revert: all tenants (including manager) need NC+OO containers

Manager tenant is a real company tenant with employees who need
NC Drive + OO. is_manager only controls admin portal access and
Traefik route inclusion, not whether NC/OO infrastructure is needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/services/scheduler/schedule_account.py

@@ -77,106 +77,98 @@ def run_account_check(schedule_log_id: int, db: Session):
             result.mailbox_done_at = now_tw()
             fail_reasons.append(f"mailbox: {e}")
 
-        # [3] NC user + Mail（manager 租戶無 NC container，跳過）
+        # [3] NC user check
-        if tenant.is_manager:
+        try:
-            result.nc_result = True
+            from app.core.config import settings as _cfg
+            nc = NextcloudClient(tenant.domain, _cfg.NC_ADMIN_USER, _cfg.NC_ADMIN_PASSWORD)
+            nc_exists = nc.user_exists(account.sso_account)
+            if nc_exists:
+                result.nc_result = True
+            else:
+                created = nc.create_user(account.sso_account, account.default_password, account.quota_limit)
+                result.nc_result = created
+            if result.nc_result and account.quota_limit:
+                nc.set_user_quota(account.sso_account, account.quota_limit)
             result.nc_done_at = now_tw()
-            result.nc_mail_result = True
+        except Exception as e:
-            result.nc_mail_done_at = now_tw()
+            result.nc_result = False
-        else:
+            result.nc_done_at = now_tw()
-            # [3] NC user check
+            fail_reasons.append(f"nc: {e}")
+
+        # [3.5] NC 台灣國定假日行事曆訂閱
+        TW_HOLIDAYS_ICS_URL = "https://www.officeholidays.com/ics-clean/taiwan"
+        if result.nc_result:
             try:
+                cal_ok = nc.subscribe_calendar(
+                    account.sso_account,
+                    "taiwan-public-holidays",
+                    "台灣國定假日",
+                    TW_HOLIDAYS_ICS_URL,
+                    "#e9322d",
+                )
+                if cal_ok:
+                    logger.info(f"NC calendar subscribed [{account.sso_account}]: taiwan-public-holidays")
+                else:
+                    logger.warning(f"NC calendar subscribe failed [{account.sso_account}]")
+            except Exception as e:
+                logger.warning(f"NC calendar subscribe error [{account.sso_account}]: {e}")
+
+        # [4] NC Mail 帳號設定
+        try:
+            if result.nc_result and result.mailbox_result:
+                import paramiko
                 from app.core.config import settings as _cfg
-                nc = NextcloudClient(tenant.domain, _cfg.NC_ADMIN_USER, _cfg.NC_ADMIN_PASSWORD)
+                is_active = tenant.status == "active"
-                nc_exists = nc.user_exists(account.sso_account)
+                nc_container = f"nc-{tenant.code}" if is_active else f"nc-{tenant.code}-test"
-                if nc_exists:
+                email = account.email or f"{account.sso_account}@{tenant.domain}"
-                    result.nc_result = True
+
+                ssh = paramiko.SSHClient()
+                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+                ssh.connect(_cfg.DOCKER_SSH_HOST, username=_cfg.DOCKER_SSH_USER, timeout=15)
+
+                def _ssh_run(cmd, timeout=60):
+                    _, stdout, _ = ssh.exec_command(cmd)
+                    stdout.channel.settimeout(timeout)
+                    try:
+                        out = stdout.read().decode().strip()
+                    except Exception:
+                        out = ""
+                    return out
+
+                export_out = _ssh_run(
+                    f"docker exec -u www-data {nc_container} "
+                    f"php /var/www/html/occ mail:account:export {account.sso_account} 2>/dev/null"
+                )
+                already_set = len(export_out) > 10 and "imap" in export_out.lower()
+
+                if already_set:
+                    result.nc_mail_result = True
                 else:
-                    created = nc.create_user(account.sso_account, account.default_password, account.quota_limit)
+                    display = account.legal_name or account.sso_account
-                    result.nc_result = created
+                    create_cmd = (
-                # 確保 quota 設定正確（無論新建或已存在）
-                if result.nc_result and account.quota_limit:
-                    nc.set_user_quota(account.sso_account, account.quota_limit)
-                result.nc_done_at = now_tw()
-            except Exception as e:
-                result.nc_result = False
-                result.nc_done_at = now_tw()
-                fail_reasons.append(f"nc: {e}")
-
-            # [3.5] NC 台灣國定假日行事曆訂閱
