feat: establish AIOA identity and organization baseline

2026-07-18 08:05:45 +08:00
commit bbb09ed56f
42 changed files with 2473 additions and 0 deletions
@@ -0,0 +1,57 @@
+name: aioa
+
+services:
+  postgres:
+    image: postgres:17.5-alpine
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-aioa}
+      POSTGRES_USER: ${POSTGRES_USER:-aioa}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-change-me}
+    ports:
+      - "15432:5432"
+    volumes:
+      # Versioned volume avoids accidentally reusing a database initialized
+      # by another local project or an earlier credential set.
+      - postgres-data-v1:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  redis:
+    image: redis:8.0.2-alpine
+    command: ["redis-server", "--appendonly", "yes"]
+    ports:
+      - "6379:6379"
+    volumes:
+      - redis-data:/data
+
+  keycloak:
+    image: quay.io/keycloak/keycloak:26.2.5
+    command: ["start-dev", "--import-realm"]
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN:-admin}
+      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-change-me}
+      KC_HOSTNAME: http://localhost:8081
+    ports:
+      - "8081:8080"
+    volumes:
+      - ./keycloak/realm-aioa.json:/opt/keycloak/data/import/realm-aioa.json:ro
+
+  minio:
+    image: minio/minio:RELEASE.2025-06-13T11-33-47Z
+    command: ["server", "/data", "--console-address", ":9001"]
+    environment:
+      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
+      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-change-me-now}
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+    volumes:
+      - minio-data:/data
+
+volumes:
+  postgres-data-v1:
+  redis-data:
+  minio-data:
@@ -0,0 +1,84 @@
+{
+  "realm": "aioa",
+  "enabled": true,
+  "displayName": "AIOA Development",
+  "registrationAllowed": false,
+  "resetPasswordAllowed": true,
+  "loginWithEmailAllowed": true,
+  "roles": {
+    "realm": [
+      { "name": "employee", "description": "普通员工" },
+      { "name": "department_manager", "description": "部门主管" },
+      { "name": "oa_admin", "description": "OA 管理员" }
+    ]
+  },
+  "clients": [
+    {
+      "clientId": "aioa-mobile",
+      "name": "AIOA Mobile",
+      "enabled": true,
+      "publicClient": true,
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": true,
+      "redirectUris": ["aioa://oauth/callback", "http://localhost:*"],
+      "webOrigins": ["+"],
+      "attributes": {
+        "pkce.code.challenge.method": "S256"
+      },
+      "protocolMappers": [
+        {
+          "name": "tenant-id",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-usermodel-attribute-mapper",
+          "consentRequired": false,
+          "config": {
+            "user.attribute": "tenant_id",
+            "claim.name": "tenant_id",
+            "jsonType.label": "String",
+            "id.token.claim": "true",
+            "access.token.claim": "true",
+            "userinfo.token.claim": "true"
+          }
+        }
+      ]
+    }
+  ],
+  "users": [
+    {
+      "id": "10000000-0000-7000-8000-000000000001",
+      "username": "employee",
+      "enabled": true,
+      "emailVerified": true,
+      "firstName": "小明",
+      "lastName": "员工",
+      "email": "employee@example.local",
+      "attributes": { "tenant_id": ["00000000-0000-7000-8000-000000000001"] },
+      "credentials": [{ "type": "password", "value": "Employee123!", "temporary": false }],
+      "realmRoles": ["employee"]
+    },
+    {
+      "id": "10000000-0000-7000-8000-000000000002",
+      "username": "manager",
+      "enabled": true,
+      "emailVerified": true,
+      "firstName": "主管",
+      "lastName": "王",
+      "email": "manager@example.local",
+      "attributes": { "tenant_id": ["00000000-0000-7000-8000-000000000001"] },
+      "credentials": [{ "type": "password", "value": "Manager123!", "temporary": false }],
+      "realmRoles": ["employee", "department_manager"]
+    },
+    {
+      "id": "10000000-0000-7000-8000-000000000003",
+      "username": "admin",
+      "enabled": true,
+      "emailVerified": true,
+      "firstName": "管理员",
+      "lastName": "OA",
+      "email": "admin@example.local",
+      "attributes": { "tenant_id": ["00000000-0000-7000-8000-000000000001"] },
+      "credentials": [{ "type": "password", "value": "Admin123!", "temporary": false }],
+      "realmRoles": ["employee", "oa_admin"]
+    }
+  ]
+}