@gadmin2n/schematics 0.0.139 → 0.0.141

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflow.seed.ts

@@ -12,7 +12,7 @@ import { seedNodeTypes } from './workflow-node-types';
  * Workflow 模块 seed
  *
  * 一站式负责 workflow 模块所有 seed：
- *   1. 菜单结构：workflow 父分组 + 2 个 leaf (workflow_list / workflow_node_instance)
+ *   1. 菜单结构：workflow 父分组及其管理、审批任务页面
  *   2. resource: workflow / workflowNodeInstance
  *   3. PageResource 绑定与 SYSTEM_ADMIN 授权
  *   4. 业务数据：node-types / workflows / event-trigger function & index
@@ -66,27 +66,58 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       resourceCode: 'workflowNodeInstance',
       resourceDescription: 'Workflow node instance management',
     },
+    {
+      code: 'workflow_connections',
+      zhName: '连接管理',
+      enName: 'Connections',
+      sortOrder: 3,
+      resourceCode: 'integrationConnection',
+      resourceDescription: 'Reusable external system connections',
+    },
     {
       code: 'workflow_temporal_tenant',
       zhName: '服务注册',
       enName: 'Service Registration',
-      sortOrder: 3,
+      sortOrder: 4,
       resourceCode: 'temporalTenantConfig',
       resourceDescription: 'Temporal tenant config management',
     },
+    {
+      code: 'workflow_approval_channels',
+      zhName: '审批通道',
+      enName: 'Approval Channels',
+      sortOrder: 5,
+      resourceCode: 'approvalChannel',
+      resourceDescription:
+        'Reusable dispatch and callback workflows for external approvals',
+    },
+    {
+      code: 'approval_tasks',
+      zhName: '审批任务',
+      enName: 'Approval Tasks',
+      sortOrder: 6,
+      resourceCode: 'humanApproval',
+      resourceDescription: 'Read and decide assigned Human Approval tasks',
+    },
   ];
 
   const allPages = [{ id: workflowPage.id, code: workflowPage.code }];
 
   for (const def of leafDefs) {
-    const p = await upsertPage(prisma, {
-      code: def.code,
-      name: def.code,
-      zhName: def.zhName,
-      enName: def.enName,
-      sortOrder: def.sortOrder,
-      parentId: workflowPage.id,
-    });
+    const p = await upsertPage(
+      prisma,
+      {
+        code: def.code,
+        name: def.code,
+        zhName: def.zhName,
+        enName: def.enName,
+        sortOrder: def.sortOrder,
+        parentId: workflowPage.id,
+      },
+      def.code === 'approval_tasks'
+        ? { parentId: workflowPage.id, sortOrder: def.sortOrder }
+        : {},
+    );
     allPages.push({ id: p.id, code: p.code });
     console.log(`[workflow] Page: ${p.code} (id=${p.id})`);
 
@@ -97,6 +128,26 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       def.resourceDescription,
     );
     console.log(`[workflow] PageResource: ${def.code} ↔ ${def.resourceCode}`);
+
+    // Provider actions live inside the existing Node Instance page. Resolve is
+    // seeded now for the later publish/runtime call path; it has no HTTP route yet.
+    if (def.code === 'workflow_node_instance') {
+      const providerResources = [
+        ['userGroup:read', 'Search and preview reusable user groups'],
+        ['userGroup:create', 'Create and maintain reusable user groups'],
+        ['subjectProviderSearch', 'Search subject provider resources'],
+        ['subjectProviderCreate', 'Create subject provider resources'],
+        ['subjectProviderPreview', 'Preview and validate subject references'],
+        [
+          'subjectProviderResolve',
+          'Resolve subjects during workflow execution',
+        ],
+      ] as const;
+      for (const [code, description] of providerResources) {
+        await bindResourceToPage(prisma, p.id, code, description);
+        console.log(`[workflow] PageResource: ${def.code} ↔ ${code}`);
+      }
+    }
   }
 
   // ── SYSTEM_ADMIN 授权 ──────────────────────────────────────────────────────
@@ -108,6 +159,70 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
     );
   }
 
