@gadmin2n/schematics 0.0.141 → 0.0.143

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflow.seed.ts

@@ -20,25 +20,26 @@ import { seedNodeTypes } from './workflow-node-types';
  * 业务数据 seed 函数仍来自 ./workflow-{node-types,workflows,event-trigger}.ts
  * （文件较大，保持独立但只被本入口 import，不再由 seed/index.ts 直接调用）。
  *
- * 前置：seedBootstrap 已建好 admin 与 SYSTEM_ADMIN。
+ * 前置：seedBootstrap 已建好 SYSTEM_ADMIN。
  */
 export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
   const role = await prisma.role.findUniqueOrThrow({
     where: { name: 'SYSTEM_ADMIN' },
   });
-  const admin = await prisma.page.findUniqueOrThrow({
-    where: { code: 'admin' },
-  });
 
-  // ── 父分组 page ────────────────────────────────────────────────────────────
-  const workflowPage = await upsertPage(prisma, {
-    code: 'workflow',
-    name: 'workflow',
-    zhName: 'Workflow',
-    enName: 'Workflow',
-    sortOrder: 1030,
-    parentId: admin.id,
-  });
+  // ── 父分组 page（与 admin 平级的顶级菜单） ─────────────────────────────────
+  const workflowPage = await upsertPage(
+    prisma,
+    {
+      code: 'workflow',
+      name: 'workflow',
+      zhName: 'Workflow',
+      enName: 'Workflow',
+      sortOrder: 1030,
+    },
+    // 从「系统管理」子菜单提升为顶级菜单：同步 parentId/排序到已有 DB
+    { parentId: null, sortOrder: 1030 },
+  );
   console.log(`[workflow] Page: ${workflowPage.code} (id=${workflowPage.id})`);
 
   // ── leaf pages + resource 绑定 ─────────────────────────────────────────────
@@ -82,20 +83,11 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       resourceCode: 'temporalTenantConfig',
       resourceDescription: 'Temporal tenant config management',
     },
-    {
-      code: 'workflow_approval_channels',
-      zhName: '审批通道',
-      enName: 'Approval Channels',
-      sortOrder: 5,
-      resourceCode: 'approvalChannel',
-      resourceDescription:
-        'Reusable dispatch and callback workflows for external approvals',
-    },
     {
       code: 'approval_tasks',
       zhName: '审批任务',
       enName: 'Approval Tasks',
-      sortOrder: 6,
+      sortOrder: 5,
       resourceCode: 'humanApproval',
       resourceDescription: 'Read and decide assigned Human Approval tasks',
     },
@@ -185,10 +177,7 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
   const connectionsPage = allPages.find(
     (page) => page.code === 'workflow_connections',
   );
-  const approvalChannelsPage = allPages.find(
-    (page) => page.code === 'workflow_approval_channels',
-  );
-  if (nodeTemplatePage && connectionsPage && approvalChannelsPage) {
+  if (nodeTemplatePage && connectionsPage) {
     const authorRoles = await prisma.rolePages.findMany({
       where: { pageId: nodeTemplatePage.id },
       select: { roleId: true },
@@ -197,10 +186,6 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       prisma,
       connectionsPage.id,
     );
-    const approvalChannelResourceIds = await getPageResourceIds(
-      prisma,
-      approvalChannelsPage.id,
-    );
     for (const { roleId } of authorRoles) {
       await grantRoleAccess(
         prisma,
@@ -211,15 +196,6 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       console.log(
         `[workflow] Grant: role#${roleId} → workflow_connections (inherits Node Template access)`,
       );
-      await grantRoleAccess(
-        prisma,
-        roleId,
-        approvalChannelsPage.id,
-        approvalChannelResourceIds,
-      );
-      console.log(
-        `[workflow] Grant: role#${roleId} → workflow_approval_channels (inherits Node Template access)`,
-      );
     }
   }
 

