@dofe/infra-prisma 0.1.1

package/dist/middleware/soft-delete.middleware.js

@@ -0,0 +1,289 @@
+"use strict";
+/**
+ * Soft Delete Middleware
+ * 软删除中间件
+ *
+ * 自动处理软删除逻辑：
+ * 1. 查询操作自动添加 isDeleted: false 条件
+ * 2. 删除操作自动转换为软删除（update isDeleted = true）
+ *
+ * Prisma 7.x 更新：
+ * - 使用 $extends 替代已移除的 $use 方法
+ * - 返回扩展后的 PrismaClient 实例
+ *
+ * @example
+ * ```typescript
+ * const prisma = new PrismaClient();
+ * const extendedPrisma = setupSoftDeleteMiddleware(prisma);
+ * // 使用 extendedPrisma 而不是原始的 prisma
+ * await extendedPrisma.userInfo.findMany(); // 自动添加 isDeleted: false
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSoftDeleteModel = isSoftDeleteModel;
+exports.setupSoftDeleteMiddleware = setupSoftDeleteMiddleware;
+exports.hardDelete = hardDelete;
+/**
+ * 查询操作列表
+ */
+const QUERY_ACTIONS = [
+    'findFirst',
+    'findMany',
+    'findUnique',
+    'findFirstOrThrow',
+    'findUniqueOrThrow',
+    'count',
+    'aggregate',
+    'groupBy',
+];
+/**
+ * 不支持软删除的模型列表（这些模型没有 isDeleted 字段）
+ *
+ * 分类说明：
+ * - 系统/配置表：SystemTaskQueue
+ * - 关联表：BotPlugin, BotSkill, BotModel
+ * - 日志表：BotUsageLog, OperateLog
+ * - 安全令牌表：ProxyToken
+ */
+const NON_SOFT_DELETE_MODELS = [
+    // 系统/配置表（无 isDeleted 字段）
+    'SystemTaskQueue',
+    'SystemConfig',
+    'TenantConfig',
+    'SystemSyncTask',
+    // 关联表（多对多关系，通过 onDelete: Cascade 级联删除，无 isDeleted 字段）
+    'BotSkill',
+    'BotModel',
+    'BotPlugin',
+    'BotMcpServer',
+    'GatewaySkill',
+    'TenantPlugin',
+    'ModelCapabilityTag',
+    'ModelAvailabilityCapabilityTag',
+    'FallbackChainModel',
+    'ComplexityRoutingModelMapping',
+    'BotSkillSourceSnapshot',
+    'BotKnowledgeBaseSourceSnapshot',
+    'BotKnowledgeLink',
+    // 路由/策略配置表（无 isDeleted 字段）
+    'BotModelRouting',
+    'BotRoutingConfig',
+    'ComplexityRoutingConfig',
+    'FallbackChain',
+    'CostStrategy',
+    'AgentModel',
+    'GatewayConfigVersion',
+    'GatewayConfigChangeLog',
+    // 技能版本表（只追加，不软删除，无 isDeleted 字段）
+    'SkillVersion',
+    // 技能表（通过 onDelete: Cascade 级联删除，无 isDeleted 字段）
+    'Skill',
+    // 模型可用性缓存表（无需软删除，无 isDeleted 字段）
+    'ModelAvailability',
+    'ModelCatalog',
+    // 日志表（只追加，不删除，无 isDeleted 字段）
+    'BotUsageLog',
+    'OperateLog',
+    'OpenClawAuditEvent',
+    // 安全令牌表（通过 revokedAt 字段标记失效，不使用软删除，无 isDeleted 字段）
+    'ProxyToken',
+    // MCP Server（无 isDeleted 字段）
+    'McpServer',
+    // Pairing 记录（无 isDeleted 字段）
+    'FeishuPairingRecord',
+    'PlatformPairingRecord',
+    // 计费相关表（当前 schema 未包含 isDeleted 字段）
+    'Invoice',
+    'InvoiceItem',
+    'Payment',
+    'Topup',
+    // === bot autonomy / trigger / notification ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'ApprovalRequest',
