@gadmin2n/schematics 0.0.146 → 0.0.148

package/dist/lib/application/files/gadmin2-game-angle-demo/CODEBUDDY.local.md

@@ -0,0 +1,8 @@
+## 与 Gadmin2 模板的关系
+
+本项目（gadmin-test）是 gadmin2 模板的**实例项目**，用于日常迭代新功能。迭代完成后需将新特性合并回 gadmin2 模板。
+
+| | 路径 |
+|------|------|
+| 实例（本项目） | `/Users/kavenma/Documents/work/code/oit/test/gadmin-test` |
+| 模板（上游） | `/Users/kavenma/Documents/work/code/common/gadmin2/schematics/src/lib/application/files/gadmin2-game-angle-demo` |

package/dist/lib/application/files/gadmin2-game-angle-demo/CODEBUDDY.md

@@ -0,0 +1,70 @@
+## 项目简介
+- 本项目由 lowcode 生成工具 Gadmin2 生成：Admin page(CRUD) + Dashboard，包括前端和后端。
+- 前端的 Admin page(CRUD) 代码由配置（`config/ui/{ModelName}.ts`）驱动生成，后端的数据模型和 CRUD 代码由 prisma schema（`config/prisma/{module}.prisma`）驱动生成。
+
+## 常用命令
+
+```bash
+# 改了 config/prisma/*.prisma —— 迁移数据库 + 生成前后端代码
+gadmin2 g prisma:dev
+
+# 只改了 config/ui/*.ts —— 只生成代码，不碰数据库
+gadmin2 g prisma
+
+cd server && yarn start:dev   # 后端，端口 8000（优先读 server/.env.local）
+cd web && yarn dev            # 前端，端口 3000（注意web/ 用 yarn，不用 npm）
+cd server && yarn seed # 执行 seed（页面/资源/权限声明）
+```
+
+> gadmin2 命令需要在项目根目录执行
+
+## Architecture Overview
+
+### Frontend Tech Stack
+React 18, TypeScript, Vite, Ant Design v5, Refinedev, ECharts, i18next
+
+```
+web/src/
+├── routes/         #页面模块：user/、role/ 等
+├── components/     # 共享 UI 组件（PageHeader、RowActions、SearchBar 等）
+├── hooks/          # 自定义 hooks（useECharts、useDynamicResources、useListPageState 等）
+├── providers/      # auth / data / access control provider
+├── config/         # routeRegistry.tsx（路由注册）、http.ts
+├── constants/# layout.ts（页面布局共享常量）
+├── enums/          # 共享枚举
+└── helpers/        # 工具函数（http.ts的 customRequest 等）
+```
+
+### Backend Tech Stack
+NestJS v10, Prisma v6, TypeScript, nest-access-control, Winston logger
+
+```
+server/src/
+├── modules/        # 业务模块，每个含 Module → Controller → Service
+├── generated/      # Prisma 自动生成（禁止直接修改）
+├── lib/            # 核心：auth.guard.ts、roles.guard.ts、taihu.ts、woaAuth.ts、logger.ts
+├── enums/          # 共享枚举
+└── utils/          # 工具函数
+```
+
+### Permission Model (RBAC)
+参考 `.agent/references/permission-model.md`
+
+### 数据库迁移、dev/prod 模式差异、认证绕过等本地开发
+细节见 `.agent/references/local-dev.md`。
+
+### playwright 无头浏览器访问项目页面
+用 `server/scripts/gen-jwt.ts` 生成临时 token。
+
+## 开发原则（必须遵守）
+- 使用 TypeScript 严格模式
+- 严格遵循前、后端既有技术栈，如无必要不要引入新库
+- 不确定时询问，不要猜；存在歧义时不要默默选择；有更简单的方案要说出来
+- 修改 config/ui/ 或 config/prisma/ 配置后，必须在**项目根目录**执行生成命令 `gadmin2 g prisma` 或者 `gadmin2 g prisma:dev`。
+- 修改 config/prisma/ 后必须同步检查 server/seed/：raw SQL 引用的列/表、seed 数据的必填字段与字段名要与新 schema 一致，改完需要提醒开发者 yarn seed 验证。
+- **优先使用 skill 解决问题** skill 的决策逻辑（配置优先、DB 先于页面等）见 `.agent/references/decision-map.md`
+- **默认业务代码范围：** 前端修改限定在 `web/src/routes/`，后端修改限定在 `server/src/modules/`、`server/seed/`。
+- **配置驱动源码：** `config/prisma/`、`config/ui/` 可按生成流程修改；标准 CRUD 优先改配置，不要绕过配置直接改生成物。
+- **跨切面窄白名单：** `web/src/config/routeRegistry.tsx` 仅可用于注册自定义路由。
+- skill 中列出的目标文件不会自动扩大修改权限。除上述范围外，修改 `web/src/components/`、`web/src/hooks/`、`web/src/constants/`、`web/src/providers/`、全局认证文件，以及 `server/src/lib/`、`server/src/app.module.ts`、`server/src/main.ts` 等跨切面文件，必须由用户明确要求或确认具体实施计划，并限定为最小必要改动。
+- **生成目录禁止直接修改：** `web/src/generated/`、`server/src/generated/` 只能由生成命令更新。

