Promise<string | null> {
+    const res = await fetch('https://api.dingtalk.com/v1.0/oauth2/accessToken', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ appKey, appSecret }),
+    });
+    const body = (await res.json()) as { accessToken?: string; expireIn?: number };
+    return body.accessToken || null;
+  }
+
+  /** 解析并脱敏：删掉 appSecret 后返回 config 对象 */
+  private parseAndMaskConfig(content: string | null): unknown {
+    if (!content) return {};
+    try {
+      const parsed = JSON.parse(content);
+      const cfg = parsed.config || parsed;
+      if (cfg.appSecret) delete cfg.appSecret;
+      return cfg;
+    } catch {
+      return {};
+    }
+  }
+}

apps/server/src/integration/dingtalk.service.ts

@@ -6,7 +6,7 @@
  * - BFS 遍历所有部门 + 用户（带限流）
  * - 用户同步（自动建 User + Student + UserDingMapping）
  */
-import { Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger, ServiceUnavailableException } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import * as bcrypt from 'bcryptjs';
@@ -53,6 +53,7 @@ interface DingTalkUserListResponse {
 /** 钉钉打卡结果 — 对齐 dws attendance check result */
 export interface DingTalkAttendanceResult {
   userId: string;
+  userName: string;
   workDate: string;
   timeResult: string;
   locationResult: string;
@@ -62,6 +63,14 @@ export interface DingTalkAttendanceResult {
   checkType: string;
 }
 
+/** 钉钉部门树节点，供前端选择器使用 */
+export interface DingOrgTreeNode {
+  id: number;
+  name: string;
+  parentId: number;
+  children: DingOrgTreeNode[];
+}
+
 
 @Injectable()
 export class DingTalkService {
@@ -121,9 +130,9 @@ export class DingTalkService {
   // Department BFS — 对齐 gongxue-dorm-sys getAllSubDepartmentIds
   // ═══════════════════════════════════════════
 
-  private async getAllDeptIds(token: string): Promise<number[]> {
+  private async getAllDeptIds(token: string, rootDeptId = 1): Promise<number[]> {
     const ids: number[] = [];
-    const queue: number[] = [1];
+    const queue: number[] = [rootDeptId];
 
     while (queue.length > 0) {
       const deptId = queue.shift()!;
@@ -219,7 +228,7 @@ export class DingTalkService {
   // Sync all — 主入口
   // ═══════════════════════════════════════════
 
-  async syncAll(): Promise<{ deptCount: number; userCount: number }> {
+  async syncAll(rootDeptId = 1): Promise<{ deptCount: number; userCount: number }> {
     if (!this.configured) {
       this.logger.warn('钉钉未配置 (DINGTALK_APP_KEY / DINGTALK_APP_SECRET)，跳过同步');
       return { deptCount: 0, userCount: 0 };
@@ -230,7 +239,7 @@ export class DingTalkService {
 
     // ── Step 1: BFS traverse all departments ──
     this.logger.log('开始 BFS 遍历钉钉部门...');
-    const deptIds = await this.getAllDeptIds(token);
+    const deptIds = await this.getAllDeptIds(token, rootDeptId);
     this.logger.log(`共发现 ${deptIds.length} 个部门`);
 
     // ── Step 2: Sync departments ──
@@ -295,6 +304,47 @@ export class DingTalkService {
     return { deptCount, userCount };
   }
 