-            TW_HOLIDAYS_ICS_URL = "https://www.officeholidays.com/ics-clean/taiwan"
-            if result.nc_result:
-                try:
-                    cal_ok = nc.subscribe_calendar(
-                        account.sso_account,
-                        "taiwan-public-holidays",
-                        "台灣國定假日",
-                        TW_HOLIDAYS_ICS_URL,
-                        "#e9322d",
-                    )
-                    if cal_ok:
-                        logger.info(f"NC calendar subscribed [{account.sso_account}]: taiwan-public-holidays")
-                    else:
-                        logger.warning(f"NC calendar subscribe failed [{account.sso_account}]")
-                except Exception as e:
-                    logger.warning(f"NC calendar subscribe error [{account.sso_account}]: {e}")
-
-            # [4] NC Mail 帳號設定
-            try:
-                if result.nc_result and result.mailbox_result:
-                    import paramiko
-                    from app.core.config import settings as _cfg
-                    is_active = tenant.status == "active"
-                    nc_container = f"nc-{tenant.code}" if is_active else f"nc-{tenant.code}-test"
-                    email = account.email or f"{account.sso_account}@{tenant.domain}"
-
-                    ssh = paramiko.SSHClient()
-                    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-                    ssh.connect(_cfg.DOCKER_SSH_HOST, username=_cfg.DOCKER_SSH_USER, timeout=15)
-
-                    def _ssh_run(cmd, timeout=60):
-                        _, stdout, _ = ssh.exec_command(cmd)
-                        stdout.channel.settimeout(timeout)
-                        try:
-                            out = stdout.read().decode().strip()
-                        except Exception:
-                            out = ""
-                        return out
-
-                    export_out = _ssh_run(
                         f"docker exec -u www-data {nc_container} "
-                        f"php /var/www/html/occ mail:account:export {account.sso_account} 2>/dev/null"
+                        f"php /var/www/html/occ mail:account:create "
+                        f"'{account.sso_account}' '{display}' '{email}' "
+                        f"10.1.0.254 143 none '{email}' '{account.default_password}' "
+                        f"10.1.0.254 587 none '{email}' '{account.default_password}' 2>&1"
                     )
-                    already_set = len(export_out) > 10 and "imap" in export_out.lower()
+                    out_text = _ssh_run(create_cmd)
-
+                    logger.info(f"NC mail:account:create [{account.sso_account}]: {out_text}")
-                    if already_set:
+                    result.nc_mail_result = (
-                        result.nc_mail_result = True
+                        "error" not in out_text.lower() and "exception" not in out_text.lower()
-                    else:
-                        display = account.legal_name or account.sso_account
-                        create_cmd = (
-                            f"docker exec -u www-data {nc_container} "
-                            f"php /var/www/html/occ mail:account:create "
-                            f"'{account.sso_account}' '{display}' '{email}' "
-                            f"10.1.0.254 143 none '{email}' '{account.default_password}' "
-                            f"10.1.0.254 587 none '{email}' '{account.default_password}' 2>&1"
-                        )
-                        out_text = _ssh_run(create_cmd)
-                        logger.info(f"NC mail:account:create [{account.sso_account}]: {out_text}")
-                        result.nc_mail_result = (
-                            "error" not in out_text.lower() and "exception" not in out_text.lower()
-                        )
-
-                    ssh.close()
-                else:
-                    result.nc_mail_result = False
-                    fail_reasons.append(
-                        f"nc_mail: skipped (nc={result.nc_result}, mailbox={result.mailbox_result})"
                     )
-                result.nc_mail_done_at = now_tw()
+
-            except Exception as e:
+                ssh.close()
+            else:
                 result.nc_mail_result = False
-                result.nc_mail_done_at = now_tw()
+                fail_reasons.append(
-                fail_reasons.append(f"nc_mail: {e}")
+                    f"nc_mail: skipped (nc={result.nc_result}, mailbox={result.mailbox_result})"
+                )
+            result.nc_mail_done_at = now_tw()
+        except Exception as e:
+            result.nc_mail_result = False
+            result.nc_mail_done_at = now_tw()
+            fail_reasons.append(f"nc_mail: {e}")
 
