feat: 终端玩家 auth 模块 + admin 管理后台 (#41)

* feat(end-user): 终端玩家 auth 模块 + 托管 CRUD API + 测试

apps/server 新增面向游戏玩家的第二个 Better Auth 实例(basepath
/api/client/auth),独立于已有的 SaaS 运营者 auth(/api/auth)。租户
既可用 SaaS 托管玩家身份,也可用 Sync API 从自家系统同步用户进来,
两种来源可在同一 org 内混用。

核心设计
- 全新 eu_* 表(eu_user / eu_session / eu_account / eu_verification)
  和既有 user/session 等物理分离,`organizationId` FK 指向同一张
  organization 表。Email per-tenant 唯一,实现方式是 DB 里存
  `{orgId}__{rawEmail}` 命名空间化的 email + 全局 UNIQUE(email),
  Better Auth 的 email-lookup 路径上加 hooks.before 自动 scope、SDK
  层自动脱前缀,外部 API 看到的永远是原始邮箱。
- requireClientUser 改造成双通道收敛:有 Better Auth session 就用
  session.user.id(托管玩家,不再需要 HMAC);没有就回退到 cpk+HMAC
  (同步玩家)。业务 handler 继续读 c.var.endUserId,不感知差异。
- eu_session.organizationId 反规范化 + cpk_.organizationId 强等值校验,
  防止跨租户 cookie 盗用。
- eu_user.disabled 软禁用,disable 时级联删除 eu_session 立即生效,
  session.create.before + requireClientUser 双重拦截后续登录/请求。

CRUD API (/api/end-user,admin auth 保护)
- POST /sync — 租户自家用户 upsert,(orgId, externalId) → (orgId, email)
  两级匹配,managed 记录只补 externalId 不覆盖密码相关字段
- GET / — 列表(search / origin=managed|synced / disabled / limit+offset)
- GET /:id / PATCH /:id / DELETE /:id
- POST /:id/disable | /enable | /sign-out-all

SDK
- packages/sdk-client-ts/src/auth.ts — 封装 sign-up/sign-in/sign-out/
  get-session,自动 strip email 前缀

测试
- service.test.ts 21 项 — 覆盖 sync 三种 merge 路径 + identity conflict +
  CRUD 全套 + setDisabled 级联 + 租户隔离
- routes.test.ts 12 项 — HTTP 边界 + 401/400/404 + 状态码映射
- end-user-auth.test.ts 9 项 — email namespacing、org 注入、跨租户 session
  guard(403 session_tenant_mismatch)、disabled 拒登

验证
- pnpm test:54 files / 834 tests 全通过
- check-types / lint:0 新错误

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(admin): 后台新增终端玩家管理页(列表 / 详情 / 禁用 / 踢下线 / 删除)

接上一 commit 的服务端 CRUD,给 admin 补一个 /end-user 管理入口。
挂在侧边栏 "Social & Competition" 分组下,图标用 Contact,和
Friend/Guild/Ranking 放一起。

列表页 (/end-user)
- 搜索框(匹配 email / name / externalId)+ origin 筛选(全部/托管/同步)
  + 状态筛选(全部/启用/禁用),映射到服务端 GET /api/end-user 的 query
- DataTable 表格:Name(点击进详情) / Email(脱前缀) / External ID /
  Origin badge(Managed Crown / Synced LinkIcon) / 活跃 session 数 /
  状态 badge / 创建时间
- 页头右侧用 PageHeaderActions 显示 "N total" 统计

详情页 (/end-user/$id)
- 身份卡(只读):End-user ID / Email / External ID / Active sessions /
  Created / Updated,右上角显示 Managed/Synced + Enabled/Disabled 双 badge
- 编辑表单:Name / Image URL / Email verified switch,PATCH 提交
- Danger zone(带 AlertDialog 二次确认):
  - Revoke all sessions — 撤销全部会话,不禁用
  - Disable user / Enable user — 软禁用,级联踢下线
  - Delete permanently — 硬删,警告玩家业务数据(排行榜/背包等以
    endUserId 关联的)不会连带删除

i18n
- zh + en 各新增 61 个 key,覆盖页面标题、列表过滤、详情字段标签、
  三种确认弹窗(title + description)、5 种 toast 消息(成功/失败含
  {count}、{message} 插值)
- nav_end_user 入口文案 "End Users" / "终端玩家"