+  /**
+   * 获取钉钉组织部门树（只含部门，不含用户），供前端选择同步起点。
+   * 返回从指定 rootDeptId 开始的树；默认根部门 1。
+   */
+  async fetchOrgTree(rootDeptId = 1): Promise<DingOrgTreeNode[]> {
+    if (!this.configured) {
+      throw new ServiceUnavailableException('钉钉未配置');
+    }
+    const token = await this.getAccessToken();
+    const deptIds = await this.getAllDeptIds(token, rootDeptId);
+
+    // 拉每个部门详情
+    const nodes: DingOrgTreeNode[] = [];
+    for (let i = 0; i < deptIds.length; i++) {
+      if (i > 0) await this.delay(i);
+      const detail = await this.getDeptDetail(token, deptIds[i]);
+      if (detail) {
+        nodes.push({
+          id: detail.dept_id,
+          name: detail.name,
+          parentId: detail.parent_id,
+          children: [],
+        });
+      }
+    }
+
+    // 组装成树
+    const map = new Map<number, DingOrgTreeNode>();
+    nodes.forEach((n) => map.set(n.id, n));
+    const roots: DingOrgTreeNode[] = [];
+    for (const node of nodes) {
+      const parent = map.get(node.parentId);
+      if (parent && node.id !== rootDeptId) {
+        parent.children.push(node);
+      } else {
+        roots.push(node);
+      }
+    }
+    return roots;
+  }
+
   // ═══════════════════════════════════════════
   // Sync one user (with mapping)
   // ═══════════════════════════════════════════
@@ -400,6 +450,8 @@ export class DingTalkService {
       checkDateTo: dateTo,
     };
     if (params.userIds?.length) body.userIds = params.userIds;
+    if (params.offset !== undefined) body.offset = params.offset;
+    if (params.limit !== undefined) body.limit = params.limit;
 
     const res = await fetch(
       `https://oapi.dingtalk.com/attendance/listRecord?access_token=${token}`,
@@ -423,6 +475,7 @@ export class DingTalkService {
 
     return (data.recordresult ?? []).map((r) => ({
       userId: r.userId,
+      userName: '',
       workDate: new Date(r.workDate).toISOString().slice(0, 10),
       timeResult: r.timeResult ?? r.sourceType ?? '',
       locationResult: r.locationResult ?? r.locationMethod ?? r.userAddress ?? '',

apps/server/src/integration/entities/integration-config.entity.ts

@@ -0,0 +1,78 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  CreateDateColumn,
+  UpdateDateColumn,
+  Index,
+  ManyToOne,
+  JoinColumn,
+} from 'typeorm';
+
+/**
+ * 第三方集成主配置表。全局单例（本项目无多组织）。
+ * type 目前固定为 'THIRD'。
+ */
+@Entity('integration_config')
+export class IntegrationConfig {
+  @PrimaryGeneratedColumn()
+  id: number;
+
+  /** 配置类型，目前固定 'THIRD' */
+  @Column({ length: 50 })
+  type: string;
+
+  /** 最近一次同步的来源: 'WECOM' | 'DINGTALK' | null */
+  @Column({ name: 'sync_resource', length: 50, nullable: true })
+  syncResource: string;
+
+  /** 是否已同步过 */
+  @Column({ name: 'is_sync', default: false })
+  isSync: boolean;
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt: Date;
+}
+
+/**
+ * 第三方集成明细配置表。一个主配置对应多条明细（钉钉/企微各一条）。
+ * content 存 JSON 字符串，含加密/明文的 corpId、appSecret 等。
+ */
+@Entity('integration_config_detail')
+@Index(['configId'])
+export class IntegrationConfigDetail {
+  @PrimaryGeneratedColumn()
+  id: number;
+
+  /** 关联主配置表 IntegrationConfig.id */
+  @Column({ name: 'config_id', type: 'integer' })
+  configId: number;
+
+  @ManyToOne(() => IntegrationConfig)
+  @JoinColumn({ name: 'config_id' })
+  config: IntegrationConfig;
+
+  @Column({ length: 100, nullable: true })
+  name: string;
+
+  /** 明细类型: 'DINGTALK_SYNC' | 'WECOM_SYNC' */
+  @Column({ length: 50 })
+  type: string;
+
+  /** 配置 JSON 字符串: { type, verify, config: {...} } */
+  @Column({ type: 'text', nullable: true })
+  content: string;
+
+  /** 该明细是否验证通过（能拿到 token） */
+  @Column({ default: false })
+  enable: boolean;
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt: Date;
+}

apps/server/src/integration/integration.module.ts

@@ -1,11 +1,11 @@
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
-import { Department, User } from '../entities';
+import { Department, User, Student, UserDingMapping } from '../entities';
 import { DingTalkService } from './dingtalk.service';
 import { WeComService } from './wecom.service';
 
 @Module({
-  imports: [TypeOrmModule.forFeature([Department, User])],
+  imports: [TypeOrmModule.forFeature([Department, User, Student, UserDingMapping])],
   providers: [DingTalkService, WeComService],
   exports: [DingTalkService, WeComService],
 })