@allbluecn/admin-app 0.2.3 → 0.2.5

package/src/server/__tests__/permissions.test.ts

@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({}),
+}))
+
+// prisma mock 必须覆盖被测模块触达的全部 model 键——缺一个会在用例内
+// 报 "Cannot read properties of undefined"（见 memrec vitest-mock 陷阱）
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    customRole: {
+      count: vi.fn(),
+      create: vi.fn(),
+      findMany: vi.fn(),
+      findFirst: vi.fn(),
+      delete: vi.fn(),
+    },
+    user: {
+      findMany: vi.fn(),
+    },
+    roleAssignment: {
+      count: vi.fn(),
+      create: vi.fn(),
+      createMany: vi.fn(),
+      delete: vi.fn(),
+      findMany: vi.fn(),
+    },
+    workspace: {
+      findMany: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAdmin: vi.fn().mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } }),
+}))
+
+vi.mock('@/server/entitlements', () => ({
+  requireFeature: vi.fn().mockResolvedValue(undefined),
+}))
+
+const services = vi.hoisted(() => new Map<string, unknown>())
+
+vi.mock('@/server/pro-services', () => ({
+  getProService: (key: string) => services.get(key) ?? null,
+}))
+
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { requireFeature } from '@/server/entitlements'
+import {
+  listRolesFn,
+  createRoleFn,
+  deleteRoleFn,
+  assignRoleFn,
+  unassignRoleFn,
+  listRoleAssignmentsFn,
+  listWorkspacesFn,
+} from '../serverFns/permissions'
+
+const customRole = prisma.customRole as unknown as {
+  count: ReturnType<typeof vi.fn>
+  create: ReturnType<typeof vi.fn>
+  findMany: ReturnType<typeof vi.fn>
+  findFirst: ReturnType<typeof vi.fn>
+  delete: ReturnType<typeof vi.fn>
+}
+const userMock = prisma.user as unknown as { findMany: ReturnType<typeof vi.fn> }
+const roleAssignment = prisma.roleAssignment as unknown as {
+  count: ReturnType<typeof vi.fn>
+  create:ReturnType<typeof vi.fn>
+  createMany: ReturnType<typeof vi.fn>
+  delete: ReturnType<typeof vi.fn>
+  findMany: ReturnType<typeof vi.fn>
+}
+const workspaceMock = prisma.workspace as unknown as { findMany: ReturnType<typeof vi.fn> }
+const requireAdminMock = requireAdmin as unknown as ReturnType<typeof vi.fn>
+const requireFeatureMock = requireFeature as unknown as ReturnType<typeof vi.fn>
+
+const WS = 'ws-1'
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  services.clear()
+  requireAdminMock.mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } })
+  requireFeatureMock.mockResolvedValue(undefined)
+  customRole.count.mockResolvedValue(0)
+  customRole.findMany.mockResolvedValue([])
+  customRole.findFirst.mockResolvedValue(null)
+  userMock.findMany.mockResolvedValue([])
+})
+
+describe('listRolesFn', () => {
+  it('非管理员拒绝：requireAdmin 抛错时零 prisma 调用', async () => {
+    requireAdminMock.mockRejectedValue(new Error('not admin'))
+
+    await expect(listRolesFn({ data: { workspaceId: WS } })).rejects.toThrow('not admin')
+    expect(customRole.count).not.toHaveBeenCalled()
+    expect(customRole.findMany).not.toHaveBeenCalled()
+  })
+
+  it('feature 未开通拒绝：requireFeature 抛错时零 prisma 调用', async () => {
+    requireFeatureMock.mockRejectedValue(new Error('locked'))
+
+    await expect(listRolesFn({ data: { workspaceId: WS } })).rejects.toThrow('locked')
+    expect(customRole.count).not.toHaveBeenCalled()
+  })
+
+  it('只查指定 workspaceId（跨租户隔离，不泄露其他 workspace 角色）', async () => {
+    customRole.count.mockResolvedValue(3)
+    customRole.findMany.mockResolvedValue([{ id: 'role-1', name: 'owner' }])
+
+    const res = await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.findMany).toHaveBeenCalledWith({
+      where: { workspaceId: WS },
+      include: { _count: { select: { assignments: true } } },
+      orderBy: { createdAt: 'desc' },
+    })
+    expect(customRole.count).toHaveBeenCalledWith({ where: { workspaceId: WS } })
+    expect(res).toEqual({ items: [{ id: 'role-1', name: 'owner' }], total: 3, seeded: 'done' })
+  })
+
+  it('已有系统角色时跳过种子化（不重复创建预设）', async () => {
+    customRole.count.mockResolvedValue(5)
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.create).not.toHaveBeenCalled()
+    expect(roleAssignment.createMany).not.toHaveBeenCalled()
+  })
+
+  it('首次种子化创建 5 个系统角色预设', async () => {
+    customRole.count.mockResolvedValue(0)