+  // 审批任务是所有业务角色的个人待办入口；移动到 Workflow 下不改变权限。
+  const approvalTasksPage = allPages.find(
+    (page) => page.code === 'approval_tasks',
+  );
+  if (approvalTasksPage) {
+    const resourceIds = await getPageResourceIds(prisma, approvalTasksPage.id);
+    for (const eligibleRole of await prisma.role.findMany()) {
+      await grantRoleAccess(
+        prisma,
+        eligibleRole.id,
+        approvalTasksPage.id,
+        resourceIds,
+      );
+    }
+  }
+
+  // Connection management is part of creating and maintaining reusable Node
+  // Templates. Keep its page access aligned with the existing Node Template
+  // page instead of limiting it to SYSTEM_ADMIN on installations that already
+  // granted workflow authoring to other roles.
+  const nodeTemplatePage = allPages.find(
+    (page) => page.code === 'workflow_node_instance',
+  );
+  const connectionsPage = allPages.find(
+    (page) => page.code === 'workflow_connections',
+  );
+  const approvalChannelsPage = allPages.find(
+    (page) => page.code === 'workflow_approval_channels',
+  );
+  if (nodeTemplatePage && connectionsPage && approvalChannelsPage) {
+    const authorRoles = await prisma.rolePages.findMany({
+      where: { pageId: nodeTemplatePage.id },
+      select: { roleId: true },
+    });
+    const connectionResourceIds = await getPageResourceIds(
+      prisma,
+      connectionsPage.id,
+    );
+    const approvalChannelResourceIds = await getPageResourceIds(
+      prisma,
+      approvalChannelsPage.id,
+    );
+    for (const { roleId } of authorRoles) {
+      await grantRoleAccess(
+        prisma,
+        roleId,
+        connectionsPage.id,
+        connectionResourceIds,
+      );
+      console.log(
+        `[workflow] Grant: role#${roleId} → workflow_connections (inherits Node Template access)`,
+      );
+      await grantRoleAccess(
+        prisma,
+        roleId,
+        approvalChannelsPage.id,
+        approvalChannelResourceIds,
+      );
+      console.log(
+        `[workflow] Grant: role#${roleId} → workflow_approval_channels (inherits Node Template access)`,
+      );
+    }
+  }
+
   // ── 业务数据 ───────────────────────────────────────────────────────────────
   await seedNodeTypes(prisma);
   await seedWorkflowEventTrigger(prisma);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/config/index.ts

@@ -53,6 +53,34 @@ const config: Record<string, any> = {
     address: 'http://127.0.0.1:3000/upload/',
     maxSize: 1024 * 1024 * 10,
   },
+  humanApprovalRuntime: runtimeConfig(),
+  workflow: {
+    publicBaseUrl: process.env.WORKFLOW_PUBLIC_BASE_URL ?? '',
+    publicHost: process.env.WORKFLOW_PUBLIC_HOST ?? '',
+  },
+  integration: {
+    secretKey: process.env.INTEGRATION_SECRET_KEY ?? '',
+  },
 };
 
+function runtimeConfig() {
+  const rawEnabled =
+    process.env.WORKFLOW_RUNTIME_ENABLED ??
+    process.env.HUMAN_APPROVAL_RUNTIME_ENABLED;
+  if (rawEnabled !== undefined && !['true', 'false'].includes(rawEnabled))
+    throw new Error('WORKFLOW_RUNTIME_ENABLED must be exactly true or false');
+  const enabled = rawEnabled === 'true';
+  const token = process.env.WORKFLOW_RUNTIME_TOKEN ?? '';
+  if (enabled && token.length < 32)
+    throw new Error(
+      'WORKFLOW_RUNTIME_TOKEN must contain at least 32 characters when Workflow runtime is enabled',
+    );
+  const tenantNamespace = process.env.GADMIN_TENANT_NAMESPACE ?? '';
+  if (enabled && !tenantNamespace)
+    throw new Error(
+      'GADMIN_TENANT_NAMESPACE is required when Workflow runtime is enabled',
+    );
+  return { enabled, token, tenantNamespace };
+}
+
 export default () => config;

