- 房间号：{drawerRoom.roomNumber}
- 楼栋：{drawerRoom.building || '-'}
- 楼层：{drawerRoom.floor ?? '-'}
- 类型：{drawerRoom.roomType || '-'}
- 额定人数：{drawerRoom.capacity}
- 租赁类别：{drawerRoom.rentalCategory === 'long' ? '长租' : '短租'}
- 月租金：{drawerRoom.monthlyRate ? `¥${drawerRoom.monthlyRate}` : '-'}
- 状态：{statusMap[drawerRoom.status]?.text}
-
- ),
- },
- {
- key: 'beds',
- label: `床位管理 (${beds.length})`,
- children: (
-
-
-
}
- disabled={drawerRoom?.status === 'archived'}
- onClick={() => { setBedEditing(null); bedForm.resetFields(); setBedModalOpen(true); }}
- >
- 添加床位
-
-
- }
- onConfirm={() => {
- const input = document.getElementById('batch-bed-count') as HTMLInputElement;
- handleBatchBeds(input ? parseInt(input.value) || 4 : 4);
- }}
- okText="生成"
- disabled={drawerRoom?.status === 'archived'}
- >
-
-
-
-
{
- const map: Record = {
- available: { text: '空闲', color: 'green' },
- occupied: { text: '占用', color: 'blue' },
- maintenance: { text: '维修', color: 'orange' },
- };
- return {map[s]?.text || s};
- },
- },
- { title: '备注', dataIndex: 'notes', render: (v: string) => v || '-' },
- {
- title: '操作', width: 120,
- render: (_: any, r: any) => (
-
- { setBedEditing(r); bedForm.setFieldsValue(r); setBedModalOpen(true); }}
- >
- 编辑
-
- {r.status !== 'occupied' && (
- handleDeleteBed(r.id)}>
-
- 删除
-
-
- )}
-
- ),
- },
- ]}
- />
-
- ),
- },
- {
- key: 'lockers',
- label: `柜子管理 (${lockers.length})`,
- children: (
-
-
-
}
- disabled={drawerRoom?.status === 'archived'}
- onClick={() => { setLockerEditing(null); lockerForm.resetFields(); setLockerModalOpen(true); }}
- >
- 添加柜子
-
-
- }
- onConfirm={() => {
- const input = document.getElementById('batch-locker-count') as HTMLInputElement;
- handleBatchLockers(input ? parseInt(input.value) || 4 : 4);
- }}
- okText="生成"
- disabled={drawerRoom?.status === 'archived'}
- >
-
-
-
-
{
- const map: Record = {
- available: { text: '空闲', color: 'green' },
- occupied: { text: '占用', color: 'blue' },
- maintenance: { text: '维修', color: 'orange' },
- };
- return {map[s]?.text || s};
- },
- },
- { title: '备注', dataIndex: 'notes', render: (v: string) => v || '-' },
- {
- title: '操作', width: 120,
- render: (_: any, r: any) => (
-
- { setLockerEditing(r); lockerForm.setFieldsValue(r); setLockerModalOpen(true); }}
- >
- 编辑
-
- {r.status !== 'occupied' && (
- handleDeleteLocker(r.id)}>
-
- 删除
-
-
- )}
-
- ),
- },
- ]}
- />
-
- ),
- },
- ]}
- />
-
-```
-
-- [ ] **Step 7: 修改"查看住户"按钮行为**
-
-将 `showDetail(record.id)` 的 onClick 改为：
-
-```typescript
-onClick={async () => {
- setDrawerRoom(record);
- setDrawerOpen(true);
- // 异步加载床位和柜子
- await Promise.all([fetchBeds(record.id), fetchLockers(record.id)]);
-}}
-```
-
-- [ ] **Step 8: 新增床位/柜子编辑 Modal**
-
-在 Drawer 之外（放在现有"添加宿舍"Modal 之后、最终 `` 之前），新增两个小型 Modal：
-
-```typescript
- {/* 床位编辑弹窗 */}
- { setBedModalOpen(false); setBedEditing(null); }}
- confirmLoading={savingBed}
- okText="保存"
- >
-
-
-
- {/* 柜子编辑弹窗 */}
- { setLockerModalOpen(false); setLockerEditing(null); }}
- confirmLoading={savingLocker}
- okText="保存"
- >
-
-
-```
-
-- [ ] **Step 9: 可删除旧的 simple detail Modal**
-
-移除第 481-502 行的旧 Modal（如果上一步已删除则跳过）。
-
-- [ ] **Step 10: Commit**
-
-```bash
-git add apps/admin/src/pages/Rooms/index.tsx
-git commit -m "feat: upgrade Room detail to Drawer with Bed/Locker tabs"
-```
-
----
-
-### Task 8: Occupancies 页面 — 入住登记改造
-
-**Files:**
-- Modify: `apps/admin/src/pages/Occupancies/index.tsx`
-
-**Consumes:** `/rooms/:id/beds/available`, `/rooms/:id/lockers/available` API
-**Produces:** 入住表单新增床位/柜子选择，表格新增床位号/柜子号列
-
-- [ ] **Step 1: 新增状态变量**
-
-在组件 state 区新增：
-
-```typescript
- const [availableBeds, setAvailableBeds] = useState([]);
- const [availableLockers, setAvailableLockers] = useState([]);
-```
-
-- [ ] **Step 2: 新增房间选择时的床位加载**
-
-```typescript
- const handleRoomChange = async (roomId: number) => {
- checkInForm.setFieldValue('bedId', undefined);
- checkInForm.setFieldValue('lockerId', undefined);
- if (!roomId) {
- setAvailableBeds([]);
- setAvailableLockers([]);
- return;
- }
- try {
- const [beds, lockers] = await Promise.all([
- api.get(`/rooms/${roomId}/beds/available`),
- api.get(`/rooms/${roomId}/lockers/available`),
- ]);
- setAvailableBeds(beds);
- setAvailableLockers(lockers);
- // 如果仅有一张可用床位，自动选中
- if (beds.length === 1) checkInForm.setFieldValue('bedId', beds[0].id);
- } catch (e) { console.error(e); }
- };
-```
-
-- [ ] **Step 3: 修改入住表单 — 在租赁方字段后新增床位/柜子**
-
-在现有入住登记 Modal 的 Form 中，`tenantId` Form.Item 之后插入：
-
-```typescript
-
-
- {availableBeds.length > 0 && (
-
- 空闲 {availableBeds.length} 张床位
-
- )}
-
-
-```
-
-- [ ] **Step 4: 修改房间选择触发加载**
-
-找到入住表单中房间的 `Form.Item`，给 Select 加 `onChange`：
-
-```typescript
-
-
-```
-
-- [ ] **Step 5: 入住提交时传 bedId/lockerId**
-
-确认 `handleCheckIn` 中 payload 包含：
-
-```typescript
- bedId: values.bedId,
- lockerId: values.lockerId || undefined,
-```
-
-- [ ] **Step 6: 表格新增床位号/柜子号列**
-
-在表格 columns 中，`宿舍` 列之后新增：
-
-```typescript
- {
- title: '床位', width: 80,
- render: (_: any, r: any) => r.bed?.bedNumber || '-',
- },
- {
- title: '柜子', width: 80,
- render: (_: any, r: any) => r.locker?.lockerNumber || '-',
- },
-```
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add apps/admin/src/pages/Occupancies/index.tsx
-git commit -m "feat: add bed/locker selection to check-in form and occupancy table"
-```
-
----
-
-### Task 9: RoomVisual 卡片 — 床位统计
-
-**Files:**
-- Modify: `apps/admin/src/pages/RoomVisual/index.tsx`
-
-**Consumes:** bed counts (可从现有 data 中扩展，或新增 API)
-**Produces:** 卡片底部显示「🛏 2/4 床」
-
-- [ ] **Step 1: 确认 API 返回 bed 数据**
-
-检查 `/rooms/visual` 返回结构是否包含床位统计。若不包含，先修改 `getRoomVisual` 方法在 `rooms.service.ts` 中添加 bed 统计：
-
-```typescript
-// 在 getRoomVisual 方法中，为每个 room 计算 bed 统计：
-const totalBeds = await this.bedRepo.count({ where: { roomId: room.id } });
-const occupiedBeds = await this.bedRepo.count({ where: { roomId: room.id, status: 'occupied' } });
-// 添加字段：totalBeds, occupiedBeds
-```
-
-- [ ] **Step 2: 在 RoomVisual 卡片底部新增床位统计**
-
-在卡片 JSX 中，`getTenantTags` 之后、`getStatusLabel` 之前的位置，新增：
-
-```typescript
-{/* 床位统计 */}
-{room.totalBeds > 0 && (
- = room.totalBeds ? '#ff4d4f' : '#52c41a', marginBottom: 4 }}>
- 床位: {room.occupiedBeds}/{room.totalBeds}
-
-)}
-```
-
-- [ ] **Step 3: 修改统计栏**
-
-将现有的 `availableBeds`（基于 capacity - currentCount）替换为基于实际 beds 统计：
-
-```typescript
- const totalBeds = rooms.reduce((sum: number, r: any) => sum + (r.totalBeds || 0), 0);
- const occupiedBeds = rooms.reduce((sum: number, r: any) => sum + (r.occupiedBeds || 0), 0);
- const availableBedsCount = totalBeds - occupiedBeds;
-```
-
-并在 Statistic 卡片中使用真实统计值。
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/admin/src/pages/RoomVisual/index.tsx apps/server/src/rooms/rooms.service.ts
-git commit -m "feat: add bed occupancy stats to RoomVisual cards"
-```
-
----
-
-### Task 10: 端到端验证 & 清理
-
-**Files:** 无新建，仅验证
-**Consumes:** 所有前序任务
-**Produces:** 验证通过的完整功能
-
-- [ ] **Step 1: 启动后端**
-
-```bash
-cd apps/server && npm run start:dev &
-```
-
-Wait for: Nest application successfully started.
-
-- [ ] **Step 2: 测试床位 API**
-
-```bash
-# 获取某房间的床位
-curl -s http://localhost:3000/api/rooms/1/beds | head -c 200
-# Expect: JSON 数组，包含 bedNumber, status 字段
-```
-
-- [ ] **Step 3: 测试入住 API（带床位）**
-
-```bash
-curl -s -X POST http://localhost:3000/api/occupancies/check-in \
- -H "Content-Type: application/json" \
- -d '{"studentId":1,"roomId":1,"checkInDate":"2026-07-09","bedId":1}' | head -c 200
-# Expect: 返回入住记录，包含 bedId
-```
-
-- [ ] **Step 4: 启动前端验证**
-
-```bash
-cd apps/admin && npm run dev
-```
-
-打开浏览器，验证：
-1. 宿舍管理 → 点击"查看住户" → 弹出 Drawer → 三个 Tab 正常切换
-2. 床位管理 Tab：可添加/编辑/删除/批量生成床位
-3. 柜子管理 Tab：同样 CRUD 操作正常
-4. 入住管理 → 入住登记 → 选房间后自动加载可用床位下拉
-5. 入住后床位状态变为"占用"
-6. 退宿后床位状态恢复"空闲"
-7. 宿舍总览卡片显示床位统计
-
-- [ ] **Step 5: 修复发现的问题并提交**
-
-```bash
-git add -A
-git commit -m "chore: E2E verification fixes for bed/locker management"
-```
-
----
-
-## Self-Review
-
-- [x] **Spec coverage**: All 8 sections covered — data model (Task 1-2), backend API (Task 3-5), occupancy integration (Task 6), frontend Drawer (Task 7), check-in form (Task 8), RoomVisual (Task 9), migration (Task 2)
-- [x] **Placeholder scan**: No TBD/TODO. All code blocks are concrete.
-- [x] **Type consistency**: `Bed`, `Locker` entity names match across tasks. `bedId`/`lockerId` field names consistent. `CreateBedDto`/`UpdateBedDto` used in both service and controller.
-- [x] **Route ordering**: Called out the critical `:roomId` vs `:id` route ordering issue in Task 5.
diff --git a/docs/superpowers/plans/2026-07-09-dingtalk-import-class-marking-plan.md b/docs/superpowers/plans/2026-07-09-dingtalk-import-class-marking-plan.md
deleted file mode 100644
index c6fcadb..0000000
--- a/docs/superpowers/plans/2026-07-09-dingtalk-import-class-marking-plan.md
+++ /dev/null
@@ -1,805 +0,0 @@
-# 钉钉导入标记班级 — 实现计划
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 在钉钉组织导入抽屉中支持标记部门为班级，导入时自动创建班级并建立师生关联。
-
-**Architecture:** 前端在 IntegrationConfig 抽屉中添加部门级「标为班级」按钮和 Modal 表单；后端 `importDingTalkUsers` 方法接收可选的 `classes[]` 参数，在单事务中先建班、再导人、最后建关联。导入时勾选的用户分配角色后即为老师，所有老师统一写入 `ClassTeacher`（`roleType='teacher'`），班级对老师为多对多。
-
-**Tech Stack:** React 19 + Ant Design 6 (前端), NestJS 11 + TypeORM 0.3 (后端), SQLite/MySQL
-
-## Global Constraints
-
-- 规范约束自 `CLAUDE.md`（恭学教育学生管理系统 — 项目约束）
-- 前端编码 agent 需注入 `ui-ux-pro-max`（Ant Design 6 交互规范）和 `vercel-react-best-practices`（性能优化）
-- 后端编码 agent 需注入 `nestjs-best-practices`
-- 所有编辑遵循现有 NestJS 模块结构
-- 敏感信息脱敏规则照旧（不涉及本次改动）
-- 遵循 skil `ponytail` full 级别约束：最简实现，不引入新依赖，不创建不必要的抽象
-
----
-
-### Task 1: 后端 — 扩展 DTO 和钉钉接口返回 deptIds
-
-**Files:**
-- Modify: `apps/server/src/sync/dto/import-users.dto.ts`
-- Modify: `apps/server/src/integration/dingtalk.service.ts:486-499`
-
-**Interfaces:**
-- Consumes: 现有 `ImportUserItemDto`, `DingOrgTreeNodeWithUsers`
-- Produces: `ImportClassItemDto`, `ImportUserItemDto.dingDeptIds`, `DingOrgTreeNodeWithUsers.users[].deptIds`
-
-- [ ] **Step 1: 扩展 ImportUsersDto，新增 ImportClassItemDto**
-
-编辑 `apps/server/src/sync/dto/import-users.dto.ts`，在现有 `ImportUserItemDto` 中加 `dingDeptIds` 字段，新增 `ImportClassItemDto` 和 `ImportUsersDto.classes`：
-
-```ts
-import {
- IsArray,
- IsString,
- IsNumber,
- IsOptional,
- IsEnum,
- ValidateNested,
-} from 'class-validator';
-import { Type } from 'class-transformer';
-
-export class ImportUserItemDto {
- @IsString()
- dingUserId: string;
-
- @IsString()
- name: string;
-
- @IsString()
- mobile: string;
-
- @IsOptional()
- @IsNumber()
- roleId: number | null;
-
- @IsArray()
- @IsNumber({}, { each: true })
- dingDeptIds: number[];
-}
-
-export class ImportClassItemDto {
- @IsNumber()
- deptId: number;
-
- @IsString()
- name: string;
-
- @IsString()
- code: string;
-
- @IsString()
- classType: string;
-
- @IsOptional()
- @IsString()
- startDate?: string;
-
- @IsOptional()
- @IsString()
- endDate?: string;
-
- @IsOptional()
- @IsNumber()
- maxStudents?: number;
-
- @IsOptional()
- @IsString()
- notes?: string;
-}
-
-export class ImportUsersDto {
- @IsOptional()
- @IsArray()
- @ValidateNested({ each: true })
- @Type(() => ImportClassItemDto)
- classes?: ImportClassItemDto[];
-
- @IsArray()
- @ValidateNested({ each: true })
- @Type(() => ImportUserItemDto)
- users: ImportUserItemDto[];
-}
-```
-
-- [ ] **Step 2: dingtalk.service.ts — fetchOrgTreeWithUsers 返回 deptIds**
-
-编辑 `apps/server/src/integration/dingtalk.service.ts`，在 `fetchOrgTreeWithUsers` 方法中保留 `dept_id_list` 到每个 user。
-
-找到第 493-498 行的 users mapping，改为：
-
-```ts
-// Before dedup: collect deptIds per user
-const userDeptMap = new Map();
-
-nodes.push({
- id: detail.dept_id,
- name: detail.name,
- parentId: detail.parent_id,
- children: [],
- users: dingUsers.map((u) => ({
- userid: u.userid,
- name: u.name,
- mobile: u.mobile,
- })),
-});
-
-// Record which departments each user belongs to
-for (const u of dingUsers) {
- if (!userDeptMap.has(u.userid)) {
- userDeptMap.set(u.userid, []);
- }
- userDeptMap.get(u.userid)!.push(detail.dept_id);
-}
-```
-
-然后在去重循环后（第 503-509 行），为每个 user 附加 deptIds：
-
-```ts
-for (const node of nodes) {
- node.users = node.users
- .filter((u) => {
- if (seenUserIds.has(u.userid)) return false;
- seenUserIds.add(u.userid);
- return true;
- })
- .map((u) => ({
- ...u,
- deptIds: userDeptMap.get(u.userid) || [],
- }));
-}
-```
-
-同步更新 `DingOrgTreeNodeWithUsers` interface：
-
-```ts
-export interface DingOrgTreeNodeWithUsers {
- id: number;
- name: string;
- parentId: number;
- children: DingOrgTreeNodeWithUsers[];
- users: Array<{
- userid: string;
- name: string;
- mobile: string;
- deptIds: number[];
- }>;
-}
-```
-
-- [ ] **Step 3: 编译验证**
-
-```bash
-cd apps/server && npx tsc --noEmit
-```
-
-Expected: no new type errors from the modified files.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/sync/dto/import-users.dto.ts apps/server/src/integration/dingtalk.service.ts
-git commit -m "feat(sync): add ImportClassItemDto and expose deptIds in org-tree-with-users"
-```
-
----
-
-### Task 2: 后端 — 改造 importDingTalkUsers 支持班级关联
-
-**Files:**
-- Modify: `apps/server/src/sync/sync.service.ts:122-199`
-- Modify: `apps/server/src/sync/sync.module.ts:16-34`
-
-**Interfaces:**
-- Consumes: `ImportClassItemDto`, `ImportUserItemDto.dingDeptIds` (from Task 1)
-- Produces: 改造后的 `importDingTalkUsers(classes?: ImportClassItemDto[], users: ImportUserItemDto[])`，返回增加 `classCount`
-
-- [ ] **Step 1: sync.module.ts — 注入 Class 和 ClassStudent Repository**
-
-SyncModule 当前未导入 `Class` 和 `ClassStudent` entity。编辑 `apps/server/src/sync/sync.module.ts`：
-
-```ts
-import {
- SyncLog, SyncState, UserDingMapping, ClassSchedule, Department,
- UserDepartment, ClassTeacher, User, Student, Role,
- Class, // 新增
- ClassStudent, // 新增
-} from '../entities';
-```
-
-并在 `TypeOrmModule.forFeature` 数组中添加 `Class, ClassStudent`。
-
-- [ ] **Step 2: sync.service.ts — constructor 注入新 repo**
-
-编辑 `apps/server/src/sync/sync.service.ts`：
-
-```ts
-import { Class } from '../entities/class.entity';
-import { ClassStudent } from '../entities/class-student.entity';
-import type { ImportClassItemDto } from './dto/import-users.dto';
-```
-
-Constructor 添加：
-
-```ts
-@InjectRepository(Class)
-private readonly classRepo: Repository,
-@InjectRepository(ClassStudent)
-private readonly classStudentRepo: Repository,
-```
-
-更新 `ImportUserDto` 接口以包含 `dingDeptIds`：
-
-```ts
-export interface ImportUserDto {
- dingUserId: string;
- name: string;
- mobile: string;
- roleId: number | null;
- dingDeptIds: number[];
-}
-```
-
-- [ ] **Step 3: 改写 importDingTalkUsers 方法签名和逻辑**
-
-将方法签名改为：
-
-```ts
-async importDingTalkUsers(
- users: ImportUserDto[],
- classes?: ImportClassItemDto[],
-): Promise<{
- teacherCount: number;
- studentCount: number;
- classCount: number;
- skipped: number;
- warnings: string[];
-}>
-```
-
-完整方法体替换为单事务版本：
-
-```ts
-async importDingTalkUsers(
- users: ImportUserDto[],
- classes?: ImportClassItemDto[],
-): Promise<{
- teacherCount: number;
- studentCount: number;
- classCount: number;
- skipped: number;
- warnings: string[];
-}> {
- const classItems = classes ?? [];
- const warnings: string[] = [];
-
- // 预检查班级编码重复
- if (classItems.length > 0) {
- const codes = classItems.map((c) => c.code);
- const existing = await this.classRepo.find({ where: codes.map((code) => ({ code } as any)) });
- if (existing.length > 0) {
- const dup = existing.map((c) => c.code).join(', ');
- throw new BadRequestException(`班级编码已存在: ${dup}`);
- }
- }
-
- let teacherCount = 0;
- let studentCount = 0;
- let skipped = 0;
-
- await this.dataSource.transaction(async (manager) => {
- // 1. 创建班级
- const deptClassMap = new Map(); // deptId -> classId
- for (const c of classItems) {
- const cls = manager.create(Class, {
- name: c.name,
- code: c.code,
- classType: c.classType,
- startDate: c.startDate ?? null,
- endDate: c.endDate ?? null,
- maxStudents: c.maxStudents ?? 0,
- notes: c.notes ?? null,
- } as any);
- await manager.save(cls);
- deptClassMap.set(c.deptId, cls.id);
- }
-
- // 2. 导入用户（逐用户）
- for (const u of users) {
- const existingMapping = await manager.findOne(UserDingMapping, {
- where: { dingUserId: u.dingUserId },
- });
- if (existingMapping) {
- skipped++;
- continue;
- }
-
- const username = `dd_${u.dingUserId}`;
- const passwordHash = await bcrypt.hash('123456', 10);
-
- const user = manager.create(User, {
- username,
- name: u.name,
- passwordHash,
- isActive: true,
- });
- await manager.save(user);
-
- let isTeacher = false;
- let isHeadTeacher = false;
-
- if (u.roleId != null) {
- const role = await manager.findOne(Role, { where: { id: u.roleId } });
- if (!role) {
- throw new BadRequestException(`角色 id=${u.roleId} 不存在`);
- }
- user.roles = [role];
- let isTeacher = false;
-
- if (u.roleId != null) {
- const role = await manager.findOne(Role, { where: { id: u.roleId } });
- if (!role) {
- throw new BadRequestException(`角色 id=${u.roleId} 不存在`);
- }
- user.roles = [role];
- await manager.save(user);
- isTeacher = true;
- teacherCount++;
- } else {
- const student = manager.create(Student, {
- name: u.name,
- phone: u.mobile || undefined,
- userId: user.id,
- status: 'active',
- });
- await manager.save(student);
- studentCount++;
- }
-
- // 钉钉映射
- const mapping = manager.create(UserDingMapping, {
- dingUserId: u.dingUserId,
- userId: user.id,
- dingName: u.name,
- dingMobile: u.mobile,
- });
- await manager.save(mapping);
-
- // 3. 建立班级关联
- if (classItems.length > 0 && u.dingDeptIds?.length > 0) {
- for (const deptId of u.dingDeptIds) {
- const classId = deptClassMap.get(deptId);
- if (!classId) continue;
-
- if (isTeacher) {
- const ct = manager.create(ClassTeacher, {
- classId,
- userId: user.id,
- roleType: 'teacher',
- } as any);
- await manager.save(ct);
- } else {
- const cs = manager.create(ClassStudent, {
- classId,
- studentId: (await manager.findOne(Student, { where: { userId: user.id } }))?.id,
- status: 'active',
- } as any);
- await manager.save(cs);
- }
- }
- }
- }
-
- // 4. 检查空班级
- for (const [deptId, classId] of deptClassMap) {
- const tc = await manager.count(ClassTeacher, { where: { classId } });
- const sc = await manager.count(ClassStudent, { where: { classId } });
- if (tc === 0 && sc === 0) {
- const cls = await manager.findOne(Class, { where: { id: classId } });
- warnings.push(`班级 "${cls?.name}" (deptId=${deptId}) 无任何师生`);
- }
- }
- });
-
- this.logger.log(
- `钉钉用户导入完成: ${teacherCount} 位老师, ${studentCount} 位学生, ${classItems.length} 个班级, ${skipped} 跳过`,
- );
- return { teacherCount, studentCount, classCount: classItems.length, skipped, warnings };
-}
-```
-
-需要新增 import：
-
-```ts
-import { BadRequestException } from '@nestjs/common';
-import { Class } from '../entities/class.entity';
-import { ClassStudent } from '../entities/class-student.entity';
-```
-
-- [ ] **Step 4: 编译验证**
-
-```bash
-cd apps/server && npx tsc --noEmit
-```
-
-Expected: no errors.