+    services.set('permissions', { kind: 'pro' })
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    const names = customRole.create.mock.calls.map((c: any[]) => c[0].data.name)
+    expect(names).toEqual(['owner', 'admin', 'member', 'editor', 'viewer'])
+    // 系统角色必须标记 isSystem，用户不可伪造/删除
+    expect(customRole.create.mock.calls.every((c: any[]) => c[0].data.isSystem === true)).toBe(true)
+    expect(customRole.create.mock.calls.every((c: any[]) => c[0].data.workspaceId === WS)).toBe(true)
+  })
+
+  it('种子化时给 ADMIN 用户赋 owner 角色', async () => {
+    customRole.count.mockResolvedValue(0)
+    services.set('permissions', { kind: 'pro' })
+    userMock.findMany.mockResolvedValue([{ id: 'u-1' }, { id: 'u-2' }])
+    customRole.findFirst.mockResolvedValue({ id: 'role-owner', name: 'owner' })
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(userMock.findMany).toHaveBeenCalledWith({
+      where: { role: 'ADMIN' },
+      select: { id: true },
+    })
+    expect(roleAssignment.createMany).toHaveBeenCalledWith({
+      data: [{ userId: 'u-1', roleId: 'role-owner' }, { userId: 'u-2', roleId: 'role-owner' }],
+      skipDuplicates: true,
+    })
+  })
+
+  it('pro service 缺失时不种子化（OSS 部署无高级权限）', async () => {
+    customRole.count.mockResolvedValue(0)
+
+    await listRolesFn({ data: { workspaceId: WS } })
+
+    expect(customRole.create).not.toHaveBeenCalled()
+  })
+})
+
+describe('createRoleFn', () => {
+  it('强制 isSystem=false（不可伪造系统角色）', async () => {
+    customRole.create.mockResolvedValue({ id: 'role-new' })
+
+    await createRoleFn({ data: { workspaceId: WS, name: 'custom-1', permissions: { 'story:read': 'read' } } })
+
+    expect(customRole.create).toHaveBeenCalledWith({
+      data: {
+        workspaceId: WS,
+        name: 'custom-1',
+        permissions: { 'story:read': 'read' },
+        isSystem: false,
+      },
+    })
+  })
+
+  it('permissions 缺省为空对象', async () => {
+    customRole.create.mockResolvedValue({ id: 'role-new' })
+
+    await createRoleFn({ data: { workspaceId: WS, name: 'custom-2' } })
+
+    expect(customRole.create.mock.calls[0][0].data.permissions).toEqual({})
+  })
+})
+
+describe('assignRoleFn', () => {
+  it('写入 userId 与 roleId 并返回 ok', async () => {
+    roleAssignment.create.mockResolvedValue({ id: 'assign-1' })
+
+    const res = await assignRoleFn({ data: { userId: 'u-1', roleId: 'role-1' } })
+
+    expect(roleAssignment.create).toHaveBeenCalledWith({ data: { userId: 'u-1', roleId: 'role-1' } })
+    expect(res).toEqual({ ok: true })
+  })
+})
+
+describe('unassignRoleFn', () => {
+  it('按 assignmentId 删除', async () => {
+    roleAssignment.delete.mockResolvedValue({ id: 'assign-1' })
+
+    const res = await unassignRoleFn({ data: { assignmentId: 'assign-1' } })
+
+    expect(roleAssignment.delete).toHaveBeenCalledWith({ where: { id: 'assign-1' } })
+    expect(res).toEqual({ ok: true })
+  })
+})
+
+describe('deleteRoleFn', () => {
+  it('按 roleId 删除并返回 success', async () => {
+    customRole.delete.mockResolvedValue({ id: 'role-1' })
+
+    const res = await deleteRoleFn({ data: { roleId: 'role-1' } })
+
+    expect(customRole.delete).toHaveBeenCalledWith({ where: { id: 'role-1' } })
+    expect(res).toEqual({ success: true })
+  })
+})
+
+describe('listRoleAssignmentsFn', () => {
+  it('按 roleId 过滤并附带用户信息选择集', async () => {
+    roleAssignment.findMany.mockResolvedValue([{ id: 'assign-1', user: { id: 'u-1', username: 'alice' } }])
+
+    const res = await listRoleAssignmentsFn({ data: { roleId: 'role-1' } })
+
+    expect(roleAssignment.findMany).toHaveBeenCalledWith({
+      where: { roleId: 'role-1' },
+      include: { user: { select: { id: true, username: true, email: true } } },
+      orderBy: { createdAt: 'desc' },
+    })
+    expect(res).toHaveLength(1)
+  })
+})
+
+describe('listWorkspacesFn', () => {
+  it('按 name 升序返回工作空间', async () => {
+    workspaceMock.findMany.mockResolvedValue([
+      { id: 'ws-a', name: 'alpha' },
+      { id: 'ws-b', name: 'beta' },
+    ])
+
+    const res = await listWorkspacesFn({ data: {} })
+
+    expect(workspaceMock.findMany).toHaveBeenCalledWith({
+      select: { id: true, name: true },
+      orderBy: { name: 'asc' },
+    })
+    expect(res).toHaveLength(2)
+  })
+})

