@allbluecn/admin-app 0.2.4 → 0.2.6

package/src/server/__tests__/invitations.test.ts

@@ -0,0 +1,311 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+vi.mock('@tanstack/react-start', () => ({
+  createServerFn: (_config: unknown) => {
+    const api: any = {
+      _validator: undefined,
+      validator(schema: any) {
+        this._validator = schema
+        return this
+      },
+      handler(fn: Function) {
+        const wrapped = async (args: any) => {
+          let data = args?.data
+          if (this._validator && data !== undefined) {
+            data = this._validator.parse ? this._validator.parse(data) : data
+          }
+          return fn({ data })
+        }
+        return wrapped
+      },
+    }
+    return api
+  },
+}))
+
+vi.mock('@tanstack/react-start/server', () => ({
+  getRequest: () => ({}),
+}))
+
+vi.mock('@allbluecn/database', () => ({
+  prisma: {
+    invitationCode: {
+      findMany: vi.fn(),
+      count: vi.fn(),
+      findUnique: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+    },
+    user: {
+      findMany: vi.fn(),
+    },
+    systemSetting: {
+      findUnique: vi.fn(),
+      upsert: vi.fn(),
+    },
+  },
+}))
+
+vi.mock('@/server/auth-helpers', () => ({
+  requireAdmin: vi
+    .fn()
+    .mockResolvedValue({ user: { id: 'admin-1', role: 'SUPER_ADMIN' } }),
+}))
+
+import { prisma } from '@allbluecn/database'
+import {
+  listInvitationCodesFn,
+  createInvitationCodeFn,
+  toggleInvitationCodeFn,
+  deleteInvitationCodeFn,
+  getRegistrationModeFn,
+  setRegistrationModeFn,
+} from '../serverFns/invitations'
+
+const ic = prisma.invitationCode as unknown as {
+  findMany: ReturnType<typeof vi.fn>
+  count: ReturnType<typeof vi.fn>
+  findUnique: ReturnType<typeof vi.fn>
+  create: ReturnType<typeof vi.fn>
+  update: ReturnType<typeof vi.fn>
+  delete: ReturnType<typeof vi.fn>
+}
+
+const user = prisma.user as unknown as { findMany: ReturnType<typeof vi.fn> }
+const systemSetting = prisma.systemSetting as unknown as {
+  findUnique: ReturnType<typeof vi.fn>
+  upsert: ReturnType<typeof vi.fn>
+}
+
+describe('invitations serverFn（admin 邀请码 CRUD 与注册模式）', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('listInvitationCodesFn：分页查询 disabledAt=null 并批量解析创建人', async () => {
+    const codes = [
+      { id: 'c1', code: 'ABC1', maxUses: 1, usedCount: 0, expiresAt: new Date(), createdById: 'u1', disabledAt: null, createdAt: new Date(), uses: [] },
+      { id: 'c2', code: 'DEF2', maxUses: 5, usedCount: 2, expiresAt: new Date(), createdById: null, disabledAt: null, createdAt: new Date(), uses: [] },
+    ]
+    ic.findMany.mockResolvedValue(codes)
+    ic.count.mockResolvedValue(42)
+    user.findMany.mockResolvedValue([{ id: 'u1', username: 'alice' }])
+
+    const result = await listInvitationCodesFn({ data: { page: 2, pageSize: 20 } })
+
+    expect(ic.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ skip: 20, take: 20, where: { disabledAt: null } }),
+    )
+    expect(ic.count).toHaveBeenCalledWith({ where: { disabledAt: null } })
+    expect(user.findMany).toHaveBeenCalledWith({
+      where: { id: { in: ['u1'] } },
+      select: { id: true, username: true },
+    })
+    expect(result).toMatchObject({
+      total: 42,
+      page: 2,
+      pageSize: 20,
+      codes: [
+        { code: 'ABC1', creator: 'alice' },
+        { code: 'DEF2', creator: null },
+      ],
+    })
+  })
+
+  it('listInvitationCodesFn：无创建人时不发起用户查询', async () => {
+    ic.findMany.mockResolvedValue([{ id: 'c1', createdById: null, uses: [] }])
+    ic.count.mockResolvedValue(1)
+
+    await listInvitationCodesFn({ data: { page: 1, pageSize: 10 } })
+
+    expect(user.findMany).not.toHaveBeenCalled()
+  })
+
+  it('createInvitationCodeFn：自定义 code 归一化为大写并写入 createdById', async () => {
+    ic.create.mockImplementation(({ data }: { data: { code: string } }) =>
+      Promise.resolve({ id: 'c-new', code: data.code }),