-
-- [ ] **Step 5: 更新 sync.controller.ts 调用方式**
-
-`apps/server/src/sync/sync.controller.ts` 第 57 行：
-
-```ts
-const result = await this.syncService.importDingTalkUsers(body.users);
-```
-
-改为：
-
-```ts
-const result = await this.syncService.importDingTalkUsers(body.users, body.classes);
-```
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add apps/server/src/sync/sync.module.ts apps/server/src/sync/sync.service.ts apps/server/src/sync/sync.controller.ts
-git commit -m "feat(sync): importDingTalkUsers supports class creation and teacher/student linking"
-```
-
----
-
-### Task 3: 前端 — IntegrationConfig 树节点和班级标记 Modal
-
-**Files:**
-- Modify: `apps/admin/src/pages/IntegrationConfig/index.tsx`
-
-**Interfaces:**
-- Consumes: 改造后的 `POST /sync/dingtalk/import-users` (classes + users)，DingOrgTreeNodeExt 新增 deptIds
-- Produces: 树中部门节点可标为班级，Modal 表单，导入 payload 含 classes
-
-**Skills to load before coding:**
-- `ui-ux-pro-max` — Ant Design 6 组件选型、交互细节
-- `vercel-react-best-practices` — memo、useMemo 避免无意义重渲染
-
-- [ ] **Step 1: 扩展前端类型定义**
-
-在 `IntegrationConfig/index.tsx` 的 interface 定义区域，修改 `DingOrgTreeNodeExt`：
-
-```ts
-interface DingOrgTreeNodeExt {
- id: number;
- name: string;
- parentId: number;
- children: DingOrgTreeNodeExt[];
- users: Array<{ userid: string; name: string; mobile: string; deptIds: number[] }>;
-}
-```
-
-新增 class mark 表单类型和状态：
-
-```ts
-interface ClassMarkForm {
- deptId: number;
- name: string;
- code: string;
- classType: string;
- startDate?: string;
- endDate?: string;
- maxStudents?: number;
- notes?: string;
-}
-```
-
-在组件 state 区域（第 91-101 行附近）新增：
-
-```ts
-const [classMarks, setClassMarks] = useState>({});
-const [classModalOpen, setClassModalOpen] = useState(false);
-const [classModalDept, setClassModalDept] = useState<{ id: number; name: string } | null>(null);
-const [classForm] = Form.useForm();
-```
-
-- [ ] **Step 2: 标记班级 Modal 组件**
-
-在组件内部（`handleImportUsers` 之前）添加 Modal 处理函数：
-
-```ts
-const openClassModal = (deptId: number, deptName: string) => {
- const existing = classMarks[deptId];
- if (existing) {
- classForm.setFieldsValue(existing);
- } else {
- classForm.setFieldsValue({
- deptId,
- name: deptName,
- code: '',
- classType: 'culture',
- });
- }
- setClassModalDept({ id: deptId, name: deptName });
- setClassModalOpen(true);
-};
-
-const handleClassModalOk = async () => {
- const values = await classForm.validateFields();
- setClassMarks((prev) => ({
- ...prev,
- [values.deptId]: values,
- }));
- setClassModalOpen(false);
- setClassModalDept(null);
-};
-
-const handleClassModalCancel = () => {
- setClassModalOpen(false);
- setClassModalDept(null);
-};
-```
-
-Modal JSX（放在 Drawer 之前或之后）：
-
-```tsx
-
-
-
-```
-
-需要新增 import：`Modal, DatePicker, InputNumber` from antd（已有 Modal、Drawer、Select、Input，检查是否缺少）。
-
-- [ ] **Step 3: 树节点中嵌入班级操作**
-
-在 `buildTreeData` 函数（约第 251 行）中，修改部门节点的 `title` 显示：
-
-```ts
-const buildTreeData = useCallback((nodes: DingOrgTreeNodeExt[]): DataNode[] => {
- return nodes.map((node) => ({
- title: (
-
- {node.name}
- {classMarks[node.id] ? (
- openClassModal(node.id, node.name)}
- >
- 班级: {classMarks[node.id].name} [已标记]
-
- ) : (
-
- )}
-
- ),
- key: `dept-${node.id}`,
- children: [
- ...buildTreeData(node.children),
- ...node.users.map((u) => ({
- title: (
- { /* ... existing toggle logic ... */ }}
- roleId={teacherRoles[u.userid]}
- defaultRoleId={defaultTeacherRoleId}
- roles={roles}
- onRoleChange={(newRoleId) => { /* ... existing role change logic ... */ }}
- />
- ),
- key: `user-${u.userid}`,
- isLeaf: true,
- })),
- ],
- }));
-}, [classMarks, teacherChecks, teacherRoles, defaultTeacherRoleId, roles]);
-```
-
-- [ ] **Step 4: 修改 handleImportUsers payload**
-
-编辑 `handleImportUsers`（约第 209 行），在 payload 中加上 classes：
-
-```ts
-const payload = {
- classes: Object.values(classMarks),
- users: allUsers.map((u) => ({
- dingUserId: u.userid,
- name: u.name,
- mobile: u.mobile,
- roleId: teacherChecks[u.userid]
- ? (teacherRoles[u.userid] || defaultTeacherRoleId)
- : null,
- dingDeptIds: u.deptIds || [], // 新增
- })),
-};
-```
-
-注意：`allUsers` 需要在 flatten 时也收集 deptIds。修改 flatten：
-
-```ts
-const flatten = (nodes: DingOrgTreeNodeExt[]) => {
- for (const node of nodes) {
- allUsers.push(...node.users);
- flatten(node.children);
- }
-};
-```
-
-由于 `node.users` 现在包含 `deptIds`，`allUsers` 的类型需调整。修改 `allUsers` 声明：
-
-```ts
-const allUsers: Array<{
- dingUserId: string;
- name: string;
- mobile: string;
- deptIds: number[];
-}> = [];
-```
-
-在 flatten 中 push 时展开正确字段：
-
-```ts
-allUsers.push(
- ...node.users.map((u) => ({
- dingUserId: u.userid,
- name: u.name,
- mobile: u.mobile,
- deptIds: u.deptIds || [],
- })),
-);
-```
-
-然后 payload 中 `u.deptIds` 可用。
-
-- [ ] **Step 5: 关闭抽屉时清理 classMarks**
-
-在 `onClose` 处理中（已有 `setDrawerOpen(false)` 的地方）加：
-
-```ts
-setClassMarks({});
-```
-
-- [ ] **Step 6: 编译前端验证**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-```
-
-修正所有类型错误。
-
-- [ ] **Step 7: Commit**
-
-```bash
-git add apps/admin/src/pages/IntegrationConfig/index.tsx
-git commit -m "feat(admin): add class marking modal in DingTalk org import drawer"
-```
-
----
-
-### Task 4: 后端 — 编写测试
-
-**Files:**
-- Modify: `apps/server/src/sync/sync.service.spec.ts`
-
-**Interfaces:**
-- Consumes: 改造后的 `importDingTalkUsers` (Task 2)
-- Produces: 7 个新测试用例
-
-**Skills to load before coding:**
-- Tester agent — 但不在此处写测试，而是委托给 Tester 子代理
-
-- [ ] **Step 1: 委托 Tester 子代理编写测试**
-
-由于同步服务已有完善的 mock 基础设施，直接委托 Tester 代理根据 spec 编写以下用例：
-
-1. **单部门标班级 + 1老师 + 1学生** — 验证 Class, ClassTeacher(roleType='teacher'), ClassStudent 均创建
-2. **单部门多老师** — 所有老师均写入 ClassTeacher
-3. **用户在多个被标记部门** — 同时加入多个班级的 ClassStudent 或 ClassTeacher
-4. **班级编码重复** — 事务回滚，抛出 BadRequestException
-5. **空部门（无人）** — 班级创建，返回 warning
-6. **纯学生无老师** — 班级创建，ClassStudent 正确
-7. **无 classes 参数** — 向下兼容，返回结果中 classCount=0
-
-代理需扩展 mock Manager 以支持 `Class.create/save/findOne/count` 和 `ClassStudent.create/save/count`。
-
-- [ ] **Step 2: 运行全部 sync 测试**
-
-```bash
-cd apps/server && npx jest --testPathPattern='sync.service.spec' --no-coverage
-```
-
-Expected: 全部通过。
-
-- [ ] **Step 3: Commit**
-
-```bash
-git add apps/server/src/sync/sync.service.spec.ts
-git commit -m "test(sync): add class-marking import test cases"
-```
-
----
-
-### Task 5: 端到端验证 & 清理
-
-**Files:** 无新增，仅验证
-
-- [ ] **Step 1: 启动后端**
-
-```bash
-cd apps/server && npm run start:dev
-```
-
-确认无启动错误。
-
-- [ ] **Step 2: 启动前端**
-
-```bash
-cd apps/admin && npm run dev
-```
-
-- [ ] **Step 3: 手动验证流程**
-
-1. 打开浏览器 → 钉钉集成配置页
-2. 点击「获取组织架构」→ 确认部门节点显示「🏫 标为班级」按钮
-3. 点击按钮 → Modal 弹出，部门名已预填
-4. 填写编码、班型 → 确定 → 节点显示 `🏫 班级: XXX [已标记]`
-5. 在该部门下勾选一个用户为「老师」角色
-6. 点击「导入」→ 确认成功
-7. 到班级管理页验证：班级存在、老师关联正确、学生归属正确
-
-- [ ] **Step 4: 验证向下兼容**
-
-不标记任何班级，仅勾选老师学生 → 导入 → 确认行为不变。
-
----
-
-## Self-Review Checklist
-
-1. **Spec coverage**: DTO 扩展 ✓, 服务层逻辑 ✓, 前端树节点 ✓, Modal 表单 ✓, 导入 payload ✓, 错误场景 ✓, 测试策略 ✓
-2. **Placeholder scan**: 无 TBD/TODO，所有代码块均为具体实现
-3. **Type consistency**: `ImportUserDto.dingDeptIds` 在 Task 1 DTO 和 Task 2 service 中类型一致；`ClassMarkForm` 在 Task 3 定义和使用一致
diff --git a/docs/superpowers/plans/2026-07-09-dingtalk-import-fixes.md b/docs/superpowers/plans/2026-07-09-dingtalk-import-fixes.md
deleted file mode 100644
index a838060..0000000
--- a/docs/superpowers/plans/2026-07-09-dingtalk-import-fixes.md
+++ /dev/null
@@ -1,324 +0,0 @@
-# DingTalk 导入链路修复 — 实现计划
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 修复钉钉导入链路的两个阻塞 bug：前端叶子节点判断、后端 CampusScope 过滤导致学生/考勤数据不可见。
-
-**Architecture:** 教学域（学生、考勤）移除 CampusScope 部门过滤，改为依赖 RBAC 权限码控制访问；管理域（宿舍、财务）保留 CampusScope 不变。
-
-**Tech Stack:** React 19 + TypeScript + NestJS 11 + TypeORM
-
-## Global Constraints
-
-- 遵循现有 NestJS 模块结构
-- 后端编译检查：`npx tsc --noEmit -p tsconfig.build.json`
-- 前端编译检查：`npx tsc --noEmit`
-- 不改动 `syncAll`、`importDingTalkUsers`、RBAC 权限码
-- 不改动 `OccupanciesService`、`RoomsService`、`BillsService`、`ExpensesService`（保留 CampusScope）
-
----
-
-### Task 1: 前端 — 叶子节点判断
-
-**Files:**
-- Modify: `apps/admin/src/pages/IntegrationConfig/index.tsx:375-393`
-
-**Interfaces:**
-- Consumes: `DingOrgTreeNodeExt` (has `children: DingOrgTreeNodeExt[]`, `users: Array<...>`)
-- Produces: `DataNode[]` tree nodes with conditional class-mark button
-
-- [ ] **Step 1: Read current code to confirm line numbers**
-
-Run: `read apps/admin/src/pages/IntegrationConfig/index.tsx:373-395`
-
-- [ ] **Step 2: Modify buildTreeData — add leaf-node condition**
-
-当前 `node.children` 和 `node.users` 渲染逻辑不需要改，只需要在 `title` 渲染部分（第 373–395 行）用条件包裹"标为班级"按钮：
-
-```tsx
-const buildTreeData = useCallback((nodes: DingOrgTreeNodeExt[]): DataNode[] => {
- return nodes.map((node) => ({
- title: (
-
- {node.name}
- {node.children.length === 0 && node.users.length > 0 && (
- classMarks[node.id] ? (
- openClassModal(node.id, node.name)}
- >
- 班级: {classMarks[node.id].name} [已标记]
-
- ) : (
-
- )
- )}
-
- ),
- key: `dept-${node.id}`,
- children: [
- ...buildTreeData(node.children),
- ...node.users.map((u) => ({ ... })),
- ],
- }));
-}, [classMarks, teacherChecks, teacherRoles, defaultTeacherRoleId, roles]);
-```
-
-改动要点：用 `{node.children.length === 0 && node.users.length > 0 && ( ... )}` 包裹原来的三元表达式。只有无子部门且有用户的叶子节点才显示按钮。
-
-- [ ] **Step 3: 验证 TypeScript 编译**
-
-Run: `cd /Users/tiku1/code/gongxue-base/apps/admin && npx tsc --noEmit`
-Expected: no errors
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/admin/src/pages/IntegrationConfig/index.tsx
-git commit -m "fix(admin): only show class-mark button on leaf departments in DingTalk org import"
-```
-
----
-
-### Task 2: 后端 — StudentsService 移除 CampusScope
-
-**Files:**
-- Modify: `apps/server/src/students/students.service.ts`
-
-**Interfaces:**
-- Consumes: (none external — internal change only)
-- Produces: `findAll(query)` returns `Promise` — same signature, no scope filtering
-
-- [ ] **Step 1: Read current code**
-
-Run: `read apps/server/src/students/students.service.ts`
-
-- [ ] **Step 2: Remove CampusScope import**
-
-Delete line 4:
-```typescript
-import { CampusScope } from '../common/campus-scope';
-```
-
-- [ ] **Step 3: Remove constructor parameter**
-
-SWAP lines 14-20 — remove `private readonly scope: CampusScope` and trailing comma on line 18:
-
-```typescript
- constructor(
- @InjectRepository(Student) private repo: Repository,
- @InjectRepository(ClassStudent) private classStudentRepo: Repository,
- @InjectRepository(Class) private classRepo: Repository,
- @InjectRepository(AttendanceRecord) private attendanceRepo: Repository,
- ) {}
-```
-
-- [ ] **Step 4: Remove scope.filter call in findAll**
-
-SWAP lines 22-33 — remove the `filteredWhere` intermediate. `findAll` now uses `where` directly:
-
-```typescript
- async findAll(query?: { name?: string; status?: string; includeArchived?: boolean; tenantId?: number | string }) {
- const where: FindOptionsWhere = {};
- if (query?.name) where.name = Like(`%${query.name}%`);
- if (query?.tenantId) where.tenantId = Number(query.tenantId);
- if (query?.status) {
- where.status = query.status;
- } else if (!query?.includeArchived) {
- where.status = Not(In(['archived']));
- }
- return this.repo.find({ where, order: { createdAt: 'DESC' }, relations: ['tenant'] });
- }
-```
-
-- [ ] **Step 5: Verify TypeScript compile**
-
-Run: `cd /Users/tiku1/code/gongxue-base/apps/server && npx tsc --noEmit -p tsconfig.build.json`
-Expected: no errors (ignore pre-existing errors in files not touched)
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add apps/server/src/students/students.service.ts
-git commit -m "fix(server): remove CampusScope from StudentsService, classes are teacher-managed not dept-filtered"
-```
-
----
-
-### Task 3: 后端 — AttendanceService 移除 CampusScope
-
-**Files:**
-- Modify: `apps/server/src/attendance/attendance.service.ts`
-
-**Interfaces:**
-- Consumes: (none external — internal change only)
-- Produces: all public method signatures unchanged, no scope filtering applied
-
-- [ ] **Step 1: Read current code to confirm line numbers**
-
-Run: `read apps/server/src/attendance/attendance.service.ts:1-40`
-
-- [ ] **Step 2: Remove CampusScope import (line 9)**
-
-```typescript
-import { CampusScope } from '../common/campus-scope';
-```
-→ Delete this line.
-
-- [ ] **Step 3: Remove constructor parameter (line 39)**
-
-SWAP the constructor body — remove `private readonly scope: CampusScope`:
-
-```typescript
- constructor(
- @InjectRepository(AttendanceRecord)
- private attendanceRepo: Repository,
- @InjectRepository(DingAttendanceRaw)
- private dingRawRepo: Repository,
- @InjectRepository(Class)
- private classRepo: Repository,
- @InjectRepository(Student)
- private studentRepo: Repository,
- @InjectRepository(ClassSchedule)
- private scheduleRepo: Repository,
- @InjectRepository(ClassStudent)
- private classStudentRepo: Repository,
- @InjectRepository(UserDingMapping)
- private userDingMappingRepo: Repository,
- ) {}
-```
-
-- [ ] **Step 4: Remove scope block in getSummary (lines 182-185)**
-
-Delete lines 182-185:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('ar.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-- [ ] **Step 5: Remove scope block in findAll (lines 287-290)**
-
-Delete lines 287-290:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('ar.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-- [ ] **Step 6: Remove scope blocks in getClasses (lines 327-330 and 339)**
-
-Delete lines 327-330:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('ar.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-SWAP line 339 — replace `await this.scope.filter({ id: In(classIds) })` with `{ id: In(classIds) }`:
-```typescript
- const classes = await this.classRepo.find({ where: { id: In(classIds) } });
-```
-
-- [ ] **Step 7: Remove scope block in findAllForExport (lines 422-425)**
-
-Delete lines 422-425:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('ar.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-- [ ] **Step 8: Remove scope guard in update (lines 460-463)**
-
-Delete lines 460-463:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds && !scopeIds.includes(record.departmentId)) {
- throw new NotFoundException(`AttendanceRecord ${id} not found`);
- }
-```
-
-- [ ] **Step 9: Remove scope guard in remove (lines 482-485)**
-
-Delete lines 482-485:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds && !scopeIds.includes(record.departmentId)) {
- throw new NotFoundException(`AttendanceRecord ${id} not found`);
- }
-```
-
-- [ ] **Step 10: Remove scope block in getReport (lines 494-497)**
-
-Delete lines 494-497:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('ar.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-- [ ] **Step 11: Remove scope block in getAlerts (lines 570-573)**
-
-Delete lines 570-573:
-```typescript
- const scopeIds = await this.scope.getScopeDepartmentIds();
- if (scopeIds) {
- qb.andWhere('a.departmentId IN (:...scopeIds)', { scopeIds });
- }
-```
-
-- [ ] **Step 12: Verify TypeScript compile**
-
-Run: `cd /Users/tiku1/code/gongxue-base/apps/server && npx tsc --noEmit -p tsconfig.build.json`
-Expected: no errors (ignore pre-existing errors in files not touched)
-
-- [ ] **Step 13: Commit**
-
-```bash
-git add apps/server/src/attendance/attendance.service.ts
-git commit -m "fix(server): remove CampusScope from AttendanceService, attendance is teacher-managed not dept-filtered"
-```
-
----
-
-### Task 4: 端到端验证
-
-- [ ] **Step 1: 启动后端**
-
-```bash
-cd /Users/tiku1/code/gongxue-base/apps/server && npm run start:dev
-```
-
-- [ ] **Step 2: 启动前端**
-
-```bash
-cd /Users/tiku1/code/gongxue-base/apps/admin && npm run dev
-```
-
-- [ ] **Step 3: 验证场景**
-
-1. 以非超管老师身份登录，打开集成配置页面
-2. 获取钉钉组织架构 → 确认父部门没有"标为班级"按钮，叶子部门有
-3. 标记班级、勾选老师、执行导入 → 确认导入成功
-4. 导航到学生管理页面 → 确认能看到导入的学生
-5. 导航到考勤管理页面 → 确认有数据
-
-- [ ] **Step 4: Commit verification notes**
-
-```bash
-git add -A && git commit -m "chore: end-to-end verification notes"
-```
diff --git a/docs/superpowers/plans/2026-07-09-dingtalk-sync-role-selection.md b/docs/superpowers/plans/2026-07-09-dingtalk-sync-role-selection.md
deleted file mode 100644
index de60555..0000000
--- a/docs/superpowers/plans/2026-07-09-dingtalk-sync-role-selection.md
+++ /dev/null
@@ -1,876 +0,0 @@
-# DingTalk Sync Role Selection — Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Move DingTalk user sync from Users page to IntegrationConfig page with a Drawer-based tree UI for selecting which synced users are teachers (with role assignment) vs students.
-
-**Architecture:** Backend adds two endpoints: one to fetch the DingTalk org tree with users attached, one to import users with role/student assignment. Frontend adds a "同步用户" Tab on IntegrationConfig page with a Drawer tree; removes the old sync button and mark-staff/mark-student buttons from Users page.
-
-**Tech Stack:** NestJS 11 + TypeORM 0.3 (backend), React 19 + Vite + Ant Design 6 (frontend)
-
-## Global Constraints
-
-- MUST inject superpowers:ui-ux-pro-max and superpowers:vercel-react-best-practices during implementation
-- Follow existing NestJS module patterns: entity/dto/service/controller
-- Frontend pages in `apps/admin/src/pages/` with independent directories
-- RBAC permission decorators on all new endpoints
-- Use existing `api` axios instance for frontend API calls
-- Default teacher role: "班主任" (look up by name from `/rbac/roles`)
-- `roleId: null` (not undefined) marks a user as student
-
----
-
-### Task 1: Backend — New type and fetchOrgTreeWithUsers
-
-**Files:**
-- Modify: `apps/server/src/integration/dingtalk.service.ts`
-
-**Interfaces:**
-- Produces: `DingOrgTreeNodeWithUsers` (exported interface), `fetchOrgTreeWithUsers(rootDeptId?: number): Promise`
-
-- [ ] **Step 1: Add DingOrgTreeNodeWithUsers type**
-
-After the existing `DingOrgTreeNode` interface (line ~73), add:
-
-```typescript
-/** 钉钉部门树节点（含用户），供同步用户选择器使用 */
-export interface DingOrgTreeNodeWithUsers {
- id: number;
- name: string;
- parentId: number;
- children: DingOrgTreeNodeWithUsers[];
- users: Array<{ userid: string; name: string; mobile: string }>;
-}
-```
-
-- [ ] **Step 2: Add fetchOrgTreeWithUsers method**
-
-After `fetchOrgTree` method (line ~456), add:
-
-```typescript
- /**
- * 获取钉钉组织部门树（含用户），供前端同步用户选择器使用。
- * 返回从指定 rootDeptId 开始的树，每个部门节点含 users 数组。
- */
- async fetchOrgTreeWithUsers(rootDeptId = 1): Promise {
- if (!this.configured) {
- throw new ServiceUnavailableException('钉钉未配置');
- }
- const token = await this.getAccessToken();
- const deptIds = await this.getAllDeptIds(token, rootDeptId);
-
- // 拉每个部门详情
- const nodes: DingOrgTreeNodeWithUsers[] = [];
- for (let i = 0; i < deptIds.length; i++) {
- if (i > 0) await this.delay(i);
- const detail = await this.getDeptDetail(token, deptIds[i]);
- if (!detail) continue;
-
- // 拉该部门下的用户
- const dingUsers = await this.getDeptUsers(token, deptIds[i]);
-
- nodes.push({
- id: detail.dept_id,
- name: detail.name,
- parentId: detail.parent_id,
- children: [],
- users: dingUsers.map((u) => ({
- userid: u.userid,
- name: u.name,
- mobile: u.mobile,
- })),
- });
- }
-
- // 全局去重：同一个 dingUserId 可能在多个部门出现
- const seenUserIds = new Set();
- for (const node of nodes) {
- node.users = node.users.filter((u) => {
- if (seenUserIds.has(u.userid)) return false;
- seenUserIds.add(u.userid);
- return true;
- });
- }
-
- // 组装成树
- const map = new Map();
- nodes.forEach((n) => map.set(n.id, n));
- const roots: DingOrgTreeNodeWithUsers[] = [];
- for (const node of nodes) {
- const parent = map.get(node.parentId);
- if (parent && node.id !== rootDeptId) {
- parent.children.push(node);
- } else {
- roots.push(node);
- }
- }
- return roots;
- }
-```
-
-- [ ] **Step 3: Build check**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-```
-
-Expected: no new errors (existing pre-existing errors may remain).
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/integration/dingtalk.service.ts
-git commit -m "feat: add fetchOrgTreeWithUsers to DingTalkService"
-```
-
----
-
-### Task 2: Backend — SyncService new methods
-
-**Files:**
-- Modify: `apps/server/src/sync/sync.service.ts`
-- Modify: `apps/server/src/sync/sync.module.ts`
-
-**Interfaces:**
-- Consumes: `DingOrgTreeNodeWithUsers` from Task 1
-- Produces: `getDingTalkOrgTreeWithUsers(rootDeptId?: number): Promise`, `importDingTalkUsers(users: ImportUserDto[]): Promise<{ teacherCount: number; studentCount: number; skipped: number }>`
-
-- [ ] **Step 1: Add ImportUserDto and inject new repos**
-
-In `sync.service.ts`, after existing imports, add:
-
-```typescript
-import { User } from '../entities/user.entity';
-import { Student } from '../entities/student.entity';
-import { Role } from '../entities/role.entity';
-import * as bcrypt from 'bcryptjs';
-```
-
-Add to constructor injection (after existing `mappingRepo`):
-
-```typescript
- @InjectRepository(User)
- private readonly userRepo: Repository,
- @InjectRepository(Student)
- private readonly studentRepo: Repository,
- @InjectRepository(Role)
- private readonly roleRepo: Repository,
-```
-
-Add DTO interface at top of file (before class):
-
-```typescript
-export interface ImportUserDto {
- dingUserId: string;
- name: string;
- mobile: string;
- roleId: number | null;
-}
-```
-
-- [ ] **Step 2: Add getDingTalkOrgTreeWithUsers method**
-
-After existing `getDingTalkOrgTree` method (line ~93), add:
-
-```typescript
- /** 获取钉钉组织部门树（含用户），供前端同步用户选择器使用 */
- async getDingTalkOrgTreeWithUsers(rootDeptId = 1) {
- return this.dingTalkService.fetchOrgTreeWithUsers(rootDeptId);
- }
-```
-
-- [ ] **Step 3: Add importDingTalkUsers method**
-
-After the new `getDingTalkOrgTreeWithUsers`, add:
-
-```typescript
- /**
- * 从钉钉导入用户：roleId 非 null → 老师（User + 指定角色），roleId null → 学生（User + Student）。
- * 已存在 UserDingMapping 的记录跳过。
- */
- async importDingTalkUsers(users: ImportUserDto[]): Promise<{
- teacherCount: number;
- studentCount: number;
- skipped: number;
- }> {
- let teacherCount = 0;
- let studentCount = 0;
- let skipped = 0;
-
- for (const u of users) {
- // 检查是否已存在映射
- const existing = await this.mappingRepo.findOne({
- where: { dingUserId: u.dingUserId },
- });
- if (existing) {
- skipped++;
- continue;
- }
-
- try {
- const username = u.mobile || `dd_${u.dingUserId}`;
- const passwordHash = await bcrypt.hash('123456', 10);
-
- const user = this.userRepo.create({
- username,
- name: u.name,
- passwordHash,
- isActive: true,
- });
- await this.userRepo.save(user);
-
- if (u.roleId != null) {
- // 老师：分配角色
- const role = await this.roleRepo.findOne({ where: { id: u.roleId } });
- if (role) {
- user.roles = [role];
- await this.userRepo.save(user);
- } else {
- this.logger.warn(`角色 id=${u.roleId} 不存在，用户 ${u.name} 未分配角色`);
- }
- teacherCount++;
- } else {
- // 学生：创建 Student 记录
- const student = this.studentRepo.create({
- name: u.name,
- phone: u.mobile || undefined,
- userId: user.id,
- status: 'active',
- });
- await this.studentRepo.save(student);
- studentCount++;
- }
-
- // 创建映射
- const mapping = this.mappingRepo.create({
- dingUserId: u.dingUserId,
- userId: user.id,
- dingName: u.name,
- dingMobile: u.mobile,
- });
- await this.mappingRepo.save(mapping);
- } catch (err: unknown) {
- const msg = err instanceof Error ? err.message : String(err);
- this.logger.error(`导入用户 ${u.name}(${u.dingUserId}) 失败: ${msg}`);
- }
- }
-
- this.logger.log(
- `钉钉用户导入完成: ${teacherCount} 位老师, ${studentCount} 位学生, ${skipped} 跳过`,
- );
- return { teacherCount, studentCount, skipped };
- }
-```
-
-- [ ] **Step 4: Update sync.module.ts — add User, Student, Role entities**
-
-In `TypeOrmModule.forFeature([...])` array, add `User`, `Student`, `Role` to the imports. Also add the import for them at the top:
-
-```typescript
-import {
- SyncLog,
- SyncState,
- UserDingMapping,
- ClassSchedule,
- Department,
- UserDepartment,
- ClassTeacher,
- User,
- Student,
- Role,
-} from '../entities';
-```
-
-And in the `forFeature` array after `ClassTeacher`:
-
-```typescript
- User,
- Student,
- Role,
-```
-
-- [ ] **Step 5: Build check**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-```
-
-Expected: no new errors from modified files.