+    'BotTokenUsage',
+    'BotTrigger',
+    'BotTriggerHistory',
+    'Notification',
+    // === workspace / session ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'Workspace',
+    'WorkspaceSession',
+    // === feedback / optimization ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'BotExecutionFeedback',
+    'BotOptimizationSuggestion',
+    // === knowledge ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'KnowledgeBaseBot',
+    'KnowledgeUsage',
+    // === bot session / chain ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'BotSessionChain',
+    'BotCrossSessionMessage',
+    'SubAgentMessage',
+    'SubAgentHeartbeatConfig',
+    'SubAgentHeartbeatLog',
+    'SubAgentRelation',
+    'AutonomyPolicy',
+    // === bot extensions ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'BotFocusExtension',
+    'BotCronJobMeta',
+    'BotMdFileVersion',
+    'MemoryItem',
+    // === organization ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'OrganizationMember',
+    'UserTenantPreference',
+    // === template ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'PositionSkill',
+    'PositionKnowledgeBase',
+    'TemplateSkill',
+    'TemplateKnowledgeBase',
+    // === general preset ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'GeneralPreset',
+    'GeneralPresetSkill',
+    'GeneralPresetKnowledgeBase',
+    // === marketing ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'MarketingLead',
+    // === compliance / data lifecycle ===
+    // DeletionRequest 模型无 isDeleted 字段，通过 status 字段管理状态
+    'DeletionRequest',
+    // === plaza ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'PlazaLike',
+    'PlazaSubscription',
+    // === workflow ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'BotWorkflow',
+    'WorkflowTemplate',
+    'WorkflowExecution',
+    'WorkflowNodeExecution',
+    'WorkflowVersion',
+    // === cost intelligence ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'CostAnomaly',
+    'AnomalyRule',
+    'OptimizationSuggestion',
+    'CostPrediction',
+    'BotOptimizationSuggestion',
+    // === compliance (Q1 2027 治理合规 1.0) ===
+    // 这些模型当前 schema 未包含 isDeleted 字段
+    'CertificationStatus',
+    'RetentionPolicy',
+    'DeletionRequest',
+    'ComplianceReport',
+];
+/**
+ * 检查模型是否支持软删除
+ */
+function isSoftDeleteModel(modelName) {
+    if (!modelName)
+        return false;
+    // 如果模型在不支持软删除的列表中，返回 false
+    return !NON_SOFT_DELETE_MODELS.includes(modelName);
+}
+/**
+ * 检查 where 条件是否已显式指定 isDeleted
+ * 支持嵌套的 OR/AND/NOT 条件
+ */
+function hasExplicitIsDeleted(where) {
+    if (!where)
+        return false;
+    // 直接检查 isDeleted 字段
