feat: add control-plane identity and management console

node-agent/WxAgent.Service/RemoteAgentHostedService.cs

@@ -876,12 +876,11 @@ public sealed class RemoteAgentHostedService(
             // the explicit accounts API remains the only path that may inspect the profile.
             var accounts = await backend.AccountsAsync(cancellationToken, refreshUiIdentity: false);
             var identities = accounts.Select(account => new RemoteAccountIdentity(
-                account.AccountId,
-                account.IsUiBindingKnown && account.Binding is not null && string.Equals(account.BindingStatus, "Bound", StringComparison.Ordinal))).ToArray();
+                account.AccountId, HasLiveWeChatBinding(account))).ToArray();
             var activeAccountId = remote.ActiveAccountId;
-            var boundAccounts = accounts
-                .Where(account => account.IsUiBindingKnown && account.Binding is not null && string.Equals(account.BindingStatus, "Bound", StringComparison.Ordinal))
-                .Select(account => account.AccountId)
+            var boundAccounts = identities
+                .Where(identity => identity.Verified)
+                .Select(identity => identity.AccountId)
                 .Distinct(StringComparer.OrdinalIgnoreCase)
                 .ToArray();
             if ((string.IsNullOrWhiteSpace(activeAccountId) || !identities.Any(identity => identity.Verified && string.Equals(identity.AccountId, activeAccountId, StringComparison.Ordinal)))
@@ -922,30 +921,16 @@ public sealed class RemoteAgentHostedService(
 
     private static ReportingConfig ConnectionAuthorizedReporting(ReportingConfig configured, BackendSnapshot? snapshot)
     {
-        var accountIds = snapshot is not null
-            ? snapshot.Accounts.Where(identity => identity.Verified).Select(identity => identity.AccountId)
-            : configured.Accounts.Where(account => account.Enabled).Select(account => account.AccountId);
-        var accounts = accountIds
-            .Distinct(StringComparer.Ordinal)
-            .Select(accountId => new AccountReportingConfig
-            {
-                AccountId = accountId,
-                Enabled = true,
-                AllowedChats =
-                [
-                    new AllowedChat { Type = ReportingChatType.Group, ChatId = "*", Enabled = true, IdentityVerified = true },
-                    new AllowedChat { Type = ReportingChatType.Private, ChatId = "*", Enabled = true, IdentityVerified = true }
-                ]
-            })
-            .ToArray();
-        return configured with
-        {
-            Enabled = true,
-            ConfigVersion = Math.Max(1, configured.ConfigVersion),
-            Accounts = accounts
-        };
+        var accountIds = snapshot?.Accounts
+            .Where(identity => identity.Verified)
+            .Select(identity => identity.AccountId) ?? Enumerable.Empty<string>();
+        return ReportingAuthorization.ForVerifiedAccounts(configured, accountIds);
     }
 
+    internal static bool HasLiveWeChatBinding(AccountInfo account) =>
+        account.IsUiBindingKnown && account.Binding is not null &&
+        string.Equals(account.BindingStatus, "Bound", StringComparison.Ordinal);
+
     private static RemoteNodeRegistration CreateRegistration(RemoteAgentOptions remote, ReportingConfig reporting, BackendSnapshot snapshot) =>
         new(remote.NodeId!, typeof(RemoteAgentHostedService).Assembly.GetName().Version?.ToString() ?? "dev",
             RemoteProtocol.Version, ["heartbeat", "poll-tasks", "send-text", "read-sessions", "read-contacts", "read-messages", "db-messages", "db-merged", "report-message"], reporting.ConfigVersion,