package/dist/lib/application/files/gadmin2-game-angle-demo/config/prisma/workflow.prisma

@@ -149,6 +149,7 @@ model WorkflowInstance {
   retryFromNodeId String?                @db.VarChar(64) @map("retry_from_node_id") // 本实例从哪个失败节点继续执行
   cancellationStatus WorkflowCancellationStatus @default(NONE) @map("cancellation_status")
   cancellationRequestedAt DateTime?      @map("cancellation_requested_at") @db.Timestamptz(3)
+  cancellationRequestedBy String?        @map("cancellation_requested_by") @db.VarChar(128)
   cancellationReason String?             @map("cancellation_reason") @db.VarChar(512)
   cancellationLastError String?          @map("cancellation_last_error") @db.Text
   cancellationBlockedAt DateTime?        @map("cancellation_blocked_at") @db.Timestamptz(3)

package/dist/lib/application/files/gadmin2-game-angle-demo/gitignore

@@ -59,3 +59,4 @@ docs/
 agent-eval/runs/
 agent-eval/baseline/
 tmp/
+CODEBUDDY.local.md

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/permission.seed.ts

@@ -12,8 +12,9 @@ import {
  *
  * 职责（仅本模块自家）：
  *   1. permission 父分组 page (顶级 admin/administration → permission)
- *   2. 5 个 leaf page: permission_readme / user / role / page / resource
- *   3. 7 个 resource: user / role / rolePages / roleResource / page / pageResource / resource
+ *   2. 7 个 leaf page: permission_readme / person_directory / user /
+ *      people_group / role / page / resource
+ *   3. permission 模块所需 resource 及页面绑定
  *   4. PageResource 绑定（page ↔ resource，多对多）
  *   5. SYSTEM_ADMIN 对上述全部 page + resource 的全量授权
  *
@@ -54,14 +55,31 @@ export async function seedPermissionModule(
       enName: 'Menu Guide',
       sortOrder: 1005,
     },
-    { code: 'user', zhName: '用户管理', enName: 'User Mgnt', sortOrder: 1010 },
-    { code: 'role', zhName: '角色管理', enName: 'Role Mgnt', sortOrder: 1020 },
-    { code: 'page', zhName: '页面管理', enName: 'Page Mgnt', sortOrder: 1030 },
+    {
+      code: 'person_directory',
+      zhName: '人员目录',
+      enName: 'People Directory',
+      sortOrder: 1010,
+    },
+    {
+      code: 'user',
+      zhName: '访问授权',
+      enName: 'Access Grants',
+      sortOrder: 1020,
+    },
+    {
+      code: 'people_group',
+      zhName: '人员组',
+      enName: 'People Groups',
+      sortOrder: 1030,
+    },
+    { code: 'role', zhName: '角色管理', enName: 'Role Mgnt', sortOrder: 1040 },
+    { code: 'page', zhName: '页面管理', enName: 'Page Mgnt', sortOrder: 1050 },
     {
       code: 'resource',
       zhName: '资源管理',
       enName: 'Resource Management',
-      sortOrder: 1040,
+      sortOrder: 1060,
     },
   ];
 
