feat(iam): provision authorized first-login users as medical assistants

2026-09-10 12:15:15 +08:00
parent f8b6196205
commit 6325ba88ff
6 changed files with 297 additions and 4 deletions
@@ -51,3 +51,23 @@ NODE_PATH=admin/node_modules node server/tests/IamLoginUiContractTest.mjs
 ```

 回退时先关闭 IAM 开关，再恢复本次代码和静态入口备份，不清空会话、用户、角色、业务数据库或全部缓存。新创建的员工与医助账号保留，由管理员决定是否停用。
+
+## 2026-09-10: authorized first-login provisioning
+
+Deploy `server/database/migrations/20260910_iam_local_identity.sql` before the adapter update (adjust the `zyt_` prefix only when configured differently). This additive InnoDB ledger is keyed by SHA-256 of the exact issuer/application/subject tuple and uniquely associates a new local account. Keep the ledger when rolling code back; never drop it or delete real accounts as a code rollback.
+
+The authenticated provisioning-context API is the authority for active employee + application grant. Only an explicit `shouldCreateLocalAccount=true` with an empty external ID creates an account. The local transaction inserts the immutable ledger, a random local account name and password, and role **2 / 医助** only; a missing, deleted, renamed or disabled default role fails closed. Neither name, phone nor email merges accounts. Existing explicit bindings use existing permissions without modification. Password setup (`is_paw=0`), non-root status, and original WeCom binding gates remain intact. The normal physician IM import runs best-effort after central binding confirmation, matching `AdminLogic::add` semantics; provider errors are logged by the existing helper.
+
+After local commit, the adapter uses application authentication and stable idempotency metadata to POST bindings, accepts HTTP 201, then reads provisioning-context again and requires the exact created ID before issuing a login ticket. Remote failures keep the local ledger for retry, with no business token. Parallel workers cannot create another ledger/account for that immutable identity. A transient DB deadlock can fail one login attempt; retry resumes the winning account.
+
+The IAM server must reject changing an existing binding to a different external ID on this endpoint (rather than an upsert overwrite). Ship that conflict fix before this adapter. Admin-driven deliberate rebindings require a separate verified workflow.
+
+Focused local tests:
+
+```sh
+php server/tests/IamOidcClientTest.php
+php server/tests/IamLoginTransactionTest.php
+php server/tests/IamProvisioningTest.php
+# Dedicated disposable local MariaDB only; drops four fixture tables in iam_fixture.
+IAM_TEST_MYSQL=1 php server/tests/IamProvisioningTest.php
+```