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add apps/server/src/sync/sync.service.ts apps/server/src/sync/sync.module.ts
-git commit -m "feat: add importDingTalkUsers and org-tree-with-users to SyncService"
-```
-
----
-
-### Task 3: Backend — SyncController new endpoints
-
-**Files:**
-- Modify: `apps/server/src/sync/sync.controller.ts`
-
-**Interfaces:**
-- Consumes: `getDingTalkOrgTreeWithUsers`, `importDingTalkUsers` from Task 2
-
-- [ ] **Step 1: Add org-tree-with-users endpoint**
-
-After `getDingTalkOrgTree` endpoint (line ~41), add:
-
-```typescript
- /** 获取钉钉组织部门树（含用户），供同步用户选择器使用 */
- @Get('dingtalk/org-tree-with-users')
- @RequirePermission('sync:read')
- async getDingTalkOrgTreeWithUsers(@Query('rootDeptId') rootDeptId?: string) {
- const rootId = rootDeptId ? this.parseRootDeptId(rootDeptId) : 1;
- const tree = await this.syncService.getDingTalkOrgTreeWithUsers(rootId);
- return { success: true, data: tree };
- }
-```
-
-- [ ] **Step 2: Add import-users endpoint**
-
-After the new endpoint above, add:
-
-```typescript
- /** 导入钉钉用户：老师分配角色，学生创建 Student */
- @Post('dingtalk/import-users')
- @RequirePermission('sync:trigger')
- async importDingTalkUsers(@Body() body: { users: Array<{ dingUserId: string; name: string; mobile: string; roleId: number | null }> }) {
- const result = await this.syncService.importDingTalkUsers(body.users);
- return { success: true, ...result };
- }
-```
-
-Add `Body` to the imports from `@nestjs/common` at the top if not already present (check line 1 — `BadRequestException` is there, add `Body`):
-
-```typescript
-import { BadRequestException, Body, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
-```
-
-- [ ] **Step 3: Build check**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-```
-
-Expected: no new errors.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/sync/sync.controller.ts
-git commit -m "feat: add org-tree-with-users and import-users endpoints"
-```
-
----
-
-### Task 4: Frontend — Users page cleanup
-
-**Files:**
-- Modify: `apps/admin/src/pages/Users/index.tsx`
-
-- [ ] **Step 1: Remove imports**
-
-Remove from import line (line 1): `useCallback` (if only used by sync), `CloudDownloadOutlined` (line 15), `TreeSelect` (from antd imports).
-
-Check: `useCallback` is also used by `fetchData` (line 81), so keep it. Only remove `CloudDownloadOutlined` and `TreeSelect` from imports.
-
-Change antd import line (line 2-14):
-- Remove `TreeSelect` from the destructured import list.
-
-Change icons import line 15:
-- Remove `CloudDownloadOutlined` from the import.
-
-- [ ] **Step 2: Remove sync-related state and functions**
-
-Remove these state declarations (lines ~33, 37-38):
-- `const [syncing, setSyncing] = useState(false);`
-- `const [syncDeptId, setSyncDeptId] = useState(undefined);`
-- `const [orgTree, setOrgTree] = useState<...>([]);`
-
-Remove these functions:
-- `loadOrgTree` (lines ~40-53)
-- `handleSyncDingTalk` (lines ~96-113)
-- `handleMarkStaff` (lines ~187-196)
-
-- [ ] **Step 3: Remove sync button and TreeSelect from JSX**
-
-In the toolbar `` (lines ~332-368):
-- Remove the `TreeSelect` block (lines ~333-342)
-- Remove the `PermissionButton` with `permission="sync:trigger"` (lines ~351-358)
-
-- [ ] **Step 4: Remove mark-staff/mark-student buttons from columns**
-
-In the `columns` useMemo (lines ~298-307), remove the two conditional blocks:
-- Remove lines ~298-302: `record.studentStatus === 'active'` → "标记教职工" button
-- Remove lines ~303-307: `record.studentStatus === 'staff'` → "恢复学员" button
-
-Adjust the `width` of the 操作 column from `320` to `240` since we're removing two buttons.
-
-- [ ] **Step 5: Build check**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-```
-
-Expected: no new errors.
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add apps/admin/src/pages/Users/index.tsx
-git commit -m "refactor: remove sync and mark-staff buttons from Users page"
-```
-
----
-
-### Task 5: Frontend — IntegrationConfig sync users Tab + Drawer
-
-**Files:**
-- Modify: `apps/admin/src/pages/IntegrationConfig/index.tsx`
-
-**Interfaces:**
-- Consumes: `GET /sync/dingtalk/org-tree-with-users`, `POST /sync/dingtalk/import-users`, `GET /rbac/roles`
-- Produces: SyncUsersTab component with org tree Drawer, teacher selection, role assignment
-
-- [ ] **Step 1: Add new imports**
-
-Add to existing antd imports: `Tabs`, `Drawer`, `Tree`, `Checkbox`, `Select`, `TreeSelect`.
-
-Add icons: `SyncOutlined`, `ReloadOutlined`.
-
-Current import block (lines 1-8):
-
-```typescript
-import React, { useEffect, useState } from 'react';
-import {
- Card, Form, Input, Button, Space, message, Spin, Switch, Alert, Descriptions, Tag,
-} from 'antd';
-import {
- SaveOutlined, ApiOutlined, CheckCircleOutlined, CloseCircleOutlined,
-} from '@ant-design/icons';
-import api from '../../api';
-```
-
-Replace with:
-
-```typescript
-import React, { useEffect, useState, useMemo } from 'react';
-import {
- Card, Form, Input, Button, Space, message, Spin, Switch, Alert, Descriptions, Tag,
- Tabs, Drawer, Tree, Checkbox, Select, TreeSelect,
-} from 'antd';
-import {
- SaveOutlined, ApiOutlined, CheckCircleOutlined, CloseCircleOutlined,
- SyncOutlined, ReloadOutlined,
-} from '@ant-design/icons';
-import type { DataNode } from 'antd/es/tree';
-import api from '../../api';
-```
-
-- [ ] **Step 2: Add types and state for sync tab**
-
-After the existing `IntegrationConfigPage` component declaration, add new state:
-
-```typescript
- // ── Sync Users Tab ──
- const [syncRootDeptId, setSyncRootDeptId] = useState(undefined);
- const [orgTree, setOrgTree] = useState([]);
- const [drawerOpen, setDrawerOpen] = useState(false);
- const [fetchingTree, setFetchingTree] = useState(false);
- const [importing, setImporting] = useState(false);
- const [roles, setRoles] = useState>([]);
- const [defaultTeacherRoleId, setDefaultTeacherRoleId] = useState(null);
- // Department tree for the picker (no users)
- const [deptPickerTree, setDeptPickerTree] = useState }>>([]);
-```
-
-Add the extended tree node type before the component:
-
-```typescript
-interface DingOrgTreeNodeExt {
- id: number;
- name: string;
- parentId: number;
- children: DingOrgTreeNodeExt[];
- users: Array<{ userid: string; name: string; mobile: string }>;
-}
-```
-
-- [ ] **Step 3: Add fetch roles and fetch org tree handlers**
-
-```typescript
- const fetchRoles = async () => {
- try {
- const res: any = await api.get('/rbac/roles');
- const activeRoles = res.filter((r: any) => r.status !== 0);
- setRoles(activeRoles);
- const teacherRole = activeRoles.find((r: any) => r.name === '班主任');
- setDefaultTeacherRoleId(teacherRole?.id || activeRoles[0]?.id || null);
- } catch {
- // ignore — roles will be empty
- }
- };
-
- const loadDeptTree = async () => {
- try {
- const res: any = await api.get('/sync/dingtalk/org-tree');
- if (res.success && res.data) {
- const toTreeNode = (nodes: any[]): any[] =>
- nodes.map((n: any) => ({
- title: n.name,
- value: n.id,
- children: n.children ? toTreeNode(n.children) : undefined,
- }));
- setDeptPickerTree(toTreeNode(res.data));
- }
- } catch {
- // ignore
- }
- };
-
- const handleFetchOrgTree = async () => {
- setFetchingTree(true);
- try {
- const params: Record = {};
- if (syncRootDeptId) params.rootDeptId = String(syncRootDeptId);
- const res: any = await api.get('/sync/dingtalk/org-tree-with-users', { params });
- if (res.success && res.data) {
- setOrgTree(res.data);
- setTeacherChecks({});
- setTeacherRoles({});
- setDrawerOpen(true);
- } else {
- message.error('获取组织架构失败');
- }
- } catch (e: any) {
- message.error(e?.message || '获取组织架构失败');
- } finally {
- setFetchingTree(false);
- }
- };
-```
-
-- [ ] **Step 4: Add import handler**
-
-```typescript
- const handleImportUsers = async () => {
- setImporting(true);
- try {
- // Flatten all users from tree
- const allUsers: Array<{
- dingUserId: string;
- name: string;
- mobile: string;
- }> = [];
-
- const flatten = (nodes: DingOrgTreeNodeExt[]) => {
- for (const node of nodes) {
- allUsers.push(...node.users);
- flatten(node.children);
- }
- };
- flatten(orgTree);
-
- const payload = {
- users: allUsers.map((u) => ({
- dingUserId: u.userid,
- name: u.name,
- mobile: u.mobile,
- roleId: teacherChecks[u.userid]
- ? (teacherRoles[u.userid] || defaultTeacherRoleId)
- : null,
- })),
- };
-
- const res: any = await api.post('/sync/dingtalk/import-users', payload);
- message.success(
- `导入完成：${res.teacherCount} 位老师，${res.studentCount} 位学生` +
- (res.skipped > 0 ? `，${res.skipped} 已跳过` : ''),
- );
- setDrawerOpen(false);
- } catch (e: any) {
- message.error(e?.message || '导入失败');
- } finally {
- setImporting(false);
- }
- };
-```
-
-- [ ] **Step 5: Build tree data for Drawer**
-
-```typescript
- const buildTreeData = (nodes: DingOrgTreeNodeExt[]): DataNode[] => {
- return nodes.map((node) => ({
- title: node.name,
- key: `dept-${node.id}`,
- children: [
- // Sub-departments
- ...buildTreeData(node.children),
- // Users in this department
- ...node.users.map((u) => ({
- title: (
-
- {
- setTeacherChecks((prev) => ({
- ...prev,
- [u.userid]: e.target.checked,
- }));
- if (!e.target.checked) {
- setTeacherRoles((prev) => {
- const next = { ...prev };
- delete next[u.userid];
- return next;
- });
- }
- }}
- >
- 老师
-
- {u.name}
- {u.mobile && (
- {u.mobile}
- )}
- {teacherChecks[u.userid] && (
-
- ),
- key: `user-${u.userid}`,
- selectable: false,
- })),
- ],
- }));
- };
-```
-
-- [ ] **Step 6: Build tree data memoized**
-
-```typescript
- const treeData = useMemo(() => buildTreeData(orgTree), [orgTree, teacherChecks, teacherRoles, defaultTeacherRoleId, roles]);
-```
-
-- [ ] **Step 7: Replace page root with Tabs**
-
-Replace the entire `return (...)` block. The page root becomes:
-
-```typescript
- const syncTabItems = config
- ? [
- {
- key: 'sync-users',
- label: '同步用户',
- children: (
-
-
-
- setSyncRootDeptId(v)}
- placeholder="选择起始部门（不选=全部）"
- allowClear
- treeDefaultExpandAll
- style={{ minWidth: 240 }}
- onDropdownVisibleChange={(open) => { if (open) loadDeptTree(); }}
- />
- }
- loading={fetchingTree}
- onClick={handleFetchOrgTree}
- >
- 获取组织架构
-
-
- {drawerOpen && (
-
setDrawerOpen(false)}
- width={520}
- footer={
-
-
- }
- loading={importing}
- onClick={handleImportUsers}
- >
- 导入
-
-
- }
- >
- {treeData.length > 0 ? (
-
- ) : (
-
- )}
-
- )}
-
-
-
- setCheckedKeys(checked as React.Key[])}
- />
-
-
-
- setClassModalOpen(true)}>+ 创建班级}>
- (
- setSelectedClassId(cls.id)}
- style={{
- cursor: 'pointer',
- background: selectedClassId === cls.id ? '#e6f4ff' : undefined,
- borderRadius: 4,
- padding: '8px 12px',
- }}
- >
-
-
- )}
- />
-
-
-
-
- {/* 创建班级 Modal */}
- { setClassModalOpen(false); classForm.resetFields(); }}
- confirmLoading={importing}
- destroyOnClose
- >
-
-
-
-```
-
-- [ ] **Step 8: Delete old code**
-
-Remove: `UserTreeNode` component, `teacherChecks`/`teacherRoles`/`classMarks`/`classModalDept` state, `handleToggleTeacher`/`handleClassModalOk`/`handleClassModalCancel`/`handleImportUsers` callbacks, `buildTreeData` (old version), per-department class mark modal, role fetch logic.
-
-- [ ] **Step 9: Verify compile**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-```
-
-- [ ] **Step 10: Commit**
-
-```bash
-git add apps/admin/src/pages/IntegrationConfig/index.tsx
-git commit -m "feat: rewrite sync drawer with checkable tree + class batch import"
-```
-
----
-
-### Task 7: Cleanup tests
-
-**Files:**
-- Modify: `apps/server/src/sync/sync.service.spec.ts` — swap UserDingMapping → StudentDingMapping, remove User-related mocks
-- Modify: `apps/server/src/attendance/attendance.service.spec.ts` — same swap
-
-- [ ] **Step 1: Fix sync.service.spec.ts**
-
-Replace all `UserDingMapping` with `StudentDingMapping`. Remove `userRepo`, `roleRepo`, `bcrypt` mocks. Update test cases that tested `importDingTalkUsers` — those tests are removed (the method is gone in Task 4). Keep only remaining tests.
-
-- [ ] **Step 2: Fix attendance.service.spec.ts**
-
-Replace `UserDingMapping` with `StudentDingMapping` in imports and mock providers.
-
-- [ ] **Step 3: Verify compile**
-
-```bash
-cd apps/server && npx tsc --noEmit
-cd apps/admin && npx tsc --noEmit
-```
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/sync/sync.service.spec.ts apps/server/src/attendance/attendance.service.spec.ts
-git commit -m "chore: update tests for StudentDingMapping"
-```
diff --git a/docs/superpowers/plans/2026-07-09-student-role-separation.md b/docs/superpowers/plans/2026-07-09-student-role-separation.md
deleted file mode 100644
index 3ad0397..0000000
--- a/docs/superpowers/plans/2026-07-09-student-role-separation.md
+++ /dev/null
@@ -1,334 +0,0 @@
-# Student 角色分离 Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 允许管理员将钉钉同步的用户标记为"教职工"（摘掉 Student），使其不在学员管理中出现，且下次同步不恢复。
-
-**Architecture:** 利用 Student.status 新增值 `'staff'`，rbac 模块加两个端点，syncOneUser 加防护逻辑，前端加操作按钮。
-
-**Tech Stack:** NestJS + TypeORM + React 19 + Ant Design 6
-
-## Global Constraints
-
-- Student.status 是 varchar，`'staff'` 是新增有效值，无需数据库迁移
-- 物理删除 User 已禁止（必须先归档），本方案不涉及 User CRUD 修改
-- 同步时不覆盖 `status != 'active'` 的 Student
-
----
-
-### Task 1: syncOneUser 防护 — 不覆盖非 active 的 Student
-
-**Files:**
-- Modify: `apps/server/src/integration/dingtalk.service.ts` (syncOneUser 方法内)
-
-**Interfaces:**
-- Consumes: `Student.status` (现有字段)
-- Produces: 无新增接口，行为变更
-
-- [ ] **Step 1: 定位 syncOneUser 中创建/更新 Student 的代码**
-
-当前逻辑（约 line 497-520）：新用户创建 Student，已有用户 backfill Student。
-
-- [ ] **Step 2: 在创建/更新 Student 前加防护**
-
-在 `syncOneUser` 中，创建新 Student 和 backfill 已有 Student 之前，都先检查是否已有 status 为非 active 的记录：
-
-```typescript
-// 在创建 Student 之前（约 line 497）:
-// 检查是否已被手动标记为教职工/毕业/退训
-const existingStudent = await this.studentRepo.findOne({ where: { userId: user.id } });
-if (existingStudent && existingStudent.status !== 'active') {
- // 用户已被标记为非学员状态，不覆盖
- return;
-}
-
-// 创建新 Student（原有逻辑，在防护之后）
-const student = this.studentRepo.create({
- name: du.name,
- phone: du.mobile || undefined,
- userId: user.id,
- status: 'active',
-});
-await this.studentRepo.save(student);
-```
-
-同样在 backfill 分支（约 line 510）也加相同检查：
-
-```typescript
-// backfill 分支：已有 User 但没有 Student
-const existingStudent = await this.studentRepo.findOne({ where: { userId: user.id } });
-if (!existingStudent || existingStudent.status === 'active') {
- // 只在没有 Student 或 Student 为 active 时才 backfill
- if (!existingStudent) {
- const student = this.studentRepo.create({ ... });
- await this.studentRepo.save(student);
- }
-}
-```
-
-- [ ] **Step 3: 编译检查**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-```
-
-Expected: no errors.
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/integration/dingtalk.service.ts
-git commit -m "feat: syncOneUser skips Students with non-active status"
-```
-
----
-
-### Task 2: RBAC mark-staff / mark-student 端点
-
-**Files:**
-- Modify: `apps/server/src/rbac/rbac.service.ts`
-- Modify: `apps/server/src/rbac/rbac.controller.ts`
-
-**Interfaces:**
-- Produces: `PUT /rbac/users/:id/mark-staff` → `{ message: string }`
-- Produces: `PUT /rbac/users/:id/mark-student` → `{ message: string }`
-
-- [ ] **Step 1: 注入 Student repo 到 RbacService**
-
-在 `apps/server/src/rbac/rbac.service.ts`:
-
-```typescript
-import { Student } from '../entities';
-
-// constructor 中新增:
-@InjectRepository(Student)
-private readonly studentRepo: Repository,
-```
-
-在 `apps/server/src/rbac/rbac.module.ts` 中 `TypeOrmModule.forFeature` 加入 `Student`。
-
-- [ ] **Step 2: 添加 markAsStaff 方法**
-
-```typescript
-async markAsStaff(userId: number) {
- const student = await this.studentRepo.findOne({ where: { userId } });
- if (!student) throw new Error('该用户没有学员记录');
- await this.studentRepo.update(student.id, { status: 'staff' });
- return { message: '已标记为教职工' };
-}
-
-async markAsStudent(userId: number) {
- const student = await this.studentRepo.findOne({ where: { userId } });
- if (!student) throw new Error('该用户没有学员记录');
- await this.studentRepo.update(student.id, { status: 'active' });
- return { message: '已恢复为学员' };
-}
-```
-
-- [ ] **Step 3: 添加 Controller 端点**
-
-在 `apps/server/src/rbac/rbac.controller.ts` 中的用户管理区域添加：
-
-```typescript
-@Put('users/:id/mark-staff')
-@RequirePermission('user:edit')
-async markAsStaff(@Param('id') id: string) {
- try {
- return await this.rbacService.markAsStaff(+id);
- } catch (e: unknown) {
- const err = e as { message?: string };
- throw new BadRequestException(err?.message);
- }
-}
-
-@Put('users/:id/mark-student')
-@RequirePermission('user:edit')
-async markAsStudent(@Param('id') id: string) {
- try {
- return await this.rbacService.markAsStudent(+id);
- } catch (e: unknown) {
- const err = e as { message?: string };
- throw new BadRequestException(err?.message);
- }
-}
-```
-
-路由顺序检查：`users/:id/mark-staff` 在 `users/:id/password` 之后，`users/:id/archive` 之前，无冲突。
-
-- [ ] **Step 4: 更新 findAllUsers 返回 Student.status**
-
-在 `findAllUsers` 的返回映射中加入 student status：
-
-```typescript
-// 在 findAllUsers 方法中，先批量查 Student
-const userIds = users.map((u) => u.id);
-const students = await this.studentRepo.find({
- where: { userId: In(userIds) },
- select: ['userId', 'status'],
-});
-const statusMap = new Map(students.map((s) => [s.userId, s.status]));
-
-return users.map((u) => ({
- // ...原有字段...