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflows.ts

@@ -40,26 +40,18 @@ const WORKFLOWS = [
           position: { x: 850, y: 200 },
           config: {},
         },
-        {
-          id: 'action_4',
-          type: 'send_notification',
-          label: '发送通知',
-          position: { x: 1100, y: 200 },
-          config: {},
-        },
       ],
       edges: [
         { id: 'e-trigger_1-action_1', source: 'trigger_1', target: 'action_1' },
         { id: 'e-action_1-action_2', source: 'action_1', target: 'action_2' },
         { id: 'e-action_2-action_3', source: 'action_2', target: 'action_3' },
-        { id: 'e-action_3-action_4', source: 'action_3', target: 'action_4' },
       ],
     },
   },
   {
     code: 'user_reg_approval',
     name: '新用户注册审批',
-    description: '新用户注册后触发审批流程，管理员审批通过后发送欢迎邮件',
+    description: '新用户注册后触发审批流程，管理员审批通过后激活用户',
     status: 'PUBLISHED' as const,
     isEnabled: true,
     creator: 'admin',
@@ -71,13 +63,6 @@ const WORKFLOWS = [
           label: 'Webhook 接收注册',
           position: { x: 100, y: 200 },
         },
-        {
-          id: 'action_1',
-          type: 'set_variable',
-          label: '提取用户信息',
-          position: { x: 350, y: 200 },
-          config: {},
-        },
         {
           id: 'approval_1',
           type: 'approval',
@@ -99,26 +84,11 @@ const WORKFLOWS = [
           position: { x: 1100, y: 100 },
           config: {},
         },
-        {
-          id: 'action_3',
-          type: 'send_notification',
-          label: '发送欢迎邮件',
-          position: { x: 1350, y: 100 },
-          config: {},
-        },
-        {
-          id: 'action_4',
-          type: 'send_notification',
-          label: '发送拒绝通知',
-          position: { x: 1100, y: 300 },
-          config: {},
-        },
       ],
       edges: [
-        { id: 'e-trigger_1-action_1', source: 'trigger_1', target: 'action_1' },
         {
-          id: 'e-action_1-approval_1',
-          source: 'action_1',
+          id: 'e-trigger_1-approval_1',
+          source: 'trigger_1',
           target: 'approval_1',
         },
         {
@@ -132,20 +102,13 @@ const WORKFLOWS = [
           target: 'action_2',
           label: 'true',
         },
-        {
-          id: 'e-condition_1-action_4',
-          source: 'condition_1',
-          target: 'action_4',
-          label: 'false',
-        },
-        { id: 'e-action_2-action_3', source: 'action_2', target: 'action_3' },
       ],
     },
   },
   {
     code: 'error_monitor_alert',
     name: '异常监控告警',
-    description: '监听系统事件，当错误率超过阈值时触发告警通知',
+    description: '监听系统事件并记录异常监控结果',
     status: 'PUBLISHED' as const,
     isEnabled: true,
     creator: 'system',
@@ -172,13 +135,6 @@ const WORKFLOWS = [
           position: { x: 600, y: 200 },
           config: {},
         },
-        {
-          id: 'action_2',
-          type: 'send_notification',
-          label: '发送告警',
-          position: { x: 850, y: 100 },
-          config: {},
-        },
         {
           id: 'action_3',
           type: 'code',
@@ -194,12 +150,6 @@ const WORKFLOWS = [
           source: 'action_1',
           target: 'condition_1',
         },
-        {
-          id: 'e-condition_1-action_2',
-          source: 'condition_1',
-          target: 'action_2',
-          label: 'true',
-        },
         {
           id: 'e-condition_1-action_3',
           source: 'condition_1',
@@ -212,7 +162,7 @@ const WORKFLOWS = [
   {
     code: 'batch_data_export',
     name: '批量数据导出',
-    description: '手动触发导出指定表的数据为CSV文件并发送邮件',
+    description: '手动触发导出指定表的数据为 CSV 文件',
     status: 'DRAFT' as const,
     isEnabled: false,
     creator: 'admin',
@@ -245,19 +195,11 @@ const WORKFLOWS = [
           position: { x: 850, y: 200 },
           config: {},
         },
-        {
-          id: 'action_3',
-          type: 'send_notification',
-          label: '发送邮件',
-          position: { x: 1100, y: 200 },
-          config: {},
-        },
       ],
       edges: [
         { id: 'e-trigger_1-action_1', source: 'trigger_1', target: 'action_1' },
         { id: 'e-action_1-loop_1', source: 'action_1', target: 'loop_1' },
         { id: 'e-loop_1-action_2', source: 'loop_1', target: 'action_2' },
-        { id: 'e-action_2-action_3', source: 'action_2', target: 'action_3' },
       ],
     },
   },
@@ -304,13 +246,6 @@ const WORKFLOWS = [
           position: { x: 850, y: 300 },