+    )
+
+    const result = await createInvitationCodeFn({ data: { code: ' ab12cd34 ' } })
+
+    expect(ic.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        code: 'AB12CD34',
+        maxUses: 1,
+        createdById: 'admin-1',
+      }),
+    })
+    expect(result.code).toBe('AB12CD34')
+  })
+
+  it('createInvitationCodeFn：自定义 code 过短 → 拒绝', async () => {
+    await expect(createInvitationCodeFn({ data: { code: 'abc000' } })).rejects.toThrow(
+      '邀请码需为 8-12 位字母或数字',
+    )
+    expect(ic.create).not.toHaveBeenCalled()
+  })
+
+  it('createInvitationCodeFn：自定义 code 含下划线短横 → 拒绝', async () => {
+    await expect(createInvitationCodeFn({ data: { code: 'ab12_cd34' } })).rejects.toThrow(
+      '邀请码需为 8-12 位字母或数字',
+    )
+  })
+
+  it('createInvitationCodeFn：纯字母 code（缺数字）→ 拒绝', async () => {
+    await expect(createInvitationCodeFn({ data: { code: 'abcdefgh' } })).rejects.toThrow(
+      '邀请码需同时包含字母和数字',
+    )
+  })
+
+  it('createInvitationCodeFn：纯数字 code（缺字母）→ 拒绝', async () => {
+    await expect(createInvitationCodeFn({ data: { code: '12345678' } })).rejects.toThrow(
+      '邀请码需同时包含字母和数字',
+    )
+  })
+
+  it('createInvitationCodeFn：未传 code 时自动生成满足 /^[A-F0-9]{8}$/', async () => {
+    ic.create.mockImplementation(({ data }: { data: { code: string } }) =>
+      Promise.resolve({ id: 'c-new', code: data.code }),
+    )
+
+    const result = await createInvitationCodeFn({ data: {} })
+
+    expect(result.code).toMatch(/^[A-F0-9]{8}$/)
+  })
+
+  it('toggleInvitationCodeFn：已启用（disabledAt=null）→ 写入当前时间', async () => {
+    ic.findUnique.mockResolvedValue({ id: 'c1', disabledAt: null })
+    const captures: Array<{ where: { id: string }; data: { disabledAt: Date | null } }> = []
+    ic.update.mockImplementation((arg: { where: { id: string }; data: { disabledAt: Date | null } }) => {
+      captures.push(arg)
+      return Promise.resolve({ id: arg.where.id, disabledAt: arg.data.disabledAt })
+    })
+
+    const before = Date.now()
+    await toggleInvitationCodeFn({ data: { id: 'c1' } })
+    const after = Date.now()
+
+    expect(captures).toHaveLength(1)
+    expect(captures[0].where).toEqual({ id: 'c1' })
+    const written = captures[0].data.disabledAt
+    expect(written).toBeInstanceOf(Date)
+    if (written instanceof Date) {
+      expect(written.getTime()).toBeGreaterThanOrEqual(before)
+      expect(written.getTime()).toBeLessThanOrEqual(after)
+    }
+  })
+
+  it('toggleInvitationCodeFn：已禁用 → 置回 null（重新启用）', async () => {
+    ic.findUnique.mockResolvedValue({ id: 'c1', disabledAt: new Date('2026-01-01') })
+    ic.update.mockImplementation(({ data }: { data: { disabledAt: Date | null } }) =>
+      Promise.resolve({ id: 'c1', disabledAt: data.disabledAt }),
+    )
+
+    const result = await toggleInvitationCodeFn({ data: { id: 'c1' } })
+
+    expect(result.disabledAt).toBeNull()
+  })
+
+  it('toggleInvitationCodeFn：不存在的 id 抛「邀请码不存在」', async () => {
+    ic.findUnique.mockResolvedValue(null)
+
+    await expect(toggleInvitationCodeFn({ data: { id: 'missing' } })).rejects.toThrow(
+      '邀请码不存在',
+    )
+  })
+
+  it('deleteInvitationCodeFn：usedCount > 0 拒绝删除', async () => {
+    ic.findUnique.mockResolvedValue({ id: 'c1', usedCount: 3 })
+
+    await expect(deleteInvitationCodeFn({ data: { id: 'c1' } })).rejects.toThrow(
+      '已有使用记录，请改用禁用',
+    )
+    expect(ic.delete).not.toHaveBeenCalled()
+  })
+
+  it('deleteInvitationCodeFn：usedCount === 0 删除成功', async () => {
+    ic.findUnique.mockResolvedValue({ id: 'c1', usedCount: 0 })
+    ic.delete.mockResolvedValue({ id: 'c1' })
+
+    const result = await deleteInvitationCodeFn({ data: { id: 'c1' } })
+
+    expect(ic.delete).toHaveBeenCalledWith({ where: { id: 'c1' } })
+    expect(result).toEqual({ deleted: true })
+  })
+
+  it('deleteInvitationCodeFn：不存在的 id 抛「邀请码不存在」', async () => {
+    ic.findUnique.mockResolvedValue(null)
+