- studentStatus: statusMap.get(u.id) || null,
-}));
-```
-
-- [ ] **Step 5: 编译检查**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-```
-
-- [ ] **Step 6: Commit**
-
-```bash
-git add apps/server/src/rbac/
-git commit -m "feat: add mark-staff/mark-student endpoints for role separation"
-```
-
----
-
-### Task 3: 学员列表默认隐藏 staff
-
-**Files:**
-- Modify: `apps/server/src/students/students.service.ts`
-
-**Interfaces:**
-- Consumes: `Student.status` (现有字段)
-- Produces: `GET /students` 默认排除 status='staff'
-
-- [ ] **Step 1: 修改 findAll 默认过滤条件**
-
-在 `apps/server/src/students/students.service.ts` 的 `findAll` 方法中：
-
-```typescript
-// 在 where 条件中默认排除 staff，除非明确传了 status=staff
-if (!query.status) {
- where.status = Not('staff');
-}
-// 如果明确传了 status=staff，则按传入值查询
-```
-
-如果 `query.status` 传了 `'staff'`，则按 `staff` 过滤，否则默认排除。
-
-- [ ] **Step 2: 编译检查 + Commit**
-
-```bash
-cd apps/server && npx tsc --noEmit -p tsconfig.build.json
-git add apps/server/src/students/students.service.ts
-git commit -m "feat: Students list excludes staff by default"
-```
-
----
-
-### Task 4: 前端 — 用户管理页面加标记/恢复按钮
-
-**Files:**
-- Modify: `apps/admin/src/pages/Users/index.tsx`
-
-**Interfaces:**
-- Consumes: `GET /rbac/users?isArchived=` 返回 `studentStatus` 字段
-- Consumes: `PUT /rbac/users/:id/mark-staff`, `PUT /rbac/users/:id/mark-student`
-
-- [ ] **Step 1: 添加 handleMarkStaff 函数**
-
-```typescript
-const handleMarkStaff = async (id: number, toStaff: boolean) => {
- try {
- await api.put(`/rbac/users/${id}/${toStaff ? 'mark-staff' : 'mark-student'}`);
- message.success(toStaff ? '已标记为教职工' : '已恢复为学员');
- fetchData();
- } catch (e: unknown) {
- const err = e as { message?: string };
- message.error(err?.message || '操作失败');
- }
-};
-```
-
-- [ ] **Step 2: 在表格操作列添加按钮**
-
-在操作列中，归档按钮之后添加：
-
-```tsx
-{record.studentStatus === 'active' && (
- handleMarkStaff(record.id, true)}>
-
- 标记教职工
-
-
-)}
-{record.studentStatus === 'staff' && (
- handleMarkStaff(record.id, false)}>
-
- 恢复学员
-
-
-)}
-```
-
-- [ ] **Step 3: 编译检查 + Commit**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-git add apps/admin/src/pages/Users/index.tsx
-git commit -m "feat: add mark-staff/restore-student buttons in user management"
-```
-
----
-
-### Task 5: 前端 — 学员管理页面加 staff 筛选
-
-**Files:**
-- Modify: `apps/admin/src/pages/Students/index.tsx`
-
-- [ ] **Step 1: 检查 Students 页面现有筛选**
-
-`apps/admin/src/pages/Students/index.tsx` 已有 `statusMap` 包含 active/graduated/withdrawn/archived。
-
-- [ ] **Step 2: 添加 staff 状态到 statusMap**
-
-```typescript
-const statusMap: Record = {
- active: { text: '在读', color: 'green' },
- graduated: { text: '已毕业', color: 'blue' },
- withdrawn: { text: '已退训', color: 'red' },
- archived: { text: '已归档', color: '#999' },
- staff: { text: '教职工', color: 'purple' },
-};
-```
-
-- [ ] **Step 3: 确认可搜索 staff 状态**
-
-因为 Student findAll 已经支持 `status` 查询参数（传 `staff` 即可），前端只需把 staff 加入 Select options 即可。staff 不在默认显示中，需要主动切换状态筛选才能看到。
-
-- [ ] **Step 4: 编译检查 + Commit**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-git add apps/admin/src/pages/Students/index.tsx
-git commit -m "feat: add staff status filter in student management"
-```
-
----
-
-### Task 6: 端到端验证
-
-- [ ] **Step 1: 启动服务**
-
-```bash
-cd apps/server && npm run start:dev
-cd apps/admin && npm run dev
-```
-
-- [ ] **Step 2: 验证流程**
-
-1. 打开「账号管理」→ 确认列表中有 `studentStatus` 显示
-2. 找到一个 studentStatus='active' 的用户 → 点「标记教职工」
-3. 确认提示 "已标记为教职工"，刷新后状态变为 staff
-4. 打开「学员管理」→ 默认列表不再显示该用户
-5. 切换状态筛选到"教职工"→ 能看到该用户
-6. 回到「账号管理」→ 点「恢复学员」→ 确认恢复
-7. 模拟同步：触发 `POST /api/sync/trigger` → 确认 staff 状态的学员不被覆盖
-
-- [ ] **Step 3: Commit（如有修复）**
diff --git a/docs/superpowers/plans/2026-07-10-fix-student-import-name.md b/docs/superpowers/plans/2026-07-10-fix-student-import-name.md
deleted file mode 100644
index 473ad64..0000000
--- a/docs/superpowers/plans/2026-07-10-fix-student-import-name.md
+++ /dev/null
@@ -1,390 +0,0 @@
-# 修复学生导入姓名与账号 — 实现计划
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 修复批量导入学生时 name 填占位符 `dd_xxx`、phone 未设置的问题，改为使用前端传入的真实姓名和手机号。
-
-**Architecture:** 前端已有钉钉用户 name/mobile 数据，导入时随请求传给后端，后端直接用于创建 Student，零额外钉钉 API 调用。
-
-**Tech Stack:** NestJS + TypeORM + React + Ant Design
-
-## Global Constraints
-
-- 不改 Student entity / 数据库 schema
-- 不改 DingTalkService
-- 不改 StudentDingMapping
-- `tsc --noEmit` 编译通过
-
----
-
-### Task 1: 后端 DTO — 字段改名
-
-**Files:**
-- Modify: `apps/server/src/classes/dto/class.dto.ts`
-
-**Interfaces:**
-- Consumes: nothing
-- Produces: `CreateClassDto.users`, `BatchImportStudentsDto.users`
-
-- [ ] **Step 1: 改 BatchImportStudentsDto**
-
-`class.dto.ts` 第 136-141 行：
-
-```typescript
-export class BatchImportStudentsDto {
- @IsArray()
- @IsString({ each: true })
- @ArrayNotEmpty()
- dingUserIds: string[];
-}
-```
-
-改为：
-
-```typescript
-export class BatchImportStudentsDto {
- @IsArray()
- @ArrayNotEmpty()
- @ValidateNested({ each: true })
- @Type(() => ImportUserItem)
- users: ImportUserItem[];
-}
-
-export class ImportUserItem {
- @IsString() @IsNotEmpty()
- dingUserId: string;
-
- @IsString() @IsNotEmpty()
- name: string;
-
- @IsOptional() @IsString()
- mobile?: string;
-}
-```
-
-- [ ] **Step 2: 改 CreateClassDto**
-
-第 43-46 行，`dingUserIds` 字段：
-
-```typescript
- @IsArray()
- @IsString({ each: true })
- @IsOptional()
- dingUserIds?: string[];
-```
-
-改为：
-
-```typescript
- @IsOptional()
- @IsArray()
- @ValidateNested({ each: true })
- @Type(() => ImportUserItem)
- users?: ImportUserItem[];
-```
-
-- [ ] **Step 3: 补 import**
-
-文件头部 import 行（第 1 行），追加 `ValidateNested`：
-
-```typescript
-import { IsOptional, IsString, IsNotEmpty, IsInt, IsArray, IsDateString, IsEnum, ArrayNotEmpty, ValidateNested } from 'class-validator';
-```
-
-- [ ] **Step 4: 编译验证**
-
-```bash
-cd apps/server && npx tsc --noEmit 2>&1 | head -20
-```
-
-预期：Pass（如果后续 Task 没改完会有 type error，属于预期）
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add apps/server/src/classes/dto/class.dto.ts
-git commit -m "feat: change dingUserIds to users array with name/mobile in DTOs"
-```
-
----
-
-### Task 2: 后端 Service — 使用真实 name 和 phone
-
-**Files:**
-- Modify: `apps/server/src/classes/classes.service.ts:96-191`
-
-**Interfaces:**
-- Consumes: `BatchImportStudentsDto.users`, `CreateClassDto.users` (from Task 1)
-- Produces: updated `batchImportStudents` signature
-
-- [ ] **Step 1: 改 create() 方法**
-
-第 96-128 行，两处 `dingUserIds` → `users`：
-
-```typescript
- async create(dto: CreateClassDto) {
- const { studentIds, teachers, users, ...classData } = dto;
- …
- // batch import students by dingUserIds
- if (users?.length) {
- await this.batchImportStudents(saved.id, users);
- }
- …
- }
-```
-
-- [ ] **Step 2: 改 batchImportStudents 签名和逻辑**
-
-第 131-191 行：
-
-```typescript
- async batchImportStudents(classId: number, users: Array<{
- dingUserId: string; name: string; mobile?: string;
- }>): Promise<{ imported: number; skipped: number }> {
- const classEntity = await this.classRepo.findOne({ where: { id: classId } });
- if (!classEntity) throw new NotFoundException('班级不存在');
-
- if (users.length === 0) return { imported: 0, skipped: 0 };
-
- const dingUserIds = users.map(u => u.dingUserId);
-
- // 1. Fetch all existing ding mappings in one query
- const existingMappings = await this.studentDingMappingRepo.find({
- where: { dingUserId: In(dingUserIds) },
- });
- const dingToStudentId = new Map(existingMappings.map(m => [m.dingUserId, m.studentId]));
-
- // 2. Batch create students for new dingUserIds
- const newUsers = users.filter(u => !dingToStudentId.has(u.dingUserId));
- if (newUsers.length > 0) {
- const newStudents = newUsers.map(u =>
- this.studentRepo.create({
- name: u.name,
- phone: u.mobile || `dt_${u.dingUserId}`,
- status: 'active',
- })
- );
- const savedStudents = await this.studentRepo.save(newStudents);
-
- const newMappings = savedStudents.map((s, i) =>
- this.studentDingMappingRepo.create({ dingUserId: newUsers[i].dingUserId, studentId: s.id })
- );
- await this.studentDingMappingRepo.save(newMappings);
-
- for (let i = 0; i < newUsers.length; i++) {
- dingToStudentId.set(newUsers[i].dingUserId, savedStudents[i].id);
- }
- }
-
- // 3. Fetch existing class-student links in one query
- const allStudentIds = Array.from(dingToStudentId.values());
- … // 不变
- }
-```
-
-- [ ] **Step 3: 编译验证**
-
-```bash
-cd apps/server && npx tsc --noEmit 2>&1 | head -20
-```
-
-预期：Pass
-
-- [ ] **Step 4: Commit**
-
-```bash
-git add apps/server/src/classes/classes.service.ts
-git commit -m "fix: use real name and phone from frontend when importing students"
-```
-
----
-
-### Task 3: 后端 Controller — 传参修正
-
-**Files:**
-- Modify: `apps/server/src/classes/classes.controller.ts:93-98`
-
-**Interfaces:**
-- Consumes: `BatchImportStudentsDto.users` (from Task 1)
-- Produces: nothing new
-
-- [ ] **Step 1: 改 controller 传参**
-
-第 97 行：
-
-```typescript
- return this.service.batchImportStudents(+id, dto.users);
-```
-
-- [ ] **Step 2: 编译验证**
-
-```bash
-cd apps/server && npx tsc --noEmit 2>&1 | head -20
-```
-
-预期：Pass
-
-- [ ] **Step 3: Commit**
-
-```bash
-git add apps/server/src/classes/classes.controller.ts
-git commit -m "fix: pass dto.users instead of dto.dingUserIds in controller"
-```
-
----
-
-### Task 4: 前端 — 传用户信息而非仅 ID
-
-**Files:**
-- Modify: `apps/admin/src/pages/IntegrationConfig/index.tsx`
-
-**Interfaces:**
-- Consumes: `orgTree` (state), `checkedKeys` (state)
-- Produces: updated API call payloads
-
-- [ ] **Step 1: 写 extractCheckedUsers 工具函数**
-
-在 `handleJoinClass` 上方插入：
-
-```typescript
- const extractCheckedUsers = useCallback((): Array<{ dingUserId: string; name: string; mobile?: string }> => {
- const result: Array<{ dingUserId: string; name: string; mobile?: string }> = [];
- const walk = (nodes: DingOrgTreeNodeExt[]) => {
- for (const node of nodes) {
- for (const u of node.users) {
- if (checkedKeys.includes(`user-${u.userid}`)) {
- result.push({ dingUserId: u.userid, name: u.name, mobile: u.mobile || undefined });
- }
- }
- walk(node.children);
- }
- };
- walk(orgTree);
- return result;
- }, [checkedKeys, orgTree]);
-```
-
-- [ ] **Step 2: 改 handleJoinClass**
-
-第 212-231 行，旧代码：
-
-```typescript
- const handleJoinClass = async () => {
- if (selectedClassId === null) return message.warning('请先选择一个班级');
- const userIds = checkedKeys
- .filter((k) => String(k).startsWith('user-'))
- .map((k) => String(k).replace('user-', ''));
- if (userIds.length === 0) return message.warning('请勾选要导入的用户');
-
- setImporting(true);
- try {
- const res = await api.post(`/classes/${selectedClassId}/students/import`, { dingUserIds: userIds });
- message.success(`导入 ${res.imported} 人，跳过 ${res.skipped} 人`);
- setCheckedKeys([]);
- setSelectedClassId(null);
- } catch (e: unknown) {
- const err = e as { message?: string };
- message.error(err?.message || '导入失败');
- } finally {
- setImporting(false);
- }
- };
-```
-
-改为：
-
-```typescript
- const handleJoinClass = async () => {
- if (selectedClassId === null) return message.warning('请先选择一个班级');
- const users = extractCheckedUsers();
- if (users.length === 0) return message.warning('请勾选要导入的用户');
-
- setImporting(true);
- try {
- const res = await api.post(`/classes/${selectedClassId}/students/import`, { users });
- message.success(`导入 ${res.imported} 人，跳过 ${res.skipped} 人`);
- setCheckedKeys([]);
- setSelectedClassId(null);
- } catch (e: unknown) {
- const err = e as { message?: string };
- message.error(err?.message || '导入失败');
- } finally {
- setImporting(false);
- }
- };
-```
-
-- [ ] **Step 3: 改 handleCreateClass**
-
-第 233-251 行：
-
-```typescript
- const handleCreateClass = async () => {
- try {
- const values = await classForm.validateFields();
- const users = extractCheckedUsers();
- await api.post('/classes', { ...values, users });
- message.success('班级创建成功');
- setClassModalOpen(false);
- classForm.resetFields();
- setCheckedKeys([]);
- fetchClasses();
- } catch (e: unknown) {
- const err = e as { message?: string };
- message.error(err?.message || '创建失败');
- } finally {
- setImporting(false);
- }
- };
-```
-
-（关键变更：`dingUserIds: userIds` → `users`，删除手动的 `.filter().map()` 逻辑）
-
-- [ ] **Step 4: 前端编译验证**
-
-```bash
-cd apps/admin && npx tsc --noEmit 2>&1 | head -20
-```
-
-预期：Pass
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add apps/admin/src/pages/IntegrationConfig/index.tsx
-git commit -m "fix: pass user name and mobile to backend when importing students"
-```
-
----
-
-### Task 5: 端到端验证
-
-- [ ] **Step 1: 后端全量编译**
-
-```bash
-cd apps/server && npx tsc --noEmit
-```
-
-预期：0 errors
-
-- [ ] **Step 2: 前端全量编译**
-
-```bash
-cd apps/admin && npx tsc --noEmit
-```
-
-预期：0 errors
-
-- [ ] **Step 3: 后端测试**
-
-```bash
-cd apps/server && npm test 2>&1 | tail -20
-```
-
-预期：现有测试全部通过
-
-- [ ] **Step 4: Commit（如有遗漏）**
-
-```bash
-git status
-```
diff --git a/docs/superpowers/plans/2026-07-13-binary-course-attendance.md b/docs/superpowers/plans/2026-07-13-binary-course-attendance.md
deleted file mode 100644
index 7d29e34..0000000
--- a/docs/superpowers/plans/2026-07-13-binary-course-attendance.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# 课程二态考勤与截止自动结算 Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** 教师课程考勤只显示已打卡/未打卡，并在课程截止后自动最终拉取、落库和完成场次。
-
-**Architecture:** 保留钉钉原始迟到状态；课程服务根据“是否存在实际打卡时间”生成临时二态结果和最终 `present/absent`。新增 Attendance 模块内的 NestJS 定时结算服务，每分钟扫描到期课程并复用导入与课程考勤服务，失败留待下一轮补偿。
-
-**Tech Stack:** NestJS 11、@nestjs/schedule 6、TypeORM 0.3、Jest、React 19、Ant Design 6。
-
-## Global Constraints
-
-- 仅调整排课关联的课程考勤。
-- 不迁移历史记录，不改变钉钉原始记录。
-- 不新增依赖、队列、兼容层或重复状态模型。
-- 课程截止后有实际打卡写 `present`，无实际打卡写 `absent`。
-- 单节失败不得阻断其他课程，后续扫描必须可补偿。
-
----
-
-### Task 1: 课程二态映射
-
-**Files:**
-- Modify: `apps/server/src/attendance/attendance.service.ts`
-- Test: `apps/server/src/attendance/attendance.lesson-session.spec.ts`
-
-**Interfaces:**
-- Produces: `createLessonAttendanceFromDingTalk(scheduleId, lessonDate, userId, finalize?)`；`finalize=false` 返回临时二态，`finalize=true` 写最终二态并完成场次。
-
-- [ ] 添加失败测试：`Late` 且有 `checkInTime` 应为 `present`；无实际时间应为 `pending`；最终结算时无时间应为 `absent` 且 session 为 `completed`。
-- [ ] 运行 `npm test -- attendance.lesson-session.spec.ts --runInBand`，确认新增断言按预期失败。
-- [ ] 将课程状态映射改为只检查课程窗口内是否存在 `checkInTime` 或 `checkOutTime`；最终结算参数控制无打卡为 `absent`，并在同一事务完成场次。
-- [ ] 再次运行相同测试，确认通过。
-
-### Task 2: 截止自动结算
-
-**Files:**
-- Create: `apps/server/src/attendance/attendance-settlement.service.ts`
-- Create: `apps/server/src/attendance/attendance-settlement.service.spec.ts`
-- Modify: `apps/server/src/attendance/attendance.module.ts`
-- Modify: `apps/server/src/app.module.ts`
-
-**Interfaces:**
-- Consumes: `AttendanceImportService.importFromDingTalk(...)`、`AttendanceService.getTeacherClassDingUserIds(...)`、`AttendanceService.createLessonAttendanceFromDingTalk(..., true)`。
-- Produces: `AttendanceSettlementService.settleEndedLessons(now?: Date): Promise`，由 `@Cron('* * * * *')` 调用。
-
-- [ ] 添加失败测试：未截止不处理、已完成不处理、到期课程最终拉取并结算、一个课程失败后继续处理下一个、昨日跨午夜课程可结算。
-- [ ] 运行 `npm test -- attendance-settlement.service.spec.ts --runInBand`，确认因服务不存在而失败。
-- [ ] 实现每分钟扫描今天普通到期课程及昨日跨午夜到期课程；逐课程捕获异常并记录；使用课程 `teacherId` 作为自动导入审计用户。
-- [ ] 在 `AttendanceModule` 注册服务，在根模块启用 `ScheduleModule.forRoot()`。
-- [ ] 再次运行相同测试，确认通过。
-
-### Task 3: 教师二态界面
-
-**Files:**
-- Modify: `apps/admin/src/pages/Attendance/attendance-workspace.ts`
-- Modify: `apps/admin/src/pages/Attendance/index.tsx`
-- Test: `apps/admin/src/pages/Attendance/attendance-workspace.test.ts`
-
-**Interfaces:**
-- Produces: `summarizeLessonCheckins(records)`，将 `present`/`late` 归为已打卡，将其余归为未打卡。
-
-- [ ] 添加失败测试：`present` 与遗留 `late` 均计入已打卡，`pending`/`absent` 计入未打卡。
-- [ ] 运行 admin 的定向测试命令并确认失败。
-- [ ] 教师抽屉改为“已打卡 / 未打卡”标签、汇总和手动修改选项；管理员档案保持原五态。
-- [ ] 再次运行定向测试，确认通过。
-
-### Task 4: 聚焦验证
-
-**Files:**
-- Verify only; no planned production edits.
-
-- [ ] 运行 server 两个定向 Jest 测试文件。
-- [ ] 运行 server `npm run typecheck`。
-- [ ] 运行 admin 定向测试与 `npm run typecheck`。
-- [ ] 用现有数据库场景确认王子琪的 `Late` 在教师视图归为已打卡、陈浩无记录归为未打卡；不修改数据库数据。
diff --git a/docs/superpowers/plans/2026-07-13-classroom-field-simplification.md b/docs/superpowers/plans/2026-07-13-classroom-field-simplification.md
deleted file mode 100644
index de54e5c..0000000
--- a/docs/superpowers/plans/2026-07-13-classroom-field-simplification.md
+++ /dev/null
@@ -1,225 +0,0 @@
-# Classroom Field Simplification Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Remove the unused classroom `courseType` and `supervisor` fields from the admin UI, API contract, persistence model, and Excel import flow.
-
-**Architecture:** Perform a clean cutover across every classroom caller. Add an idempotent bootstrap migration that drops the legacy columns on SQLite and MySQL, while leaving scheduling unchanged because schedule `subject` and class `classType` already own those concepts.
-
-**Tech Stack:** React 19, Ant Design 6, NestJS 11, TypeORM 0.3, Jest, Vitest, SQLite, MySQL 8
-
-## Global Constraints
-
-- Do not add a replacement abstraction or compatibility alias.
-- Preserve classroom name, building, floor, capacity, room type, status, and notes behavior.
-- Do not change schedule form fields or schedule conflict behavior.
-- Use test-first changes and run focused tests before package builds.
-
----
-
-### Task 1: Drop Legacy Classroom Columns
-
-**Files:**
-- Modify: `apps/server/src/database/database-migrations.spec.ts`
-- Modify: `apps/server/src/database/database-migrations.service.ts:11`
-- Modify: `apps/server/src/entities/classroom.entity.ts:23`
-
-**Interfaces:**
-- Consumes: TypeORM `DataSource`, `QueryRunner`, and the existing bootstrap migration sequence.
-- Produces: private `removeUnusedClassroomColumns(): Promise` called during application bootstrap.
-
-- [ ] **Step 1: Write failing migration tests**
-
-Extend `MigrationsPrivate` with `removeUnusedClassroomColumns(): Promise`. Add focused tests proving that the method:
-
-```typescript
-it('drops legacy classroom fields when present', async () => {
- const runner = mockRunner({
- getTable: {
- name: 'classrooms',
- columns: [{ name: 'id' }, { name: 'course_type' }, { name: 'supervisor' }],
- },
- });
- await bootstrapClassroomCleanup(runner);
-
- await service.removeUnusedClassroomColumns();
-
- expect(runner.query).toHaveBeenCalledWith('ALTER TABLE classrooms DROP COLUMN course_type');
- expect(runner.query).toHaveBeenCalledWith('ALTER TABLE classrooms DROP COLUMN supervisor');
- expect(runner.release).toHaveBeenCalled();
-});
-
-it('does nothing when classrooms or legacy fields are absent', async () => {
- const runner = mockRunner({ getTables: [], getTable: { name: 'classrooms', columns: [] } });
- await bootstrapClassroomCleanup(runner);
-
- await service.removeUnusedClassroomColumns();
-
- expect(runner.query).not.toHaveBeenCalled();
- expect(runner.release).toHaveBeenCalled();
-});
-```
-
-Use a local `bootstrapClassroomCleanup` helper matching the existing Nest testing-module setup.
-
-- [ ] **Step 2: Run tests and verify RED**
-
-Run: `npm test -w apps/server -- database/database-migrations.spec.ts --runInBand`
-
-Expected: FAIL because `removeUnusedClassroomColumns` does not exist.
-
-- [ ] **Step 3: Implement the idempotent migration**
-
-Call `await this.removeUnusedClassroomColumns();` from `onApplicationBootstrap()`. Implement the method with one query runner: inspect `classrooms`, return when absent, and issue one `ALTER TABLE classrooms DROP COLUMN ` per present legacy column. Always release the runner in `finally`.
-
-Remove these entity properties and decorators:
-
-```typescript
-courseType: string;
-supervisor: string;
-```
-
-- [ ] **Step 4: Run migration tests and verify GREEN**
-
-Run: `npm test -w apps/server -- database/database-migrations.spec.ts --runInBand`
-
-Expected: PASS.
-
-### Task 2: Remove Fields From API and Excel Import
-
-**Files:**
-- Modify: `apps/server/src/classrooms/dto/classroom.dto.ts:3`
-- Modify: `apps/server/src/classrooms/classrooms.controller.ts:48`
-- Modify: `apps/server/src/classrooms/classrooms.service.ts:126`
-- Create: `apps/server/src/classrooms/classrooms.controller.spec.ts`
-
-**Interfaces:**
-- Consumes: `CreateClassroomDto`, `UpdateClassroomDto`, classroom Excel template/import endpoints.
-- Produces: classroom requests and spreadsheets containing only `name`, `building`, `floor`, `roomType`, `capacity`, and optional `notes` where applicable.
-
-- [ ] **Step 1: Write a failing Excel contract test**
-
-Instantiate `ClassroomsController` with mocked service/log dependencies, invoke `downloadTemplate`, capture the workbook response buffer, load it with ExcelJS, and assert:
-
-```typescript
-expect(worksheet.getRow(1).values).toEqual([
- undefined,
- '教室名',
- '楼栋',
- '楼层',
- '类型',
- '容量',
-]);
-```
-
-Also assert the usage notes no longer mention course type or supervisor.
-
-- [ ] **Step 2: Run test and verify RED**
-
-Run: `npm test -w apps/server -- classrooms/classrooms.controller.spec.ts --runInBand`
-
-Expected: FAIL because the generated template still includes `课程类型` and `负责人`.
-
-- [ ] **Step 3: Remove fields from server contracts**
-
-Delete `courseType` and `supervisor` from both DTO classes. Remove them from:
-
-- template columns, example rows, and usage notes;
-- parsed import rows;
-- `batchImport` row type.
-
-Keep the existing field order `name`, `building`, `floor`, `roomType`, `capacity` consistent between export and import.
-
-- [ ] **Step 4: Run focused server tests**
-
-Run: `npm test -w apps/server -- classrooms/classrooms.controller.spec.ts database/database-migrations.spec.ts --runInBand`
-
-Expected: PASS.
-
-### Task 3: Simplify Classroom Admin UI
-
-**Files:**
-- Modify: `apps/admin/src/pages/Classrooms/index.tsx:143`
-- Create: `apps/admin/src/pages/Classrooms/classroom-fields.ts`
-- Create: `apps/admin/src/pages/Classrooms/classroom-fields.integration.test.ts`
-
-**Interfaces:**
-- Consumes: classroom records returned by `/classrooms`.
-- Produces: exported `CLASSROOM_VISIBLE_FIELDS` used to document/test the UI contract; list and form without `courseType` or `supervisor`.
-
-- [ ] **Step 1: Write a failing UI contract test**
-
-Create a small contract test:
-
-```typescript
-import { describe, expect, it } from 'vitest';
-import { CLASSROOM_VISIBLE_FIELDS } from './classroom-fields';
-
-describe('classroom visible fields', () => {
- it('excludes obsolete course and supervisor metadata', () => {
- expect(CLASSROOM_VISIBLE_FIELDS).toEqual([
- 'name',
- 'building',
- 'floor',
- 'roomType',
- 'capacity',
- 'status',
- 'notes',
- ]);
- });
-});
-```
-
-- [ ] **Step 2: Run test and verify RED**
-
-Run: `npm test -w apps/admin -- src/pages/Classrooms/classroom-fields.integration.test.ts`
-
-Expected: FAIL because `classroom-fields.ts` does not exist.
-
-- [ ] **Step 3: Implement minimal UI cleanup**
-
-Create the constant exactly as asserted. Remove the `课程类型` and `负责人` table columns and the corresponding two `Form.Item` blocks. Do not alter scheduling pages.
-
-- [ ] **Step 4: Run focused admin test**
-
-Run: `npm test -w apps/admin -- src/pages/Classrooms/classroom-fields.integration.test.ts`
-
-Expected: PASS.
-
-### Task 4: Verify Clean Cutover
-
-**Files:**
-- Verify: `apps/server/src/entities/classroom.entity.ts`
-- Verify: `apps/server/src/classrooms/`
-- Verify: `apps/admin/src/pages/Classrooms/`
-
-**Interfaces:**
-- Consumes: completed Tasks 1–3.
-- Produces: buildable admin/server packages with no classroom `courseType` or `supervisor` path.
-
-- [ ] **Step 1: Run focused tests together**
-
-Run: `npm test -w apps/server -- classrooms/classrooms.controller.spec.ts database/database-migrations.spec.ts --runInBand`
-
-Run: `npm test -w apps/admin -- src/pages/Classrooms/classroom-fields.integration.test.ts`
-
-Expected: all PASS.
-
-- [ ] **Step 2: Run package typechecks/builds**
-
-Run: `npm run typecheck -w apps/server`
-
-Run: `npm run build -w apps/admin`
-
-Expected: both exit successfully.
-
-- [ ] **Step 3: Smoke-test observable contracts**
-
-Start the existing app and verify:
-
-1. Adding/editing a classroom shows no course type or supervisor field.
-2. Classroom list shows neither obsolete column.
-3. Downloaded import template has five headers: 教室名、楼栋、楼层、类型、容量.
-4. Creating a schedule still selects and saves a classroom normally.