           config: {},
         },
-        {
-          id: 'action_3',
-          type: 'send_notification',
-          label: '部署完成通知',
-          position: { x: 1100, y: 200 },
-          config: {},
-        },
       ],
       edges: [
         {
@@ -333,16 +268,13 @@ const WORKFLOWS = [
           source: 'approval_1',
           target: 'action_2',
         },
-        { id: 'e-action_1-action_3', source: 'action_1', target: 'action_3' },
-        { id: 'e-action_2-action_3', source: 'action_2', target: 'action_3' },
       ],
     },
   },
   {
     code: 'user_role_change',
-    name: '用户角色变更通知',
-    description:
-      '当 t_admin_user_role 表中用户角色发生变更时，记录审计日志并通知相关人员',
+    name: '用户角色变更审计',
+    description: '当 t_admin_user_role 表中用户角色发生变更时，记录审计日志',
     status: 'PUBLISHED' as const,
     isEnabled: true,
     creator: 'admin',
@@ -386,17 +318,6 @@ const WORKFLOWS = [
             ],
           },
         },
-        {
-          id: 'action_3',
-          type: 'send_notification',
-          label: '发送安全告警',
-          position: { x: 1100, y: 100 },
-          config: {
-            channel: 'wecom',
-            recipients: ['security-team'],
-            message: '用户 {{username}} 被授予 SYSTEM_ADMIN 角色',
-          },
-        },
         {
           id: 'action_4',
           type: 'db_execute',
@@ -414,9 +335,9 @@ const WORKFLOWS = [
           target: 'condition_1',
         },
         {
-          id: 'e-condition_1-action_3',
+          id: 'e-condition_1-action_4-true',
           source: 'condition_1',
-          target: 'action_3',
+          target: 'action_4',
           label: 'true',
         },
         {
@@ -425,15 +346,13 @@ const WORKFLOWS = [
           target: 'action_4',
           label: 'false',
         },
-        { id: 'e-action_3-action_4', source: 'action_3', target: 'action_4' },
       ],
     },
   },
   {
     code: 'event_remind_sync',
     name: 'Event活动提醒与同步',
-    description:
-      '当 t_event 表新增活动或活动即将开始时，自动同步到 ServiceNow 并通知参与人员',
+    description: '当 t_event 表新增活动或活动即将开始时，自动同步到 ServiceNow',
     status: 'PUBLISHED' as const,
     isEnabled: true,
     creator: 'admin',
@@ -504,17 +423,6 @@ const WORKFLOWS = [
           position: { x: 1600, y: 80 },
           config: { operation: 'update', table: 't_event', where: 'id = $1' },
         },
-        {
-          id: 'action_4',
-          type: 'send_notification',
-          label: '通知OIT负责人',
-          position: { x: 1350, y: 250 },
-          config: {
-            channel: 'email',
-            message:
-              '活动 {{currentItem.city}} - {{currentItem.eventType}} 将于 {{currentItem.start_date}} 开始',
-          },
-        },
         {
           id: 'action_5',
           type: 'code',
@@ -551,14 +459,7 @@ const WORKFLOWS = [
           target: 'action_2',
           label: 'false',
         },
-        {
-          id: 'e-condition_2-action_4',
-          source: 'condition_2',
-          target: 'action_4',
-          label: 'true',
-        },
         { id: 'e-action_2-action_3', source: 'action_2', target: 'action_3' },
-        { id: 'e-action_3-action_4', source: 'action_3', target: 'action_4' },
       ],
     },
   },
@@ -566,7 +467,7 @@ const WORKFLOWS = [
     code: 'new_user_onboard',
     name: '新增用户自动化流程',
     description:
-      '当 t_admin_user_role 新增用户时，自动分配默认角色、同步到外部系统并发送欢迎通知',
+      '当 t_admin_user_role 新增用户时，自动分配默认角色、同步到外部系统并记录审计日志',
     status: 'PUBLISHED' as const,
     isEnabled: true,
     creator: 'admin',
@@ -632,18 +533,6 @@ const WORKFLOWS = [
             method: 'POST',
           },
         },
-        {
-          id: 'action_5',
-          type: 'send_notification',
-          label: '发送欢迎通知',
-          position: { x: 1350, y: 200 },
-          config: {
-            channel: 'wecom',
-            recipients: ['{{userid}}'],
-            message:
-              '欢迎加入系统！您的初始角色为 GUEST，如需更多权限请联系管理员。',
-          },
-        },
         {
           id: 'action_6',
           type: 'db_execute',
@@ -677,8 +566,7 @@ const WORKFLOWS = [
           label: 'false',
         },
         { id: 'e-action_3-action_4', source: 'action_3', target: 'action_4' },
-        { id: 'e-action_4-action_5', source: 'action_4', target: 'action_5' },
-        { id: 'e-action_5-action_6', source: 'action_5', target: 'action_6' },
+        { id: 'e-action_4-action_6', source: 'action_4', target: 'action_6' },
       ],
     },
   },