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/json-body-parser.spec.ts

@@ -0,0 +1,61 @@
+import { Body, Controller, Module, Post, Req } from '@nestjs/common';
+import { NestFactory } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
+import { Request } from 'express';
+import * as request from 'supertest';
+import { configureJsonBodyParser } from './json-body-parser';
+
+type RequestWithRawBody = Request & { rawBody?: Buffer };
+
+@Controller()
+class JsonBodyProbeController {
+  @Post('/probe')
+  probe(@Body() body: unknown, @Req() req: RequestWithRawBody) {
+    return {
+      body,
+      rawBodyLength: req.rawBody?.length ?? 0,
+    };
+  }
+}
+
+@Module({ controllers: [JsonBodyProbeController] })
+class JsonBodyProbeModule {}
+
+describe('configureJsonBodyParser', () => {
+  let app: NestExpressApplication;
+
+  beforeAll(async () => {
+    app = await NestFactory.create<NestExpressApplication>(
+      JsonBodyProbeModule,
+      {
+        logger: false,
+        rawBody: true,
+      },
+    );
+    configureJsonBodyParser(app);
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it.each(['application/json', 'application/problem+json', 'text/json'])(
+    'parses %s and preserves its raw body',
+    async (contentType) => {
+      const payload = {
+        adminUrl: 'http://127.0.0.1:8081',
+        namespace: 'test-namespace',
+      };
+
+      const response = await request(app.getHttpServer())
+        .post('/probe')
+        .set('Content-Type', contentType)
+        .send(JSON.stringify(payload))
+        .expect(201);
+
+      expect(response.body.body).toEqual(payload);
+      expect(response.body.rawBodyLength).toBeGreaterThan(0);
+    },
+  );
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/json-body-parser.ts

@@ -0,0 +1,7 @@
+import { NestExpressApplication } from '@nestjs/platform-express';
+
+export function configureJsonBodyParser(app: NestExpressApplication): void {
+  app.useBodyParser('json', {
+    type: ['application/json', 'application/*+json', 'text/json'],
+  });
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/structured-all-exceptions.filter.spec.ts

@@ -0,0 +1,54 @@
+import { ArgumentsHost, BadRequestException } from '@nestjs/common';
+import { StructuredAllExceptionsFilter } from './structured-all-exceptions.filter';
+
+function httpHost(url = '/api/workflowNodeInstance') {
+  const response = {
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn(),
+  };
+  const host = {
+    switchToHttp: () => ({
+      getResponse: () => response,
+      getRequest: () => ({ url }),
+    }),
+  } as ArgumentsHost;
+  return { host, response };
+}
+
+describe('StructuredAllExceptionsFilter', () => {
+  it('preserves controlled response fields without expanding unknown errors', () => {
+    const filter = new StructuredAllExceptionsFilter();
+    const structured = httpHost();
+
+    filter.catch(
+      new BadRequestException({
+        code: 'SUBJECT_REF_INVALID',
+        issues: [{ code: 'NOT_FOUND', ref: 'group:missing' }],
+      }),
+      structured.host,
+    );
+
+    expect(structured.response.status).toHaveBeenCalledWith(400);
+    expect(structured.response.json).toHaveBeenCalledWith({
+      code: 'SUBJECT_REF_INVALID',
+      issues: [{ code: 'NOT_FOUND', ref: 'group:missing' }],
+      statusCode: 400,
+      message: 'Bad Request Exception',
+      error: 'BadRequestException',
+      path: '/api/workflowNodeInstance',
+    });
+
+    const unknown = httpHost();
+    filter.catch(
+      Object.assign(new Error('password=secret'), { token: 'must-not-leak' }),
+      unknown.host,
+    );
+
+    expect(unknown.response.json).toHaveBeenCalledWith({
+      statusCode: 500,
+      message: 'Internal server error.',
+      error: 'Error',
+      path: '/api/workflowNodeInstance',
+    });
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/structured-all-exceptions.filter.ts