+    if ('isDeleted' in where)
+        return true;
+    // 检查 OR 条件
+    if (Array.isArray(where.OR)) {
+        for (const condition of where.OR) {
+            if (hasExplicitIsDeleted(condition)) {
+                return true;
+            }
+        }
+    }
+    // 检查 AND 条件
+    if (Array.isArray(where.AND)) {
+        for (const condition of where.AND) {
+            if (hasExplicitIsDeleted(condition)) {
+                return true;
+            }
+        }
+    }
+    // 检查 NOT 条件
+    if (where.NOT) {
+        if (Array.isArray(where.NOT)) {
+            for (const condition of where.NOT) {
+                if (hasExplicitIsDeleted(condition)) {
+                    return true;
+                }
+            }
+        }
+        else {
+            if (hasExplicitIsDeleted(where.NOT)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * 设置软删除中间件
+ * Prisma 7.x: 使用 $extends 创建扩展客户端
+ *
+ * 注意：由于 Prisma 7.x 的 $extends API 限制，delete 操作的转换需要使用模型特定的扩展
+ * 当前实现仅处理查询操作的软删除过滤
+ *
+ * @param prisma - Prisma 客户端实例
+ * @returns 扩展后的 PrismaClient 实例
+ */
+function setupSoftDeleteMiddleware(prisma) {
+    return prisma.$extends({
+        query: {
+            $allOperations({ operation, model, args, query }) {
+                // 检查是否为软删除模型
+                if (!isSoftDeleteModel(model)) {
+                    return query(args);
+                }
+                // 处理查询操作：自动添加 isDeleted: false
+                if (QUERY_ACTIONS.includes(operation)) {
+                    const newArgs = { ...args };
+                    if (!newArgs.where) {
+                        newArgs.where = {};
+                    }
+                    // 只有在未显式指定 isDeleted 时才自动添加
+                    if (!hasExplicitIsDeleted(newArgs.where)) {
+                        newArgs.where = {
+                            ...newArgs.where,
+                            isDeleted: false,
+                        };
+                    }
+                    return query(newArgs);
+                }
+                // 对于 delete 和 deleteMany 操作，我们需要使用不同的方法
+                // 在 Prisma 7.x 中，我们不能在 $extends 中直接将一个操作转换为另一个操作
+                // 这些操作需要在使用时手动处理，或者使用模型特定的扩展
+                // 暂时让这些操作通过，后续可以通过其他方式处理
+                return query(args);
+            },
+        },
+    });
+}
+/**
+ * 硬删除工具函数
+ * 当确实需要物理删除时使用
+ *
+ * @example
+ * ```typescript
+ * await hardDelete(prisma.userInfo, { id: 'xxx' });
+ * ```
+ */
+async function hardDelete(model, where) {
+    // 直接调用原始 delete，绕过中间件的软删除转换
+    // 注意：由于中间件会拦截 delete，这个函数实际上需要使用 $executeRaw
+    // 这里只是一个概念示例，实际使用时需要使用原始 SQL
+    return model.delete({ where });
+}
+//# sourceMappingURL=soft-delete.middleware.js.map

