feat: add tenant admin configuration and governance endpoints

Tiku.Application/TenantAdmin/ITenantAdminDirectService.cs

@@ -69,4 +69,89 @@ public interface ITenantAdminDirectService
         TenantAdminActor actor,
         UpsertTenantAdminStudentFollowupCommand command,
         CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantAdminMemberItem>> GetMembersAsync(
+        TenantAdminActor actor,
+        TenantAdminMemberFilter filter,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantAdminMemberItem>> UpsertMemberAsync(
+        TenantAdminActor actor,
+        UpsertTenantAdminMemberCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantAdminMemberItem>> DisableMemberAsync(
+        TenantAdminActor actor,
+        Guid membershipId,
+        CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantAdminAuditLogItem>> GetAuditLogsAsync(
+        TenantAdminActor actor,
+        TenantAdminAuditLogFilter filter,
+        CancellationToken cancellationToken = default);
+
+    Task<TenantAdminPermissionMatrix> GetPermissionMatrixAsync(
+        TenantAdminActor actor,
+        CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantAdminRoleTemplateItem>> GetRoleTemplatesAsync(
+        TenantAdminActor actor,
+        TenantAdminRoleTemplateFilter filter,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantAdminRoleTemplateItem>> UpsertRoleTemplateAsync(
+        TenantAdminActor actor,
+        UpsertTenantAdminRoleTemplateCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantAdminRoleTemplateItem>> DisableRoleTemplateAsync(
+        TenantAdminActor actor,
+        Guid roleTemplateId,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantBrandingItem>> UpsertBrandingAsync(
+        TenantAdminActor actor,
+        UpsertTenantBrandingCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantSettingsItem>> UpsertSettingsAsync(
+        TenantAdminActor actor,
+        UpsertTenantSettingsCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantThemeTemplateItem>> GetThemeTemplatesAsync(
+        TenantAdminActor actor,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantThemeItem>> GetThemeAsync(
+        TenantAdminActor actor,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantThemeItem>> PreviewThemeAsync(
+        TenantAdminActor actor,
+        PreviewTenantThemeCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantThemeItem>> PublishThemeAsync(
+        TenantAdminActor actor,
+        PublishTenantThemeCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantDomainItem>> GetDomainsAsync(
+        TenantAdminActor actor,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantDomainItem>> CreateDomainAsync(
+        TenantAdminActor actor,
+        CreateTenantDomainCommand command,
+        CancellationToken cancellationToken = default);
+
+    Task<CatalogList<TenantAuthProviderItem>> GetAuthProvidersAsync(
+        TenantAdminActor actor,
+        CancellationToken cancellationToken = default);
+
+    Task<ContentManagementResult<TenantAuthProviderItem>> UpsertAuthProviderAsync(
+        TenantAdminActor actor,
+        UpsertTenantAuthProviderCommand command,
+        CancellationToken cancellationToken = default);
 }

Tiku.Application/TenantAdmin/TenantAdminDirectModels.cs

@@ -1,10 +1,11 @@
 using System.Text.Json;
 using Tiku.Domain.Common;
+using Tiku.Domain.Operations;
 using Tiku.Domain.Tenancy;
 
 namespace Tiku.Application.TenantAdmin;
 
-public sealed record TenantAdminActor(Guid TenantId, Guid UserId);
+public sealed record TenantAdminActor(Guid TenantId, Guid UserId, TenantRole Role = TenantRole.TenantAdmin);
 
 public sealed record TenantAdminClassFilter(
     Guid? RegionId = null,
@@ -30,6 +31,22 @@ public sealed record TenantAdminStudentActivityFilter(
     string? Status = null,
     int? Limit = null);
 
+public sealed record TenantAdminMemberFilter(
+    string? Role = null,
+    string? Status = null,
+    string? Keyword = null,
+    int? Limit = null);
+
+public sealed record TenantAdminAuditLogFilter(
+    string? Action = null,
+    string? TargetType = null,
+    Guid? ActorUserId = null,
+    int? Limit = null);
+
+public sealed record TenantAdminRoleTemplateFilter(
+    string? Status = null,
+    int? Limit = null);
+
 public sealed record UpsertTenantAdminClassCommand(
     Guid? Id,
     Guid? RegionId,
@@ -94,6 +111,66 @@ public sealed record UpsertTenantAdminStudentFollowupCommand(
     DateTimeOffset? DueAt,
     JsonElement Metadata);
 