-
-Expected: all four scenarios succeed without console or API errors.
diff --git a/docs/superpowers/plans/casl-migration.md b/docs/superpowers/plans/casl-migration.md
deleted file mode 100644
index 7606c02..0000000
--- a/docs/superpowers/plans/casl-migration.md
+++ /dev/null
@@ -1,282 +0,0 @@
-# CASL 授权体系迁移文档
-
-## 概述
-
-NestJS 后端授权已从基于 `permissions.includes()` 的字符串匹配迁移到 CASL（`@casl/ability`）基于能力的 ABAC 授权模型。
-
-## 架构
-
-```
-┌─────────────────────────────────────────────────────────┐
-│ AuthorizationModule (@Global) │
-│ │
-│ ┌──────────────────────┐ ┌────────────────────────┐ │
-│ │ CaslAbilityFactory │ │ AuthorizationService │ │
-│ │ │ │ │ │
-│ │ createForUser(user) │ │ can(req, action, subj) │ │
-│ │ → AppAbility │ │ assert(req, ...) │ │
-│ │ │ │ canAbility(ab, ...) │ │
-│ └──────────┬───────────┘ │ assertAbility(ab, ...) │ │
-│ │ └────────────────────────┘ │
-│ ┌──────────▼───────────┐ ┌────────────────────────┐ │
-│ │ casl.constants.ts │ │ PoliciesGuard │ │
-│ │ mapPermissionCode() │ │ @CheckPolicies(…) │ │
-│ │ CaslAction/Subject │ └────────────────────────┘ │
-│ └──────────────────────┘ │
-└─────────────────────────────────────────────────────────┘
-```
-
-### 核心类型
-
-|概念|类型|说明|
-|---|---|---|
-|Action|`CaslAction`|`'manage' \| 'create' \| 'read' \| 'update' \| 'delete'`|
-|Subject|`SubjectName`|`'Student' \| 'Room' \| 'Class' \| …` (所有实体)|
-|Ability|`AppAbility`|`MongoAbility<[CaslAction, AppSubject]>`|
-|User|`AuthenticatedUser`|`{ id, username, permissions, isSuperAdmin, roles }`|
-
-### 权限码映射
-
-|旧权限码|CASL Action|CASL Subject|
-|---|---|---|
-|`student:view`|`read`|`Student`|
-|`student:create` / `student:import`|`create`|`Student`|
-|`student:edit`|`update`|`Student`|
-|`student:delete`|`delete`|`Student`|
-|`student:export`|`read`|`Student`|
-|`occupancy:checkin`|`create`|`Occupancy`|
-|`occupancy:checkout`|`update`|`Occupancy`|
-|`occupancy:transfer`|`update`|`Occupancy`|
-|`bill:generate` / `bill:confirm`|`update`|`Bill`|
-|`bill:export-excel` / `bill:export-pdf`|`read`|`Bill`|
-|`deposit:approve`|`update`|`Deposit`|
-|`sync:trigger` / `integration:trigger`|`update`|`Sync` / `Integration`|
-
-完整映射见 `apps/server/src/authorization/casl.constants.ts`。
-
-### 超管处理
-
-`isSuperAdmin === true` → `ability.can('manage', 'all')` → 所有操作全部放行。
-
-### 未知权限码处理
-
-未知/无法映射的权限码（如 `ghost:action`）→ **不产生任何 CASL ability → deny-by-default**。用户对象上仍保留完整的 `permissions` 数组用于前端菜单/日志，但授权判断拒绝未知码。
-
-## 修改文件清单
-
-### 新增文件
-
-|文件|说明|
-|---|---|
-|`apps/server/src/authorization/casl.constants.ts`|Action/Subject 定义、权限码映射函数|
-|`apps/server/src/authorization/interfaces.ts`|`AppAbility`, `AuthenticatedUser`, `PolicyHandler` 类型|
-|`apps/server/src/authorization/casl-ability.factory.ts`|CASL Ability 构建工厂|
-|`apps/server/src/authorization/authorization.service.ts`|通用授权服务（HTTP + 非 HTTP）|
-|`apps/server/src/authorization/authorization.module.ts`|@Global 模块|
-|`apps/server/src/authorization/index.ts`|桶导出|
-|`apps/server/src/authorization/decorators/check-policies.decorator.ts`|`@CheckPolicies()` 装饰器|
-|`apps/server/src/authorization/guards/policies.guard.ts`|`PoliciesGuard` CASL 策略守卫|
-|`apps/server/src/authorization/casl-ability.factory.spec.ts`|工厂测试（17 用例）|
-|`apps/server/src/authorization/authorization.service.spec.ts`|服务测试（12 用例）|
-|`apps/server/src/authorization/guards/policies.guard.spec.ts`|策略守卫测试（7 用例）|
-
-### 修改文件
-
-|文件|变更|
-|---|---|
-|`apps/server/src/auth/guards/permission.guard.ts`|注入 `CaslAbilityFactory`，用 `ability.can()` 替代 `permissions.includes()`|
-|`apps/server/src/auth/guards/permission.guard.spec.ts`|新增 CASL 授权测试（7 用例）|
-|`apps/server/src/app.module.ts`|导入 `AuthorizationModule`|
-|`apps/server/package.json`|新增 `@casl/ability` 依赖|
-|`apps/server/src/students/students.controller.ts`|注入 `AuthorizationService`，用 CASL 替代 `isSuperAdmin` 检查|
-|`apps/server/src/classes/classes.controller.ts`|同上|
-|`apps/server/src/attendance/attendance.controller.ts`|同上，修复测试兼容|
-|`apps/server/src/schedules/schedules.controller.ts`|同上|
-|`apps/server/src/dashboard/dashboard.controller.ts`|同上|
-
-## Agent Tool 使用指南
-
-CASL 授权服务**不依赖 HTTP ExecutionContext**，可在 Agent Tool、后台任务、CLI 等场景直接使用：
-
-```typescript
-import { CaslAbilityFactory } from './authorization';
-import { AuthorizationService } from './authorization';
-import { CaslAction, SubjectName } from './authorization';
-
-// 方式 1: 只构建 Ability
-const factory = app.get(CaslAbilityFactory);
-const ability = factory.createForUser({
- permissions: ['attendance:view', 'attendance:create'],
- isSuperAdmin: false,
-});
-
-if (ability.can(CaslAction.Read, SubjectName.Attendance)) {
- // 执行考勤查询
-}
-
-// 方式 2: 使用 AuthorizationService
-const authz = app.get(AuthorizationService);
-const toolAbility = factory.createForUser(user);
-authz.assertAbility(toolAbility, CaslAction.Create, SubjectName.Attendance);
-// 如果无权限，抛出 ForbiddenException
-
-// 方式 3: 通过 request-like 对象（适用于有 request 模拟的场景）
-authz.assert(
- { user: { permissions: ['student:view'], isSuperAdmin: false } },
- CaslAction.Read,
- SubjectName.Student,
-);
-```
-
-推荐 Agent Tool 使用 **方式 1+2**：先用 `factory.createForUser(user)` 构建 ability，再用 `service.canAbility/assertAbility` 检查。这种方式完全独立于 NestJS 请求生命周期。
-
-## 测试命令与结果
-
-```bash
-cd apps/server
-
-# 全部测试
-npx jest --no-coverage
-# 结果: 27 passed, 127 passed, 3 skipped
-
-# 仅 CASL 相关测试
-npx jest --no-coverage authorization/ auth/guards/permission.guard.spec.ts
-# 结果: 54 passed
-
-# 类型检查
-npx tsc -p tsconfig.build.json --noEmit
-# 结果: clean (无错误)
-```
-
-## 遗留风险 / TODO
-
-1. **`class:edit` 宽泛授权**（ponytail 标记）：拥有 `class:edit` 权限的教师目前获得全量学生/排课/考勤管理权限。理想情况下应通过 CASL conditions 限制为仅自己班级的学生。当前数据模型（需查询 `class_teacher` 关联表确定 scope）无法直接在 CASL Ability 中表达。**未降低现有权限**，保留现状并加 TODO。
-
-2. **前端权限守卫**：前端 `PermissionRoute` 组件（`apps/admin/src/auth/permission-store.ts`）仍然使用 `permissions.includes()` 检查。不影响安全性（后端是真实授权源），但可在后续迭代中统一。
-
-3. **操作日志中的权限上下文**：当前操作日志记录仍使用 `user.permissions` 数组。CASL 迁移未改变日志格式。
-
-4. **`dashboard:manage` 权限**：`dashboard` subject 在 preset permissions 中仅有 `dashboard:view`，但 dashboard.controller 检查了 `dashboard:manage`。CASL 映射将 `dashboard:manage` 的未知 action 映射为 `read`（保守），非 super_admin 用户理论上无法通过此检查。但实际上 controller 的权限守卫用的是 `@RequirePermission('dashboard:view')`，CASL 映射正常。`dashboard:manage` 仅出现在内部方法 `canManageAllDashboard` 的 permissions.includes 检查中，现已被 CASL 替代。
-
-5. **构建验证**：`npx nest build` 未在迁移中执行（jest + tsc 已覆盖编译和类型检查）。Docker 部署前建议执行一次完整构建。
-
-## Agent Tool 只读数据安全执行框架
-
-### 架构
-
-```
-┌──────────────────────────────────────────────────────────────┐
-│ AgentToolsModule (NON-HTTP — no controller) │
-│ │
-│ ┌──────────────────────┐ ┌─────────────────────────────┐ │
-│ │ AgentToolRegistry │ │ AgentToolExecutor │ │
-│ │ │ │ │ │
-│ │ listAvailable(ctx) │ │ execute(name, input, ctx) │ │
-│ │ → ToolDef[] │ │ 1. assertPermission │ │
-│ │ │ │ 2. tool.validate(input) │ │
-│ │ Filtered by exact- │ │ 3. tool.execute(…) │ │
-│ │ code permission │ │ 4. audit (best-effort) │ │
-│ └──────────────────────┘ └─────────────────────────────┘ │
-│ │
-│ Built-in tools: │
-│ ┌──────────────────────────────────────────────────────┐ │
-│ │ search_students (student:view) │ │
-│ │ get_student_basic (student:view) │ │
-│ └──────────────────────────────────────────────────────┘ │
-└──────────────────────────────────────────────────────────────┘
-```
-
-### 安全保证
-
-1. **动态暴露（listAvailable）**：只暴露 principal 拥有 exact permission 的 Tool。
-2. **执行时二次授权（execute）**：不依赖 `listAvailable`，`execute` 再次调用 `assertPermission`。
-3. **数据库 WHERE 数据范围**：`StudentAccessScope` 使用 TypeORM QueryBuilder + EXISTS 子查询，在 SQL 层面限制数据范围：
- - `manageAll`：超管或全量学生范围 → 无限制
- - `teacher`：仅 `ClassTeacher.userId` 分配班级的 active `ClassStudent`
-4. **输出白名单**：所有 Tool 输出仅限 `id, name, studentNo, gender, status, organizationId, organizationName, classIds`。`phone`, `idNumber`, `emergencyContact`, `emergencyPhone` 不进入查询 SELECT。
-5. **审计**：模块 `AI Agent Tool`，记录 tool 名、状态（success/denied/failed）、userId/username（来自 context principal）。审计写入失败不影响 Tool 调用结果。
-6. **审计脱敏**：审计 detail 绝不包含 raw input、phone、idNumber 等敏感值。
-
-### SDK 适配伪代码（provider-neutral）
-
-任何 LLM SDK（Vercel AI、LangChain、OpenAI function calling 等）都可以适配：
-
-```typescript
-// 1. 获取 NestJS 容器中的 Registry 和 Executor
-const registry = app.get(AgentToolRegistry);
-const executor = app.get(AgentToolExecutor);
-const authz = app.get(AuthorizationService);
-
-// 2. 构建可信 AgentToolContext（userId/permissions 来自服务端认证）
-const ability = abilityFactory.createForUser(authenticatedUser);
-const ctx: AgentToolContext = {
- userId: authenticatedUser.id,
- username: authenticatedUser.username,
- permissions: authenticatedUser.permissions,
- isSuperAdmin: authenticatedUser.isSuperAdmin,
- ability,
-};
-
-// 3. 动态暴露工具列表（给 LLM SDK 的 tools/functions 定义）
-const availableTools = registry.listAvailable(ctx);
-const sdkTools = availableTools.map(tool => ({
- name: tool.name,
- description: tool.description,
- // … 根据 tool 自定义参数 schema
-}));
-
-// 4. 执行 Tool 调用（带输入校验 + 二次授权 + 审计）
-const result = await executor.execute("search_students", rawInput, ctx);
-// result.status: 'success' | 'denied' | 'failed'
-// result.result: 白名单后的数据（仅 success 时）
-// result.error: 错误信息（denied/failed 时）
-```
-
-### 新增文件清单
-
-|文件|说明|
-|---|---|
-|`src/agent-tools/agent-tool.types.ts`|AgentToolContext, ToolDef, ToolExecutionResult 类型定义|
-|`src/agent-tools/agent-tool.registry.ts`|Tool 注册 + 按权限过滤暴露|
-|`src/agent-tools/agent-tool.executor.ts`|执行时二次授权 + 输入校验 + 审计|
-|`src/agent-tools/tools/search-students.tool.ts`|search_students Tool|
-|`src/agent-tools/tools/get-student-basic.tool.ts`|get_student_basic Tool|
-|`src/agent-tools/agent-tools.module.ts`|NestJS 模块（不暴露 HTTP endpoint）|
-|`src/agent-tools/index.ts`|桶导出|
-|`src/students/student-access-scope.ts`|StudentAccessScope 数据范围类型|
-|`src/agent-tools/agent-tool.executor.spec.ts`|执行器测试（19 用例）|
-|`src/agent-tools/tools/search-students.tool.spec.ts`|search_students 测试（12 用例）|
-|`src/agent-tools/tools/get-student-basic.tool.spec.ts`|get_student_basic 测试（10 用例）|
-|`src/students/students.agent-api.spec.ts`|agent-safe API 测试（17 用例）|
-
-### 修改文件
-
-|文件|变更|
-|---|---|
-|`src/authorization/authorization.service.ts`|新增 `canPermission` / `assertPermission` 方法|
-|`src/authorization/authorization.service.spec.ts`|新增 8 个 exact-code 权限检查测试|
-|`src/students/students.service.ts`|新增 `agentSearchStudents` / `agentGetStudentBasic` + `applyStudentScope`|
-|`src/app.module.ts`|导入 `AgentToolsModule`|
-|`docs/superpowers/plans/casl-migration.md`|本文档新增 Agent Tool 章节|
-
-### 测试结果
-
-```bash
-npx jest --no-coverage --forceExit
-# 结果: 31 suites, 223 passed, 3 skipped
-
-npx tsc -p tsconfig.build.json --noEmit
-# 结果: clean
-
-npx nest build
-# 结果: clean
-
-npx eslint --no-fix src/agent-tools/**/*.ts src/students/student-access-scope.ts src/authorization/authorization.service.ts
-# 结果: clean
-```
-
-### 剩余风险
-
-1. **classIds 聚合为第二查询**：对大量结果，批量聚合 classIds 的第二条查询使用 `IN (:...ids)`，在 MySQL 中 IN 子句过大时有性能上限（当前 limit 50 安全）。
-2. **`manageAll` 判定**：当前 `manageAll` = `isSuperAdmin`。若未来有非超管的全量学生范围角色，需扩展 `StudentAccessScope` 的 `manageAll` 判定逻辑。
-3. **Tool 扩展**：当前仅 `student:view` 的两个 Tool。新增 Tool 只需实现 `ToolDef` 并注册到 `AgentToolsModule`，无需修改框架代码。
diff --git a/docs/superpowers/reports/2026-07-02-add-tsbuildinfo-to-gitignore-verify.md b/docs/superpowers/reports/2026-07-02-add-tsbuildinfo-to-gitignore-verify.md
deleted file mode 100644
index b3e188d..0000000
--- a/docs/superpowers/reports/2026-07-02-add-tsbuildinfo-to-gitignore-verify.md
+++ /dev/null
@@ -1,26 +0,0 @@
-# Verification Report: add-tsbuildinfo-to-gitignore
-
-**Date**: 2026-07-02
-**Verify Mode**: light
-**Change**: Add `*.tsbuildinfo` to `.gitignore`
-
-## Checks
-
-| # | Check | Result | Detail |
-|---|-------|--------|--------|
-| 1 | Tasks complete | ✅ PASS | 3/3 tasks `[x]` |
-| 2 | Diff matches tasks | ✅ PASS | Only `.gitignore` modified |
-| 3 | Build passes | ✅ PASS | `npm run build` — 2 tasks, 2 cached |
-| 4 | Tests pass | ✅ PASS | 1 suite, 1 test, 0 failures |
-| 5 | No security issues | ✅ PASS | No secrets, no unsafe ops |
-| 6 | Code review | ⏭️ SKIP | `review_mode: off` |
-
-## Branch Handling
-
-- **Status**: handled
-- **Action**: Committed directly to `main` (local-only repo, no remote configured)
-- **Commit**: `a671980` — `tweak: add *.tsbuildinfo to .gitignore to prevent stale incremental cache`
-
-## Summary
-
-All light verification checks passed. The change is minimal (1 line in `.gitignore`) and safe.
diff --git a/docs/superpowers/reports/2026-07-02-migrate-to-turborepo-verify.md b/docs/superpowers/reports/2026-07-02-migrate-to-turborepo-verify.md
deleted file mode 100644
index fca5da6..0000000
--- a/docs/superpowers/reports/2026-07-02-migrate-to-turborepo-verify.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# Verification Report: migrate-to-turborepo
-
-- Date: 2026-07-02
-- Verify Mode: full
-
-## Summary Scorecard
-
-| Dimension | Status |
-|-----------|--------|
-| Completeness | 27/27 tasks, 3 specs, 0 remaining |
-| Correctness | 11/11 requirements covered |
-| Coherence | Followed — design decisions reflected in implementation |
-
-## Fresh Verification Evidence
-
-| Check | Command | Result |
-|-------|---------|--------|
-| Build | `npm run build` | 2 successful, FULL TURBO |
-| Test | `npm run test --workspace=apps/server` | 1 passed, 1 total |
-| Typecheck | `npm run typecheck` | 2 successful |
-
-## Completeness
-
-### Tasks: 27/27 ✅
-
-All tasks checked off in tasks.md and plan. Every task has a corresponding commit.
-
-### Spec Coverage: 3/3 specs ✅
-
-**monorepo-structure** (4 requirements):
-- Monorepo directory structure ✅ — `apps/server/`, `apps/admin/`, `packages/typescript-config/` exist
-- npm workspaces configuration ✅ — root `package.json` has `workspaces: ["apps/*", "packages/*"]`
-- Shared TypeScript configuration ✅ — `packages/typescript-config/` with base/nestjs/react-vite presets
-- Docker Compose path compatibility ✅ — `docker-compose.yml` build contexts updated
-
-**turborepo-pipeline** (3 requirements):
-- Turbo pipeline configuration ✅ — `turbo.json` with build/dev/lint/test/format/typecheck
-- Unified root scripts ✅ — root `package.json` delegates to `turbo run`
-- Independent workspace scripts ✅ — workspace package.json files retain own scripts
-
-**oxlint-oxfmt-toolchain** (4 requirements):
-- oxfmt replaces Prettier ✅ — `.oxfmtrc.json` at root, Prettier configs removed
-- Admin oxlint replaces ESLint ✅ — `apps/admin/package.json` uses oxlint, ESLint removed
-- Server retains ESLint ✅ — ESLint config preserved, Prettier integration removed
-- Pre-existing Prettier/ESLint cleanup ✅ — no Prettier remnants in config files
-
-## Correctness
-
-All 11 spec requirements have verifiable implementation evidence in the repository. No requirement-to-implementation divergence detected. The implementation is a structural migration — all changes are in config files (package.json, tsconfig, eslint config, turbo.json, docker-compose.yml, oxlint config, oxfmt config), with zero business logic modifications.
-
-## Coherence
-
-### Design Adherence
-
-| Design Decision | Implementation Evidence |
-|----------------|------------------------|
-| git mv for history preservation | 137 file renames at 100% similarity |
-| npm workspaces (apps/*, packages/*) | Root package.json workspaces field |
-| Turborepo pipeline | turbo.json with 6 tasks |
-| oxfmt unified formatting | .oxfmtrc.json at root |
-| Admin oxlint + Server ESLint | Respective lint scripts and configs |
-| @gongxue/typescript-config shared | packages/typescript-config/ with exports |
-| TS ~6.0.2 unified | Both server and admin devDependencies |
-| Docker container names unchanged | docker-compose.yml confirms |
-
-### Delta Spec vs Design Doc
-
-No conflicts detected. Design doc decisions align with delta spec requirements. No implementation divergence to document.
-
-## Issues
-
-**CRITICAL**: None
-
-**WARNING**: None
-
-**SUGGESTION**:
-- Docker daemon was unavailable during verification; build contexts are correct but runtime verification deferred
-
-## Final Assessment
-
-**All checks passed. Ready for archive.**
diff --git a/docs/superpowers/reports/2026-07-02-rbac-refactor-verify.md b/docs/superpowers/reports/2026-07-02-rbac-refactor-verify.md
deleted file mode 100644
index 3a5fb6f..0000000
--- a/docs/superpowers/reports/2026-07-02-rbac-refactor-verify.md
+++ /dev/null
@@ -1,85 +0,0 @@
-# RBAC 鉴权重构 — 验证报告
-
-- **Change**: rbac-refactor
-- **Date**: 2026-07-02
-- **Verify Mode**: full
-- **Commits**: 22 (78676a1 → d159615)
-- **Files Changed**: ~50+ (核心变更)
-
-## 1. 构建验证
-
-| 检查项 | 结果 | 证据 |
-|--------|------|------|
-| Backend TypeScript 编译 | PASS | `npx tsc --noEmit` exit 0, 零错误 |
-| Frontend TypeScript 编译 | PASS | `npx tsc -b --noEmit` exit 0, 零错误 |
-| Frontend Vite 生产构建 | PASS | `npx vite build` exit 0, 构建成功 |
-
-## 2. 任务完成度
-
-| 检查项 | 结果 |
-|--------|------|
-| tasks.md 全部勾选 | PASS (0 unchecked) |
-| Plan 全部勾选 | PASS (0 unchecked) |
-
-## 3. 设计决策对照
-
-| 决策 | 实现状态 |
-|------|---------|
-| RBAC 数据模型 (User↔Role↔Permission) | ✅ Permission, Role 实体 + ManyToMany 关联 |
-| 权限码 module:action 格式 | ✅ 51 个权限码按 13 个 group 组织 |
-| @RequirePermission OR 语义 | ✅ PermissionGuard.getAllAndMerge 扁平匹配 |
-| PermissionGuard 全局 + @Public 豁免 | ✅ APP_GUARD 注册，@Public 跳过检查 |
-| JWT payload {sub, username, permissions} | ✅ login() 调用 getUserPermissions 打入 |
-| 独立 RbacModule | ✅ forwardRef 解决 AuthModule 循环依赖 |
-| 种子数据幂等 | ✅ orIgnore() INSERT，onModuleInit 触发 |
-| PermissionButton 隐藏（非禁用） | ✅ return null 实现 |
-| TypeORM synchronize 保留 | ✅ 保留 synchronize: true（dev mode） |
-
-## 4. Proposal 目标达成
-
-| 目标 | 状态 |
-|------|------|
-| RBAC 实体层：Role/Permission 四表 | ✅ |
-| 权限守卫：@RequirePermission + PermissionGuard | ✅ |
-| User 实体迁移：移除 role/allowedMenus | ✅ |
-| 种子数据：4 预置角色 + 权限点 | ✅ |
-| 前端权限管理界面 | ✅ Roles + Permissions 页 |
-| 前端权限适配：路由/按钮/菜单 | ✅ |
-| 权限点定义：覆盖所有模块 | ✅ 13 groups, 51 codes |
-
-## 5. Capabilities 实现
-
-| Capability | 状态 |
-|------------|------|
-| db-migration | ⚠️ 跳过（保留 synchronize 模式） |
-| rbac-core | ✅ 实体 + 服务层 + 种子数据 |
-| permission-guard | ✅ PermissionGuard + @Public + @RequirePermission |
-| permission-admin-ui | ✅ Roles CRUD + Permissions 只读展示 |
-
-## 6. 安全性检查
-
-| 检查项 | 结果 |
-|--------|------|
-| 无硬编码密钥 | PASS |
-| 所有 API 受权限保护 | PASS（全局 PermissionGuard + @RequirePermission） |
-| @Public 不可绕过 | PASS（handler + class 层双重检查） |
-| 系统角色不可删除 | PASS（isSystem 检查） |
-| admin 用户不可删除 | PASS（username 检查） |
-
-## 7. 代码审查
-
-- 最终审查模式：standard
-- 审查模型：Fable
-- 发现问题：3 IMPORTANT
-- 修复状态：全部修复 + 复查 APPROVED
-
-## 8. 最终判定
-
-**VERDICT: PASS**
-
-所有检查通过。建议进入归档阶段。
-
-## 9. 已知偏差
-
-- TypeORM Migration 脚本未创建（保留 synchronize: true，种子数据通过 onModuleInit 幂等插入）
-- e2e 测试未实现（项目原无 e2e 测试基础设施）
diff --git a/docs/superpowers/reports/2026-07-03-admin-responsive-adaptation-verify.md b/docs/superpowers/reports/2026-07-03-admin-responsive-adaptation-verify.md
deleted file mode 100644
index b6bcda7..0000000
--- a/docs/superpowers/reports/2026-07-03-admin-responsive-adaptation-verify.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Verification Report: admin-responsive-adaptation
-
-**Date:** 2026-07-03
-**Verify Mode:** full
-**Review Mode:** off (纯 UI/CSS props 改动，无业务逻辑变更)
-
-## Summary
-
-| Dimension | Status |
-|-----------|--------|
-| Completeness | 56/56 tasks ✅ |
-| Correctness | 8/8 requirements covered ✅ |
-| Coherence | Design decisions followed ✅ |
-| Build | Pass ✅ (`npm run build` exit 0) |
-| Code Review | Skipped — review_mode:off |
-
-## Completeness
-
-All 56 tasks completed and checked off in tasks.md.