@@ -0,0 +1,86 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpStatus,
+} from '@nestjs/common';
+
+interface ControlledException {
+  getStatus?: () => number;
+  getResponse?: () => unknown;
+  name?: string;
+  message?: string;
+}
+
+@Catch()
+export class StructuredAllExceptionsFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost): void {
+    const context = host.switchToHttp();
+    const response = context.getResponse();
+    const request = context.getRequest<{ url?: string }>();
+    const controlled = this.asControlledException(exception);
+    const statusCode = this.statusFrom(controlled);
+    const payload = this.responseFrom(controlled);
+    const error = controlled?.name ?? 'Error';
+    const path = request.url ?? '';
+
+    if (isRecord(payload)) {
+      response.status(statusCode).json({
+        ...payload,
+        statusCode,
+        message: payload.message ?? controlled?.message ?? error,
+        error: payload.error ?? error,
+        path,
+      });
+      return;
+    }
+
+    response.status(statusCode).json({
+      statusCode,
+      message:
+        typeof payload === 'string'
+          ? payload
+          : statusCode === HttpStatus.INTERNAL_SERVER_ERROR
+          ? 'Internal server error.'
+          : controlled?.message ?? error,
+      error,
+      path,
+    });
+  }
+
+  private asControlledException(
+    exception: unknown,
+  ): ControlledException | undefined {
+    return exception !== null &&
+      (typeof exception === 'object' || typeof exception === 'function')
+      ? (exception as ControlledException)
+      : undefined;
+  }
+
+  private statusFrom(exception?: ControlledException): number {
+    if (typeof exception?.getStatus !== 'function') {
+      return HttpStatus.INTERNAL_SERVER_ERROR;
+    }
+    try {
+      const status = exception.getStatus();
+      return Number.isInteger(status)
+        ? status
+        : HttpStatus.INTERNAL_SERVER_ERROR;
+    } catch {
+      return HttpStatus.INTERNAL_SERVER_ERROR;
+    }
+  }
+
+  private responseFrom(exception?: ControlledException): unknown {
+    if (typeof exception?.getResponse !== 'function') return undefined;
+    try {
+      return exception.getResponse();
+    } catch {
+      return undefined;
+    }
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/main.ts

@@ -3,7 +3,7 @@ import './lib/tracing'; // OpenTelemetry Prisma instrumentation - 必须第一
 // 非终端环境禁用 ANSI 颜色，避免日志收集时出现裸转义码
 if (!process.stdout.isTTY) process.env.NO_COLOR = '1';
 
-import { AllExceptionsFilter, UserType } from '@gadmin2n/nest-common';
+import { UserType } from '@gadmin2n/nest-common';
 import {
   ClassSerializerInterceptor,
   UnauthorizedException,
@@ -13,6 +13,7 @@ import './alias.config';
 
 import { ConfigService } from '@nestjs/config';
 import { HttpAdapterHost, NestFactory, Reflector } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import {
   DocumentBuilder,
   SwaggerDocumentOptions,
@@ -22,7 +23,9 @@ import 'dotenv/config';
 import { PrismaClientExceptionFilter, PrismaService } from 'nestjs-prisma';
 import { AppModule } from './app.module';
 import AuthGuard from './lib/auth.guard';
+import { configureJsonBodyParser } from './lib/json-body-parser';
 import RolesGuard from './lib/roles.guard';
+import { StructuredAllExceptionsFilter } from './lib/structured-all-exceptions.filter';
 import { UserService } from './modules/user/user.service';
 import cookieParser = require('cookie-parser');
 
@@ -37,10 +40,13 @@ JSON.stringify = (value: any, _: any, space: string | number | undefined) => {
 };
 
 async function bootstrap() {
-  const app = await NestFactory.create(AppModule, {
+  const app = await NestFactory.create<NestExpressApplication>(AppModule, {
     cors: true,
     rawBody: true, // Required for HMAC verification on /api/workflow/webhook/:path
   });
+  // MyOA may deliver callback JSON as text/json instead of application/json.
+  // Keep the raw bytes so the same parser also remains usable for signed webhooks.
+  configureJsonBodyParser(app);
   // 添加全局前缀 '/api'
   app.setGlobalPrefix(`${process.env.DEPLOY_NAME || ''}/api`);
 