         # [5] Quota
         try:

backend/app/services/scheduler/schedule_tenant.py

@@ -946,93 +946,82 @@ def run_tenant_check(schedule_log_id: int, db: Session):
 
         # ── [4] NC container + DB 驗證 + OIDC 設定 ─────────────────────────
         pg_db = f"nc_{tenant.code}_db"
-        if tenant.is_manager:
+        try:
-            # Manager 租戶無需 NC/OO 容器，直接標記成功
+            nc_state = docker.check_container_ssh(nc_name)
-            result.nc_result = True
+            if nc_state is None:
-            result.nc_done_at = now_tw()
+                # 容器不存在 → 確保 docker-compose.yml + DB + 部署
-            result.office_result = True
+                logger.info(f"NC {nc_name}: not found, ensuring compose/DB and deploying")
-            result.office_done_at = now_tw()
+                _ensure_tenant_compose(tenant, is_active)
-        else:
+                _ensure_nc_db(pg_host, pg_db, pg_port)
-            try:
+                ok = docker.ssh_compose_up(tenant.code)
-                nc_state = docker.check_container_ssh(nc_name)
+                result.nc_result = True if ok else False
-                if nc_state is None:
+                if not ok:
-                    # 容器不存在 → 確保 docker-compose.yml + DB + 部署
+                    fail_reasons.append("nc: deploy failed")
-                    logger.info(f"NC {nc_name}: not found, ensuring compose/DB and deploying")
-                    _ensure_tenant_compose(tenant, is_active)
-                    _ensure_nc_db(pg_host, pg_db, pg_port)
-                    ok = docker.ssh_compose_up(tenant.code)
-                    result.nc_result = True if ok else False
-                    if not ok:
-                        fail_reasons.append("nc: deploy failed")
-                    else:
-                        # 部署成功後驗證 NC 是否正確使用 PostgreSQL
-                        if not _nc_db_check(nc_name, pg_host, pg_db, tenant.domain, pg_port):
-                            result.nc_result = False
-                            fail_reasons.append("nc: installed but not using pgsql")
-                elif nc_state is False:
-                    # 容器存在但已停止 → 重啟
-                    logger.info(f"NC {nc_name}: stopped, restarting")
-                    ok = docker.ssh_compose_up(tenant.code)
-                    result.nc_result = True if ok else False
-                    if not ok:
-                        fail_reasons.append("nc: start failed")
                 else:
-                    # 容器正常運行 → 驗證 DB 類型（防止 sqlite3 殘留問題）
+                    if not _nc_db_check(nc_name, pg_host, pg_db, tenant.domain, pg_port):
-                    db_ok = _nc_db_check(nc_name, pg_host, pg_db, tenant.domain, pg_port)
-                    if not db_ok:
                         result.nc_result = False
-                        fail_reasons.append("nc: DB check failed (possible sqlite3 issue)")
+                        fail_reasons.append("nc: installed but not using pgsql")
-                    else:
+            elif nc_state is False:
-                        result.nc_result = True
+                # 容器存在但已停止 → 重啟
-                        if kc_drive_secret:
+                logger.info(f"NC {nc_name}: stopped, restarting")
-                            if not _nc_initialized(nc_name):
+                ok = docker.ssh_compose_up(tenant.code)
-                                # 首次初始化：語言 + Apps + OIDC + SSO 強制模式 + OO 整合
+                result.nc_result = True if ok else False
-                                oo_url = (f"https://office-{tenant.code}.ease.taipei" if is_active
+                if not ok:
-                                          else f"https://office-{tenant.code}.lab.taipei")
+                    fail_reasons.append("nc: start failed")
-                                ok = _nc_initialize(nc_name, kc_host, realm, kc_drive_secret, tenant.domain,
+            else:
-                                                    oo_name, oo_url, is_active)
+                # 容器正常運行 → 驗證 DB 類型
-                                if not ok:
+                db_ok = _nc_db_check(nc_name, pg_host, pg_db, tenant.domain, pg_port)
-                                    fail_reasons.append("nc: initialization failed")
+                if not db_ok:
-                            else:
+                    result.nc_result = False
-                                # 已初始化：僅同步 OIDC secret（確保與 KC 一致）