-
-**Implementation commits (15):**
-```
-dff74fc feat: 建立三断点 CSS 体系，替换单断点移动端样式
-3a1c406 feat: MainLayout 三端布局重构，使用 antd Grid.useBreakpoint()
-456261e feat: Dashboard 响应式网格，统计卡片/图表/工具栏适配三端
-339ff47 feat: 学生管理字段拆分（学号/身份证分列），表格和工具栏响应式适配
-49f8044 feat: 宿舍管理表格添加 scroll 横向滚动
-db4fcf1 feat: 入住管理表格添加 scroll 横向滚动
-b5a97ab feat: 费用录入两个表格添加 scroll 横向滚动
-a5c4570 feat: 押金管理表格添加 scroll 横向滚动
-4e6a3f4 feat: 账单管理表格添加 scroll，详情内嵌表格也添加 scroll
-8c555a4 feat: 教室管理表格添加 scroll 横向滚动
-39b3df0 feat: 租赁方表格添加 scroll 横向滚动
-a6165fd feat: 角色管理工具栏添加 flexWrap 响应式适配
-ea42b72 feat: 权限一览工具栏添加 flexWrap 响应式适配
-2137c7a feat: 账号管理工具栏添加 flexWrap 响应式适配
-4993d2b feat: 登录卡片改为 maxWidth + calc 响应式宽度
-```
-
-**Changed files:** 17 (15 source + 2 documentation)
-
-## Correctness — Requirement Implementation
-
-| Requirement | Status | Evidence |
-|-------------|--------|----------|
-| 1. Three-breakpoint responsive system | ✅ | `index.css` @media rules + `MainLayout.tsx` useBreakpoint() |
-| 2. Table horizontal scroll on narrow screens | ✅ | All 12 table pages have `scroll={{ x }}` |
-| 3. Login page responsiveness | ✅ | `Login/index.tsx` maxWidth + calc |
-| 4. Dashboard responsive grid | ✅ | `Dashboard/index.tsx` Col xs/sm/md |
-| 5. Modal responsiveness | ✅ | `index.css` max-width: calc(100vw - 24px) |
-| 6. Page toolbar responsive wrapping | ✅ | All pages have flexWrap + gap |
-| 7. Student fields separation | ✅ | 学号/身份证 split into two columns |
-| 8. Classroom schedule table scrolling | ✅ | Existing overflowX:auto + sticky column |
-
-## Coherence — Design Adherence
-
-| Design Decision | Status |
-|----------------|--------|
-| antd Grid.useBreakpoint() | ✅ Followed |
-| CSS: antd Props first, @media fallback | ✅ Followed |
-| Table scroll={{ x }} on all tables | ✅ Followed |
-| Modal CSS max-width global constraint | ✅ Followed |
-| Dashboard Col responsive breakpoints | ✅ Followed |
-| ECharts width: 100% | ✅ Followed |
-| Login card maxWidth + calc | ✅ Followed |
-| Student field split with ellipsis | ✅ Followed |
-
-## Issues
-
-**CRITICAL:** 0
-**WARNING:** 0
-**SUGGESTION:** 0
-
-## Final Assessment
-
-All checks passed. No critical issues, no warnings. Ready for archive.
diff --git a/docs/superpowers/reports/2026-07-03-rbac-refactor-verify.md b/docs/superpowers/reports/2026-07-03-rbac-refactor-verify.md
deleted file mode 100644
index 1abb1aa..0000000
--- a/docs/superpowers/reports/2026-07-03-rbac-refactor-verify.md
+++ /dev/null
@@ -1,104 +0,0 @@
-# 验证报告：rbac-refactor
-
-- **日期**: 2026-07-03
-- **变更**: rbac-refactor
-- **验证模式**: 完整验证 (full)
-- **验证结果**: ✅ PASS — 所有检查通过
-
-## 新鲜验证证据（2026-07-03 09:19 UTC+8）
-
-| 验证项 | 命令 | 结果 |
-|--------|------|------|
-| 类型检查 | `npm run typecheck` (turbo) | ✅ 2/2 成功, 0 errors |
-| 构建 | `npm run build` (turbo) | ✅ 2/2 成功 (nest build + vite build) |
-| 测试 | `npm run test` (turbo) | ✅ 1 passed, 0 failures |
-
-## 摘要评分卡
-
-| 维度 | 状态 |
-|------|------|
-| 完整性 (Completeness) | ✅ 49/49 任务全部完成 |
-| 正确性 (Correctness) | ✅ 构建/类型检查/测试全部通过（新鲜验证） |
-| 一致性 (Coherence) | ✅ 设计偏差已记录至 Design Doc §12 |
-
-## 验证检查项
-
-| # | 检查项 | 结果 |
-|---|--------|------|
-| 1 | tasks.md 全部任务已完成 | ✅ PASS (49/49) |
-| 2 | 构建通过 | ✅ PASS (turbo build, 2/2) |
-| 3 | 类型检查通过 | ✅ PASS (turbo typecheck, 0 errors) |
-| 4 | 测试通过 | ✅ PASS (1 passed, 0 failures) |
-| 5 | 无明显安全问题 | ✅ PASS |
-| 6 | 实现符合 design.md 高层设计决策 | ✅ PASS (偏差已记录) |
-| 7 | 实现符合 Design Doc 技术设计 | ✅ PASS (偏差已记录至 §12) |
-| 8 | proposal.md 目标已满足 | ✅ PASS |
-| 9 | Design Doc 可定位 | ✅ PASS (`docs/superpowers/specs/2026-07-02-rbac-refactor-design.md`) |
-
-## 实现验证详情
-
-### 后端 RBAC 核心
-
-| 组件 | 文件 | 状态 |
-|------|------|------|
-| Permission 实体 | `apps/server/src/entities/permission.entity.ts` | ✅ |
-| Role 实体 | `apps/server/src/entities/role.entity.ts` | ✅ |
-| User 实体（迁移） | `apps/server/src/entities/user.entity.ts` | ✅ (role + allowedMenus 已移除) |
-| RbacService | `apps/server/src/rbac/rbac.service.ts` | ✅ (52 权限点, 4 角色, 种子数据幂等) |
-| RbacController | `apps/server/src/rbac/rbac.controller.ts` | ✅ (角色 CRUD + 权限树 + 用户管理) |
-| PermissionGuard | `apps/server/src/auth/guards/permission.guard.ts` | ✅ (全局 APP_GUARD) |
-| @RequirePermission 装饰器 | `apps/server/src/auth/decorators/permission.decorator.ts` | ✅ |
-| @Public 装饰器 | `apps/server/src/auth/decorators/public.decorator.ts` | ✅ |
-| JwtStrategy（权限扩展） | `apps/server/src/auth/strategies/jwt.strategy.ts` | ✅ (payload.permissions) |
-| AuthService（登录流程） | `apps/server/src/auth/auth.service.ts` | ✅ (RbacService.getUserPermissions → JWT) |
-| forwardRef 循环依赖 | `apps/server/src/auth/auth.module.ts` ↔ `apps/server/src/rbac/rbac.module.ts` | ✅ |
-
-### 控制器权限覆盖率
-
-所有 12 个业务控制器均已添加 `@RequirePermission`：
-
-| Controller | 文件 | 权限方法数 |
-|------------|------|-----------|
-| OccupanciesController | `apps/server/src/occupancies/occupancies.controller.ts` | 11 个方法 |
-| ExpensesController | `apps/server/src/expenses/expenses.controller.ts` | 17 个方法 |
-| RbacController | `apps/server/src/rbac/rbac.controller.ts` | 12 个方法 |
-| ClassroomRentalsController | `apps/server/src/classroom-rentals/classroom-rentals.controller.ts` | 9 个方法 |
-| TenantsController | `apps/server/src/tenants/tenants.controller.ts` | 5 个方法 |
-| DepositsController | `apps/server/src/deposits/deposits.controller.ts` | ✅ |
-| BillsController | `apps/server/src/bills/bills.controller.ts` | ✅ |
-| StudentsController | `apps/server/src/students/students.controller.ts` | ✅ |
-| RoomsController | `apps/server/src/rooms/rooms.controller.ts` | ✅ |
-| ClassroomsController | `apps/server/src/classrooms/classrooms.controller.ts` | ✅ |
-| DashboardController | `apps/server/src/dashboard/dashboard.controller.ts` | ✅ |
-| OperationLogsController | `apps/server/src/operation-logs/operation-logs.controller.ts` | ✅ |
-
-### 前端实现
-
-| 组件 | 文件 | 状态 |
-|------|------|------|
-| usePermission Hook | `apps/admin/src/hooks/usePermission.ts` | ✅ |
-| PermissionButton | `apps/admin/src/components/PermissionButton.tsx` | ✅ |
-| PermissionRoute | `apps/admin/src/components/PermissionRoute.tsx` | ✅ |
-| 路由权限守卫 | `apps/admin/src/App.tsx` | ✅ (全部路由包装) |
-| 菜单权限过滤 | `apps/admin/src/layouts/MainLayout.tsx` | ✅ (递归过滤, 含子菜单) |
-| 角色管理页面 | `apps/admin/src/pages/Roles/index.tsx` | ✅ |
-| 权限一览页面 | `apps/admin/src/pages/Permissions/index.tsx` | ✅ |
-| 用户管理重构 | `apps/admin/src/pages/Users/index.tsx` | ✅ (多角色选择) |
-
-## 设计偏差处理
-
-### ✅ 已记录：PermissionGuard AND/OR 语义简化
-
-**Design Doc §12.1** 已记录：实现简化为扁平 OR 匹配（vs. 设计中的嵌套 AND/OR），当前无接口需要 AND 语义，装饰器注释已标注限制。
-
-### ✅ 已记录：权限点数量
-
-**Design Doc §12.2** 已记录：实际实现 52 个权限点（vs. 设计文档声称的 42 个），所有权限点均符合 `module:action` 命名规范。
-
-## 最终评估
-
-- **CRITICAL 问题**: 0
-- **WARNING 问题**: 0（偏差已通过 Design Doc §12 Implementation Divergence 记录）
-- **SUGGESTION 问题**: 0（权限点计数偏差已记录）
-
-**结论**: 构建、类型检查、测试全部通过（新鲜验证）。49/49 任务完成。无安全风险。设计偏差已通过 Design Doc "Implementation Divergence" 节完整记录。所有 proposal 目标已达成。
diff --git a/docs/superpowers/specs/2026-07-02-migrate-to-turborepo-design.md b/docs/superpowers/specs/2026-07-02-migrate-to-turborepo-design.md
deleted file mode 100644
index 767efe3..0000000
--- a/docs/superpowers/specs/2026-07-02-migrate-to-turborepo-design.md
+++ /dev/null
@@ -1,118 +0,0 @@
----
-comet_change: migrate-to-turborepo
-role: technical-design
-canonical_spec: openspec
-archived-with: 2026-07-02-migrate-to-turborepo
-status: final
----
-
-# Migrate to Turborepo Monorepo — Technical Design
-
-## Architecture Overview
-
-```
-gongxue-base/
-├── apps/
-│ ├── server/ # ← git mv backend → apps/server (NestJS API)
-│ ├── admin/ # ← git mv frontend → apps/admin (React + Vite)
-│ └── student/ # 未来：学生端
-├── packages/
-│ └── typescript-config/ # 共享 TS 配置：base / nestjs / react-vite
-├── package.json # npm workspaces + turbo 根脚本
-├── turbo.json # Turborepo 流水线
-├── .oxfmtrc.json # oxfmt 全局配置
-├── oxlint.config.ts # oxlint 全局配置（admin 前端）
-└── docker-compose.yml # 调整 build.context 路径
-```
-
-## Key Decisions
-
-### 1. File Migration: `git mv`
-
-`node_modules/` 从未被 Git 追踪，因此 `git mv backend apps/server` 和 `git mv frontend apps/admin` 可以干净执行，完整保留文件历史。
-
-### 2. Package Manager: npm workspaces
-
-用户指定沿用 npm。根 `package.json` 声明 `workspaces: ["apps/*", "packages/*"]`，所有根脚本委托 `turbo run` 执行。
-
-### 3. Build Orchestration: Turborepo
-
-`turbo.json` 定义六条流水线：
-
-| Task | 配置 |
-|------|------|
-| `build` | `dependsOn: ["^build"]`, outputs: `dist/**` |
-| `dev` | `cache: false`, `persistent: true` |
-| `lint` | 无特殊配置，各 workspace 自行定义工具 |
-| `test` | 无特殊配置 |
-| `format` | `cache: false` (oxfmt) |
-| `typecheck` | `dependsOn: ["^build"]` |
-
-### 4. Toolchain: oxfmt + oxlint (mixed)
-
-- **oxfmt**：根目录 `.oxfmtrc.json`，映射 Prettier 配置 `{ singleQuote: true, trailingComma: "all" }`
-- **oxlint**：仅用于 `apps/admin`，覆盖 TypeScript + React 规则。`exhaustive-deps` 和 `react-refresh` 由 TypeScript compiler + code review 兜底
-- **ESLint**：`apps/server` 保留，移除 Prettier 集成。保障 NestJS 装饰器类型检查
-
-所有 workspace 统一使用 `lint` 脚本名，Turborepo 在 `turbo run lint` 时并行调度。
-
-### 5. Shared TypeScript Config
-
-`@gongxue/typescript-config` 包提供三个预设：
-
-| 预设 | 继承 | 用途 |
-|------|------|------|
-| `base.json` | — | 通用选项：ES2023、strictNullChecks、skipLibCheck |
-| `nestjs.json` | base | NestJS：nodenext module、experimentalDecorators、declaration |
-| `react-vite.json` | base | Vite + React：bundler resolution、jsx: react-jsx、noEmit |
-
-TypeScript 版本统一为 `~6.0.2`（从 server 5.7→6.0 和 admin 6.0 对齐）。
-
-### 6. Docker Compose
-
-容器名 `dorm_billing_backend` / `dorm_billing_frontend` 保持不变，仅调整 `build.context`：
-- `backend: build: ./apps/server`
-- `frontend: build: ./apps/admin`
-
-## Data Flow
-
-```
-npm run dev (根)
- │
- ▼
-turbo run dev
- │
- ├──▶ apps/server (NestJS, :3003) ← ESLint, @gongxue/typescript-config/nestjs
- └──▶ apps/admin (Vite, :3002) ← oxlint, @gongxue/typescript-config/react-vite
- │
- ▼ /api proxy → localhost:3003
-```
-
-## Testing Strategy
-
-### Core Verification Chain
-
-1. `npm install` — 所有 workspace 依赖正确安装，hoisting 无冲突
-2. `npm run build` — server + admin 构建通过
-3. `npm run lint` — server ESLint + admin oxlint 通过
-4. `npm run format -- --check` — oxfmt 格式化检查通过
-5. `npm run test --workspace=apps/server` — NestJS Jest 测试通过
-
-### Runtime Verification
-
-- `npm run dev` → server :3003 + admin :3002 并行启动
-- admin Vite 代理 `/api` → `localhost:3003` 正常工作
-
-### Docker Verification
-
-- `docker compose build` — 所有镜像构建成功
-- `docker compose up` — 所有服务启动并响应
-
-## Risks & Mitigations
-
-| Risk | Impact | Mitigation |
-|------|--------|------------|
-| `git mv` 后路径引用失效 | docker-compose、tsconfig extends、scripts | 逐文件验证，每步 commit |
-| oxlint 规则覆盖不全 | `exhaustive-deps`、`react-refresh` 缺失 | TS compiler + code review 兜底，明确文档化 |
-| TS 6.x + NestJS 生态兼容 | ts-jest、ts-node 可能报错 | 迁移后立即验证 build + test |
-| npm hoisting 行为变化 | 子项目可能拿到不兼容版本 | 重新 install 后逐 workspace 验证 |
diff --git a/docs/superpowers/specs/2026-07-02-rbac-refactor-design.md b/docs/superpowers/specs/2026-07-02-rbac-refactor-design.md
deleted file mode 100644
index 78f546c..0000000
--- a/docs/superpowers/specs/2026-07-02-rbac-refactor-design.md
+++ /dev/null
@@ -1,737 +0,0 @@
----
-comet_change: rbac-refactor
-role: technical-design
-canonical_spec: openspec
-archived-with: 2026-07-03-rbac-refactor
-status: final
----
-
-# RBAC 鉴权重构技术设计
-
-- 日期：2026-07-02
-- 变更：rbac-refactor
-- 阶段：Design → Build
-
-## 1. 架构总览
-
-```
- ┌─────────────────────────┐
- │ Request │
- └───────────┬─────────────┘
- │
- ▼
- ┌─────────────────────────┐
- │ JwtAuthGuard │
- │ (Token 有效性校验) │
- └───────────┬─────────────┘
- │
- ┌───────────▼─────────────┐
- │ PermissionGuard │ ← 全局 APP_GUARD
- │ (从 req.user 读 │
- │ permissions 数组) │
- └───────────┬─────────────┘
- │
- ┌─────────────────┼─────────────────┐
- │ │ │
- ▼ ▼ ▼
- @Public() @RequirePermission 无装饰器
- 放行 ('student:create') → 403
- │
- ▼
- ┌───────────────┐
- │ Controller │
- └───────────────┘
-```
-
-**核心原则**：
-
-- **认证（Authentication）** 与 **授权（Authorization）** 分离：`AuthModule` 只负责登录/JWT/profile；新建 `RbacModule` 负责角色/权限/用户-角色关联。
-- **默认拒绝**：全局 `PermissionGuard` 要求所有接口显式声明权限；公开接口（login）通过 `@Public()` 豁免。
-- **JWT 携带权限**：登录时将 User→Role→Permission 链展开为 `permissions: string[]` 打入 JWT payload，避免每次请求查库。
-
-## 2. 数据模型
-
-### 2.1 ER 图
-
-```
-┌──────────────┐ ┌──────────────────┐ ┌──────────────┐
-│ User │ │ Role │ │ Permission │
-├──────────────┤ ├──────────────────┤ ├──────────────┤
-│ id (PK) │ │ id (PK) │ │ id (PK) │
-│ username(UK) │ │ name (UK) │ │ code (UK) │
-│ passwordHash │ │ description │ │ name │
-│ name │ │ isSystem │ │ group │
-│ isActive │ │ status │ │ description │
-│ lastLoginAt │ │ createdAt │ └──────┬───────┘
-│ createdAt │ │ updatedAt │ │
-│ updatedAt │ └────────┬─────────┘ │
-└──────┬───────┘ │ │
- │ │ │
- │ N:M │ M:N │
- ▼ ▼ ▼
-┌──────────────┐ ┌──────────────────┐
-│ UserRole │ │ RolePermission │
-├──────────────┤ ├──────────────────┤
-│ userId (FK) │ │ roleId (FK) │
-│ roleId (FK) │ │ permissionId(FK) │
-└──────────────┘ └──────────────────┘
-```
-
-### 2.2 实体定义
-
-**Permission**（`permissions` 表）
-
-| 字段 | 类型 | 说明 |
-|------|------|------|
-| id | INT PK AUTO_INCREMENT | |
-| code | VARCHAR(50) UNIQUE | 权限码，格式 `module:action` |
-| name | VARCHAR(50) | 中文名称 |
-| group | VARCHAR(30) | 分组（对应模块） |
-| description | VARCHAR(200) | 可选说明 |
-
-**Role**（`roles` 表）
-
-| 字段 | 类型 | 说明 |
-|------|------|------|
-| id | INT PK AUTO_INCREMENT | |
-| name | VARCHAR(30) UNIQUE | 角色名称 |
-| description | VARCHAR(200) | 角色描述 |
-| isSystem | BOOLEAN DEFAULT FALSE | 系统预置角色，不可删除/改名 |
-| status | TINYINT DEFAULT 1 | 1=启用, 0=禁用 |
-| createdAt | DATETIME | |
-| updatedAt | DATETIME | |
-
-**User 实体变更**
-
-| 操作 | 字段 | 说明 |
-|------|------|------|
-| 移除 | `role` VARCHAR(20) | 原 admin/operator 硬编码 |
-| 移除 | `allowedMenus` TEXT | 原 JSON 数组，前端菜单可见性 |
-| 新增 | `roles` @ManyToMany → Role | 通过 user_roles 关联表 |
-
-### 2.3 权限点清单（42 个）
-
-| Group | 权限码 | 名称 |
-|-------|--------|------|
-| dashboard | `dashboard:view` | 查看数据面板 |
-| student | `student:view` | 查看学生 |
-| student | `student:create` | 新增学生 |
-| student | `student:edit` | 编辑学生 |
-| student | `student:delete` | 删除学生 |
-| student | `student:import` | 导入学生 |
-| student | `student:export` | 导出学生 |
-| room | `room:view` | 查看宿舍 |
-| room | `room:create` | 新增宿舍 |
-| room | `room:edit` | 编辑宿舍 |
-| room | `room:delete` | 删除宿舍 |
-| occupancy | `occupancy:view` | 查看入住 |
-| occupancy | `occupancy:checkin` | 办理入住 |
-| occupancy | `occupancy:checkout` | 办理退宿 |
-| occupancy | `occupancy:transfer` | 调换宿舍 |
-| expense | `expense:view` | 查看费用 |
-| expense | `expense:create` | 录入费用 |
-| expense | `expense:edit` | 编辑费用 |
-| expense | `expense:delete` | 删除费用 |
-| bill | `bill:view` | 查看账单 |
-| bill | `bill:generate` | 生成账单 |
-| bill | `bill:confirm` | 确认账单 |
-| bill | `bill:delete` | 删除账单 |
-| bill | `bill:export-excel` | 导出 Excel |
-| bill | `bill:export-pdf` | 导出 PDF |
-| deposit | `deposit:view` | 查看押金 |
-| deposit | `deposit:create` | 新增押金 |
-| deposit | `deposit:edit` | 编辑押金 |
-| deposit | `deposit:delete` | 删除押金 |
-| classroom | `classroom:view` | 查看教室 |
-| classroom | `classroom:create` | 新增教室 |
-| classroom | `classroom:edit` | 编辑教室 |
-| classroom | `classroom:delete` | 删除教室 |
-| tenant | `tenant:view` | 查看租赁方 |
-| tenant | `tenant:create` | 新增租赁方 |
-| tenant | `tenant:edit` | 编辑租赁方 |
-| tenant | `tenant:delete` | 删除租赁方 |
-| rental | `rental:view` | 查看租赁订单 |
-| rental | `rental:create` | 新增租赁订单 |
-| rental | `rental:edit` | 编辑租赁订单 |
-| rental | `rental:delete` | 删除租赁订单 |
-| log | `log:view` | 查看操作日志 |
-| user | `user:view` | 查看用户 |
-| user | `user:create` | 创建用户 |
-| user | `user:edit` | 编辑用户 |
-| user | `user:delete` | 删除用户 |
-| user | `user:reset-password` | 重置密码 |
-| role | `role:view` | 查看角色 |
-| role | `role:create` | 创建角色 |
-| role | `role:edit` | 编辑角色 |
-| role | `role:delete` | 删除角色 |
-
-### 2.4 预置角色与权限映射
-
-| 角色 | code | isSystem | 权限范围 |
-|------|------|----------|---------|
-| 超管 | `super_admin` | true | **全部 42 个权限点** |
-| 机构负责人 | `institution_head` | true | 预留角色，暂分配教室/租赁相关 view 权限 |
-| 老师 | `teacher` | true | 预留角色，暂分配学生 view 权限 |
-| 宿管老师 | `dormitory_supervisor` | true | 学生/宿舍/入住/费用/账单/押金/日志的全部权限 + dashboard:view（替代原 operator） |
-
-> **注意**：机构负责人和老师为占位角色。其实际业务权限点（课表、考勤等）在当前系统中尚不存在，后续 change 再补充。
-
-### 2.5 设计决策：为什么不用 JSON 字段？
-
-- JSON 字段无法做数据库级外键约束和联表查询
-- "某权限被哪些角色拥有" → 关联表索引查询 O(log n)，JSON 需全表扫描 O(n)
-- 后续数据级权限（机构→班级→学生）扩展时，关联表可直接扩展 Role + 数据策略组合
-
-## 3. 后端模块设计
-
-### 3.1 模块拆分
-
-```
-AuthModule（瘦身） RbacModule（新建）
-├── AuthController ├── RbacController
-│ ├── POST /auth/login │ ├── GET /rbac/roles
-│ └── GET /auth/profile │ ├── GET /rbac/roles/:id
-│ │ ├── POST /rbac/roles
-├── AuthService │ ├── PUT /rbac/roles/:id
-│ ├── login() ← 改：查询权限 │ ├── DELETE /rbac/roles/:id
-│ ├── validateUser() │ ├── GET /rbac/permissions
-│ └── initAdmin() ← 转移 │ ├── GET /rbac/users
-│ │ ├── POST /rbac/users
-├── JwtStrategy │ ├── PUT /rbac/users/:id
-│ └── validate() ← 改：返回权限 │ ├── DELETE /rbac/users/:id
-│ │ └── PUT /rbac/users/:id/password
-└── JwtAuthGuard（不变） │
- ├── RbacService
- │ ├── getRoles / CRUD
- │ ├── getPermissions / getPermissionTree
- │ ├── getUserPermissions(userId): string[]
- │ ├── createUser / updateUser / deleteUser
- │ └── seedData() ← 幂等种子数据
- │
- └── 导入 TypeOrmModule.forFeature([
- User, Role, Permission
- ])
-```
-
-**关键改动**：
-
-1. `AuthService.login()` → 登录成功后调用 `RbacService.getUserPermissions(userId)`，将结果打入 JWT payload
-2. `AuthService.initAdmin()` → 移到 `RbacService.seedData()` 中，因为超管角色和权限种子数据是 RBAC 层的职责
-3. `AuthModule` 需要 `imports: [RbacModule]` 或使用 `forwardRef` 避免循环依赖
-4. 原 `/auth/register`、`/auth/users` CRUD 全部迁移到 `RbacController`，变为 `/rbac/users`
-
-### 3.2 循环依赖处理
-
-`AuthModule` 和 `RbacModule` 存在双向依赖：
-- `AuthService.login()` 需要 `RbacService.getUserPermissions()`
-- `RbacController` 的用户 CRUD 接口需要 `JwtAuthGuard`
-
-```typescript
-// auth.module.ts
-@Module({
- imports: [
- TypeOrmModule.forFeature([User]),
- forwardRef(() => RbacModule), // 延迟解析
- PassportModule,
- JwtModule.registerAsync({...}),
- ],
- controllers: [AuthController],
- providers: [AuthService, JwtStrategy],
- exports: [AuthService],
-})
-
-// rbac.module.ts
-@Module({
- imports: [
- TypeOrmModule.forFeature([User, Role, Permission]),
- forwardRef(() => AuthModule), // 延迟解析（获取 JwtAuthGuard）
- ],
- controllers: [RbacController],
- providers: [RbacService],
- exports: [RbacService],
-})
-```
-
-## 4. 权限守卫设计
-
-### 4.1 装饰器
-
-```typescript
-// backend/src/auth/decorators/public.decorator.ts
-import { SetMetadata } from '@nestjs/common';
-export const IS_PUBLIC_KEY = 'isPublic';
-export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);
-
-// backend/src/auth/decorators/permission.decorator.ts
-import { SetMetadata } from '@nestjs/common';
-export const PERMISSION_KEY = 'permissions';
-export const RequirePermission = (...permissions: string[]) =>
- SetMetadata(PERMISSION_KEY, permissions);
-```
-
-**语义约定**：
-
-| 用法 | 语义 |
-|------|------|
-| `@RequirePermission('student:create')` | 需要此权限 |
-| `@RequirePermission('bill:export-excel', 'bill:export-pdf')` | 满足**任一**即可（OR） |
-| `@RequirePermission('bill:view')` + `@RequirePermission('bill:delete')` | 两个都需满足（AND） |
-
-装饰器多次 SetMetadata 时 NestJS 自动合并为数组，`Reflector.get('permissions')` 返回 `[['bill:view'], ['bill:delete']]`，以此区分 AND 还是 OR 调用。
-
-### 4.2 PermissionGuard
-
-```typescript
-// backend/src/auth/guards/permission.guard.ts
-@Injectable()
-export class PermissionGuard implements CanActivate {
- constructor(private reflector: Reflector) {}
-
- canActivate(context: ExecutionContext): boolean {
- // 1. @Public() 豁免
- const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
- context.getHandler(), context.getClass(),
- ]);
- if (isPublic) return true;
-
- // 2. 获取所需权限
- const requiredPermissions = this.reflector.getAllAndOverride(
- PERMISSION_KEY,
- [context.getHandler(), context.getClass()],
- );
- // 无装饰器 = 默认拒绝
- if (!requiredPermissions) return false;
-
- // 3. 从 JWT payload 获取用户权限
- const { user } = context.switchToHttp().getRequest();
- if (!user?.permissions) return false;
-
- // 4. 匹配逻辑：外层 AND，内层 OR
- return requiredPermissions.every(group =>
- group.some(p => user.permissions.includes(p))
- );
- }
-}
-```
-
-**匹配算法**：
-
-```
-装饰器层级: @ReqPerm(A) @ReqPerm(B) @ReqPerm(C, D)
- ↓
-Reflector 返回: [ [A], [B], [C, D] ]
- ↓
-PermissionGuard: [A] ∧ [B] ∧ [C, D]
- A 满足 ∧ B 满足 ∧ (C 或 D 满足)
-```
-
-超管拥有全部权限 → `user.permissions.includes(p)` 始终 true → 全部放行。
-
-### 4.3 全局注册
-
-```typescript
-// app.module.ts — providers 数组新增
-{ provide: APP_GUARD, useClass: PermissionGuard },
-```
-
-注意：`APP_GUARD` 的顺序即为执行顺序。ThrottlerGuard 在前、JwtAuthGuard 在各模块注册、PermissionGuard 全局。
-
-## 5. JWT 变更
-
-### 5.1 Payload 结构
-
-```
-变更前: { sub: number, username: string, role: string }
-变更后: { sub: number, username: string, permissions: string[] }
-```
-
-- 移除 `role` 字段（用户不再有单一角色）
-- 新增 `permissions` 数组（登录时计算，有效期跟随 JWT 过期，默认 4h）
-
-### 5.2 登录流程
-
-```
-POST /auth/login { username, password }
- → AuthService.login()
- → 验证凭证
- → RbacService.getUserPermissions(userId)
- → SELECT DISTINCT p.code
- FROM permission p
- JOIN role_permission rp ON p.id = rp.permissionId
- JOIN user_role ur ON rp.roleId = ur.roleId
- WHERE ur.userId = ?
