Move admin auth local

server/app.mjs

@@ -1,8 +1,25 @@
 import express from 'express';
 import { listUsagePaged, listLedgerPaged } from './pagination.mjs';
 
+function asyncHandler(handler) {
+  return (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
+}
+
+function wrapRouterAsync(router) {
+  for (const method of ['get', 'post', 'put', 'patch', 'delete']) {
+    const original = router[method].bind(router);
+    router[method] = (path, ...handlers) =>
+      original(
+        path,
+        ...handlers.map((handler) =>
+          typeof handler === 'function' && handler.length < 4 ? asyncHandler(handler) : handler,
+        ),
+      );
+  }
+}
+
 export function createAdminApp(services) {
-  const { userAuth, llmProviderService, pool, ready } = services;
+  const { userAuth, llmProviderService, pool, ready, wechatAdmin } = services;
   const app = express();
   app.set('trust proxy', 1);
 
@@ -12,11 +29,13 @@ export function createAdminApp(services) {
 
   let cookieHelpers = null;
   const cookieReady = ready.then(async () => {
-    const [userAuthMod, authMod] = await Promise.all([
-      services.importUserAuthModule(),
-      services.importAuthModule(),
-    ]);
-    cookieHelpers = { ...userAuthMod, parseCookies: authMod.parseCookies };
+    cookieHelpers = {
+      parseCookies: services.parseCookies,
+      USER_COOKIE: services.USER_COOKIE,
+      userLoginCookies: services.userLoginCookies,
+      clearUserSessionCookie: services.clearUserSessionCookie,
+      resolveCookieDomainForRequest: services.resolveCookieDomainForRequest,
+    };
   });
 
   function userToken(req) {
@@ -44,15 +63,19 @@ export function createAdminApp(services) {
     res.json({ ok: true, service: 'memind_adm' });
   });
 
-  app.get('/auth/status', async (req, res) => {
+  app.get('/healthz', (_req, res) => {
+    res.json({ ok: true, service: 'memind_adm' });
+  });
+
+  app.get('/auth/status', asyncHandler(async (req, res) => {
     await cookieReady;
     await ready;
     const me = await userAuth.getMe(userToken(req));
     if (!me) return res.json({ authenticated: false, mode: 'user' });
     return res.json({ authenticated: true, user: me, mode: 'user' });
-  });
+  }));
 
-  app.post('/auth/login', jsonBody, async (req, res) => {
+  app.post('/auth/login', jsonBody, asyncHandler(async (req, res) => {
     await cookieReady;
     await ready;
     const { username, password } = req.body ?? {};
@@ -69,27 +92,28 @@ export function createAdminApp(services) {
     }
     setUserLoginCookies(res, req, result.token);
     return res.json({ authenticated: true, user: result.user, mode: 'user' });
-  });
+  }));
 
-  app.post('/auth/logout', async (req, res) => {
+  app.post('/auth/logout', asyncHandler(async (req, res) => {
     await cookieReady;
     await ready;
     await userAuth.revoke(userToken(req));
     clearUserLoginCookies(res, req);
     res.status(204).end();
-  });
+  }));
 
   const adminApi = express.Router();
+  wrapRouterAsync(adminApi);
   adminApi.use(jsonBody);
 
-  adminApi.use(async (req, res, next) => {
+  adminApi.use(asyncHandler(async (req, res, next) => {
     await cookieReady;
     await ready;
     const me = await userAuth.getMe(userToken(req));
     if (!me) return res.status(401).json({ message: '未登录' });
     req.currentUser = me;
     next();
-  });
+  }));
 
   const requireAdmin = (req, res, next) => {
     if (!req.currentUser || req.currentUser.role !== 'admin') {
@@ -99,6 +123,14 @@ export function createAdminApp(services) {
     next();
   };
 
+  function resolveSessionUser(req, res, next) {
+    if (!req.currentUser) {
+      res.status(401).json({ message: '未授权，请重新登录' });
+      return;
+    }
+    next();
+  }
+
   adminApi.get('/users', requireAdmin, async (req, res) => {
     const result = await userAuth.listUsers({
       page: Number(req.query.page) || 1,
@@ -161,6 +193,52 @@ export function createAdminApp(services) {
     res.json(result);
   });
 