package/src/server/middlewares/security-headers.ts

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createMiddleware } from '@tanstack/react-start'
+
+const PROD_CSP = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "media-src 'self' blob: https:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+  "upgrade-insecure-requests",
+].join('; ')
+
+const DEV_CSP = [
+  "default-src 'self' 'unsafe-inline' data: blob:",
+  "script-src 'self' 'unsafe-inline' data: blob:",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob: https: http:",
+  "font-src 'self' data:",
+  "connect-src 'self' ws: wss: http: https:",
+  "media-src 'self' blob: https: http:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "child-src 'none'",
+  "frame-src 'none'",
+  "worker-src 'self' blob:",
+  "frame-ancestors 'none'",
+].join('; ')
+
+export function buildSecurityHeaders(prod: boolean): Record<string, string> {
+  const headers: Record<string, string> = {
+    'X-Content-Type-Options': 'nosniff',
+    'X-Frame-Options': 'DENY',
+    'Cross-Origin-Resource-Policy': 'same-origin',
+    'Cross-Origin-Opener-Policy': 'same-origin',
+    'Permissions-Policy':
+      'camera=(), microphone=(), geolocation=(), payment=(), usb=(), fullscreen=(self)',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    'Content-Security-Policy': prod ? PROD_CSP : DEV_CSP,
+  }
+  if (prod) {
+    headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
+  }
+  return headers
+}
+
+function mergeSecurityHeaders(source: Headers, headers: Record<string, string>): Headers {
+  const entries = Object.entries(headers)
+  try {
+    for (const [name, value] of entries) source.set(name, value)
+    return source
+  } catch {
+    // @auth/core 响应（登录回调成功/失败路径）的 headers 为 immutable guard，
+    // 原地 set 抛 TypeError: immutable → 未捕获异常 → 登录 500。
+    const merged = new Headers(source)
+    for (const [name, value] of entries) merged.set(name, value)
+    return merged
+  }
+}
+
+function withSecurityHeaders(result: Response, headers: Record<string, string>): Response {
+  const merged = mergeSecurityHeaders(result.headers, headers)
+  if (merged === result.headers) return result
+  return new Response(result.body, {
+    status: result.status,
+    statusText: result.statusText,
+    headers: merged,
+  })
+}
+
+export const securityHeadersMiddleware = createMiddleware().server(async ({ next }: any) => {
+  const headers = buildSecurityHeaders(process.env.NODE_ENV === 'production')
+  const result = await next() as any
+
+  if (result instanceof Response) return withSecurityHeaders(result, headers)
+
+  const carrier: any = result?.response || result
+  const target: Headers | undefined = carrier?.headers
+  if (!target) return result
+
+  const merged = mergeSecurityHeaders(target, headers)
+  if (merged === target) return result
+  return new Response(result?.body ?? null, {
+    status: result?.status ?? 200,
+    statusText: result?.statusText,
+    headers: merged,
+  })
+})

package/src/server/serverFns/components/import.ts

@@ -18,7 +18,7 @@
 import { createServerFn } from '@tanstack/react-start'
 import { z } from 'zod'
 import { prisma } from '@allbluecn/database'
-import { execSync } from 'node:child_process'
+import { execFileSync } from 'node:child_process'
 import { writeFileSync, mkdirSync, existsSync, readFileSync } from 'node:fs'
 import { resolve, join } from 'node:path'
 
@@ -89,7 +89,7 @@ export const importComponentFn = createServerFn({ method: 'POST' })
       if (!packageName) throw new Error('npm 包名不能为空')
       const prototypeDir = join(monorepoRoot, 'packages/prototype')
       try {
-        execSync(`pnpm add ${packageName}`, {
+        execFileSync('pnpm', ['add', packageName], {
           cwd: prototypeDir,
           stdio: 'pipe',
           timeout: 60000,
@@ -114,7 +114,7 @@ export const importComponentFn = createServerFn({ method: 'POST' })
       } else {
         const compName = importPath.split('/').pop() ?? importPath
         try {
-          execSync(`pnpm dlx shadcn@latest add ${importPath} --yes`, {
+          execFileSync('pnpm', ['dlx', 'shadcn@latest', 'add', importPath, '--yes'], {
             cwd: webDir,
             stdio: 'pipe',
             timeout: 120000,