- → JWT sign({ sub, username, permissions })
- → 返回 { access_token, user: { id, username, name, roles, permissions } }
-```
-
-### 5.3 JwtStrategy.validate()
-
-```typescript
-async validate(payload: any) {
- return {
- id: payload.sub,
- username: payload.username,
- permissions: payload.permissions || [],
- };
-}
-```
-
-req.user 后续被 PermissionGuard 消费，`permissions` 数组供匹配。
-
-### 5.4 设计决策：为什么权限不入库实时查询？
-
-- **性能**：避免每次请求都做 4 表 JOIN
-- **JWT 无状态**：不依赖数据库连接，适合水平扩展
-- **折中**：权限变更在下次登录生效。对极高安全要求的操作（账单确认/删除），可在 Controller 内额外做一次实时校验
-- **体积**：42 个短字符串约增加 500 bytes，在可接受范围
-
-## 6. 前端架构
-
-### 6.1 权限基础设施
-
-```
-frontend/src/
-├── hooks/
-│ └── usePermission.ts ← 新建
-├── components/
-│ ├── PermissionButton.tsx ← 新建
-│ └── PermissionRoute.tsx ← 新建
-└── pages/
- ├── Roles/ ← 新建（角色管理）
- ├── Permissions/ ← 新建（权限一览）
- └── Users/ ← 重构
-```
-
-### 6.2 usePermission Hook
-
-```typescript
-// hooks/usePermission.ts
-export function usePermission() {
- const permissions: string[] = JSON.parse(
- localStorage.getItem('permissions') || '[]'
- );
-
- const hasPermission = (code: string) => permissions.includes(code);
- const hasAnyPermission = (...codes: string[]) =>
- codes.some(c => permissions.includes(c));
- const hasAllPermissions = (...codes: string[]) =>
- codes.every(c => permissions.includes(c));
-
- return { permissions, hasPermission, hasAnyPermission, hasAllPermissions };
-}
-```
-
-### 6.3 PermissionButton
-
-```typescript
-// components/PermissionButton.tsx
-// 无权限时 return null（隐藏），不占界面空间
-const PermissionButton: React.FC<{
- permission: string;
- children: React.ReactNode;
-} & ButtonProps> = ({ permission, children, ...btnProps }) => {
- const { hasPermission } = usePermission();
- if (!hasPermission(permission)) return null;
- return ;
-};
-```
-
-### 6.4 PermissionRoute
-
-```typescript
-// components/PermissionRoute.tsx
-// 无权限渲染 403 页面
-const PermissionRoute: React.FC<{
- permission: string;
- children: React.ReactNode;
-}> = ({ permission, children }) => {
- const { hasPermission } = usePermission();
- if (!hasPermission(permission)) {
- return ;
- }
- return <>{children};
-};
-```
-
-### 6.5 Login 页面变更
-
-```typescript
-// 登录成功后
-localStorage.setItem('token', res.access_token);
-localStorage.setItem('user', JSON.stringify(res.user));
-localStorage.setItem('permissions', JSON.stringify(res.user.permissions));
-```
-
-### 6.6 404/403 处理
-
-```typescript
-// api/index.ts — axios 拦截器
-// 401 → 跳登录（不变）
-// 403 → 不跳转，显示 "权限不足" 提示
-if (error.response?.status === 403) {
- message.error('权限不足');
- return Promise.reject(error);
-}
-```
-
-### 6.7 菜单过滤
-
-MainLayout 每项菜单新增 `permission` 字段：
-
-```typescript
-const menuItems = [
- { key: '/dashboard', icon: , label: '数据面板', permission: 'dashboard:view' },
- { key: '/students', icon: , label: '学生管理', permission: 'student:view' },
- // ...
-];
-
-// 按权限过滤
-const { hasPermission } = usePermission();
-const visibleItems = menuItems.filter(item => !item.permission || hasPermission(item.permission));
-```
-
-### 6.8 角色管理页面设计
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│ 角色管理 [+ 新增角色] │
-├─────────────────────────────────────────────────────────────┤
-│ ID │ 名称 │ 描述 │ 权限标签 │ 系统 │ 操作 │
-├─────┼──────────┼──────────────┼─────────────┼──────┼─────────┤
-│ 1 │ 超管 │ 全部权限 │ 42个权限 │ ✓ │ - │
-│ 2 │ 宿管老师 │ 宿舍相关管理 │ 查看/管理 │ ✓ │ 编辑 │
-│ 3 │ 老师 │ 学生查看 │ 学生:view │ ✓ │ 编辑 │
-│ 4 │ 机构负责人│ 教室管理 │ 教室:view │ ✓ │ 编辑 │
-└─────────────────────────────────────────────────────────────┘
-```
-
-点击编辑 → Modal 弹窗：
-- 基本信息：名称（系统角色禁用编辑）、描述
-- 权限勾选区域：按 group 分组，每组一个 Card，内含 Checkbox.Group
-- 每组支持全选/取消全选
-
-### 6.9 用户管理页面变更
-
-| 变更项 | 原设计 | 新设计 |
-|--------|--------|--------|
-| 角色列 | 单一 Tag（admin/operator） | 多角色 Tag 列表 |
-| 编辑弹窗-角色 | Select 单选（admin/operator） | Select mode="multiple"（所有活跃角色） |
-| 编辑弹窗-菜单 | Checkbox.Group（14 项菜单） | 移除 |
-| 新增弹窗 | 默认 operator | 必选角色列表 |
-| API 端点 | `/auth/register`、`/auth/users` | `/rbac/users` |
-
-## 7. 迁移策略
-
-### 7.1 TypeORM Migration 配置
-
-```json
-// backend/package.json 新增
-{
- "scripts": {
- "typeorm": "ts-node -r tsconfig-paths/register ./node_modules/typeorm/cli.js",
- "migration:generate": "npm run typeorm -- migration:generate -d src/data-source.ts",
- "migration:run": "npm run typeorm -- migration:run -d src/data-source.ts",
- "migration:revert": "npm run typeorm -- migration:revert -d src/data-source.ts"
- }
-}
-```
-
-### 7.2 迁移脚本步骤
-
-```sql
--- 在同一事务中执行
-BEGIN;
-
--- Step 1: 创建新表
-CREATE TABLE permissions (...);
-CREATE TABLE roles (...);
-CREATE TABLE role_permissions (...);
-CREATE TABLE user_roles (...);
-
--- Step 2: 插入种子数据
--- 42 个权限点
-INSERT INTO permissions (code, name, `group`) VALUES
- ('dashboard:view', '查看数据面板', 'dashboard'),
- ...
-
--- 4 个预置角色
-INSERT INTO roles (name, description, isSystem) VALUES
- ('超管', '系统超级管理员，拥有全部权限', 1),
- ('宿管老师', '管理宿舍相关业务', 1),
- ('老师', '查看和管理本班学生', 1),
- ('机构负责人', '管理机构教室和课程', 1);
-
--- 角色-权限关联
-INSERT INTO role_permissions (roleId, permissionId)
- SELECT r.id, p.id FROM roles r, permissions p WHERE r.name = '超管';
-
--- 宿管老师：学生/宿舍/入住/费用/账单/押金/日志/dashboard
-INSERT INTO role_permissions (roleId, permissionId)
- SELECT r.id, p.id FROM roles r, permissions p
- WHERE r.name = '宿管老师' AND p.`group` IN ('student', 'room', 'occupancy', 'expense', 'bill', 'deposit', 'log', 'dashboard');
-
--- Step 3: 迁移现有用户
--- admin → 超管
-INSERT INTO user_roles (userId, roleId)
- SELECT u.id, r.id FROM users u, roles r
- WHERE u.role = 'admin' AND r.name = '超管';
-
--- operator → 宿管老师
-INSERT INTO user_roles (userId, roleId)
- SELECT u.id, r.id FROM users u, roles r
- WHERE u.role = 'operator' AND r.name = '宿管老师';
-
--- Step 4: 删除旧字段
-ALTER TABLE users DROP COLUMN role;
-ALTER TABLE users DROP COLUMN allowed_menus;
-
-COMMIT;
-```
-
-### 7.3 回滚策略
-
-```sql
-BEGIN;
--- 1. 恢复 users 表旧字段（从备份临时表）
-ALTER TABLE users ADD COLUMN role VARCHAR(20) DEFAULT 'operator';
-ALTER TABLE users ADD COLUMN allowed_menus TEXT;
-
-UPDATE users SET role = COALESCE(
- (SELECT CASE WHEN r.name = '超管' THEN 'admin' ELSE 'operator' END
- FROM user_roles ur JOIN roles r ON ur.roleId = r.id
- WHERE ur.userId = users.id LIMIT 1),
- 'operator'
-);
-
--- 2. 删除新表
-DROP TABLE IF EXISTS user_roles;
-DROP TABLE IF EXISTS role_permissions;
-DROP TABLE IF EXISTS roles;
-DROP TABLE IF EXISTS permissions;
-COMMIT;
-```
-
-### 7.4 synchronize → migration 切换
-
-AppModule 中 TypeORM 配置将 `synchronize: true` 改为 `synchronize: false`（仅对迁移后的环境生效，首次迁移前可保留），`migrations: [...]` 指向迁移目录。
-
-## 8. 种子数据初始化
-
-`RbacModule.onModuleInit()` 中调用 `RbacService.seedData()`：
-
-```typescript
-async seedData() {
- // 1. 权限点：INSERT ... WHERE NOT EXISTS (幂等)
- for (const perm of PRESET_PERMISSIONS) {
- await this.permRepo
- .createQueryBuilder()
- .insert().into(Permission)
- .values(perm)
- .orIgnore() // SQLite: OR IGNORE; MySQL: ON DUPLICATE KEY
- .execute();
- }
-
- // 2. 角色：同上
- // 3. 角色-权限关联：先查角色和权限，批量 INSERT IGNORE
- // 4. 初始 admin 用户（复用原 initAdmin 逻辑）
-}
-```
-
-**幂等性保证**：
-- 权限点：`code` UNIQUE 约束 + `orIgnore()`
-- 角色：`name` UNIQUE 约束 + `orIgnore()`
-- 角色-权限关联：`(roleId, permissionId)` 联合唯一约束
-- 重复启动不会重复插入
-
-## 9. 测试策略
-
-### 9.1 单元测试
-
-**PermissionGuard（5 用例）**：
-
-| # | 场景 | 预期 |
-|---|------|------|
-| 1 | @Public() 装饰的接口 | 放行 |
-| 2 | 无装饰器 | 403 |
-| 3 | @RequirePermission('a')，用户有 'a' | 放行 |
-| 4 | @RequirePermission('a')，用户无 'a' | 403 |
-| 5 | @ReqPerm('a') + @ReqPerm('b')，用户有 'a' 无 'b' | 403（AND 不满足） |
-
-**RbacService.getUserPermissions（3 用例）**：
-
-| # | 场景 | 预期 |
-|---|------|------|
-| 1 | 单角色用户 | 返回该角色全部权限 |
-| 2 | 多角色用户 | 返回并集去重 |
-| 3 | 无角色用户 | 返回空数组 |
-
-### 9.2 e2e 测试
-
-| # | 场景 | 步骤 | 预期 |
-|---|------|------|------|
-| 1 | 超管全通链路 | 登录 → GET /students → POST /students | 全部 200 |
-| 2 | 宿管老师受限链路 | 登录 → GET /students → 200；POST /rbac/roles → 403 | 学生可查，角色管理拒绝 |
-
-### 9.3 迁移验证
-
-- SQLite 环境：`npm run migration:run` → 表结构正确 → 种子数据完整
-- MySQL 环境：同上
-- 现有 admin 用户：迁移后登录 → 拥有 `super_admin` 角色 → 全部权限可访问
-
-## 10. 风险与缓解
-
-| 风险 | 等级 | 缓解措施 |
-|------|------|---------|
-| users 表结构变更破坏现有业务 | 中 | 迁移在事务中执行，失败自动回滚；部署前 staging 验证 |
-| JWT payload 增大 | 低 | ~42 个短字符串约 500 bytes，可接受；后续若权限点过多可改用压缩编码 |
-| 权限变更在下次登录才生效 | 低 | 关键操作可额外做实时校验；后续可用 Redis 黑名单强制下线 |
-| 前端改造面大 | 中 | 分步迁移：先建组件 → 逐页替换 → 每步可编译可运行 |
-| synchronize → migration 切换有学习成本 | 低 | 保留 `synchronize: true` 作为本地开发模式，migration 仅用于生产部署 |
-
-## 11. 后续扩展预留
-
-本次 RBAC 基础设施为以下扩展预留架构空间：
-
-```
-当前阶段（本 change） 后续阶段
-══════════════════════════ ══════════════════════════
-User ↔ Role ↔ Permission User ↔ Organization（数据级）
-操作级：student:create 数据级：student:view:org-1
- → RBAC + 数据策略组合
-```
-
-- `Permission.code` 保持纯粹的操作定义（`module:action`），不混入数据范围
-- 后续数据级权限通过新增 `DataPolicy` 实体 + `@DataScope` 装饰器实现
-- `Role` 实体预留扩展空间，可关联数据策略
-
-## 12. 实现偏差记录 (Implementation Divergence)
-
-> 本节记录 build 阶段验证时发现的、与原始设计不一致但经确认可接受的实现偏差。
-
-### 12.1 PermissionGuard AND/OR 语义简化
-
-**设计 (Design Doc §4.2)**:
-```typescript
-// 嵌套 AND/OR: getAllAndOverride → 返回 [['A'], ['B','C']]
-// 外层 AND (every)，内层 OR (some)
-requiredPermissions.every(group => group.some(p => user.permissions.includes(p)))
-```
-
-**实现 (PermissionGuard)**:
-```typescript
-// 扁平 OR: getAllAndMerge → 返回 ['A', 'B', 'C']
-// 仅 OR 匹配
-requiredPermissions.some(p => user.permissions.includes(p))
-```
-
-**偏差原因**: 当前所有接口均为单一 `@RequirePermission(...)` 调用，不涉及多次装饰器叠加的 AND 场景。扁平 OR 语义足以覆盖"一个接口需要多个权限中的任一即可访问"的需求，同时简化了匹配逻辑和调试成本。装饰器注释已标注"不支持 AND 语义：多次调用装饰器会被全局 PermissionGuard 合并为扁平数组"。
-
-**影响**: 无。当前无接口需要 AND 权限组合。若未来业务需要"同时满足多个权限才可访问"，届时再升级匹配算法（将 `getAllAndMerge` 改为 `getAllAndOverride` + 双层循环），向后兼容。
-
-### 12.2 权限点数量
-
-**设计文档声称** 42 个权限点，**实际实现** 52 个。差异来自：
-- 设计文档手动列举时遗漏 `occupancy:delete` 等权限点
-- 设计文档实际列举 51 个而非 42 个（计数偏差）
-
-所有 52 个权限点均符合 `module:action` 命名规范且与模块目录结构一致，实现正确。
diff --git a/docs/superpowers/specs/2026-07-03-admin-responsive-adaptation-design.md b/docs/superpowers/specs/2026-07-03-admin-responsive-adaptation-design.md
deleted file mode 100644
index b880cb6..0000000
--- a/docs/superpowers/specs/2026-07-03-admin-responsive-adaptation-design.md
+++ /dev/null
@@ -1,163 +0,0 @@
----
-comet_change: admin-responsive-adaptation
-role: technical-design
-canonical_spec: openspec
-archived-with: 2026-07-03-admin-responsive-adaptation
-status: final
----
-
-# 管理后台三端响应式适配 — 技术设计
-
-## 1. 架构概览
-
-```
-┌─────────────────────────────────────────────────────────────────┐
-│ Admin Frontend │
-├─────────────────────────────────────────────────────────────────┤
-│ App.tsx │
-│ └─ ConfigProvider (antd theme + locale) │
-│ └─ BrowserRouter │
-│ ├─ LoginPage │
-│ └─ MainLayout │
-│ ├─ Sider/Drawer (断点决定) │
-│ ├─ Header (用户区域断点隐藏文字) │
-│ └─ Content → │
-│ ├─ Dashboard (统计卡片 + ECharts) │
-│ ├─ RoomVisual (房态网格卡片) │
-│ ├─ [14 个表格型页面] (Table + 搜索/操作工具栏) │
-│ └─ ClassroomSchedule (HTML 排期大表) │
-└─────────────────────────────────────────────────────────────────┘
-```
-
-## 2. 断点体系
-
-使用 antd v6 内置 `Grid.useBreakpoint()` hook，映射三类设备行为：
-
-| 端侧 | antd 断点 | 视口宽度 | 布局行为 |
-|------|-----------|---------|---------|
-| 手机 | `xs` | < 576px | Drawer 抽屉菜单，padding 12px |
-| 平板 | `sm`, `md` | 576-991px | 侧栏默认折叠，padding 16px |
-| 桌面 | `lg`, `xl`, `xxl` | ≥ 992px | 侧栏可折叠（默认展开），padding 24px |
-
-**选择理由：** 使用 antd 内置断点与 `Row/Col` 响应式 props 天然一致，避免维护两套断点逻辑。992px 与最初规划的 1024px 相差 32px，实际设备无感知。
-
-## 3. 核心决策
-
-### 3.1 MainLayout 响应式检测
-
-**当前：** `useState(window.innerWidth < 768)` + `resize` 事件 → `isMobile` 布尔值
-
-**目标：** `Grid.useBreakpoint()` → `{ xs, sm, md, lg, xl, xxl }` 布尔值
-
-```typescript
-const screens = Grid.useBreakpoint();
-const isMobile = !screens.sm; // < 576px (仅 xs)
-const isTablet = (screens.sm || screens.md) && !screens.lg; // 576-991px
-const isDesktop = !!screens.lg; // ≥ 992px
-```
-
-影响范围：仅 `MainLayout.tsx` 一个文件，`useEffect` + `resize` 事件监听可移除。
-
-### 3.2 CSS 策略：antd Props 优先
-
-| 场景 | 优先方案 | 兜底方案 |
-|------|---------|---------|
-| 表格列过多 | `scroll={{ x }}` | 无（antd 自带滚动条） |
-| 卡片网格 | `Col` 响应式断点 props | `index.css` @media |
-| 文字截断 | `ellipsis: true` | `text-overflow: ellipsis` CSS |
-| 弹窗宽度 | antd `width` prop | `index.css` `max-width` 约束 |
-| 工具栏换行 | `flexWrap: 'wrap'` + `gap` inline style | — |
-
-**`index.css` 追加的 @media 规则（总计约 40 行）：**
-- `(max-width: 575px)`: 表格字体 13px、弹窗 max-width 约束、Modal body max-height
-- `(min-width: 576px) and (max-width: 991px)`: 平板特有的间距微调
-- 通用: `.ant-table-wrapper { overflow-x: auto }` 确保所有表格容器可滚动
-
-### 3.3 表格横向滚动
-
-所有 `` 统一添加 `scroll={{ x }}`。具体值：
-- 列少（≤6 列）：`scroll={{ x: 'max-content' }}` 或省略（antd 自动处理）
-- 列中（7-10 列）：`scroll={{ x: 800 }}`
-- 列多（>10 列或含长文本列）：`scroll={{ x: 1000 }}` 或更大
-
-操作列（最后一列）使用 `width` 固定宽度，必要时添加 `fixed: 'right'` 在宽表场景下提升体验。
-
-### 3.4 Dashboard 响应式网格
-
-```
-统计卡片 (4 张):
- // 手机2列 平板2列 桌面4列
-
-图表卡片 (2 张):
- // 手机堆叠 平板及以上并排
-```
-
-顶部工具栏（标题 + DatePicker）在小屏下从 `flex` 横向排列改为 `flexDirection: 'column'` 堆叠。
-
-### 3.5 ECharts 图表
-
-通过 `echarts-for-react` 的内置 `ResizeObserver` 自动适配：
-```tsx
-
-```
-容器宽度由 antd `Col` 响应式断点控制，图表自动跟随。甘特图动态高度逻辑不变（`Math.max(300, data.length * 40)`）。
-
-### 3.6 弹窗适配
-
-**全局 CSS（index.css）：**
-```css
-@media (max-width: 575px) {
- .ant-modal { max-width: calc(100vw - 24px) !important; }
- .ant-modal-body { max-height: 60vh; overflow-y: auto; }
-}
-```
-
-**组件级别：** 各弹窗 `width` 在桌面端固定值（400-600px），移动端由全局 CSS 覆盖为 `max-width` 约束。
-
-### 3.7 教室排期表
-
-最复杂的适配场景 — HTML `` 含 31+ 日期列 + sticky 首列：
-- 外层 `div` 保持 `overflowX: 'auto'`
-- 首列（教室名）`position: sticky; left: 0` 保持已有
-- 日期列 `minWidth: 26` 不压窄
-- `overflowX` 容器在平板/手机下自动出现横向滚动条
-
-### 3.8 学生字段拆分
-
-学生管理页将 `{ title: '学号/身份证', dataIndex: 'idNumber' }` 一列拆为两列：
-```typescript
-{ title: '学号', dataIndex: 'studentNumber', width: 120, ellipsis: true },
-{ title: '身份证', dataIndex: 'idNumber', width: 180, ellipsis: true },
-```
-向后兼容：若后端暂未返回 `studentNumber` 字段，该列显示 `-`，不报错。
-
-## 4. 实现顺序
-
-```
-Phase 1: 基础
- 1. index.css 三断点体系
- 2. MainLayout useBreakpoint 重构
-
-Phase 2: 高优先级页面
- 3. Dashboard (4 张统计卡 + 3 张图)
- 4. 学生管理 (表格 + 字段拆分)
- 5. 入住管理 (表格 + 弹窗多)
-
-Phase 3: 批量页面
- 6-17. 剩余 12 个表格型页面（模式统一，效率高）
-
-Phase 4: 收尾
- 18. 教室排期表（特殊 HTML table）
- 19. 登录页（单卡片）
- 20. 全局验证
-```
-
-## 5. 验证计划
-
-- **视觉检查：** Chrome DevTools 响应式模式 → 375 / 768 / 992 / 1440 四个宽度
-- **每个页面检查：** 表格有无横向滚动 → 按钮是否错位/溢出 → 弹窗是否出屏 → 文字是否截断
-- **编译检查：** `npm run build` 确保 TypeScript 无报错
diff --git a/docs/superpowers/specs/2026-07-05-gongxue-p0-design.md b/docs/superpowers/specs/2026-07-05-gongxue-p0-design.md
deleted file mode 100644
index 0f8216b..0000000
--- a/docs/superpowers/specs/2026-07-05-gongxue-p0-design.md
+++ /dev/null
@@ -1,302 +0,0 @@
-# 恭学教育学生管理系统 P0 批次 — 设计规格
-
-> 版本：v1.0
-> 日期：2026-07-05
-> 基于 PRD：`../../Downloads/PRD-恭学教育学生管理系统.md`（commit `59f75bb`）
-
-## 目标
-
-按 PRD 优先级分批实施，本批次覆盖 P0（阻塞上线）的全部 5 项 + 部分 P1（上线前完成），打通班级→排课→宿舍增强→操作日志→RBAC→考勤前端→数据面板的完整链路。
-
-## 架构
-
-Monorepo (Turborepo)，后端 NestJS 11 + TypeORM 0.3 + SQLite/MySQL，前端 React 19 + Vite + Ant Design 6 + ECharts。新增 `classes`、`schedules` 两个独立 NestJS 模块，在现有 `rooms`/`occupancies`/`bills` 模块上增量增强，考勤前端新建页面。遵循现有模块结构：每个业务模块独立目录，含 `entity`/`dto`/`service`/`controller`/`module`。
-
-## 技术栈
-
-| 层级 | 技术 |
-|------|------|
-| 架构 | Monorepo (Turborepo) |
-| 前端 | React 19 + Vite + Ant Design 6 + ECharts |
-| 后端 | NestJS 11 + TypeORM 0.3 + JWT + Passport |
-| 数据库 | 开发 SQLite / 生产 MySQL 8 |
-| 测试 | Jest (后端) + Playwright (前端 E2E) |
-
-## 全局约束
-
-- 所有涉及大量数据的列表/表单页面必须有详细的筛选方案
-- 敏感信息（手机号、身份证）需脱敏展示，查看时二次确认+记录操作日志
-- 遵循现有 NestJS 模块结构，每个业务模块独立目录
-- 前端页面放在 `apps/admin/src/pages/` 下，每个模块独立目录
-- 表名使用复数形式（与现有 `students`、`rooms`、`classrooms`、`bills` 一致）
-- 冲突检测使用数据库唯一约束 + 应用层双重保障
-
----
-
-## 模块 1：班级管理（Class）
-
-### 实体
-
-**`classes`**：班级主表，含 name/code/class_type/status/日期/教师/人数上限，通过 `department_id` 关联校区。
-
-**`class_student`**：班级-学员关联，`UNIQUE(class_id, student_id)`，含 enroll_id/join_date/leave_date/status。
-
-**`class_teacher`**：班级-教师关联，`UNIQUE(class_id, user_id, role_type)`，含 role_type（任课老师/班主任/生活老师/学服老师）+ subject。
-
-Class 自身的 `head_teacher_id`/`life_teacher_id`/`academic_teacher_id` 与 `class_teacher` 表保持同步——创建/编辑班级时，若传了 head_teacher_id 等字段，同时写入 class_teacher 表对应记录。
-
-### API
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| GET | `/classes` | 班级列表（筛选：department_id/status/class_type/keyword） |
-| POST | `/classes` | 创建班级（含初始教师/学员分配） |
-| GET | `/classes/:id` | 班级详情（教师列表+学员统计） |
-| PUT | `/classes/:id` | 编辑班级 |
-| DELETE | `/classes/:id` | 删除班级（CASCADE 删除关联） |
-| GET | `/classes/:id/students` | 班级学员列表 |
-| POST | `/classes/:id/students` | 批量添加学员 `{ studentIds: number[] }` |
-| DELETE | `/classes/:id/students/:studentId` | 移除学员 |
-| GET | `/classes/:id/teachers` | 班级教师列表 |
-| POST | `/classes/:id/teachers` | 添加教师 `{ userId, roleType, subject? }` |
-| DELETE | `/classes/:id/teachers/:userId` | 移除教师 |
-
-### 前端
-
-**列表页 `Classes/index.tsx`**：筛选栏（校区下拉/班型下拉/状态下拉/搜索输入）+ 表格（名称/编码/校区/班型/日期/学员数/班主任/状态Tag/操作）+ 分页。
-
-**详情页 `Classes/Detail.tsx`**：3 Tab — 基本信息（可编辑表单）、花名册（学员表格+批量添加/移除）、教师（教师表格+添加/移除）。
-
----
-
-## 模块 2：排课管理（ClassSchedule）
-
-### 实体
-
-**`class_schedule`**：排课记录，含 class_id/classroom_id/week_day/start_time/end_time/start_date/end_date/subject/teacher_id/schedule_type（INTERNAL/RENTAL）/rental_id/status。
-
-唯一约束：同教室 + 同 week_day + 时间段重叠 + status=active 拒绝写入（应用层检测 + 数据库层面依赖应用层保证，SQLite 不支持排他约束）。
-
-### 核心规则
-
-1. INTERNAL 排课：按班级维度，展示科目+教师，关联 class_id
-2. RENTAL 排课：仅标记教室占用，关联 rental_id（classroom_rentals）
-3. 冲突检测：新增/编辑时检查同教室同星期同时段是否已有 active 排课
-4. 时段定义：预设 PRD 作息表（早自习 7:30-8:40、上午 9:00-12:00、下午 14:00-17:00、晚自习 18:30-21:00），管理员可在系统设置中调整
-
-### API
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| GET | `/class-schedules` | 排课列表（筛选：classroom_id/class_id/week_day/date_range） |
-| POST | `/class-schedules` | 创建排课（含冲突检测） |
-| PUT | `/class-schedules/:id` | 编辑排课（含冲突检测） |
-| DELETE | `/class-schedules/:id` | 删除排课 |
-| GET | `/class-schedules/weekly` | 周视图数据（按教室+week_day聚合） |
-| GET | `/class-schedules/classroom/:id/occupancy` | 教室占用时间线（合并内部+外部） |
