feat: complete leave approval MVP

scripts/README.md

@@ -1,5 +1,7 @@
 # Scripts
 
-后续放置开发环境检查、契约生成、数据库迁移和本地启动脚本。脚本必须可重复运行，不得包含密钥。
+开发环境检查、契约验证、数据库迁移和本地启动脚本放在此目录。脚本必须可重复运行，不得包含生产密钥。
 
-`verify-local-auth.sh` 使用 Keycloak Realm 中明确标记为仅限本地开发的账号，验证健康检查、Token 获取和 `/api/v1/me`。不得把该脚本及其测试凭据用于共享或生产环境。
+`verify-local-auth.sh` 使用 Keycloak Realm 中明确标记为仅限本地开发的账号，注册脚本设备并验证健康检查、Token 获取、设备会话和 `/api/v1/me`。不得把该脚本及其测试凭据用于共享或生产环境。
+
+`verify-all.sh` 执行后端测试、AI 服务测试、Flutter 格式/分析/测试、OpenAPI YAML 和 Git 空白检查。设置 `AIOA_FULL_BUILD=1` 后还会构建 Android Debug APK，并在 macOS 上构建 iOS Simulator App。

scripts/dev-android-reverse.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+adb reverse tcp:8080 tcp:8080
+adb reverse tcp:8081 tcp:8081
+adb reverse tcp:9000 tcp:9000
+
+echo "Android emulator reverse ports configured for AIOA API, Keycloak, and MinIO."

scripts/verify-all.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+java_home_default='/usr/local/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home'
+
+if [[ -z "${JAVA_HOME:-}" && -d "${java_home_default}" ]]; then
+  export JAVA_HOME="${java_home_default}"
+fi
+
+if [[ -z "${JAVA_HOME:-}" ]]; then
+  echo 'JDK 21 is required. Set JAVA_HOME before running verification.' >&2
+  exit 1
+fi
+
+echo '[1/5] Backend tests'
+(
+  cd "${root_dir}/backend"
+  ./gradlew --no-daemon test
+)
+
+echo '[2/5] AI service tests'
+(
+  cd "${root_dir}/ai-service"
+  if [[ -x .venv/bin/python ]]; then
+    .venv/bin/python -m compileall -q app tests
+    .venv/bin/python -m pytest
+  else
+    python3 -m compileall -q app tests
+    python3 -m pytest
+  fi
+)
+
+echo '[3/5] Flutter formatting, analysis and tests'
+(
+  cd "${root_dir}/mobile"
+  dart format --output=none --set-exit-if-changed lib test
+  flutter analyze
+  flutter test
+)
+
+echo '[4/5] Contract and whitespace checks'
+(
+  cd "${root_dir}"
+  ruby -e "require 'yaml'; YAML.load_file('contracts/openapi/aioa-v1.yaml')"
+  git diff --check
+)
+
+echo '[5/5] Optional platform builds'
+if [[ "${AIOA_FULL_BUILD:-0}" == '1' ]]; then
+  (
+    cd "${root_dir}/mobile"
+    flutter build apk --debug
+    if [[ "$(uname -s)" == 'Darwin' ]]; then
+      flutter build ios --simulator --no-codesign
+    fi
+  )
+else
+  echo 'Skipped. Set AIOA_FULL_BUILD=1 to build Android and iOS simulator artifacts.'
+fi
+
+echo 'AIOA verification completed successfully.'

scripts/verify-local-auth.sh

@@ -25,8 +25,23 @@ for username in employee manager admin hr; do
       --data-urlencode password="${password}"
   } | jq -r .access_token)"
 
+  case "${username}" in
+    employee) device_id='10000000-0000-4000-8000-000000000001' ;;
+    manager) device_id='10000000-0000-4000-8000-000000000002' ;;
+    admin) device_id='10000000-0000-4000-8000-000000000003' ;;
+    hr) device_id='10000000-0000-4000-8000-000000000004' ;;
+  esac
+
+  curl --fail --silent --show-error \
+    -X POST "${backend_url}/api/v1/devices/register" \
+    -H "Authorization: Bearer ${token}" \
+    -H 'Content-Type: application/json' \
+    --data "{\"id\":\"${device_id}\",\"name\":\"Local auth verifier (${username})\",\"platform\":\"OTHER\",\"appVersion\":\"script\"}" \
+    >/dev/null
+
   printf '%s\n' "${username}"
   curl --fail --silent --show-error \
     "${backend_url}/api/v1/me" \
-    -H "Authorization: Bearer ${token}" | jq .
+    -H "Authorization: Bearer ${token}" \
+    -H "X-AIOA-Device-Id: ${device_id}" | jq .
 done