+  adminApi.get('/wechat/summary', requireAdmin, async (_req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    res.json(await wechatAdmin.getSummary());
+  });
+
+  adminApi.get('/wechat/bindings', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    res.json(await wechatAdmin.listBindings(req.query));
+  });
+
+  adminApi.get('/wechat/messages', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    res.json(await wechatAdmin.listMessages(req.query));
+  });
+
+  adminApi.get('/wechat/digests', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    res.json(await wechatAdmin.listDigests(req.query));
+  });
+
+  adminApi.get('/wechat/deliveries', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    res.json(await wechatAdmin.listDeliveries(req.query));
+  });
+
+  adminApi.post('/wechat/users/:userId/route/clear', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    const result = await wechatAdmin.clearRouteForUser(req.params.userId);
+    if (!result.ok) return res.status(404).json({ message: result.message ?? '清除失败' });
+    res.json(result);
+  });
+
+  adminApi.post('/wechat/digests/:id/cancel', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    const result = await wechatAdmin.cancelDigest(req.params.id);
+    if (!result.ok) return res.status(404).json({ message: '订阅不存在或已暂停' });
+    res.json(result);
+  });
+
+  adminApi.post('/wechat/digests/:id/resume', requireAdmin, async (req, res) => {
+    if (!wechatAdmin) return res.status(503).json({ message: '服务号管理未启用' });
+    const result = await wechatAdmin.resumeDigest(req.params.id);
+    if (!result.ok) return res.status(404).json({ message: result.message ?? '恢复失败' });
+    res.json(result);
+  });
+
   adminApi.get('/capabilities/catalog', requireAdmin, (_req, res) => {
     res.json({ catalog: userAuth.capabilityCatalog });
   });
@@ -363,5 +441,27 @@ export function createAdminApp(services) {
 
   app.use('/admin-api', adminApi);
 
+  if (services.createOpsApi) {
+    const opsApi = express.Router();
+    wrapRouterAsync(opsApi);
+    opsApi.use(asyncHandler(async (req, res, next) => {
+      await cookieReady;
+      await ready;
+      const me = await userAuth.getMe(userToken(req));
+      if (!me) return res.status(401).json({ message: '未授权，请重新登录' });
+      req.currentUser = me;
+      next();
+    }));
+    opsApi.use(resolveSessionUser);
+    opsApi.use('/ops/v1', services.createOpsApi({ jsonBody, plazaOps: services.plazaOps }));
+    app.use('/api', opsApi);
+  }
+
+  app.use((err, _req, res, _next) => {
+    console.error('Admin API request failed:', err);
+    if (res.headersSent) return;
+    res.status(500).json({ message: err instanceof Error ? err.message : '管理后台请求失败' });
+  });
+
   return app;
 }

server/bootstrap.mjs

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { createDbPool, isDatabaseConfigured } from './db.mjs';
-import { importMemind, resolveMemindLib } from './lib-path.mjs';
 import { projectRoot } from './load-env.mjs';
+import { createLocalUserAuth } from './local-auth.mjs';
+import { importMemind, resolveMemindLib } from './lib-path.mjs';
 
 export async function bootstrapAdminServices() {
   if (!isDatabaseConfigured()) {
@@ -10,19 +11,44 @@ export async function bootstrapAdminServices() {
 
   const memindLib = resolveMemindLib();
   const pool = createDbPool();
-  const { createUserAuth } = await importMemind('user-auth.mjs');
   const { createLlmProviderService } = await importMemind('llm-providers.mjs');
+  const { createWechatAdminService } = await importMemind('wechat-admin.mjs');
+  const { loadWechatMpConfig } = await importMemind('wechat-mp.mjs');
+  const { createPlazaPostService, formatPostRow } = await importMemind('plaza-posts.mjs');
+  const { createPlazaInteractionService } = await importMemind('plaza-interactions.mjs');
+  const { createPlazaOpsService } = await importMemind('plaza-ops.mjs');
+  const { createNoopPlazaRedis } = await importMemind('plaza-redis.mjs');
+  const { ensureAlgorithmConfig, loadAlgorithmConfig } = await importMemind('plaza-algorithm.mjs');
+  const { createOpsApi } = await importMemind('admin-routes.mjs');
 