package/dist/middleware/soft-delete.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-delete.middleware.js","sourceRoot":"","sources":["../../src/middleware/soft-delete.middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA2LH,8CAIC;AA4DD,8DAmCC;AAWD,gCAUC;AA/SD;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW;IACX,UAAU;IACV,YAAY;IACZ,kBAAkB;IAClB,mBAAmB;IACnB,OAAO;IACP,WAAW;IACX,SAAS;CACV,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG;IAC7B,yBAAyB;IACzB,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,gBAAgB;IAEhB,sDAAsD;IACtD,UAAU;IACV,UAAU;IACV,WAAW;IACX,cAAc;IACd,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,gCAAgC;IAChC,oBAAoB;IACpB,+BAA+B;IAC/B,wBAAwB;IACxB,gCAAgC;IAChC,kBAAkB;IAElB,2BAA2B;IAC3B,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,eAAe;IACf,cAAc;IACd,YAAY;IACZ,sBAAsB;IACtB,wBAAwB;IAExB,iCAAiC;IACjC,cAAc;IACd,gDAAgD;IAChD,OAAO;IAEP,iCAAiC;IACjC,mBAAmB;IACnB,cAAc;IAEd,8BAA8B;IAC9B,aAAa;IACb,YAAY;IACZ,oBAAoB;IAEpB,mDAAmD;IACnD,YAAY;IAEZ,6BAA6B;IAC7B,WAAW;IAEX,6BAA6B;IAC7B,qBAAqB;IACrB,uBAAuB;IAEvB,oCAAoC;IACpC,SAAS;IACT,aAAa;IACb,SAAS;IACT,OAAO;IAEP,gDAAgD;IAChD,iCAAiC;IACjC,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,cAAc;IAEd,8BAA8B;IAC9B,iCAAiC;IACjC,WAAW;IACX,kBAAkB;IAElB,kCAAkC;IAClC,iCAAiC;IACjC,sBAAsB;IACtB,2BAA2B;IAE3B,oBAAoB;IACpB,iCAAiC;IACjC,kBAAkB;IAClB,gBAAgB;IAEhB,8BAA8B;IAC9B,iCAAiC;IACjC,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,yBAAyB;IACzB,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAEhB,yBAAyB;IACzB,iCAAiC;IACjC,mBAAmB;IACnB,gBAAgB;IAChB,kBAAkB;IAClB,YAAY;IAEZ,uBAAuB;IACvB,iCAAiC;IACjC,oBAAoB;IACpB,sBAAsB;IAEtB,mBAAmB;IACnB,iCAAiC;IACjC,eAAe;IACf,uBAAuB;IACvB,eAAe;IACf,uBAAuB;IAEvB,yBAAyB;IACzB,iCAAiC;IACjC,eAAe;IACf,oBAAoB;IACpB,4BAA4B;IAE5B,oBAAoB;IACpB,iCAAiC;IACjC,eAAe;IAEf,sCAAsC;IACtC,oDAAoD;IACpD,iBAAiB;IAEjB,gBAAgB;IAChB,iCAAiC;IACjC,WAAW;IACX,mBAAmB;IAEnB,mBAAmB;IACnB,iCAAiC;IACjC,aAAa;IACb,kBAAkB;IAClB,mBAAmB;IACnB,uBAAuB;IACvB,iBAAiB;IAEjB,4BAA4B;IAC5B,iCAAiC;IACjC,aAAa;IACb,aAAa;IACb,wBAAwB;IACxB,gBAAgB;IAChB,2BAA2B;IAE3B,wCAAwC;IACxC,iCAAiC;IACjC,qBAAqB;IACrB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;CACV,CAAC;AAEX;;GAEG;AACH,SAAgB,iBAAiB,CAAC,SAA6B;IAC7D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,2BAA2B;IAC3B,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,SAAgB,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,KAA0C;IAE1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,oBAAoB;IACpB,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEtC,WAAW;IACX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACjC,IAAI,oBAAoB,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,oBAAoB,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,YAAY;IACZ,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClC,IAAI,oBAAoB,CAAC,SAAoC,CAAC,EAAE,CAAC;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,oBAAoB,CAAC,KAAK,CAAC,GAA8B,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,yBAAyB,CAAC,MAAoB;IAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC;QACrB,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9C,aAAa;gBACb,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC;oBACrB,CAAC;oBAED,4BAA4B;oBAC5B,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzC,OAAO,CAAC,KAAK,GAAG;4BACd,GAAG,OAAO,CAAC,KAAK;4BAChB,SAAS,EAAE,KAAK;yBACjB,CAAC;oBACJ,CAAC;oBAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;gBAED,wCAAwC;gBACxC,iDAAiD;gBACjD,6BAA6B;gBAC7B,yBAAyB;gBACzB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;SACF;KACF,CAAiB,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,UAAU,CAC9B,KAEC,EACD,KAAQ;IAER,4BAA4B;IAC5B,6CAA6C;IAC7C,6BAA6B;IAC7B,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/middleware/tenant-isolation-extension.d.ts