数据层
- lib/types/end-user.ts — 手写类型(不走 sdk-admin-ts,和其它模块保持一致)
- hooks/use-end-user.ts — 7 个 React Query hook,mutation 成功后
  invalidate END_USERS_KEY

smoke 验证:登录 admin → 访问 /end-user → 列表渲染 → 点进详情 →
改名字保存 → PATCH /api/end-user/:id 200 → DB 落库确认。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dengzhaofun

apps/admin/messages/en.json

@@ -1415,5 +1415,65 @@
   "rank_match_col_participants": "Players",
   "rank_match_col_settled": "Settled",
   "rank_no_matches": "No matches settled in this season yet.",
-  "rank_loading": "Loading…"
+  "rank_loading": "Loading…",
+
+  "nav_end_user": "End Users",
+  "end_user_title": "End Users",
+  "end_user_subtitle": "Players of your game — managed here or synced in from your own system.",
+  "end_user_search_placeholder": "Search email, name, or externalId",
+  "end_user_filter_all": "All",
+  "end_user_filter_origin_managed": "Managed (password)",
+  "end_user_filter_origin_synced": "Synced (external)",
+  "end_user_filter_disabled_only": "Disabled only",
+  "end_user_filter_enabled_only": "Enabled only",
+  "end_user_col_name": "Name",
+  "end_user_col_email": "Email",
+  "end_user_col_external_id": "External ID",
+  "end_user_col_origin": "Origin",
+  "end_user_col_sessions": "Sessions",
+  "end_user_col_status": "Status",
+  "end_user_col_created_at": "Created",
+  "end_user_origin_managed": "Managed",
+  "end_user_origin_synced": "Synced",
+  "end_user_status_enabled": "Enabled",
+  "end_user_status_disabled": "Disabled",
+  "end_user_status_email_unverified": "Unverified",
+  "end_user_empty_title": "No players yet",
+  "end_user_empty_description": "Players appear here after they sign up via your game, or after you sync them in.",
+  "end_user_total_count": "{count} total",
+  "end_user_loading": "Loading…",
+  "end_user_detail_back": "Back to list",
+  "end_user_detail_section_identity": "Identity",
+  "end_user_detail_section_sessions": "Sessions",
+  "end_user_detail_section_danger": "Danger zone",
+  "end_user_detail_field_id": "End-user ID",
+  "end_user_detail_field_email": "Email",
+  "end_user_detail_field_external_id": "External ID",
+  "end_user_detail_field_name": "Name",
+  "end_user_detail_field_image": "Image URL",
+  "end_user_detail_field_email_verified": "Email verified",
+  "end_user_detail_field_origin": "Origin",
+  "end_user_detail_field_status": "Status",
+  "end_user_detail_field_created_at": "Created",
+  "end_user_detail_field_updated_at": "Updated",
+  "end_user_detail_field_session_count": "Active sessions",
+  "end_user_detail_action_save": "Save changes",
+  "end_user_detail_action_sign_out_all": "Revoke all sessions",
+  "end_user_detail_action_disable": "Disable user",
+  "end_user_detail_action_enable": "Enable user",
+  "end_user_detail_action_delete": "Delete permanently",
+  "end_user_detail_sign_out_all_confirm_title": "Revoke all active sessions?",
+  "end_user_detail_sign_out_all_confirm_description": "The player will be forced to sign in again on every device.",
+  "end_user_detail_disable_confirm_title": "Disable this player?",
+  "end_user_detail_disable_confirm_description": "They will be signed out everywhere immediately, and blocked from signing in until you re-enable them.",
+  "end_user_detail_delete_confirm_title": "Delete this player permanently?",
+  "end_user_detail_delete_confirm_description": "This removes the account, all sessions, and the password. Business data keyed by endUserId (leaderboards, inventory) is NOT deleted. This cannot be undone.",
+  "end_user_detail_toast_saved": "Changes saved.",
+  "end_user_detail_toast_disabled": "Player disabled and all sessions revoked.",
+  "end_user_detail_toast_enabled": "Player enabled.",
+  "end_user_detail_toast_signed_out": "Revoked {count} active sessions.",
+  "end_user_detail_toast_deleted": "Player deleted.",
+  "end_user_detail_toast_save_failed": "Save failed: {message}",
+  "end_user_detail_not_found_title": "Player not found",
+  "end_user_detail_not_found_description": "This player may have been deleted or belongs to a different organization."
 }