   const usersRoot =
     process.env.H5_USERS_ROOT?.trim() ?? path.join(projectRoot, 'data', 'users');
   const apiTarget = process.env.TKMIND_API_TARGET ?? 'https://127.0.0.1:18006';
-  const apiSecret = process.env.TKMIND_SERVER__SECRET_KEY ?? 'local-dev-secret';
+  const plazaRedis = createNoopPlazaRedis();
 
-  const userAuth = createUserAuth(pool, {
-    usersRoot,
-    h5Root: memindLib,
-    defaultSignupBalanceCents: Number(process.env.H5_SIGNUP_BALANCE_CENTS ?? 500),
+  await ensureAlgorithmConfig(pool);
+  const algorithmConfig = await loadAlgorithmConfig(pool);
+  const plazaInteractions = createPlazaInteractionService(pool, { formatPostRow, plazaRedis });
+
+  let plazaOps = null;
+  const plazaPosts = createPlazaPostService(pool, {
+    loadViewerReactions: (viewerId, postIds) =>
+      plazaInteractions.loadViewerReactions(viewerId, postIds),
+    plazaRedis,
+    algorithmConfig,
+    onPostPublished: () => {},
+    loadFeaturedPosts: async (viewerId) => {
+      if (!plazaOps) return { homepage_banner: [], trending: [], category_top: {} };
+      return plazaOps.loadActiveFeaturedPosts(viewerId);
+    },
   });
+  plazaOps = createPlazaOpsService(pool, {
+    formatPostRow,
+    reviewPost: (...args) => plazaPosts.reviewPost(...args),
+    invalidateFeedCaches: () => plazaRedis?.invalidateFeedCaches?.(),
+  });
+
+  const userAuth = createLocalUserAuth(pool);
 
   await userAuth.ensureAdminUser();
 
@@ -30,10 +56,15 @@ export async function bootstrapAdminServices() {
     apiTarget,
     apiSecret,
   });
+  const wechatAdmin = createWechatAdminService(pool, {
+    config: loadWechatMpConfig(),
+    scheduleEnabled: process.env.H5_SCHEDULE_ENABLED === '1',
+    reminderWorkerEnabled: process.env.H5_REMINDER_WORKER_ENABLED === '1',
+  });
 
   console.log(`Admin DB connected (${process.env.MYSQL_DATABASE ?? 'via DATABASE_URL'})`);
   console.log(`Users root: ${usersRoot}`);
   console.log(`Memind lib: ${memindLib}`);
 
-  return { pool, userAuth, llmProviderService };
+  return { pool, userAuth, llmProviderService, plazaOps, createOpsApi, wechatAdmin };
 }

server/index.mjs

@@ -1,9 +1,15 @@
 import { ensureArgon2Sync } from './argon2-polyfill.mjs';
 import { loadProjectEnv } from './load-env.mjs';
+import {
+  USER_COOKIE,
+  clearUserSessionCookie,
+  parseCookies,
+  resolveCookieDomainForRequest,
+  userLoginCookies,
+} from './local-auth.mjs';
 
 ensureArgon2Sync();
 import { bootstrapAdminServices } from './bootstrap.mjs';
-import { importMemind } from './lib-path.mjs';
 import { createAdminApp } from './app.mjs';
 
 loadProjectEnv();
@@ -13,17 +19,28 @@ const port = Number(process.env.ADM_API_PORT ?? 8085);
 const ready = bootstrapAdminServices();
 const services = {
   ready,
-  importUserAuthModule: () => importMemind('user-auth.mjs'),
-  importAuthModule: () => importMemind('auth.mjs'),
+  USER_COOKIE,
+  parseCookies,
+  userLoginCookies,
+  clearUserSessionCookie,
+  resolveCookieDomainForRequest,
 };
 