@@ -69,14 +87,23 @@ export async function seedPermissionModule(
   pagesByCode.set(permissionPage.code, permissionPage.id);
 
   for (const def of leafDefs) {
-    const p = await upsertPage(prisma, {
-      code: def.code,
-      name: def.code,
-      zhName: def.zhName,
-      enName: def.enName,
-      sortOrder: def.sortOrder,
-      parentId: permissionPage.id,
-    });
+    const p = await upsertPage(
+      prisma,
+      {
+        code: def.code,
+        name: def.code,
+        zhName: def.zhName,
+        enName: def.enName,
+        sortOrder: def.sortOrder,
+        parentId: permissionPage.id,
+      },
+      {
+        zhName: def.zhName,
+        enName: def.enName,
+        sortOrder: def.sortOrder,
+        parentId: permissionPage.id,
+      },
+    );
     pagesByCode.set(p.code, p.id);
     console.log(`[permission] Page: ${p.code} (id=${p.id})`);
   }
@@ -87,7 +114,32 @@ export async function seedPermissionModule(
     description: string;
     pageCode: string;
   }[] = [
-    { code: 'user', description: 'User management', pageCode: 'user' },
+    {
+      code: 'user',
+      description: 'People directory',
+      pageCode: 'person_directory',
+    },
+    {
+      code: 'staffDirectory',
+      description: 'Search the shared staff directory',
+      pageCode: 'person_directory',
+    },
+    { code: 'user', description: 'Access grants', pageCode: 'user' },
+    {
+      code: 'userGroup:read',
+      description: 'Read reusable people groups',
+      pageCode: 'people_group',
+    },
+    {
+      code: 'userGroup:create',
+      description: 'Maintain reusable people groups',
+      pageCode: 'people_group',
+    },
+    {
+      code: 'user',
+      description: 'Read people for group membership',
+      pageCode: 'people_group',
+    },
     { code: 'role', description: 'Role management', pageCode: 'role' },
     {
       code: 'rolePages',

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflow-node-types.ts

@@ -980,7 +980,11 @@ const HUMAN_APPROVAL_CONFIG_SCHEMA: NodeTypeSeed['configSchema'] = {
         type: 'object',
         properties: {
           source: { type: 'string', enum: ['STATIC', 'DYNAMIC'] },
-          provider: { type: 'string', enum: ['USER', 'USER_GROUP'] },
+          provider: {
+            type: 'string',
+            enum: ['USER', 'USER_GROUP'],
+            default: 'USER',
+          },
           refs: {
             type: 'array',
             minItems: 1,
@@ -998,7 +1002,7 @@ const HUMAN_APPROVAL_CONFIG_SCHEMA: NodeTypeSeed['configSchema'] = {
             additionalProperties: false,
           },
         },
-        required: ['source', 'provider'],
+        required: ['source'],
         allOf: [
           {
             if: { properties: { source: { const: 'STATIC' } } },
@@ -1093,7 +1097,7 @@ const humanApprovalNode: NodeTypeSeed = {
   configSchema: HUMAN_APPROVAL_CONFIG_SCHEMA,
   outputs: ['true', 'false'],
   runtimeKey: 'human_approval',
-  schemaVersion: 20,
+  schemaVersion: 22,
   instancePolicy: 'OPTIONAL',
   uiSchema: HUMAN_APPROVAL_UI_SCHEMA,
 };
@@ -1361,7 +1365,16 @@ export const NODE_TYPES: NodeTypeSeed[] = [
 