+    await expect(deleteInvitationCodeFn({ data: { id: 'missing' } })).rejects.toThrow(
+      '邀请码不存在',
+    )
+  })
+
+  it('getRegistrationModeFn：无行时默认 invite', async () => {
+    systemSetting.findUnique.mockResolvedValue(null)
+
+    await expect(getRegistrationModeFn({ data: {} })).resolves.toEqual({ mode: 'invite' })
+  })
+
+  it('getRegistrationModeFn：value=open 返回 open', async () => {
+    systemSetting.findUnique.mockResolvedValue({ key: 'auth.registrationMode', value: 'open' })
+
+    await expect(getRegistrationModeFn({ data: {} })).resolves.toEqual({ mode: 'open' })
+  })
+
+  it('setRegistrationModeFn：写入后 upsert create 分支带 category=auth', async () => {
+    systemSetting.upsert.mockResolvedValue({ id: 's1' })
+
+    const result = await setRegistrationModeFn({ data: { mode: 'open' } })
+
+    expect(systemSetting.upsert).toHaveBeenCalledWith({
+      where: { key: 'auth.registrationMode' },
+      update: { value: 'open' },
+      create: expect.objectContaining({
+        key: 'auth.registrationMode',
+        value: 'open',
+        category: 'auth',
+      }),
+    })
+    expect(result).toEqual({ mode: 'open' })
+  })
+
+  it('setRegistrationModeFn + getRegistrationModeFn：写读一致', async () => {
+    let stored: string | null = null
+    systemSetting.upsert.mockImplementation(
+      ({ update }: { update: { value: string } }) => {
+        stored = update.value
+        return Promise.resolve({ id: 's1', value: stored })
+      },
+    )
+    systemSetting.findUnique.mockImplementation(() =>
+      stored === null
+        ? Promise.resolve(null)
+        : Promise.resolve({ key: 'auth.registrationMode', value: stored }),
+    )
+
+    await setRegistrationModeFn({ data: { mode: 'open' } })
+    await expect(getRegistrationModeFn({ data: {} })).resolves.toEqual({ mode: 'open' })
+
+    await setRegistrationModeFn({ data: { mode: 'invite' } })
+    await expect(getRegistrationModeFn({ data: {} })).resolves.toEqual({ mode: 'invite' })
+  })
+})

package/src/server/serverFns/invitations.ts

@@ -0,0 +1,165 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+
+function randomInvitationCode(): string {
+  const hex = crypto
+    .getRandomValues(new Uint8Array(4))
+    .reduce((s, b) => s + b.toString(16).padStart(2, '0'), '')
+  return hex.toUpperCase()
+}
+
+const pageSchema = z.object({
+  page: z.number().int().min(1).default(1),
+  pageSize: z.number().int().min(1).max(100).default(50),
+})
+
+export const listInvitationCodesFn = createServerFn({ method: 'GET' })
+  .validator(pageSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const skip = (data.page - 1) * data.pageSize
+    const [codes, total] = await Promise.all([
+      prisma.invitationCode.findMany({
+        where: { disabledAt: null },
+        select: {
+          id: true,
+          code: true,
+          maxUses: true,
+          usedCount: true,
+          expiresAt: true,
+          createdById: true,
+          disabledAt: true,
+          createdAt: true,
+          uses: {
+            select: { userId: true, usedAt: true, user: { select: { username: true } } },
+          },
+        },
+        orderBy: { createdAt: 'desc' },
+        skip,
+        take: data.pageSize,
+      }),
+      prisma.invitationCode.count({ where: { disabledAt: null } }),
+    ])
+    const creatorIds = [
+      ...new Set(codes.map((c) => c.createdById).filter((v): v is string => !!v)),
+    ]
+    const creators = creatorIds.length
+      ? await prisma.user.findMany({
+          where: { id: { in: creatorIds } },
+          select: { id: true, username: true },
+        })
+      : []
+    const creatorMap = new Map(creators.map((u) => [u.id, u.username]))
+    return {
+      codes: codes.map((c) => ({
+        ...c,
+        creator: c.createdById ? (creatorMap.get(c.createdById) ?? null) : null,
+      })),
+      total,
+      page: data.page,
+      pageSize: data.pageSize,