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/app.module.ts

@@ -23,6 +23,7 @@ import { HealthModule } from './modules/health/health.module';
 import { RoleModule } from './modules/role/role.module';
 import { RoleService } from './modules/role/role.service';
 import { RolesRefresherService } from './modules/role/roles-refresher.service';
+import { WorkflowRuntimeConfigModule } from './modules/workflowRuntimeConfig/workflowRuntimeConfig.module';
 
 @Module({
   imports: [
@@ -84,6 +85,8 @@ import { RolesRefresherService } from './modules/role/roles-refresher.service';
       ttl: 5 * 60 * 1000, // 5 minutes
     }),
 
+    WorkflowRuntimeConfigModule,
+
     ...modules,
     AgendaModule,
     HealthModule,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/config/index.ts

@@ -53,7 +53,6 @@ const config: Record<string, any> = {
     address: 'http://127.0.0.1:3000/upload/',
     maxSize: 1024 * 1024 * 10,
   },
-  humanApprovalRuntime: runtimeConfig(),
   workflow: {
     publicBaseUrl: process.env.WORKFLOW_PUBLIC_BASE_URL ?? '',
     publicHost: process.env.WORKFLOW_PUBLIC_HOST ?? '',
@@ -63,24 +62,4 @@ const config: Record<string, any> = {
   },
 };
 
-function runtimeConfig() {
-  const rawEnabled =
-    process.env.WORKFLOW_RUNTIME_ENABLED ??
-    process.env.HUMAN_APPROVAL_RUNTIME_ENABLED;
-  if (rawEnabled !== undefined && !['true', 'false'].includes(rawEnabled))
-    throw new Error('WORKFLOW_RUNTIME_ENABLED must be exactly true or false');
-  const enabled = rawEnabled === 'true';
-  const token = process.env.WORKFLOW_RUNTIME_TOKEN ?? '';
-  if (enabled && token.length < 32)
-    throw new Error(
-      'WORKFLOW_RUNTIME_TOKEN must contain at least 32 characters when Workflow runtime is enabled',
-    );
-  const tenantNamespace = process.env.GADMIN_TENANT_NAMESPACE ?? '';
-  if (enabled && !tenantNamespace)
-    throw new Error(
-      'GADMIN_TENANT_NAMESPACE is required when Workflow runtime is enabled',
-    );
-  return { enabled, token, tenantNamespace };
-}
-
 export default () => config;