 export async function seedNodeTypes(prisma: PrismaClient) {
   console.log('Seeding workflow node types...');
-  for (const removedType of ['return_result', 'db_query']) {
+  for (const removedType of [
+    'return_result',
+    'db_query',
+    'approval_request_trigger',
+    'send_notification',
+    'set_variable',
+    'submit_approval_result',
+    'submit_external_result',
+    'error_handler',
+  ]) {
     const removedNodeType = await prisma.workflowNodeType.findUnique({
       where: { type: removedType },
       select: { id: true },

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/config/index.ts

@@ -60,6 +60,11 @@ const config: Record<string, any> = {
   integration: {
     secretKey: process.env.INTEGRATION_SECRET_KEY ?? '',
   },
+  staffDirectory: {
+    baseUrl: process.env.STAFF_DIRECTORY_BASE_URL ?? '',
+    apiKey: process.env.STAFF_DIRECTORY_API_KEY ?? '',
+    searchPath: process.env.STAFF_DIRECTORY_SEARCH_PATH ?? '/api/staff/search',
+  },
 };
 
 export default () => config;

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/structured-all-exceptions.filter.spec.ts

@@ -1,4 +1,5 @@
 import { ArgumentsHost, BadRequestException } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
 import { StructuredAllExceptionsFilter } from './structured-all-exceptions.filter';
 
 function httpHost(url = '/api/workflowNodeInstance') {
@@ -51,4 +52,27 @@ describe('StructuredAllExceptionsFilter', () => {
       path: '/api/workflowNodeInstance',
     });
   });
+
+  it('returns a safe 409 response for an unhandled Prisma unique conflict', () => {
+    const filter = new StructuredAllExceptionsFilter();
+    const structured = httpHost('/api/user/createOne');
+
+    filter.catch(
+      new Prisma.PrismaClientKnownRequestError('sensitive database details', {
+        code: 'P2002',
+        clientVersion: '6.19.3',
+        meta: { target: ['userid'] },
+      }),
+      structured.host,
+    );
+
+    expect(structured.response.status).toHaveBeenCalledWith(409);
+    expect(structured.response.json).toHaveBeenCalledWith({
+      statusCode: 409,
+      code: 'RESOURCE_ALREADY_EXISTS',
+      message: '记录已存在，请勿重复提交',
+      error: 'Conflict',
+      path: '/api/user/createOne',
+    });
+  });
 });

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/lib/structured-all-exceptions.filter.ts

@@ -4,6 +4,7 @@ import {
   ExceptionFilter,
   HttpStatus,
 } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
 
 interface ControlledException {
   getStatus?: () => number;
@@ -24,6 +25,20 @@ export class StructuredAllExceptionsFilter implements ExceptionFilter {
     const error = controlled?.name ?? 'Error';
     const path = request.url ?? '';
 
+    if (
+      exception instanceof Prisma.PrismaClientKnownRequestError &&
+      exception.code === 'P2002'
+    ) {
+      response.status(HttpStatus.CONFLICT).json({
+        statusCode: HttpStatus.CONFLICT,
+        code: 'RESOURCE_ALREADY_EXISTS',
+        message: '记录已存在，请勿重复提交',
+        error: 'Conflict',
+        path,
+      });
+      return;
+    }
+
     if (isRecord(payload)) {
       response.status(statusCode).json({
         ...payload,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/codeRuntime/code-runtime.controller.spec.ts

@@ -28,12 +28,11 @@ describe('CodeRuntimeController', () => {
                   subjects: [
                     {
                       source: 'DYNAMIC',
-                      provider: 'USER',
                       inputKey: 'direct_manager',
                       lookup: {
                         result: {
                           script:
-                            "return { subjects: [{ provider: 'USER', refs: [response.data.leader] }], requester: input.user_id };",
+                            'return [response.data.leader, input.user_id];',
                         },
                       },
                     },
@@ -89,10 +88,7 @@ describe('CodeRuntimeController', () => {
         workflow: {},
       }),
     ).resolves.toEqual({
-      result: {
-        subjects: [{ provider: 'USER', refs: ['leader-a'] }],
-        requester: 'applicant-a',
-      },
+      result: ['leader-a', 'applicant-a'],
     });
   });
 });