package/src/server/serverFns/invitations.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+
+function randomInvitationCode(): string {
+  const hex = crypto
+    .getRandomValues(new Uint8Array(4))
+    .reduce((s, b) => s + b.toString(16).padStart(2, '0'), '')
+  return hex.toUpperCase()
+}
+
+const pageSchema = z.object({
+  page: z.number().int().min(1).default(1),
+  pageSize: z.number().int().min(1).max(100).default(50),
+})
+
+export const listInvitationCodesFn = createServerFn({ method: 'GET' })
+  .validator(pageSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const skip = (data.page - 1) * data.pageSize
+    const [codes, total] = await Promise.all([
+      prisma.invitationCode.findMany({
+        where: { disabledAt: null },
+        select: {
+          id: true,
+          code: true,
+          maxUses: true,
+          usedCount: true,
+          expiresAt: true,
+          createdById: true,
+          disabledAt: true,
+          createdAt: true,
+          uses: {
+            select: { userId: true, usedAt: true, user: { select: { username: true } } },
+          },
+        },
+        orderBy: { createdAt: 'desc' },
+        skip,
+        take: data.pageSize,
+      }),
+      prisma.invitationCode.count({ where: { disabledAt: null } }),
+    ])
+    const creatorIds = [
+      ...new Set(codes.map((c) => c.createdById).filter((v): v is string => !!v)),
+    ]
+    const creators = creatorIds.length
+      ? await prisma.user.findMany({
+          where: { id: { in: creatorIds } },
+          select: { id: true, username: true },
+        })
+      : []
+    const creatorMap = new Map(creators.map((u) => [u.id, u.username]))
+    return {
+      codes: codes.map((c) => ({
+        ...c,
+        creator: c.createdById ? (creatorMap.get(c.createdById) ?? null) : null,
+      })),
+      total,
+      page: data.page,
+      pageSize: data.pageSize,
+    }
+  })
+
+const createCodeSchema = z.object({
+  code: z
+    .string()
+    .trim()
+    .regex(/^[A-Za-z0-9]{8,12}$/, '邀请码需为 8-12 位字母或数字')
+    .refine((v) => /[a-zA-Z]/.test(v) && /[0-9]/.test(v), '邀请码需同时包含字母和数字')
+    .optional(),
+  maxUses: z.number().int().min(1).max(9999).default(1),
+  validDays: z.number().int().min(1).max(365).default(30),
+})
+
+export const createInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(createCodeSchema)
+  .handler(async ({ data }) => {
+    const session = await requireAdmin()
+    const code = data.code ? data.code.trim().toUpperCase() : randomInvitationCode()
+    const row = await prisma.invitationCode.create({
+      data: {
+        code,
+        maxUses: data.maxUses,
+        expiresAt: new Date(Date.now() + data.validDays * 24 * 60 * 60 * 1000),
+        createdById: session.user?.id ?? null,
+      },
+    })
+    return row
+  })
+
+const idSchema = z.object({ id: z.string().min(1) })
+
+export const toggleInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(idSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const row = await prisma.invitationCode.findUnique({ where: { id: data.id } })
+    if (!row) throw new Error('邀请码不存在')
+    const disabledAt = row.disabledAt ? null : new Date()
+    const updated = await prisma.invitationCode.update({
+      where: { id: data.id },
+      data: { disabledAt },
+    })
+    return updated
+  })
+
+export const deleteInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(idSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const row = await prisma.invitationCode.findUnique({
+      where: { id: data.id },
+      select: { id: true, usedCount: true },
+    })
+    if (!row) throw new Error('邀请码不存在')
+    if (row.usedCount > 0) throw new Error('已有使用记录，请改用禁用')
+    await prisma.invitationCode.delete({ where: { id: data.id } })
+    return { deleted: true }
+  })
+
+export const getRegistrationModeFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async () => {
+    await requireAdmin()
+    const setting = await prisma.systemSetting.findUnique({
+      where: { key: 'auth.registrationMode' },
+    })
+    return { mode: setting?.value === 'open' ? 'open' : 'invite' }
+  })
+
+export const setRegistrationModeFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ mode: z.enum(['invite', 'open']) }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await prisma.systemSetting.upsert({
+      where: { key: 'auth.registrationMode' },
+      update: { value: data.mode },
+      create: {
+        key: 'auth.registrationMode',
+        value: data.mode,
+        category: 'auth',
+        desc: '注册模式：invite 需邀请码，open 开放注册',
+      },
+    })
+    return { mode: data.mode }
+  })