+                    fail_reasons.append("nc: DB check failed (possible sqlite3 issue)")
-                                ok = _configure_nc_oidc(nc_name, kc_host, realm, kc_drive_secret, tenant.domain)
-                                if not ok:
-                                    fail_reasons.append("nc: OIDC sync failed")
-                result.nc_done_at = now_tw()
-            except Exception as e:
-                result.nc_result = False
-                result.nc_done_at = now_tw()
-                fail_reasons.append(f"nc: {e}")
-
-            # ── [5] OO container ─────────────────────────────────────────────────
-            try:
-                oo_state = docker.check_container_ssh(oo_name)
-                if oo_state is None:
-                    ok = docker.ssh_compose_up(tenant.code)
-                    result.office_result = True if ok else False
-                    if not ok:
-                        fail_reasons.append("oo: deploy failed")
-                elif oo_state is False:
-                    ok = docker.ssh_compose_up(tenant.code)
-                    result.office_result = True if ok else False
-                    if not ok:
-                        fail_reasons.append("oo: start failed")
                 else:
-                    result.office_result = True
+                    result.nc_result = True
-                result.office_done_at = now_tw()
+                    if kc_drive_secret:
-            except Exception as e:
+                        if not _nc_initialized(nc_name):
-                result.office_result = False
+                            oo_url = (f"https://office-{tenant.code}.ease.taipei" if is_active
-                result.office_done_at = now_tw()
+                                      else f"https://office-{tenant.code}.lab.taipei")
-                fail_reasons.append(f"oo: {e}")
+                            ok = _nc_initialize(nc_name, kc_host, realm, kc_drive_secret, tenant.domain,
+                                                oo_name, oo_url, is_active)
+                            if not ok:
+                                fail_reasons.append("nc: initialization failed")
+                        else:
+                            ok = _configure_nc_oidc(nc_name, kc_host, realm, kc_drive_secret, tenant.domain)
+                            if not ok:
+                                fail_reasons.append("nc: OIDC sync failed")
+            result.nc_done_at = now_tw()
+        except Exception as e:
+            result.nc_result = False
+            result.nc_done_at = now_tw()
+            fail_reasons.append(f"nc: {e}")
+
+        # ── [5] OO container ─────────────────────────────────────────────────
+        try:
+            oo_state = docker.check_container_ssh(oo_name)
+            if oo_state is None:
+                ok = docker.ssh_compose_up(tenant.code)
+                result.office_result = True if ok else False
+                if not ok:
+                    fail_reasons.append("oo: deploy failed")
+            elif oo_state is False:
+                ok = docker.ssh_compose_up(tenant.code)
+                result.office_result = True if ok else False
+                if not ok:
+                    fail_reasons.append("oo: start failed")
+            else:
+                result.office_result = True
+            result.office_done_at = now_tw()
+        except Exception as e:
+            result.office_result = False
+            result.office_done_at = now_tw()
+            fail_reasons.append(f"oo: {e}")
 
         # ── [6] Quota (OO disk + PG DB size) ────────────────────────────────
-        if not tenant.is_manager:
+        try:
-            try:
+            oo_gb = docker.get_oo_disk_usage_gb(oo_name) or 0.0
-                oo_gb = docker.get_oo_disk_usage_gb(oo_name) or 0.0
+            pg_gb = _get_pg_db_size_gb(pg_host, pg_db, pg_port) or 0.0
-                pg_gb = _get_pg_db_size_gb(pg_host, pg_db, pg_port) or 0.0
+            result.quota_usage = round(oo_gb + pg_gb, 3)
-                result.quota_usage = round(oo_gb + pg_gb, 3)
+        except Exception as e:
-            except Exception as e:
+            logger.warning(f"Quota check failed for {tenant.code}: {e}")
-                logger.warning(f"Quota check failed for {tenant.code}: {e}")
 
         if fail_reasons:
             result.fail_reason = "; ".join(fail_reasons)