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/approval-subject-source.util.spec.ts

@@ -5,36 +5,22 @@ describe('materializeApprovalSubjects', () => {
     expect(
       materializeApprovalSubjects(
         [
-          { source: 'STATIC', provider: 'USER', refs: ['alice'] },
+          { source: 'STATIC', refs: ['alice', 'bob'] },
           {
             source: 'DYNAMIC',
-            provider: 'USER',
             inputKey: 'request_owner',
           },
           {
             source: 'DYNAMIC',
-            provider: 'USER_GROUP',
-            inputKey: 'review_groups',
+            inputKey: 'backup_approvers',
           },
         ],
         {
-          request_owner: {
-            subjects: [{ provider: 'USER', refs: ['bob'] }],
-          },
-          review_groups: {
-            subjects: [
-              {
-                provider: 'USER_GROUP',
-                refs: ['finance', 'risk', 'finance'],
-              },
-            ],
-          },
+          request_owner: ['bob', 'carol'],
+          backup_approvers: ['alice', 'dave', 'carol'],
         },
       ),
-    ).toEqual([
-      { provider: 'USER', refs: ['alice', 'bob'] },
-      { provider: 'USER_GROUP', refs: ['finance', 'risk'] },
-    ]);
+    ).toEqual([{ provider: 'USER', refs: ['alice', 'bob', 'carol', 'dave'] }]);
   });
 
   it('rejects a missing dynamic approver input', () => {
@@ -43,7 +29,6 @@ describe('materializeApprovalSubjects', () => {
         [
           {
             source: 'DYNAMIC',
-            provider: 'USER',
             inputKey: 'request_owner',
           },
         ],
@@ -58,32 +43,46 @@ describe('materializeApprovalSubjects', () => {
         [
           {
             source: 'DYNAMIC',
-            provider: 'USER',
             inputKey: 'direct_manager',
           },
         ],
-        {
-          direct_manager: {
-            subjects: [{ provider: 'USER', refs: ['leader-a'] }],
-          },
-        },
+        { direct_manager: ['leader-a'] },
       ),
     ).toEqual([{ provider: 'USER', refs: ['leader-a'] }]);
   });
 
-  it('rejects a lookup result that does not use the configured provider', () => {
+  it('keeps fixed user groups for runtime expansion while deduplicating users', () => {
+    expect(
+      materializeApprovalSubjects(
+        [
+          { source: 'STATIC', provider: 'USER', refs: ['alice'] },
+          {
+            source: 'STATIC',
+            provider: 'USER_GROUP',
+            refs: ['finance'],
+          },
+          { source: 'DYNAMIC', inputKey: 'backup_approvers' },
+        ],
+        { backup_approvers: ['alice', 'bob', 'bob'] },
+      ),
+    ).toEqual([
+      { provider: 'USER', refs: ['alice', 'bob'] },
+      { provider: 'USER_GROUP', refs: ['finance'] },
+    ]);
+  });
+
+  it('rejects a lookup result that is not a user ID array', () => {
     expect(() =>
       materializeApprovalSubjects(
         [
           {
             source: 'DYNAMIC',
-            provider: 'USER',
             inputKey: 'direct_manager',
           },
         ],
         {
           direct_manager: {
-            subjects: [{ provider: 'USER_GROUP', refs: ['leaders'] }],
+            subjects: [{ provider: 'USER', refs: ['leader-a'] }],
           },
         },
       ),

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/approval-subject-source.util.ts