 ready
-  .then(({ pool, userAuth, llmProviderService }) => {
-    Object.assign(services, { pool, userAuth, llmProviderService });
+  .then(({ pool, userAuth, llmProviderService, plazaOps, createOpsApi, wechatAdmin }) => {
+    Object.assign(services, {
+      pool,
+      userAuth,
+      llmProviderService,
+      plazaOps,
+      createOpsApi,
+      wechatAdmin,
+    });
     const app = createAdminApp(services);
-    app.listen(port, '127.0.0.1', () => {
+    const server = app.listen(port, '127.0.0.1', () => {
       console.log(`TKMind Admin API @ http://127.0.0.1:${port}`);
     });
+    globalThis.__tkmindAdminServer = server;
   })
   .catch((err) => {
     console.error('Admin server bootstrap failed:', err);

server/local-auth.mjs

@@ -0,0 +1,267 @@
+import crypto from 'node:crypto';
+
+const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 30;
+
+function now() {
+  return new Date();
+}
+
+function hashPassword(password, salt = crypto.randomBytes(16).toString('hex')) {
+  const digest = crypto.scryptSync(String(password), salt, 64).toString('hex');
+  return `scrypt$${salt}$${digest}`;
+}
+
+function verifyPassword(password, stored) {
+  const [scheme, salt, digest] = String(stored ?? '').split('$');
+  if (scheme !== 'scrypt' || !salt || !digest) return false;
+  const next = crypto.scryptSync(String(password), salt, 64).toString('hex');
+  return crypto.timingSafeEqual(Buffer.from(next, 'hex'), Buffer.from(digest, 'hex'));
+}
+
+function rowToUser(row) {
+  if (!row) return null;
+  return {
+    id: String(row.id),
+    username: row.username,
+    displayName: row.display_name ?? row.username,
+    role: row.role,
+    status: row.status,
+    balanceCents: Number(row.balance_cents ?? 0),
+    workspaceRoot: row.workspace_root ?? '',
+    createdAt: row.created_at ? new Date(row.created_at).getTime() : Date.now(),
+    updatedAt: row.updated_at ? new Date(row.updated_at).getTime() : Date.now(),
+  };
+}
+
+function defaultCapabilities() {
+  return {};
+}
+
+export function parseCookies(cookieHeader = '') {
+  return Object.fromEntries(
+    cookieHeader.split(';').map((part) => {
+      const index = part.indexOf('=');
+      if (index < 0) return ['', ''];
+      return [decodeURIComponent(part.slice(0, index).trim()), decodeURIComponent(part.slice(index + 1).trim())];
+    }).filter(([k]) => k),
+  );
+}
+
+export const USER_COOKIE = 'tkmind_admin_token';
+
+export function userLoginCookies(token, secure, domain) {
+  const parts = [
+    `${USER_COOKIE}=${encodeURIComponent(token)}`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    secure ? 'Secure' : null,
+    domain ? `Domain=${domain}` : null,
+    `Max-Age=${SESSION_TTL_MS / 1000}`,
+  ].filter(Boolean);
+  return `${parts.join('; ')}`;
+}
+
+export function clearUserSessionCookie(secure, domain) {
+  const parts = [
+    `${USER_COOKIE}=`,
+    'Path=/',
+    'HttpOnly',
+    'SameSite=Lax',
+    secure ? 'Secure' : null,
+    domain ? `Domain=${domain}` : null,
+    'Max-Age=0',
+  ].filter(Boolean);
+  return `${parts.join('; ')}`;
+}
+
+export function resolveCookieDomainForRequest(_req) {
+  return '';
+}
+
+export function createLocalUserAuth(pool) {
+  const capabilityCatalog = [];
+  const policyCatalog = [];
+  const skillCatalog = [];
+
+  async function ensureTables() {
+    await pool.execute(`
+      CREATE TABLE IF NOT EXISTS auth_users (
+        id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+        username VARCHAR(191) NOT NULL UNIQUE,
+        display_name VARCHAR(191) NULL,
+        role VARCHAR(32) NOT NULL DEFAULT 'user',
+        status VARCHAR(32) NOT NULL DEFAULT 'active',