+    }
+  })
+
+const createCodeSchema = z.object({
+  code: z
+    .string()
+    .trim()
+    .regex(/^[A-Za-z0-9]{8,12}$/, '邀请码需为 8-12 位字母或数字')
+    .refine((v) => /[a-zA-Z]/.test(v) && /[0-9]/.test(v), '邀请码需同时包含字母和数字')
+    .optional(),
+  maxUses: z.number().int().min(1).max(9999).default(1),
+  validDays: z.number().int().min(1).max(365).default(30),
+})
+
+export const createInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(createCodeSchema)
+  .handler(async ({ data }) => {
+    const session = await requireAdmin()
+    const code = data.code ? data.code.trim().toUpperCase() : randomInvitationCode()
+    const row = await prisma.invitationCode.create({
+      data: {
+        code,
+        maxUses: data.maxUses,
+        expiresAt: new Date(Date.now() + data.validDays * 24 * 60 * 60 * 1000),
+        createdById: session.user?.id ?? null,
+      },
+    })
+    return row
+  })
+
+const idSchema = z.object({ id: z.string().min(1) })
+
+export const toggleInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(idSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const row = await prisma.invitationCode.findUnique({ where: { id: data.id } })
+    if (!row) throw new Error('邀请码不存在')
+    const disabledAt = row.disabledAt ? null : new Date()
+    const updated = await prisma.invitationCode.update({
+      where: { id: data.id },
+      data: { disabledAt },
+    })
+    return updated
+  })
+
+export const deleteInvitationCodeFn = createServerFn({ method: 'POST' })
+  .validator(idSchema)
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const row = await prisma.invitationCode.findUnique({
+      where: { id: data.id },
+      select: { id: true, usedCount: true },
+    })
+    if (!row) throw new Error('邀请码不存在')
+    if (row.usedCount > 0) throw new Error('已有使用记录，请改用禁用')
+    await prisma.invitationCode.delete({ where: { id: data.id } })
+    return { deleted: true }
+  })
+
+export const getRegistrationModeFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async () => {
+    await requireAdmin()
+    const setting = await prisma.systemSetting.findUnique({
+      where: { key: 'auth.registrationMode' },
+    })
+    return { mode: setting?.value === 'open' ? 'open' : 'invite' }
+  })
+
+export const setRegistrationModeFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ mode: z.enum(['invite', 'open']) }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    await prisma.systemSetting.upsert({
+      where: { key: 'auth.registrationMode' },
+      update: { value: data.mode },
+      create: {
+        key: 'auth.registrationMode',
+        value: data.mode,
+        category: 'auth',
+        desc: '注册模式：invite 需邀请码，open 开放注册',
+      },
+    })
+    return { mode: data.mode }
+  })

package/src/server/serverFns/oauth-providers.ts

@@ -0,0 +1,161 @@
+// ⚠ serverFn 纯净原则：本文件禁止 export 普通函数/常量；只允许 createServerFn 返回值和 interface。
+//   工具函数（如 maskSecret）如需复用请放同目录其他 .ts 文件。
+//
+// 跨 app 缓存失效：admin 与 web 是独立 app（各自独立 prisma 实例），admin 写 DB 后 web 端
+// oauth-config 60s 缓存最长延迟 60s 生效（TTL 自然过期，符合 plan2 spec），无跨进程失效通道。
+import { createServerFn } from '@tanstack/react-start'
+import { z } from 'zod'
+import { prisma } from '@allbluecn/database'
+import { requireAdmin } from '@/server/auth-helpers'
+import { decryptSecret, encryptSecret } from '@allbluecn/kernel/crypto'
+
+export interface OAuthProviderView {
+  provider: string
+  clientId: string
+  /** 数据库行是否含有效密文（v1. 前缀）；'***' 占位视为 false */
+  hasSecret: boolean
+  enabled: boolean
+  hasEnvFallback: boolean
+  fromDb: boolean
+}
+
+const PROVIDER_KEY = 'google'
+
+const GOOGLE_OPENID_URL = 'https://accounts.google.com/.well-known/openid-configuration'
+
+function hasGoogleEnvFallback(): boolean {
+  return Boolean(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET)
+}
+
+export const listOAuthProvidersFn = createServerFn({ method: 'GET' })
+  .validator(z.object({}))