@@ -3,12 +3,11 @@ export type ApprovalSubjectProvider = 'USER' | 'USER_GROUP';
 export type ApprovalSubjectSource =
   | {
       source?: 'STATIC';
-      provider: ApprovalSubjectProvider;
+      provider?: ApprovalSubjectProvider;
       refs: string[];
     }
   | {
       source: 'DYNAMIC';
-      provider: ApprovalSubjectProvider;
       inputKey: string;
     };
 
@@ -21,50 +20,33 @@ export function materializeApprovalSubjects(
   sources: ApprovalSubjectSource[],
   dynamicInputs: Record<string, unknown> = {},
 ): MaterializedApprovalSubject[] {
-  const refsByProvider = new Map<ApprovalSubjectProvider, string[]>();
+  const refsByProvider = new Map<ApprovalSubjectProvider, Set<string>>();
 
   for (const source of sources) {
-    const refs =
+    const provider =
+      source.source === 'DYNAMIC' ? 'USER' : source.provider ?? 'USER';
+    const refs = normalizeRefs(
       source.source === 'DYNAMIC'
-        ? normalizeDynamicRefs(
-            dynamicInputs[source.inputKey],
-            source.inputKey,
-            source.provider,
-          )
-        : normalizeRefs(source.refs);
-    const current = refsByProvider.get(source.provider) ?? [];
-    refsByProvider.set(source.provider, [...new Set([...current, ...refs])]);
+        ? normalizeDynamicRefs(dynamicInputs[source.inputKey], source.inputKey)
+        : source.refs,
+    );
+    const combined = refsByProvider.get(provider) ?? new Set<string>();
+    refs.forEach((ref) => combined.add(ref));
+    refsByProvider.set(provider, combined);
   }
 
-  return [...refsByProvider].map(([provider, refs]) => ({ provider, refs }));
+  return [...refsByProvider].flatMap(([provider, refs]) =>
+    refs.size ? [{ provider, refs: [...refs] }] : [],
+  );
 }
 
-function normalizeDynamicRefs(
-  value: unknown,
-  inputKey: string,
-  provider: ApprovalSubjectProvider,
-): string[] {
-  const result = asObject(value);
-  const subjects = Array.isArray(result.subjects) ? result.subjects : [];
-  const refs = normalizeRefs(
-    subjects.flatMap((item) => {
-      const subject = asObject(item);
-      return subject.provider === provider && Array.isArray(subject.refs)
-        ? subject.refs
-        : [];
-    }),
-  );
+function normalizeDynamicRefs(value: unknown, inputKey: string): string[] {
+  const refs = Array.isArray(value) ? normalizeRefs(value) : [];
   if (refs.length === 0)
     throw new Error(`Dynamic approver input "${inputKey}" is missing or empty`);
   return refs;
 }
 
-function asObject(value: unknown): Record<string, unknown> {
-  return value && typeof value === 'object' && !Array.isArray(value)
-    ? (value as Record<string, unknown>)
-    : {};
-}
-
 function normalizeRefs(values: unknown[]): string[] {
   return [
     ...new Set(

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/human-approval.dto.ts

@@ -20,9 +20,9 @@ export class ApprovalSubjectConfigDto {
   @IsIn(['STATIC', 'DYNAMIC'])
   source: 'STATIC' | 'DYNAMIC';
 
-  @IsString()
-  @IsNotEmpty()
-  provider: string;
+  @IsOptional()
+  @IsIn(['USER', 'USER_GROUP'])
+  provider?: 'USER' | 'USER_GROUP';
 
   @ValidateIf((input) => input.source === 'STATIC')
   @IsArray()

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/human-approval.service.spec.ts