+        password_hash VARCHAR(255) NOT NULL,
+        balance_cents BIGINT NOT NULL DEFAULT 0,
+        workspace_root VARCHAR(255) NULL,
+        created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+      )
+    `);
+    await pool.execute(`
+      CREATE TABLE IF NOT EXISTS auth_sessions (
+        token VARCHAR(191) NOT NULL PRIMARY KEY,
+        user_id BIGINT UNSIGNED NOT NULL,
+        expires_at TIMESTAMP NOT NULL,
+        created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        INDEX idx_auth_sessions_user_id (user_id),
+        INDEX idx_auth_sessions_expires_at (expires_at)
+      )
+    `);
+  }
+
+  async function ensureAdminUser() {
+    await ensureTables();
+    const [rows] = await pool.execute('SELECT id FROM auth_users WHERE username = ? LIMIT 1', ['admin']);
+    if (rows.length) return;
+    throw new Error('admin 账号未初始化，请先运行 npm run admin:init');
+  }
+
+  async function getUserByUsername(username) {
+    const [rows] = await pool.execute('SELECT * FROM auth_users WHERE username = ? LIMIT 1', [username]);
+    return rowToUser(rows[0]);
+  }
+
+  async function getUserById(id) {
+    const [rows] = await pool.execute('SELECT * FROM auth_users WHERE id = ? LIMIT 1', [id]);
+    return rowToUser(rows[0]);
+  }
+
+  async function getMe(token) {
+    if (!token) return null;
+    const [rows] = await pool.execute(
+      'SELECT u.* FROM auth_sessions s JOIN auth_users u ON u.id = s.user_id WHERE s.token = ? AND s.expires_at > NOW() LIMIT 1',
+      [token],
+    );
+    return rowToUser(rows[0]);
+  }
+
+  async function revoke(token) {
+    if (!token) return;
+    await pool.execute('DELETE FROM auth_sessions WHERE token = ?', [token]);
+  }
+
+  async function login({ username, password }) {
+    await ensureTables();
+    const [rows] = await pool.execute('SELECT * FROM auth_users WHERE username = ? LIMIT 1', [username]);
+    const row = rows[0];
+    if (!row) return { ok: false, message: '账号或密码错误', retryAfterMs: 0 };
+    if (!verifyPassword(password, row.password_hash)) return { ok: false, message: '账号或密码错误', retryAfterMs: 0 };
+    const token = crypto.randomUUID().replace(/-/g, '');
+    const expiresAt = new Date(Date.now() + SESSION_TTL_MS);
+    await pool.execute('INSERT INTO auth_sessions (token, user_id, expires_at) VALUES (?, ?, ?)', [token, row.id, expiresAt]);
+    return { ok: true, token, user: rowToUser(row) };
+  }
+
+  async function listUsers({ page = 1, pageSize = 20, search = '', role = '', status = '' }) {
+    await ensureTables();
+    const clauses = [];
+    const params = [];
+    if (search) {
+      clauses.push('(username LIKE ? OR display_name LIKE ?)');
+      params.push(`%${search}%`, `%${search}%`);
+    }
+    if (role) {
+      clauses.push('role = ?');
+      params.push(role);
+    }
+    if (status) {
+      clauses.push('status = ?');
+      params.push(status);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(' AND ')}` : '';
+    const [[countRow]] = await pool.execute(`SELECT COUNT(*) AS total FROM auth_users ${where}`, params);
+    const offset = (Math.max(page, 1) - 1) * Math.max(pageSize, 1);
+    const [rows] = await pool.execute(
+      `SELECT * FROM auth_users ${where} ORDER BY id DESC LIMIT ? OFFSET ?`,
+      [...params, Math.max(pageSize, 1), offset],
+    );
+    return {
+      items: rows.map((row) => rowToUser(row)),
+      total: Number(countRow.total ?? 0),
+      page,
+      pageSize,
+      totalPages: Math.max(1, Math.ceil(Number(countRow.total ?? 0) / pageSize)),
+    };
+  }
+
+  async function createUser(payload) {