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/codeRuntime/code-runtime.controller.ts

@@ -6,10 +6,10 @@ import {
   Post,
   UseGuards,
 } from '@nestjs/common';
-import { ConfigService } from '@nestjs/config';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { RuntimeTokenGuard } from '../humanApproval/runtime/runtime-token.guard';
+import { WorkflowRuntimeConfigService } from '../workflowRuntimeConfig/workflow-runtime-config.service';
 import { CodeNodeConfig, executeCode } from './code-executor';
 import { ExecuteCodeRuntimeDto } from './code-runtime.dto';
 
@@ -18,20 +18,13 @@ import { ExecuteCodeRuntimeDto } from './code-runtime.dto';
 export class CodeRuntimeController {
   constructor(
     private readonly prisma: PrismaService,
-    private readonly config: ConfigService,
+    private readonly runtimeConfig: WorkflowRuntimeConfigService,
   ) {}
 
   @Post('execute')
   @AllowUnauthorizedRequest()
   async execute(@Body() input: ExecuteCodeRuntimeDto) {
-    const runtime = this.config.get<{ tenantNamespace: string }>(
-      'humanApprovalRuntime',
-    );
-    if (input.tenantNamespace !== runtime?.tenantNamespace)
-      throw runtimeError(
-        'WORKFLOW_RUNTIME_TENANT_MISMATCH',
-        'Runtime tenant does not match this application',
-      );
+    await this.runtimeConfig.assertTenant(input.tenantNamespace);
 
     const instanceId = parseId(input.workflowInstanceId);
     const versionId = parseId(input.workflowVersionId);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/codeRuntime/codeRuntime.module.ts

@@ -1,5 +1,4 @@
 import { Injectable, Module, OnModuleInit } from '@nestjs/common';
-import { RuntimeTokenGuard } from '../humanApproval/runtime/runtime-token.guard';
 import { WidgetCatalogService } from '../workflowConfig/widget-catalog.service';
 import { WorkflowConfigModule } from '../workflowConfig/workflowConfig.module';
 import { CodeRuntimeController } from './code-runtime.controller';
@@ -16,6 +15,6 @@ class CodeWidgetRegistrar implements OnModuleInit {
 @Module({
   imports: [WorkflowConfigModule],
   controllers: [CodeRuntimeController],
-  providers: [RuntimeTokenGuard, CodeWidgetRegistrar],
+  providers: [CodeWidgetRegistrar],
 })
 export class CodeRuntimeModule {}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/externalInteraction/external-callback.controller.spec.ts