@@ -2,6 +2,65 @@ import { hashNodeInstanceConfig } from '../workflowNodeInstance/node-instance-co
 import { HumanApprovalService } from './human-approval.service';
 
 describe('HumanApprovalService', () => {
+  it('deduplicates people resolved from fixed users and fixed user groups', async () => {
+    const userProvider = {
+      preview: jest.fn().mockResolvedValue({
+        items: [{ ref: 'alice', label: 'Alice' }],
+      }),
+      resolve: jest.fn().mockResolvedValue([
+        {
+          principalType: 'USER',
+          principalRef: 'alice',
+          displayName: 'Alice',
+          sourceRefs: ['alice'],
+        },
+      ]),
+    };
+    const groupProvider = {
+      preview: jest.fn().mockResolvedValue({
+        items: [{ ref: 'finance', label: 'Finance' }],
+      }),
+      resolve: jest.fn().mockResolvedValue([
+        {
+          principalType: 'USER',
+          principalRef: 'alice',
+          displayName: 'Alice',
+          sourceRefs: ['finance'],
+        },
+        {
+          principalType: 'USER',
+          principalRef: 'bob',
+          displayName: 'Bob',
+          sourceRefs: ['finance'],
+        },
+      ]),
+    };
+    const service = new HumanApprovalService(
+      {} as any,
+      {
+        get: jest.fn((key) =>
+          key === 'USER_GROUP' ? groupProvider : userProvider,
+        ),
+      } as any,
+    );
+
+    const result = await (service as any).resolveSubjects(
+      [
+        { provider: 'USER', refs: ['alice'] },
+        { provider: 'USER_GROUP', refs: ['finance'] },
+      ],
+      { userId: 'runtime' },
+    );
+
+    expect(result.candidates).toEqual([
+      expect.objectContaining({
+        principalRef: 'alice',
+        sourceRefs: ['alice', 'finance'],
+      }),
+      expect.objectContaining({ principalRef: 'bob' }),
+    ]);
+  });
+
   it('stores the resolved task in the built-in approval request', async () => {
     const create = jest.fn().mockResolvedValue({
       id: BigInt(40),
@@ -56,9 +115,7 @@ describe('HumanApprovalService', () => {
         },
         details: [],
       },
-      subjects: [
-        { source: 'STATIC' as const, provider: 'USER', refs: ['alice'] },
-      ],
+      subjects: [{ source: 'STATIC' as const, refs: ['alice'] }],
       approvalRule: { mode: 'ANY' as const },
       rejectionRule: { mode: 'ANY' as const },
       timeout: { durationSeconds: 0, action: 'REJECTED' as const },
@@ -227,9 +284,7 @@ describe('HumanApprovalService', () => {
         callbackResult: { script: 'return callback.body;' },
       },
       task: {},
-      subjects: [
-        { source: 'STATIC' as const, provider: 'USER', refs: ['alice'] },
-      ],
+      subjects: [{ source: 'STATIC' as const, refs: ['alice'] }],
       approvalRule: { mode: 'ANY' as const },
       rejectionRule: { mode: 'ANY' as const },
       timeout: { durationSeconds: 60, action: 'REJECTED' as const },

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/humanApproval/runtime/human-approval-runtime.controller.spec.ts

@@ -67,7 +67,7 @@ describe('HumanApprovalRuntimeController', () => {
         },
         details: [],
       },
-      subjects: [{ source: 'STATIC', provider: 'USER', refs: ['reviewer'] }],
+      subjects: [{ source: 'STATIC', refs: ['reviewer'] }],
       approvalRule: { mode: 'ANY' },
       rejectionRule: { mode: 'ANY' },
       timeout: { durationSeconds: 0, action: 'REJECTED' },
@@ -113,7 +113,7 @@ describe('HumanApprovalRuntimeController', () => {
   it('reuses a completed approval from the original retry operation', async () => {
     const config = {
       task: { title: { source: 'FIXED', value: '采购审批' }, details: [] },
-      subjects: [{ source: 'STATIC', provider: 'USER', refs: ['reviewer'] }],
+      subjects: [{ source: 'STATIC', refs: ['reviewer'] }],
       approvalRule: { mode: 'ANY' },
       rejectionRule: { mode: 'ANY' },
       timeout: { durationSeconds: 0, action: 'REJECTED' },