-
-### 前端
-
-**周视图 `Schedules/index.tsx`**：顶部周切换 + 教室/班级筛选，主体 7列×N行矩阵（列=周一~周日，行=教室），每格显示科目/教师/时间。点击格子弹出排课表单 Modal（班级/科目/教师/教室/星期/时段/日期范围）。冲突时 Modal 内红色提示。
-
----
-
-## 模块 3：宿舍/入住/账单增强
-
-### 数据变更
-
-**rooms**：新增 `rental_category`（VARCHAR(10)，long/short）、`monthly_rate`（DECIMAL(10,2)）。
-
-**occupancies**：新增 `rental_type`（VARCHAR(10)，long/short）、`tenant_id`（FK → tenants.id）。
-
-**students**：新增 `tenant_id`（FK → tenants.id），替代原 `organization` 文本字段。迁移时根据 `organization` 匹配 `tenants.name`。
-
-### 账单逻辑
-
-`POST /bills/generate` 内部：遍历宿舍的 occupancy 记录，`rental_type === 'long'` 的长租学生走固定月费独立生成（不参与分摊），`short` 学生走原人天数加权分摊。
-
-### 前端
-
-Rooms 表单增加 `rental_category` Select + `monthly_rate` InputNumber。Occupancies 表单增加 `rental_type` Select + `tenant_id` Select。
-
----
-
-## 模块 4：操作日志全量接入
-
-### 覆盖范围
-
-在以下 controller 的每个写操作中统一调用 `OperationLogsService.log()`：
-
-| 模块 | 审计操作 |
-|------|---------|
-| Classes | 创建/编辑/删除班级、添加/移除学员、添加/移除教师 |
-| ClassSchedules | 创建/编辑/删除排课 |
-| Students | 新增/编辑/删除学生、导入/导出、查看敏感信息 |
-| Occupancies | 新增/编辑/退住 |
-| Expenses | 新增/编辑/删除费用 |
-| Bills | 生成账单、确认账单、标记已付、导出 |
-| Deposits | 收取/退还押金 |
-| Attendance | 补录/编辑考勤、匹配钉钉数据 |
-| RBAC | 角色变更、权限变更 |
-
-### 调用模式
-
-```typescript
-this.operationLogsService.log({
- userId: req.user.id,
- username: req.user.username,
- module: 'CLASS',
- action: 'CREATE',
- targetId: result.id,
- targetType: 'class',
- detail: { name: result.name },
- ipAddress: req.ip,
- status: 'success',
-});
-```
-
----
-
-## 模块 5：RBAC 权限扩展
-
-`permission.json` 新增以下节点：
-
-| 权限节点 | super_admin | staff | class_teacher | student |
-|----------|:---:|:---:|:---:|:---:|
-| CLASS:READ | ✅ | ✅ | ✅ | - |
-| CLASS:ADD | ✅ | ✅ | - | - |
-| CLASS:UPDATE | ✅ | ✅ | - | - |
-| CLASS:DELETE | ✅ | - | - | - |
-| SCHEDULE:READ | ✅ | ✅ | ✅ | - |
-| SCHEDULE:ADD | ✅ | ✅ | - | - |
-| SCHEDULE:UPDATE | ✅ | ✅ | - | - |
-| SCHEDULE:DELETE | ✅ | - | - | - |
-| ATTENDANCE:READ | ✅ | ✅ | ✅ | ✅ |
-| ATTENDANCE:ADD | ✅ | ✅ | - | - |
-| ATTENDANCE:UPDATE | ✅ | ✅ | - | - |
-
----
-
-## 模块 6：考勤管理前端
-
-### 页面
-
-**列表页 `Attendance/index.tsx`**：筛选栏（班级/日期范围/时段/状态/来源）+ 表格（姓名/班级/日期/时段/状态Tag/来源/打卡时间/备注/操作）+ 批量补录按钮 + 切换到日历视图按钮。
-
-**日历视图**：切换模式，行=学生、列=日期+时段，格=状态色块（绿=出勤、黄=迟到、红=缺勤、蓝=请假）。
-
-### API
-
-增强现有 `/attendance-records` 筛选参数，新增：
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| POST | `/attendance-records/batch` | 批量补录 |
-| GET | `/attendance-records/summary` | 考勤汇总统计（按班级/日期范围） |
-| GET | `/attendance-records/calendar` | 日历视图数据 |
-| GET | `/ding-attendance-raw` | 钉钉原始数据列表（筛选match_status） |
-| POST | `/ding-attendance-raw/:id/match` | 手动匹配钉钉数据到学生 |
-
----
-
-## 模块 7：数据面板增强
-
-在现有 Dashboard 的基础上：
-
-- **第二行指标卡**：教室总数/占用率、今日出勤率、本月收入总额、教室占用率
-- **新增图表**：考勤趋势折线图（近30天）、近6月收入趋势图
-- **权限控制**：不同角色看到不同指标——班主任只看本班考勤，超管看全局
-
-### API
-
-`GET /dashboard` 返回数据增加字段：`classroomCount`/`classroomOccupancyRate`/`todayAttendanceRate`/`monthlyIncome`/`attendanceTrend`/`incomeTrend`。
-
----
-
-## 数据库迁移
-
-### 新增表
-
-`classes`、`class_student`、`class_teacher`、`class_schedule` — TypeORM `synchronize: true` 自动建表。
-
-### 现有表变更
-
-```sql
-ALTER TABLE rooms ADD COLUMN rental_category VARCHAR(10) DEFAULT 'short';
-ALTER TABLE rooms ADD COLUMN monthly_rate DECIMAL(10,2) DEFAULT 0;
-ALTER TABLE occupancies ADD COLUMN rental_type VARCHAR(10) DEFAULT 'short';
-ALTER TABLE occupancies ADD COLUMN tenant_id INTEGER REFERENCES tenants(id);
-ALTER TABLE students ADD COLUMN tenant_id INTEGER REFERENCES tenants(id);
-```
-
-### 数据迁移
-
-`students.organization` → `students.tenant_id`：遍历 students 表，根据 `organization` 文本匹配 `tenants.name`，匹配到的写入 tenant_id，未匹配的置 NULL。原 `organization` 列保留不删，待后续迭代清理。
-
----
-
-## 文件结构
-
-```
-apps/server/src/
-├── entities/
-│ ├── class.entity.ts 🆕
-│ ├── class-student.entity.ts 🆕
-│ ├── class-teacher.entity.ts 🆕
-│ ├── class-schedule.entity.ts 🆕
-│ ├── room.entity.ts ✏️
-│ ├── occupancy.entity.ts ✏️
-│ ├── student.entity.ts ✏️
-│ └── index.ts ✏️
-├── classes/ 🆕
-│ ├── classes.module.ts
-│ ├── classes.controller.ts
-│ ├── classes.service.ts
-│ └── dto/
-├── schedules/ 🆕
-│ ├── schedules.module.ts
-│ ├── schedules.controller.ts
-│ ├── schedules.service.ts
-│ └── dto/
-├── rooms/ ✏️ dto
-├── occupancies/ ✏️ dto + service
-├── bills/ ✏️ service
-├── operation-logs/ ✏️ 注入各模块
-├── rbac/ ✏️ permission.json
-├── dashboard/ ✏️ service + controller
-└── app.module.ts ✏️ 注册新模块
-
-apps/admin/src/pages/
-├── Classes/ 🆕
-│ ├── index.tsx
-│ └── Detail.tsx
-├── Schedules/ 🆕
-│ └── index.tsx
-├── Attendance/ 🆕
-│ └── index.tsx
-├── Dashboard/ ✏️ index.tsx
-├── Rooms/ ✏️ index.tsx
-└── Occupancies/ ✏️ index.tsx
-```
-
----
-
-## 开发顺序
-
-```
-Phase 1 班级管理（无上游依赖）
- │
-Phase 2 排课管理（依赖班级+教室）
- │
-Phase 3 宿舍/入住/账单增强（独立，可与1/2并行）
- │
-Phase 4 操作日志全量接入（依赖1/2/3的controller就绪）
- │
-Phase 5 RBAC权限扩展（依赖1/2模块存在）
- │
-Phase 6 考勤管理前端（后端API已有，独立开发）
- │
-Phase 7 数据面板增强（依赖各方面数据）
-```
-
-Phase 1-3 可部分并行，Phase 4-5 需等 1-3 完成，Phase 6-7 可在 1-5 完成后并行。
diff --git a/docs/superpowers/specs/2026-07-05-multi-campus-design.md b/docs/superpowers/specs/2026-07-05-multi-campus-design.md
deleted file mode 100644
index d04fe6a..0000000
--- a/docs/superpowers/specs/2026-07-05-multi-campus-design.md
+++ /dev/null
@@ -1,340 +0,0 @@
-# 多校区切换/隔离 — 设计规格
-
-> 版本：v1.0
-> 日期：2026-07-05
-> 基于 PRD：`PRD-恭学教育学生管理系统.md` §23.7（多校区隔离确认需要，Department.type=campus 预留）+
-> §1.2（角色数据范围：超管全部 / 教职工指定部门+子部门 / 班主任本班 / 学生本人）
-
-## 1. 目标
-
-为系统引入多校区（Campus）概念，实现：
-- 校区树形组织结构（校区 → 子部门 → 班级）
-- 用户-部门绑定 + 默认校区
-- 全局数据查询按校区自动隔离
-- 前端校区切换器（支持单校区 / 全部校区视图）
-
-## 2. 数据模型
-
-### 2.1 部门表 `departments`
-
-```sql
-departments
-├── id INTEGER PK AUTOINCREMENT
-├── name VARCHAR(100) NOT NULL -- 部门名称，如 "鼓楼校区"
-├── parent_id INTEGER NULLABLE FK → self -- 上级部门，NULL = 顶层校区
-├── type VARCHAR(20) DEFAULT 'department'
- -- 'campus' = 校区（顶层，parent_id=NULL）
- -- 'department' = 子部门（教学部、后勤部等）
-├── sort_order INTEGER DEFAULT 0
-├── status VARCHAR(20) DEFAULT 'active' -- active / archived
-├── created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-├── updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-```
-
-### 2.2 用户-部门关联 `user_departments`
-
-```sql
-user_departments
-├── id INTEGER PK AUTOINCREMENT
-├── user_id INTEGER NOT NULL FK → users.id
-├── department_id INTEGER NOT NULL FK → departments.id
-├── is_default BOOLEAN DEFAULT false
-├── created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-UNIQUE(user_id, department_id)
-```
-
-超管不在此表有记录 → 默认全部数据可见。学生不发此关联，通过 `students.department_id` 表所属部门。
-
-### 2.3 现有实体追加 `department_id`
-
-采用**冗余存储**策略（写入时填入，避免查询时多表 JOIN）：
-
-| 实体 | 操作 | 说明 |
-|------|:---:|------|
-| `students` | 新增 | 学生所属部门 |
-| `classes` | 保留 | 已有 `department_id` 字段 |
-| `rooms` | 新增 | 宿舍归属校区 |
-| `classrooms` | 新增 | 教室归属校区 |
-| `class_schedules` | 新增 | 冗余加速（也可从 class→department 间接获取） |
-| `attendance_records` | 新增 | 冗余加速（也可从 student→department 间接获取） |
-| `room_expenses` | 新增 | 冗余加速（也可从 room→department 间接获取） |
-| `personal_expenses` | 新增 | 冗余加速（也可从 student→department 间接获取） |
-| `occupancies` | 新增 | 冗余加速（也可从 room→department 间接获取） |
-| `bills` | 新增 | 冗余加速（也可从 student→department 间接获取） |
-| `deposits` | 新增 | 冗余加速（也可从 student→department 间接获取） |
-| `deposit_installments` | 新增 | 冗余加速 |
-| `classroom_rentals` | 新增 | 冗余加速（也可从 classroom→department 间接获取） |
-
-**全局共享不隔离**：`users`、`roles`、`permissions`、`tenants`、`operation_logs`、`notifications`、`sync_logs`、`sync_states`、`ding_attendance_raw`、`expense_types`。
-
-## 3. 后端隔离机制
-
-### 3.1 JWT Payload 扩展
-
-```typescript
-// 登录时注入
-const payload = {
- sub: user.id,
- username: user.username,
- permissions,
- isSuperAdmin: user.roles?.some(r => r.name === 'super_admin'),
- // 不再注入 departmentIds，改为请求级 CampusScope 实时查询
-};
-```
-
-不将 `departmentIds` 写入 JWT，避免校区分配变更后需重新登录。
-
-### 3.2 CampusScope（请求级 Provider）
-
-```typescript
-// apps/server/src/common/campus-scope.ts
-@Injectable({ scope: Scope.REQUEST })
-export class CampusScope {
- private _departmentIds: number[] | null = null;
- currentDepartmentId: number | null;
-
- constructor(
- @Inject(REQUEST) private req: any,
- private departmentsService: DepartmentsService,
- ) {
- this.currentDepartmentId = parseInt(
- req.headers['x-campus-id'] || '0'
- ) || null;
- }
-
- get isSuperAdmin(): boolean {
- return this.req.user?.isSuperAdmin ?? false;
- }
-
- /** 获取当前用户可访问的所有部门 ID（含子部门） */
- async getDepartmentIds(): Promise {
- if (this._departmentIds) return this._departmentIds;
- const userDepts = await this.departmentsService.getUserDepartments(
- this.req.user.id
- );
- this._departmentIds = userDepts;
- return this._departmentIds;
- }
-
- /** 对 TypeORM find 条件追加校区过滤 */
- async filter>(where: T): Promise {
- if (this.isSuperAdmin && !this.currentDepartmentId) return where;
- const ids = await this.getEffectiveScopeIds();
- return { ...where, departmentId: In(ids) } as any;
- }
-
- private async getEffectiveScopeIds(): Promise {
- // 选择了具体校区 → 该校区 + 所有子部门
- // 未选 → 用户所有可访问部门 + 子部门
- const baseId = this.currentDepartmentId;
- if (baseId) {
- return this.departmentsService.getDescendantIds(baseId);
- }
- const allIds = await this.getDepartmentIds();
- const expanded = await Promise.all(
- allIds.map(id => this.departmentsService.getDescendantIds(id))
- );
- return [...new Set(expanded.flat())];
- }
-}
-```
-
-### 3.3 Controller 使用模式
-
-```typescript
-@Get()
-async findAll(@Req() req: Request) {
- const scope = req.campusScope; // 由 middleware 注入
- const where = await scope.filter({ status: 'active' });
- return this.repo.find({ where, order: { createdAt: 'DESC' } });
-}
-```
-
-超管不传 `X-Campus-Id` → `filter()` 原样返回 → 不做隔离。
-
-### 3.4 校区选择 Header
-
-前端 axios interceptor 注入：
-
-```typescript
-api.interceptors.request.use((config) => {
- const campusId = localStorage.getItem('currentCampusId');
- if (campusId) {
- config.headers['X-Campus-Id'] = campusId;
- }
- return config;
-});
-```
-
-### 3.5 部门管理 CRUD
-
-| 方法 | 路径 | 认证 | 说明 |
-|------|------|:---:|------|
-| GET | `/departments` | JWT | 部门列表（树形结构，按 sort_order + name） |
-| GET | `/departments/:id` | JWT | 部门详情 |
-| POST | `/departments` | JWT | 创建部门（指定 parent_id + type） |
-| PUT | `/departments/:id` | JWT | 编辑部门 |
-| DELETE | `/departments/:id` | JWT | 删除部门（检查无子部门+无关联用户） |
-| GET | `/departments/:id/users` | JWT | 部门下关联的用户列表 |
-| POST | `/departments/:id/users` | JWT | 为用户分配部门 `{ userId, isDefault? }` |
-| DELETE | `/departments/:id/users/:userId` | JWT | 移除用户-部门关联 |
-| GET | `/departments/tree` | JWT | 树形数据（前端级联选择器用） |
-
-### 3.6 写操作时 department_id 填充
-
-新建宿舍时：
-```typescript
-async create(dto: CreateRoomDto) {
- // department_id 由前端传入（校区选择器当前选中值）
- return this.repo.save({ ...dto, departmentId: dto.departmentId });
-}
-```
-
-新建学生时关联班级的 department：
-```typescript
-async create(dto: CreateStudentDto) {
- const cls = await this.classesRepo.findOne({ where: { id: dto.classId } });
- return this.studentRepo.save({
- ...dto,
- departmentId: cls?.departmentId,
- });
-}
-```
-
-## 4. 前端
-
-### 4.1 校区选择器 `CampusSwitcher`
-
-Header 左侧，Logo 旁边：
-
-```
-[ 恭学教育 ] [ 鼓楼校区 ▾ ]
-```
-
-- `Select` 组件，列出当前用户可访问的校区（从 JWT payload 或 `/departments` API 获取）
-- 切换时：`localStorage.setItem('currentCampusId', id)` + 刷新所有页面数据
-- 多校区权限用户底部显示「全部校区」选项（value 为空字符串）
-- 仅一个校区 → 纯文本展示，不可切换
-- 默认选中 `localStorage.getItem('currentCampusId')` 或用户默认校区
-
-### 4.2 `useCampus` Hook
-
-```typescript
-function useCampus() {
- const [campuses, setCampuses] = useState([]);
- const [currentId, setCurrentId] = useState(
- () => localStorage.getItem('currentCampusId') || ''
- );
-
- const switchCampus = (id: string) => {
- setCurrentId(id);
- localStorage.setItem('currentCampusId', id);
- // 触发全局数据刷新（通过 event 或 context）
- window.dispatchEvent(new CustomEvent('campus-changed', { detail: id }));
- };
-
- return { campuses, currentId, switchCampus };
-}
-```
-
-### 4.3 部门管理页面 `Departments/index.tsx`
-
-- 左侧 `Tree` 组件展示部门树
-- 点击节点 → 右侧表单编辑部门信息
-- 右键/操作按钮：添加子部门、编辑、删除
-- 「部门成员」Tab：用户列表 + 分配/移除
-
-### 4.4 数据面板适配
-
-选中「全部校区」时：
-- 统计卡片数值为各校区汇总
-- 图表按校区分组（图例标注校区名）
-- 不选全部校区 → 仅显示当前校区数据
-
-## 5. 文件结构
-
-```
-apps/server/src/
-├── entities/
-│ ├── department.entity.ts 🆕
-│ ├── user-department.entity.ts 🆕
-│ ├── student.entity.ts ✏️ +department_id
-│ ├── room.entity.ts ✏️ +department_id
-│ ├── classroom.entity.ts ✏️ +department_id
-│ ├── class-schedule.entity.ts ✏️ +department_id
-│ ├── attendance-record.entity.ts ✏️ +department_id
-│ ├── room-expense.entity.ts ✏️ +department_id
-│ ├── personal-expense.entity.ts ✏️ +department_id
-│ ├── occupancy.entity.ts ✏️ +department_id
-│ ├── bill.entity.ts ✏️ +department_id
-│ ├── deposit.entity.ts ✏️ +department_id
-│ ├── deposit-installment.entity.ts ✏️ +department_id
-│ ├── classroom-rental.entity.ts ✏️ +department_id
-│ └── index.ts ✏️
-├── departments/ 🆕
-│ ├── departments.module.ts
-│ ├── departments.controller.ts
-│ ├── departments.service.ts
-│ └── dto/
-│ └── department.dto.ts
-├── common/
-│ └── campus-scope.ts 🆕
-├── auth/
-│ ├── auth.service.ts ✏️ 登录注入 isSuperAdmin
-│ └── strategies/jwt.strategy.ts ✏️ payload 扩展
-├── students/
-│ └── students.service.ts ✏️ create 时填充 department_id
-├── rooms/
-│ └── rooms.service.ts ✏️ create 时填充 department_id
-├── ...（各 service 使用 scope.filter()）
-└── app.module.ts ✏️ 注册 DepartmentsModule + CampusScope
-
-apps/admin/src/
-├── pages/
-│ └── Departments/
-│ └── index.tsx 🆕 部门管理页
-├── components/
-│ └── CampusSwitcher.tsx 🆕
-├── api/index.ts ✏️ interceptor 加 X-Campus-Id
-├── hooks/
-│ └── useCampus.ts 🆕
-├── layouts/
-│ └── MainLayout.tsx ✏️ 挂载 CampusSwitcher
-└── App.tsx ✏️ 注册 /departments 路由
-```
-
-## 6. 数据库迁移
-
-### 新增表
-
-`departments`、`user_departments` — TypeORM `synchronize: true` 自动建表。
-
-### 现有表 ALTER
-
-```sql
-ALTER TABLE students ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE rooms ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE classrooms ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE class_schedules ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE attendance_records ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE room_expenses ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE personal_expenses ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE occupancies ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE bills ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE deposits ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE deposit_installments ADD COLUMN department_id INTEGER REFERENCES departments(id);
-ALTER TABLE classroom_rentals ADD COLUMN department_id INTEGER REFERENCES departments(id);
-```
-
-### 数据回填
-
-1. 创建默认校区 "主校区"（`departments` type=campus）
-2. 所有现有数据的 `department_id` 回填为默认校区 ID
-3. 现有用户全部关联到默认校区（`user_departments`）
-
-## 7. 钉钉同步集成
-
-钉钉组织架构拉取已有能力（PRD §19.1），同步时将钉钉部门树映射到 `departments` 表：
-- 根部门 → `type = 'campus'`
-- 子部门 → `type = 'department'`
-- 同步时维护 `parent_id` 树结构
diff --git a/docs/superpowers/specs/2026-07-05-notification-center-design.md b/docs/superpowers/specs/2026-07-05-notification-center-design.md
deleted file mode 100644
index 96b74de..0000000
--- a/docs/superpowers/specs/2026-07-05-notification-center-design.md
+++ /dev/null
@@ -1,233 +0,0 @@
-# 站内信通知中心 — 设计规格
-
-> 版本：v1.0
-> 日期：2026-07-05
-> 基于 PRD：`PRD-恭学教育学生管理系统.md` §23.7（通知中心确认需要） + §12.3（账单通知推送 P2）
-
-## 1. 目标
-
-为系统全部角色（超管、教职工、班主任、学生）提供统一的站内信通知中心，支撑以下业务场景的实时通知，同时预留钉钉/企微外发扩展点。
-
-## 2. 通知场景
-
-| 场景 | 触发方 | 通知类型 | 接收方 |
-|------|--------|----------|--------|
-| 账单生成 | 系统/管理员 | `bill_generated` | 学生 + 财务 |
-| 账单确认/已付 | 管理员 | `bill_paid` | 学生 + 宿管 |
-| 入住登记 | 宿管 | `check_in` | 宿管 + 学生 |
-| 退宿 | 宿管 | `check_out` | 宿管 + 学生 |
-| 押金催缴 | 财务 | `deposit_due` | 学生 + 财务 |
-| 押金退还 | 财务 | `deposit_refunded` | 学生 + 财务 |
-| 班级学员增减 | 教务 | `class_change` | 班主任 |
-| 班级教师调整 | 教务 | `class_change` | 相关教师 |
-| 排课冲突 | 系统检测 | `schedule_conflict` | 教务 |
-| 系统公告 | 管理员手动 | `announcement` | 全员/指定角色 |
-
-## 3. 技术方案
-
-**SSE (Server-Sent Events) 推送 + 轮询兜底。**
-
-- NestJS 原生 `@Sse()` + RxJS `Observable`
-- 前端 `EventSource` 建立长连接，断开时自动重连
-- 重连间隙兜底轮询 `GET /notifications/unread-count`（60s 间隔）
-- 钉钉/企微外发通过 EventEmitter2 异步解耦
-
-## 4. 数据模型
-
-```sql
-notifications
-├── id INTEGER PK AUTOINCREMENT
-├── recipient_id INTEGER NOT NULL -- FK → users.id
-├── type VARCHAR(30) NOT NULL -- bill_generated | bill_paid | check_in | check_out |
- -- deposit_due | deposit_refunded | class_change |
- -- schedule_conflict | announcement
-├── title VARCHAR(200) NOT NULL -- 通知标题
-├── content TEXT -- 通知正文（支持模板变量）
-├── link VARCHAR(500) NULLABLE -- 点击跳转路径，如 /bills/123
-├── is_read BOOLEAN DEFAULT false
-├── read_at DATETIME NULLABLE
-├── created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-```
-
-设计决策：
-- **一通知一接收方** — 同一事件对 N 个用户各建一条记录，避免 `is_read` 共享状态。
-- **无软删除** — 通知不可删除（保留审计痕迹），支持"全部已读"。
-- **cursor-based 分页** — `?after=&limit=20`，适合实时追加场景。
-
-## 5. 后端模块
-
-### 5.1 文件结构
-
-```
-apps/server/src/
-├── entities/
-│ └── notification.entity.ts 🆕
-├── notifications/ 🆕
-│ ├── notifications.module.ts
-│ ├── notifications.controller.ts
-│ ├── notifications.service.ts
-│ └── dto/
-│ └── notification.dto.ts
-└── app.module.ts ✏️ 注册 NotificationsModule
-```
-
-### 5.2 API
-
-| 方法 | 路径 | 认证 | 说明 |
-|------|------|:---:|------|
-| GET | `/notifications` | JWT | 当前用户通知列表（cursor 分页，`?after=&limit=20`） |
-| GET | `/notifications/unread-count` | JWT | `{ count: number }` |
-| GET | `/notifications/stream` | JWT | SSE 端点，`text/event-stream` |
-| PUT | `/notifications/:id/read` | JWT | 标记单条已读 |
-| PUT | `/notifications/read-all` | JWT | 当前用户全部已读 |
-
-### 5.3 Service 接口
-
-```typescript
-class NotificationsService {
- create(dto: CreateNotificationDto): Promise;
- findByUser(userId: number, after?: number, limit?: number): Promise;
- getUnreadCount(userId: number): Promise;
- markRead(id: number, userId: number): Promise;
- markAllRead(userId: number): Promise;
- subscribe(userId: number): Observable