+  .handler(async (): Promise<{ providers: OAuthProviderView[] }> => {
+    await requireAdmin()
+    const row = await prisma.oAuthProviderConfig.findUnique({
+      where: { provider: PROVIDER_KEY },
+    })
+    return {
+      providers: [
+        row
+          ? {
+              provider: PROVIDER_KEY,
+              clientId: row.clientId,
+              hasSecret:
+                row.clientSecret.startsWith('v1.') &&
+                decryptSecret(row.clientSecret) !== null,
+              enabled: row.enabled,
+              hasEnvFallback: false,
+              fromDb: true,
+            }
+          : {
+              provider: PROVIDER_KEY,
+              clientId: '',
+              hasSecret: false,
+              enabled: false,
+              hasEnvFallback: hasGoogleEnvFallback(),
+              fromDb: false,
+            },
+      ],
+    }
+  })
+
+export const saveOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      provider: z.literal('google'),
+      clientId: z.string().min(1, 'clientId 不能为空'),
+      clientSecret: z.string().optional(),
+      enabled: z.boolean(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    const hasSecret = Boolean(data.clientSecret && data.clientSecret.length > 0)
+    if (!hasSecret) {
+      // 无 secret：仅当 DB 已有记录时更新 clientId/enabled；无记录时创建 secret='***' 占位
+      // （'***' 会被 web 端 decryptSecret 返回 null，filter 掉，实际回落 env）
+      const existing = await prisma.oAuthProviderConfig.findUnique({
+        where: { provider: data.provider },
+      })
+      if (existing) {
+        await prisma.oAuthProviderConfig.update({
+          where: { provider: data.provider },
+          data: { clientId: data.clientId, enabled: data.enabled },
+        })
+      } else {
+        await prisma.oAuthProviderConfig.create({
+          data: {
+            provider: data.provider,
+            clientId: data.clientId,
+            clientSecret: '***',
+            enabled: data.enabled,
+          },
+        })
+      }
+      return { ok: true }
+    }
+    const encrypted = encryptSecret(data.clientSecret as string)
+    await prisma.oAuthProviderConfig.upsert({
+      where: { provider: data.provider },
+      create: {
+        provider: data.provider,
+        clientId: data.clientId,
+        clientSecret: encrypted,
+        enabled: data.enabled,
+      },
+      update: {
+        clientId: data.clientId,
+        clientSecret: encrypted,
+        enabled: data.enabled,
+      },
+    })
+    return { ok: true }
+  })
+
+export const testOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(
+    z.object({
+      provider: z.literal('google'),
+      clientId: z.string(),
+    }),
+  )
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    if (!data.clientId || data.clientId.trim().length === 0) {
+      return { ok: false, detail: 'clientId 为空，无法测试' }
+    }
+    let res: Response
+    try {
+      res = await fetch(GOOGLE_OPENID_URL, {
+        method: 'GET',
+        headers: { 'accept': 'application/json' },
+        signal: AbortSignal.timeout(10_000),
+      })
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e)
+      return { ok: false, detail: `无法访问 Google OpenID 端点：${msg}` }
+    }
+    if (!res.ok) {
+      return { ok: false, detail: `Google OpenID 端点返回 HTTP ${res.status}` }
+    }
+    return {
+      ok: true,
+      detail:
+        '仅验证 Google OAuth 端点可达，key 真伪需在实际登录流程中验证',
+    }
+  })
+
+export const deleteOAuthProviderFn = createServerFn({ method: 'POST' })
+  .validator(z.object({ provider: z.literal('google') }))
+  .handler(async ({ data }) => {
+    await requireAdmin()
+    try {
+      await prisma.oAuthProviderConfig.delete({ where: { provider: data.provider } })
+    } catch (e) {
+      const code = (e as { code?: string }).code
+      if (code !== 'P2025') {
+        throw e
+      }
+    }
+    return { ok: true, fallbackToEnv: hasGoogleEnvFallback() }
+  })