@@ -0,0 +1,18 @@
+import { AsyncLocalStorage } from 'async_hooks';
+export declare const tenantContext: AsyncLocalStorage<{
+    tenantId: string;
+}>;
+/**
+ * 获取当前租户 ID
+ */
+export declare function getTenantId(): string | null;
+/**
+ * 设置租户上下文
+ */
+export declare function setTenantContext(tenantId: string, callback: () => void): void;
+/**
+ * 创建租户隔离扩展（Prisma 7.x）
+ * 自动注入 tenantId 过滤，防止跨租户数据访问
+ */
+export declare function setupTenantIsolationExtension(prisma: any): any;
+//# sourceMappingURL=tenant-isolation-extension.d.ts.map

package/dist/middleware/tenant-isolation-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation-extension.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-isolation-extension.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,eAAO,MAAM,aAAa;cAAqC,MAAM;EAAK,CAAC;AAE3E;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,IAAI,CAG3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,QAEtE;AAyBD;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,GAAG,OA2ExD"}

package/dist/middleware/tenant-isolation-extension.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantContext = void 0;
+exports.getTenantId = getTenantId;
+exports.setTenantContext = setTenantContext;
+exports.setupTenantIsolationExtension = setupTenantIsolationExtension;
+const common_1 = require("@nestjs/common");
+const async_hooks_1 = require("async_hooks");
+// 全局上下文存储
+exports.tenantContext = new async_hooks_1.AsyncLocalStorage();
+/**
+ * 获取当前租户 ID
+ */
+function getTenantId() {
+    const context = exports.tenantContext.getStore();
+    return context?.tenantId || null;
+}
+/**
+ * 设置租户上下文
+ */
+function setTenantContext(tenantId, callback) {
+    exports.tenantContext.run({ tenantId }, callback);
+}
+/**
+ * 多租户表列表
+ */
+const MULTI_TENANT_MODELS = [
+    'Bot',
+    'BotCronJobMeta',
+    'BotModelRouting',
+    'BotSkill',
+    'BotUsageLog',
+    'Conversation',
+    'Message',
+    'PluginInstall',
+    'ProviderKey',
+    'ModelAvailability',
+    'AuditLog',
+    'File',
+    'Skill',
+    'SkillVersion',
+    'TenantMember',
+    'FallbackChain',
+    'GatewayConfigVersion',
+];
+/**
+ * 创建租户隔离扩展（Prisma 7.x）
+ * 自动注入 tenantId 过滤，防止跨租户数据访问
+ */
+function setupTenantIsolationExtension(prisma) {
+    return prisma.$extends({
+        query: {
+            $allModels: {
+                async $allOperations({ model, operation, args, query }) {
+                    // 只处理多租户表
+                    if (!MULTI_TENANT_MODELS.includes(model)) {
+                        return query(args);
+                    }
+                    // 获取当前租户 ID
+                    const tenantId = getTenantId();
+                    // 如果没有租户上下文，跳过（例如系统级操作）
+                    if (!tenantId) {
+                        return query(args);
+                    }
+                    // 读操作：自动注入 tenantId 过滤
+                    if ([
+                        'findMany',
+                        'findFirst',
+                        'findUnique',
+                        'count',
+                        'aggregate',
+                    ].includes(operation)) {
+                        args.where = {
+                            ...args.where,
+                            tenantId,
+                        };
+                    }
+                    // 写操作：自动注入 tenantId
+                    if (operation === 'create') {
+                        args.data = {
+                            ...args.data,
+                            tenantId,
+                        };
+                    }
+                    if (operation === 'createMany') {
+                        if (Array.isArray(args.data)) {
+                            args.data = args.data.map((item) => ({
+                                ...item,
+                                tenantId,
+                            }));
+                        }
+                    }
+                    // 更新/删除操作：验证 tenantId
+                    if (['update', 'updateMany', 'delete', 'deleteMany', 'upsert'].includes(operation)) {
+                        args.where = {
+                            ...args.where,
+                            tenantId,
+                        };
+                    }
+                    const result = await query(args);
+                    // 验证返回结果不包含其他租户数据
+                    if (result && typeof result === 'object') {
+                        validateResultTenantId(result, tenantId);
+                    }
+                    return result;
+                },
+            },
+        },
+    });
+}
+/**
+ * 验证结果中的 tenantId
+ */
+function validateResultTenantId(result, expectedTenantId) {
+    if (Array.isArray(result)) {
+        result.forEach((item) => validateResultTenantId(item, expectedTenantId));
+    }
+    else if (result && typeof result === 'object') {
+        if (result.tenantId && result.tenantId !== expectedTenantId) {
+            throw new common_1.ForbiddenException(`Data leak detected: result contains data from tenant ${result.tenantId}`);
+        }
+    }
+}
+//# sourceMappingURL=tenant-isolation-extension.js.map