+public sealed record UpsertTenantAdminMemberCommand(
+    Guid? MembershipId,
+    UserLookupCommand User,
+    string? Role,
+    string? Status,
+    Guid? RoleTemplateId,
+    JsonElement Permissions,
+    string? PrimaryRole);
+
+public sealed record UpsertTenantAdminRoleTemplateCommand(
+    Guid? Id,
+    string? Code,
+    string Name,
+    string? Description,
+    string? BaseRole,
+    string? Status,
+    JsonElement Permissions,
+    JsonElement MenuPermissions,
+    JsonElement ModulePermissions,
+    JsonElement FieldPermissions,
+    JsonElement DataScope,
+    int? Order);
+
+public sealed record UpsertTenantBrandingCommand(
+    string BrandName,
+    string? ShortName,
+    string? Slogan,
+    string? OrganizationName,
+    string? LogoUrl,
+    string? FaviconUrl,
+    string? ServiceWechat,
+    string? ServiceAccountName);
+
+public sealed record UpsertTenantSettingsCommand(
+    JsonElement FeatureFlags,
+    JsonElement AdminFeatureFlags,
+    JsonElement PublicConfig);
+
+public sealed record PreviewTenantThemeCommand(
+    string TemplateCode,
+    JsonElement Theme,
+    JsonElement PublicAssets);
+
+public sealed record PublishTenantThemeCommand(
+    bool UseDraft,
+    string? TemplateCode,
+    JsonElement Theme,
+    JsonElement PublicAssets);
+
+public sealed record CreateTenantDomainCommand(
+    string Host,
+    string? DomainType,
+    bool IsPrimary);
+
+public sealed record UpsertTenantAuthProviderCommand(
+    string Provider,
+    string? Status,
+    string? DisplayName,
+    JsonElement ConfigPublic);
+
 public sealed record TenantAdminClassList(
     IReadOnlyCollection<TenantAdminClassItem> Items,
     bool Scoped);
@@ -204,6 +281,128 @@ public sealed record TenantAdminStudentFollowupItem(
     DateTimeOffset CreatedAt,
     DateTimeOffset UpdatedAt);
 
+public sealed record TenantAdminMemberItem(
+    Guid MembershipId,
+    Guid UserId,
+    TenantRole Role,
+    MembershipStatus Status,
+    JsonElement Permissions,
+    Guid? RoleTemplateId,
+    string? RoleTemplateCode,
+    string? RoleTemplateName,
+    string? LegacyRole,
+    TenantAdminUserSummary User,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantAdminAuditLogItem(
+    Guid Id,
+    Guid? ActorUserId,
+    string Action,
+    string? TargetType,
+    string? TargetId,
+    JsonElement Details,
+    string? IpAddress,
+    string? UserAgent,
+    string? ActorName,
+    string? ActorPhone,
+    DateTimeOffset CreatedAt);
+
+public sealed record TenantAdminPermissionMatrix(
+    TenantAdminCurrentPermission Current,
+    IReadOnlyCollection<TenantAdminPermissionCatalogItem> Permissions,
+    IReadOnlyDictionary<string, IReadOnlyCollection<string>> RoleDefaults);
+
+public sealed record TenantAdminCurrentPermission(
+    Guid UserId,
+    Guid TenantId,
+    TenantRole Role);
+
+public sealed record TenantAdminPermissionCatalogItem(string Key, string Label);
+
+public sealed record TenantAdminRoleTemplateItem(
+    Guid Id,
+    string Code,
+    string Name,
+    string? Description,
+    TenantRole BaseRole,
+    TenantRoleTemplateStatus Status,
+    JsonElement Permissions,
+    JsonElement MenuPermissions,
+    JsonElement ModulePermissions,
+    JsonElement FieldPermissions,
+    JsonElement DataScope,
+    bool IsSystem,
+    int Order,
+    Guid? CreatedBy,
+    Guid? UpdatedBy,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantBrandingItem(
+    Guid TenantId,
+    string BrandName,
+    string? ShortName,
+    string? Slogan,
+    string? OrganizationName,
+    string? LogoUrl,
+    string? FaviconUrl,
+    string? ServiceWechat,
+    string? ServiceAccountName,
+    JsonElement Theme,
+    JsonElement PublicAssets,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantSettingsItem(
+    Guid TenantId,
+    JsonElement FeatureFlags,
+    JsonElement AdminFeatureFlags,
+    JsonElement PublicConfig,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantThemeTemplateItem(
+    string Code,
+    string Name,
+    string? Description,
+    string? PreviewImageUrl,
+    JsonElement Theme,
+    JsonElement PublicAssets,
+    int Order);
+
+public sealed record TenantThemeItem(
+    Guid TenantId,
+    string? ActiveTemplateCode,
+    JsonElement ActiveTheme,
+    JsonElement ActivePublicAssets,
+    string? DraftTemplateCode,
+    JsonElement DraftTheme,
+    JsonElement DraftPublicAssets,
+    TenantThemeConfigStatus Status,
+    DateTimeOffset? PublishedAt,
+    Guid? PublishedBy,
+    Guid? DraftUpdatedBy,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantDomainItem(
+    Guid Id,
+    string Host,
+    TenantDomainType DomainType,
+    TenantDomainStatus Status,
+    bool IsPrimary,
+    string? VerificationToken,
+    DateTimeOffset? VerifiedAt,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset UpdatedAt);
+
+public sealed record TenantAuthProviderItem(
+    Guid Id,
+    string Provider,
+    TenantAuthProviderStatus Status,
+    string? DisplayName,
+    JsonElement ConfigPublic,
+    DateTimeOffset CreatedAt,
+    DateTimeOffset UpdatedAt);
+
 public sealed class TenantAdminDirectException(string message, string code) : Exception(message)
 {
     public string Code { get; } = code;