apps/admin/messages/zh.json

@@ -1415,5 +1415,65 @@
   "rank_match_col_participants": "参赛者",
   "rank_match_col_settled": "结算时间",
   "rank_no_matches": "当前赛季暂无对局。",
-  "rank_loading": "加载中…"
+  "rank_loading": "加载中…",
+
+  "nav_end_user": "终端玩家",
+  "end_user_title": "终端玩家",
+  "end_user_subtitle": "你游戏的玩家 —— 可托管注册或从你自己的账号体系同步而来。",
+  "end_user_search_placeholder": "搜索邮箱、昵称或外部 ID",
+  "end_user_filter_all": "全部",
+  "end_user_filter_origin_managed": "托管(密码登录)",
+  "end_user_filter_origin_synced": "同步(外部账号)",
+  "end_user_filter_disabled_only": "只看禁用",
+  "end_user_filter_enabled_only": "只看启用",
+  "end_user_col_name": "昵称",
+  "end_user_col_email": "邮箱",
+  "end_user_col_external_id": "外部 ID",
+  "end_user_col_origin": "来源",
+  "end_user_col_sessions": "会话",
+  "end_user_col_status": "状态",
+  "end_user_col_created_at": "创建时间",
+  "end_user_origin_managed": "托管",
+  "end_user_origin_synced": "同步",
+  "end_user_status_enabled": "正常",
+  "end_user_status_disabled": "已禁用",
+  "end_user_status_email_unverified": "未验证",
+  "end_user_empty_title": "暂无玩家",
+  "end_user_empty_description": "玩家在游戏里注册或通过同步接口进来之后,会出现在这里。",
+  "end_user_total_count": "共 {count} 人",
+  "end_user_loading": "加载中…",
+  "end_user_detail_back": "返回列表",
+  "end_user_detail_section_identity": "身份信息",
+  "end_user_detail_section_sessions": "会话",
+  "end_user_detail_section_danger": "高危操作",
+  "end_user_detail_field_id": "玩家 ID",
+  "end_user_detail_field_email": "邮箱",
+  "end_user_detail_field_external_id": "外部 ID",
+  "end_user_detail_field_name": "昵称",
+  "end_user_detail_field_image": "头像 URL",
+  "end_user_detail_field_email_verified": "邮箱已验证",
+  "end_user_detail_field_origin": "来源",
+  "end_user_detail_field_status": "状态",
+  "end_user_detail_field_created_at": "创建时间",
+  "end_user_detail_field_updated_at": "更新时间",
+  "end_user_detail_field_session_count": "活跃会话数",
+  "end_user_detail_action_save": "保存修改",
+  "end_user_detail_action_sign_out_all": "踢下线所有会话",
+  "end_user_detail_action_disable": "禁用用户",
+  "end_user_detail_action_enable": "恢复启用",
+  "end_user_detail_action_delete": "彻底删除",
+  "end_user_detail_sign_out_all_confirm_title": "踢下线所有活跃会话?",
+  "end_user_detail_sign_out_all_confirm_description": "玩家所有设备上的登录态都会立刻失效,需要重新登录。",
+  "end_user_detail_disable_confirm_title": "禁用这个玩家?",
+  "end_user_detail_disable_confirm_description": "立即踢下线所有会话,且禁止重新登录,直到你恢复启用。",
+  "end_user_detail_delete_confirm_title": "彻底删除这个玩家?",
+  "end_user_detail_delete_confirm_description": "将删除账号、所有会话和密码。业务数据(天梯、背包等按 endUserId 关联的)不会被删除。此操作无法撤销。",
+  "end_user_detail_toast_saved": "修改已保存。",
+  "end_user_detail_toast_disabled": "玩家已禁用,所有会话已撤销。",
+  "end_user_detail_toast_enabled": "玩家已恢复启用。",
+  "end_user_detail_toast_signed_out": "已撤销 {count} 个活跃会话。",
+  "end_user_detail_toast_deleted": "玩家已删除。",
+  "end_user_detail_toast_save_failed": "保存失败:{message}",
+  "end_user_detail_not_found_title": "找不到该玩家",
+  "end_user_detail_not_found_description": "这个玩家可能已被删除,或属于其他组织。"
 }