package/dist/middleware/tenant-isolation-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-isolation-extension.js","sourceRoot":"","sources":["../../src/middleware/tenant-isolation-extension.ts"],"names":[],"mappings":";;;AASA,kCAGC;AAKD,4CAEC;AA6BD,sEA2EC;AA3HD,2CAAoD;AACpD,6CAAgD;AAEhD,UAAU;AACG,QAAA,aAAa,GAAG,IAAI,+BAAiB,EAAwB,CAAC;AAE3E;;GAEG;AACH,SAAgB,WAAW;IACzB,MAAM,OAAO,GAAG,qBAAa,CAAC,QAAQ,EAAE,CAAC;IACzC,OAAO,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,QAAoB;IACrE,qBAAa,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,KAAK;IACL,gBAAgB;IAChB,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,cAAc;IACd,SAAS;IACT,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,UAAU;IACV,MAAM;IACN,OAAO;IACP,cAAc;IACd,cAAc;IACd,eAAe;IACf,sBAAsB;CACvB,CAAC;AAEF;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,MAAW;IACvD,OAAO,MAAM,CAAC,QAAQ,CAAC;QACrB,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAO;oBACzD,UAAU;oBACV,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBAED,YAAY;oBACZ,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;oBAE/B,wBAAwB;oBACxB,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBAED,uBAAuB;oBACvB,IACE;wBACE,UAAU;wBACV,WAAW;wBACX,YAAY;wBACZ,OAAO;wBACP,WAAW;qBACZ,CAAC,QAAQ,CAAC,SAAS,CAAC,EACrB,CAAC;wBACD,IAAI,CAAC,KAAK,GAAG;4BACX,GAAG,IAAI,CAAC,KAAK;4BACb,QAAQ;yBACT,CAAC;oBACJ,CAAC;oBAED,oBAAoB;oBACpB,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAC3B,IAAI,CAAC,IAAI,GAAG;4BACV,GAAG,IAAI,CAAC,IAAI;4BACZ,QAAQ;yBACT,CAAC;oBACJ,CAAC;oBAED,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;wBAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC;gCACxC,GAAG,IAAI;gCACP,QAAQ;6BACT,CAAC,CAAC,CAAC;wBACN,CAAC;oBACH,CAAC;oBAED,sBAAsB;oBACtB,IACE,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACjE,SAAS,CACV,EACD,CAAC;wBACD,IAAI,CAAC,KAAK,GAAG;4BACX,GAAG,IAAI,CAAC,KAAK;4BACb,QAAQ;yBACT,CAAC;oBACJ,CAAC;oBAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEjC,kBAAkB;oBAClB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACzC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC3C,CAAC;oBAED,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,MAAW,EAAE,gBAAwB;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3E,CAAC;SAAM,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAC5D,MAAM,IAAI,2BAAkB,CAC1B,wDAAwD,MAAM,CAAC,QAAQ,EAAE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/prisma/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Prisma 模块导出
+ */
+export { PrismaModule } from './prisma.module';
+export * from './prisma.service';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/prisma/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prisma/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC"}

package/dist/prisma/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaModule = void 0;
+/**
+ * Prisma 模块导出
+ */
+var prisma_module_1 = require("./prisma.module");
+Object.defineProperty(exports, "PrismaModule", { enumerable: true, get: function () { return prisma_module_1.PrismaModule; } });
+__exportStar(require("./prisma.service"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/prisma/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prisma/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;GAEG;AACH,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,mDAAiC;AACjC,0CAAwB"}

package/dist/prisma/prisma.module.d.ts

@@ -0,0 +1,3 @@
+export declare class PrismaModule {
+}
+//# sourceMappingURL=prisma.module.d.ts.map

package/dist/prisma/prisma.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.module.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.module.ts"],"names":[],"mappings":"AAMA,qBAKa,YAAY;CAAG"}

package/dist/prisma/prisma.module.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaModule = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("@/prisma/prisma.service");
+const prisma_write_module_1 = require("@/prisma-write/prisma-write.module");
+const prisma_read_module_1 = require("@/prisma-read/prisma-read.module");
+const infra_redis_1 = require("@dofe/infra-redis");
+const config_1 = require("@nestjs/config");
+let PrismaModule = class PrismaModule {
+};
+exports.PrismaModule = PrismaModule;
+exports.PrismaModule = PrismaModule = __decorate([
+    (0, common_1.Module)({
+        imports: [prisma_write_module_1.PrismaWriteModule, prisma_read_module_1.PrismaReadModule, infra_redis_1.RedisModule, config_1.ConfigModule],
+        providers: [prisma_service_1.PrismaService],
+        exports: [prisma_service_1.PrismaService],
+    })
+], PrismaModule);
+//# sourceMappingURL=prisma.module.js.map

package/dist/prisma/prisma.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.module.js","sourceRoot":"","sources":["../../src/prisma/prisma.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,4DAAwD;AACxD,4EAAuE;AACvE,yEAAoE;AACpE,mDAAgD;AAChD,2CAA8C;AAMvC,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IALxB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,uCAAiB,EAAE,qCAAgB,EAAE,yBAAW,EAAE,qBAAY,CAAC;QACzE,SAAS,EAAE,CAAC,8BAAa,CAAC;QAC1B,OAAO,EAAE,CAAC,8BAAa,CAAC;KACzB,CAAC;GACW,YAAY,CAAG"}