@@ -0,0 +1,48 @@
+import { ExternalCallbackController } from './external-callback.controller';
+
+describe('ExternalCallbackController', () => {
+  it('extracts the callback token from MyOA data and submits the raw callback', async () => {
+    const interactions = {
+      submitResult: jest.fn().mockResolvedValue({ accepted: true }),
+    };
+    const controller = new ExternalCallbackController(
+      interactions as any,
+      {
+        getRequired: jest.fn().mockResolvedValue({ namespace: 'tenant-a' }),
+      } as any,
+    );
+    const body = {
+      id: 'workitem-1',
+      status: 'approved',
+      data: [
+        { key: 'business_id', value: ['SO-1'] },
+        { key: 'gadmin_callback_token', value: ['ext_cb_approval'] },
+      ],
+    };
+
+    await expect(
+      controller.receive(body, { 'content-type': 'text/json' }),
+    ).resolves.toEqual({ accepted: true });
+    expect(interactions.submitResult).toHaveBeenCalledWith('tenant-a', {
+      callbackToken: 'ext_cb_approval',
+      eventId: 'external:workitem-1',
+      outcome: 'RECEIVED',
+      data: { callback: body, contentType: 'text/json' },
+    });
+  });
+
+  it('rejects a callback without the one-time token', async () => {
+    const controller = new ExternalCallbackController(
+      { submitResult: jest.fn() } as any,
+      {
+        getRequired: jest.fn().mockResolvedValue({ namespace: 'tenant-a' }),
+      } as any,
+    );
+
+    await expect(
+      controller.receive({ id: 'workitem-1' }, {}),
+    ).rejects.toMatchObject({
+      response: { code: 'EXTERNAL_CALLBACK_TOKEN_MISSING' },
+    });
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/externalInteraction/external-callback.controller.ts

@@ -0,0 +1,96 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Headers,
+  Post,
+} from '@nestjs/common';
+import { createHash } from 'node:crypto';
+import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { WorkflowRuntimeConfigService } from '../workflowRuntimeConfig/workflow-runtime-config.service';
+import { ExternalInteractionService } from './external-interaction.service';
+
+@Controller('workflow/external-callback')
+export class ExternalCallbackController {
+  constructor(
+    private readonly interactions: ExternalInteractionService,
+    private readonly runtimeConfig: WorkflowRuntimeConfigService,
+  ) {}
+
+  @Post()
+  @AllowUnauthorizedRequest()
+  async receive(
+    @Body() body: unknown,
+    @Headers() headers: Record<string, string | string[] | undefined>,
+  ) {
+    const callbackToken = extractCallbackToken(body);
+    if (!callbackToken)
+      throw new BadRequestException({
+        code: 'EXTERNAL_CALLBACK_TOKEN_MISSING',
+        message: '回调数据中缺少 gadmin_callback_token',
+      });
+    const runtime = await this.runtimeConfig.getRequired();
+    return this.interactions.submitResult(runtime.namespace, {
+      callbackToken,
+      eventId: externalEventId(body),
+      outcome: 'RECEIVED',
+      data: {
+        callback: body,
+        contentType: headerValue(headers['content-type']),
+      },
+    });
+  }
+}
+
+function extractCallbackToken(value: unknown): string | undefined {
+  const body = asObject(value);
+  if (typeof body.callbackToken === 'string' && body.callbackToken.trim())
+    return body.callbackToken.trim();
+
+  const data = body.data;
+  if (Array.isArray(data)) {
+    for (const rawItem of data) {
+      const item = asObject(rawItem);
+      if (item.key !== 'gadmin_callback_token') continue;
+      const token = Array.isArray(item.value) ? item.value[0] : item.value;
+      if (typeof token === 'string' && token.trim()) return token.trim();
+    }
+  }
+  const dataObject = asObject(data);
+  const nested = dataObject.gadmin_callback_token;
+  if (typeof nested === 'string' && nested.trim()) return nested.trim();
+  if (Array.isArray(nested) && typeof nested[0] === 'string')
+    return nested[0].trim() || undefined;
+  return undefined;
+}
+
+function externalEventId(body: unknown): string {
+  const value = asObject(body);
+  for (const key of [
+    'eventId',
+    'event_id',
+    'id',
+    'workitemId',
+    'workitem_id',
+  ]) {
+    const candidate = value[key];
+    if (
+      (typeof candidate === 'string' || typeof candidate === 'number') &&
+      String(candidate).trim()
+    )
+      return `external:${String(candidate).trim()}`;
+  }
+  return `external:${createHash('sha256')
+    .update(JSON.stringify(body ?? null))
+    .digest('hex')}`;
+}
+
+function headerValue(value: string | string[] | undefined): string | undefined {
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function asObject(value: unknown): Record<string, any> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, any>)
+    : {};
+}