apps/admin/src/components/AppSidebar.tsx

@@ -6,6 +6,7 @@ import {
   CalendarCheck,
   ChevronRight,
   Coins,
+  Contact,
   Dices,
   FolderOpen,
   GalleryHorizontal,
@@ -85,6 +86,7 @@ type NavItem = {
     | "/team"
     | "/leaderboard"
     | "/rank"
+    | "/end-user"
     | "/api-keys"
   icon: LucideIcon
 }
@@ -152,6 +154,7 @@ function getNavGroups(): NavGroup[] {
         { title: m.nav_team, to: "/team", icon: Swords },
         { title: m.nav_leaderboard, to: "/leaderboard", icon: Trophy },
         { title: m.nav_rank, to: "/rank", icon: Medal },
+        { title: m.nav_end_user, to: "/end-user", icon: Contact },
       ],
     },
     {

apps/admin/src/components/end-user/EndUserTable.tsx

@@ -0,0 +1,122 @@
+/**
+ * Table for the end-user list page. Wraps the shared `DataTable` with
+ * the column definitions for a player row.
+ */
+import type { ColumnDef } from "@tanstack/react-table"
+import { Link } from "@tanstack/react-router"
+import { Ban, CheckCircle2, Crown, LinkIcon } from "lucide-react"
+
+import { Badge } from "#/components/ui/badge"
+import { DataTable } from "#/components/data-table/DataTable"
+import type { EndUser } from "#/lib/types/end-user"
+import * as m from "#/paraglide/messages.js"
+
+function formatDate(iso: string): string {
+  const d = new Date(iso)
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`
+}
+
+const columns: ColumnDef<EndUser>[] = [
+  {
+    accessorKey: "name",
+    header: () => m.end_user_col_name(),
+    cell: ({ row }) => (
+      <Link
+        to="/end-user/$id"
+        params={{ id: row.original.id }}
+        className="font-medium hover:underline"
+      >
+        {row.original.name}
+      </Link>
+    ),
+  },
+  {
+    accessorKey: "email",
+    header: () => m.end_user_col_email(),
+    cell: ({ row }) => (
+      <span className="text-sm text-muted-foreground">{row.original.email}</span>
+    ),
+  },
+  {
+    accessorKey: "externalId",
+    header: () => m.end_user_col_external_id(),
+    cell: ({ row }) =>
+      row.original.externalId ? (
+        <code className="rounded bg-muted px-1.5 py-0.5 text-xs">
+          {row.original.externalId}
+        </code>
+      ) : (
+        <span className="text-xs text-muted-foreground">—</span>
+      ),
+  },
+  {
+    accessorKey: "origin",
+    header: () => m.end_user_col_origin(),
+    cell: ({ row }) =>
+      row.original.origin === "managed" ? (
+        <Badge variant="secondary" className="gap-1">
+          <Crown className="size-3" />
+          {m.end_user_origin_managed()}
+        </Badge>
+      ) : (
+        <Badge variant="outline" className="gap-1">
+          <LinkIcon className="size-3" />
+          {m.end_user_origin_synced()}
+        </Badge>
+      ),
+  },
+  {
+    accessorKey: "sessionCount",
+    header: () => m.end_user_col_sessions(),
+    cell: ({ row }) => (
+      <span className="tabular-nums text-sm">{row.original.sessionCount}</span>
+    ),
+  },
+  {
+    accessorKey: "disabled",
+    header: () => m.end_user_col_status(),
+    cell: ({ row }) =>
+      row.original.disabled ? (
+        <Badge variant="destructive" className="gap-1">
+          <Ban className="size-3" />
+          {m.end_user_status_disabled()}
+        </Badge>
+      ) : (
+        <Badge variant="secondary" className="gap-1">
+          <CheckCircle2 className="size-3" />
+          {m.end_user_status_enabled()}
+        </Badge>
+      ),
+  },
+  {
+    accessorKey: "createdAt",
+    header: () => m.end_user_col_created_at(),
+    cell: ({ row }) => (
+      <span className="text-sm text-muted-foreground tabular-nums">
+        {formatDate(row.original.createdAt)}
+      </span>
+    ),
+  },
+]
+
+interface Props {
+  data: EndUser[]
+  isLoading?: boolean
+  toolbar?: React.ReactNode
+}
+
+export function EndUserTable({ data, isLoading, toolbar }: Props) {
+  // `showSearch={false}` — the list page renders its own search box
+  // that drives server-side filters; we don't want DataTable's
+  // client-side filter shadowing it.
+  return (
+    <DataTable
+      columns={columns}
+      data={data}
+      isLoading={isLoading}
+      toolbar={toolbar}
+      showSearch={false}
+      getRowId={(r) => r.id}
+    />
+  )
+}