feat: add tenant admin configuration and governance endpoints

Tiku.IntegrationTests/Api/TenantAdminDirectEndpointTests.cs

@@ -7,6 +7,7 @@ using Tiku.Api.Contracts;
 using Tiku.Domain.Catalog;
 using Tiku.Domain.Common;
 using Tiku.Domain.Identity;
+using Tiku.Domain.Operations;
 using Tiku.Domain.Tenancy;
 using Tiku.Infrastructure.Auth;
 using Tiku.Infrastructure.Persistence;
@@ -164,6 +165,140 @@ public sealed class TenantAdminDirectEndpointTests
         Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
     }
 
+    [Fact]
+    public async Task Tenant_admin_can_manage_branding_settings_theme_domains_and_auth_providers()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedAdminAsync(factory);
+        await factory.SeedAsync(new TenantThemeTemplate
+        {
+            Code = "classic",
+            Name = "经典主题",
+            Theme = JsonSerializer.SerializeToElement(new { color = "blue" }),
+            PublicAssets = JsonSerializer.SerializeToElement(new { logo = "/logo.png" }),
+            Status = TenantThemeTemplateStatus.Active
+        });
+        using var client = factory.CreateClient();
+        await LoginAsync(client, seed);
+
+        var brandingResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/branding",
+            new UpsertTenantBrandingDto
+            {
+                BrandName = "机构题库",
+                ShortName = "题库",
+                ServiceWechat = "wechat"
+            });
+        var settingsResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/settings",
+            new UpsertTenantSettingsDto
+            {
+                FeatureFlags = JsonSerializer.SerializeToElement(new { catalog = true }),
+                PublicConfig = JsonSerializer.SerializeToElement(new { icp = "蜀ICP备" })
+            });
+        var previewResponse = await client.PostAsJsonAsync(
+            "/api/tenant-admin/theme/preview",
+            new PreviewTenantThemeDto
+            {
+                TemplateCode = "classic",
+                Theme = JsonSerializer.SerializeToElement(new { color = "red" })
+            });
+        var publishResponse = await client.PostAsJsonAsync(
+            "/api/tenant-admin/theme/publish",
+            new PublishTenantThemeDto { UseDraft = true });
+        var domainResponse = await client.PostAsJsonAsync(
+            "/api/tenant-admin/domains",
+            new CreateTenantDomainDto
+            {
+                Host = "learn.example.com",
+                DomainType = "custom",
+                IsPrimary = true
+            });
+        var authProviderResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/auth-providers",
+            new UpsertTenantAuthProviderDto
+            {
+                Provider = "wechat_mp",
+                Status = "active",
+                DisplayName = "微信公众号",
+                ConfigPublic = JsonSerializer.SerializeToElement(new { appId = "wx-test" })
+            });
+        var secretSettingsResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/settings",
+            new UpsertTenantSettingsDto
+            {
+                PublicConfig = JsonSerializer.SerializeToElement(new { appSecret = "nope" })
+            });
+
+        Assert.Equal(HttpStatusCode.OK, brandingResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, settingsResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, previewResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, publishResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, domainResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, authProviderResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.BadRequest, secretSettingsResponse.StatusCode);
+
+        using var scope = factory.Services.CreateScope();
+        var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+        Assert.True(await dbContext.TenantBrandings.AnyAsync(item => item.TenantId == seed.TenantId && item.BrandName == "机构题库"));
+        Assert.True(await dbContext.TenantThemeConfigs.AnyAsync(item => item.TenantId == seed.TenantId && item.ActiveTemplateCode == "classic"));
+        Assert.True(await dbContext.TenantDomains.AnyAsync(item => item.TenantId == seed.TenantId && item.Host == "learn.example.com" && item.IsPrimary));
+        Assert.True(await dbContext.TenantAuthProviders.AnyAsync(item => item.TenantId == seed.TenantId && item.Provider == "wechat_mp"));
+    }
+
+    [Fact]
+    public async Task Tenant_admin_can_manage_role_templates_members_and_audit_logs()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedAdminAsync(factory);
+        using var client = factory.CreateClient();
+        await LoginAsync(client, seed);
+
+        var roleResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/role-templates",
+            new UpsertTenantAdminRoleTemplateDto
+            {
+                Code = "teacher-basic",
+                Name = "教师基础权限",
+                BaseRole = "teacher",
+                Permissions = JsonSerializer.SerializeToElement(new Dictionary<string, bool>
+                {
+                    ["classes:read"] = true,
+                    ["students:read"] = true
+                }),
+                FieldPermissions = JsonSerializer.SerializeToElement(new Dictionary<string, bool>
+                {
+                    ["student.phone"] = false
+                })
+            });
+        var roleJson = await ReadJsonAsync(roleResponse);
+        var roleTemplateId = roleJson.RootElement.GetProperty("item").GetProperty("id").GetGuid();
+
+        var memberResponse = await client.PutAsJsonAsync(
+            "/api/tenant-admin/members",
+            new UpsertTenantAdminMemberDto
+            {
+                RoleTemplateId = roleTemplateId,
+                User = new TenantAdminUserLookupDto
+                {
+                    Phone = "13900000004",
+                    Name = "教师"
+                }
+            });
+        var membersResponse = await client.GetAsync("/api/tenant-admin/members?role=teacher");
+        var permissionsResponse = await client.GetAsync("/api/tenant-admin/permissions");
+        var auditResponse = await client.GetAsync("/api/tenant-admin/audit-logs?action=tenant.role_template");
+        var membersJson = await ReadJsonAsync(membersResponse);
+        var auditJson = await ReadJsonAsync(auditResponse);
+
+        Assert.Equal(HttpStatusCode.OK, roleResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, memberResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, membersResponse.StatusCode);
+        Assert.Equal(HttpStatusCode.OK, permissionsResponse.StatusCode);
+        Assert.Single(membersJson.RootElement.GetProperty("items").EnumerateArray());
+        Assert.NotEmpty(auditJson.RootElement.GetProperty("items").EnumerateArray());
+    }
+
     private static async Task<(Guid TenantId, Guid UserId, string Phone)> SeedAdminAsync(
         ApiTestFactory factory,
         TenantRole role = TenantRole.TenantAdmin)