package/dist/prisma/prisma.service.d.ts

@@ -0,0 +1,10 @@
+import { PrismaReadService } from '@/prisma-read/prisma-read.service';
+import { PrismaWriteService } from '@/prisma-write/prisma-write.service';
+export declare class PrismaService {
+    private readonly prismaRead;
+    private readonly prismaWrite;
+    constructor(prismaRead: PrismaReadService, prismaWrite: PrismaWriteService);
+    get read(): import("@prisma/client").PrismaClient<import("@prisma/client").Prisma.PrismaClientOptions, import("@prisma/client").Prisma.LogLevel, import("../../../../../models.dofe.ai/apps/api/generated/prisma-client/runtime/client").DefaultArgs>;
+    get write(): import("@prisma/client").PrismaClient<import("@prisma/client").Prisma.PrismaClientOptions, import("@prisma/client").Prisma.LogLevel, import("../../../../../models.dofe.ai/apps/api/generated/prisma-client/runtime/client").DefaultArgs>;
+}
+//# sourceMappingURL=prisma.service.d.ts.map

package/dist/prisma/prisma.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,qBACa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,UAAU,EAAE,iBAAiB,EAC7B,WAAW,EAAE,kBAAkB;IAElD,IAAI,IAAI,8OAEP;IAED,IAAI,KAAK,8OAER;CACF"}

package/dist/prisma/prisma.service.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaService = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_read_service_1 = require("@/prisma-read/prisma-read.service");
+const prisma_write_service_1 = require("@/prisma-write/prisma-write.service");
+let PrismaService = class PrismaService {
+    prismaRead;
+    prismaWrite;
+    constructor(prismaRead, prismaWrite) {
+        this.prismaRead = prismaRead;
+        this.prismaWrite = prismaWrite;
+    }
+    get read() {
+        return this.prismaRead.client;
+    }
+    get write() {
+        return this.prismaWrite.client;
+    }
+};
+exports.PrismaService = PrismaService;
+exports.PrismaService = PrismaService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_read_service_1.PrismaReadService,
+        prisma_write_service_1.PrismaWriteService])
+], PrismaService);
+//# sourceMappingURL=prisma.service.js.map

package/dist/prisma/prisma.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.service.js","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2EAAsE;AACtE,8EAAyE;AAGlE,IAAM,aAAa,GAAnB,MAAM,aAAa;IAEL;IACA;IAFnB,YACmB,UAA6B,EAC7B,WAA+B;QAD/B,eAAU,GAAV,UAAU,CAAmB;QAC7B,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IACJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;IACjC,CAAC;CACF,CAAA;AAZY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAGoB,uCAAiB;QAChB,yCAAkB;GAHvC,aAAa,CAYzB"}

package/dist/prisma/types.d.ts

@@ -0,0 +1,4 @@
+export declare class AppDbConfig {
+    url: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/prisma/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/prisma/types.ts"],"names":[],"mappings":"AAEA,qBAAa,WAAW;IAEtB,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/prisma/types.js

@@ -0,0 +1,22 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppDbConfig = void 0;
+const class_validator_1 = require("class-validator");
+class AppDbConfig {
+    url;
+}
+exports.AppDbConfig = AppDbConfig;
+__decorate([
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AppDbConfig.prototype, "url", void 0);
+//# sourceMappingURL=types.js.map

package/dist/prisma/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/prisma/types.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA6C;AAE7C,MAAa,WAAW;IAEtB,GAAG,CAAS;CACb;AAHD,kCAGC;AADC;IADC,IAAA,4BAAU,GAAE;;wCACD"}

package/dist/prisma-read/prisma-read.module.d.ts

@@ -0,0 +1,3 @@
+export declare class PrismaReadModule {
+}
+//# sourceMappingURL=prisma-read.module.d.ts.map

package/dist/prisma-read/prisma-read.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-read.module.d.ts","sourceRoot":"","sources":["../../src/prisma-read/prisma-read.module.ts"],"names":[],"mappings":"AAKA,qBAKa,gBAAgB;CAAG"}