+    if (!payload?.username || !payload?.password) return { ok: false, message: '用户名和密码不能为空' };
+    const [exists] = await pool.execute('SELECT id FROM auth_users WHERE username = ? LIMIT 1', [payload.username]);
+    if (exists.length) return { ok: false, message: '用户名已存在' };
+    await pool.execute(
+      'INSERT INTO auth_users (username, display_name, role, status, password_hash, balance_cents, workspace_root) VALUES (?, ?, ?, ?, ?, ?, ?)',
+      [
+        payload.username,
+        payload.displayName || payload.username,
+        payload.role === 'admin' ? 'admin' : 'user',
+        'active',
+        hashPassword(payload.password),
+        Number(payload.balanceCents ?? 0),
+        payload.workspaceRoot ?? null,
+      ],
+    );
+    return { ok: true, user: await getUserByUsername(payload.username) };
+  }
+
+  async function updateUser(userId, payload) {
+    const user = await getUserById(userId);
+    if (!user) return { ok: false, message: '用户不存在' };
+    const displayName = payload.displayName ?? user.displayName;
+    const workspaceRoot = payload.workspaceRoot ?? user.workspaceRoot;
+    const status = payload.status ?? user.status;
+    const role = payload.role === 'admin' ? 'admin' : user.role;
+    const balanceCents = payload.balanceCents ?? user.balanceCents;
+    await pool.execute(
+      'UPDATE auth_users SET display_name = ?, workspace_root = ?, status = ?, role = ?, balance_cents = ? WHERE id = ?',
+      [displayName, workspaceRoot || null, status, role, balanceCents, userId],
+    );
+    return { ok: true, user: await getUserById(userId) };
+  }
+
+  async function recharge(userId, amountCents) {
+    const user = await getUserById(userId);
+    if (!user) return { ok: false, message: '用户不存在' };
+    await pool.execute('UPDATE auth_users SET balance_cents = balance_cents + ? WHERE id = ?', [Number(amountCents ?? 0), userId]);
+    return { ok: true, user: await getUserById(userId) };
+  }
+
+  async function getAdminSummary() {
+    const [[row]] = await pool.execute(
+      `SELECT COUNT(*) AS total, SUM(CASE WHEN balance_cents < 0 THEN 1 ELSE 0 END) AS lowBalance FROM auth_users`,
+    );
+    return { users: { total: Number(row.total ?? 0), lowBalance: Number(row.lowBalance ?? 0) }, routes: { total: 0, active: 0 } };
+  }
+
+  return {
+    hashPassword,
+    capabilityCatalog,
+    policyCatalog,
+    skillCatalog,
+    ensureAdminUser,
+    login,
+    getMe,
+    revoke,
+    listUsers,
+    createUser,
+    updateUser,
+    recharge,
+    getAdminSummary,
+    getRoleCapabilities: async () => ({ ok: true, role: 'user', capabilities: defaultCapabilities() }),
+    setRoleCapabilities: async () => ({ ok: true, role: 'user', capabilities: defaultCapabilities() }),
+    getUserCapabilities: async () => ({ ok: true, userId: null, capabilities: defaultCapabilities() }),
+    setUserCapabilities: async () => ({ ok: true }),
+    clearUserCapabilityOverrides: async () => ({ ok: true }),
+    getRolePolicies: async () => ({ ok: true, role: 'user', policies: {} }),
+    setRolePolicies: async () => ({ ok: true, role: 'user', policies: {} }),
+    getUserPolicies: async () => ({ ok: true, userId: null, policies: {} }),
+    setUserPolicies: async () => ({ ok: true }),
+    clearUserPolicyOverrides: async () => ({ ok: true }),
+    getRoleSkills: async () => ({ ok: true, role: 'user', skills: {} }),
+    setRoleSkills: async () => ({ ok: true, role: 'user', skills: {} }),
+    getUserSkills: async () => ({ ok: true, userId: null, skills: {} }),
+    setUserSkills: async () => ({ ok: true }),
+    clearUserSkillOverrides: async () => ({ ok: true }),
+  };
+}