@@ -100,7 +106,7 @@ async function bootstrap() {
   const { httpAdapter } = app.get(HttpAdapterHost);
   app.useGlobalFilters(
     new PrismaClientExceptionFilter(httpAdapter),
-    new AllExceptionsFilter(),
+    new StructuredAllExceptionsFilter(),
   );
 
   // Swagger Api

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/approvalChannel/approval-channel.controller.ts

@@ -0,0 +1,89 @@
+import { ACGuard } from '@gadmin2n/nest-common';
+import {
+  Body,
+  Controller,
+  Get,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import { UseRoles } from 'nest-access-control';
+import {
+  actorContextFromRequest,
+  AuthenticatedActorRequest,
+} from '../subjectProvider/actor-context.util';
+import {
+  CreateApprovalChannelDto,
+  UpdateApprovalChannelDto,
+} from './approval-channel.dto';
+import { ApprovalChannelService } from './approval-channel.service';
+
+@ApiTags('approval-channels')
+@UseGuards(ACGuard)
+@Controller('approval-channels')
+export class ApprovalChannelController {
+  constructor(private readonly service: ApprovalChannelService) {}
+
+  @Get()
+  @UseRoles({
+    resource: 'approvalChannel',
+    action: 'read',
+    possession: 'any',
+  })
+  list(@Query('q') query?: string) {
+    return this.service.list(query?.trim() ?? '');
+  }
+
+  @Get('dispatch-workflows')
+  @UseRoles({
+    resource: 'approvalChannel',
+    action: 'read',
+    possession: 'any',
+  })
+  listDispatchWorkflows(
+    @Query('includeWorkflowId') includeWorkflowId?: string,
+  ) {
+    return this.service.listDispatchWorkflows(includeWorkflowId?.trim());
+  }
+
+  @Get(':code')
+  @UseRoles({
+    resource: 'approvalChannel',
+    action: 'read',
+    possession: 'any',
+  })
+  get(@Param('code') code: string) {
+    return this.service.get(code);
+  }
+
+  @Post()
+  @UseRoles({
+    resource: 'approvalChannel',
+    action: 'create',
+    possession: 'any',
+  })
+  create(
+    @Body() input: CreateApprovalChannelDto,
+    @Req() request: AuthenticatedActorRequest,
+  ) {
+    return this.service.create(input, actorContextFromRequest(request));
+  }
+
+  @Patch(':code')
+  @UseRoles({
+    resource: 'approvalChannel',
+    action: 'update',
+    possession: 'any',
+  })
+  update(
+    @Param('code') code: string,
+    @Body() input: UpdateApprovalChannelDto,
+    @Req() request: AuthenticatedActorRequest,
+  ) {
+    return this.service.update(code, input, actorContextFromRequest(request));
+  }
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/approvalChannel/approval-channel.dto.ts

@@ -0,0 +1,68 @@
+import { Type } from 'class-transformer';
+import {
+  IsBoolean,
+  IsInt,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  Matches,
+  MaxLength,
+  Min,
+} from 'class-validator';
+
+const CHANNEL_CODE_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/;
+const POSITIVE_BIGINT_PATTERN = /^[1-9]\d*$/;
+
+export class CreateApprovalChannelDto {
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(64)
+  @Matches(CHANNEL_CODE_PATTERN)
+  code?: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(128)
+  name!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(512)
+  description?: string;
+
+  @IsString()
+  @Matches(POSITIVE_BIGINT_PATTERN)
+  dispatchWorkflowId!: string;
+
+  @IsOptional()
+  @IsBoolean()
+  isEnabled?: boolean;
+}
+
+export class UpdateApprovalChannelDto {
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  expectedRevision!: number;
+
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(128)
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(512)
+  description?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @Matches(POSITIVE_BIGINT_PATTERN)
+  dispatchWorkflowId?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  isEnabled?: boolean;
+}