@gadmin2n/schematics 0.0.150 → 0.0.152

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/page-transfer.service.ts

@@ -0,0 +1,491 @@
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
+import { PrismaService } from 'nestjs-prisma';
+import * as path from 'path';
+import { Logger } from 'winston';
+import {
+  assertTransferPayload,
+  ImportPreviewResponse,
+  MissingRef,
+  PageExportPayload,
+  PageResourceTransferItem,
+  PageTransferItem,
+  TRANSFER_PAYLOAD_VERSION,
+  TransferPayload,
+} from './perm-transfer.dto';
+import { TransferTokenService } from './transfer-token.service';
+
+type PageRow = Prisma.PageGetPayload<{ include: { pageResources: true } }>;
+
+/** actions is a Json column that historically holds an array or a CSV string */
+function parseActions(actions: unknown): string[] {
+  if (!actions) return [];
+  if (Array.isArray(actions)) return actions.map(String).filter(Boolean);
+  if (typeof actions === 'string') {
+    try {
+      const parsed = JSON.parse(actions);
+      if (Array.isArray(parsed)) return parsed.map(String).filter(Boolean);
+    } catch {
+      // fall through to CSV handling
+    }
+    return actions
+      .split(',')
+      .map((a) => a.trim())
+      .filter(Boolean);
+  }
+  return [];
+}
+
+@Injectable()
+export class PageTransferService {
+  constructor(
+    private prisma: PrismaService,
+    private readonly tokenService: TransferTokenService,
+    @Inject(WINSTON_MODULE_PROVIDER) private readonly logger: Logger,
+  ) {
+    this.logger = this.logger.child({ file: path.basename(__filename) });
+  }
+
+  async generateExportToken(
+    code: string,
+    baseUrl: string,
+  ): Promise<{ url: string }> {
+    const page = await this.prisma.page.findUnique({
+      where: { code },
+      select: { code: true },
+    });
+    if (!page) throw new NotFoundException('Page not found');
+
+    const token = this.tokenService.sign('page', code);
+    return { url: this.tokenService.buildUrl(baseUrl, 'page', code, token) };
+  }
+
+  /**
+   * BFS-collect the root page and all descendants (parents before children),
+   * including pageResource bindings with resource codes resolved.
+   */
+  private async collectSubtree(
+    rootCode: string,
+    client: Prisma.TransactionClient | PrismaService = this.prisma,
+  ): Promise<{
+    pages: PageTransferItem[];
+    pageResources: PageResourceTransferItem[];
+  } | null> {
+    const root = await client.page.findUnique({
+      where: { code: rootCode },
+      include: { pageResources: true },
+    });
+    if (!root) return null;
+
+    const rows: PageRow[] = [root];
+    // `visited` guards against parent_id cycles (the page tree is only
+    // enforced by application code, so a drag-and-drop mishap could create one)
+    const visited = new Set<number>([root.id]);
+    let frontier: number[] = [root.id];
+    while (frontier.length > 0) {
+      const children = await client.page.findMany({
+        where: { parentId: { in: frontier } },
+        include: { pageResources: true },
+        orderBy: { id: 'asc' },
+      });
+      const fresh = children.filter((c) => !visited.has(c.id));
+      fresh.forEach((c) => visited.add(c.id));
+      rows.push(...fresh);
+      frontier = fresh.map((c) => c.id);
+    }
+
+    const codeById = new Map<number, string>();
+    const parentCodeById = new Map<number, string | null>();
+    for (const row of rows) codeById.set(row.id, row.code);
+    // parents outside the subtree (i.e. the root's parent) need one extra lookup
+    const outsideParentIds = rows
+      .map((r) => r.parentId)
+      .filter((id): id is number => id !== null && !codeById.has(id));
+    if (outsideParentIds.length > 0) {
+      const parents = await client.page.findMany({
+        where: { id: { in: outsideParentIds } },
+        select: { id: true, code: true },
+      });
+      for (const p of parents) codeById.set(p.id, p.code);
+    }
+    for (const row of rows) {
+      parentCodeById.set(
+        row.id,
+        row.parentId === null ? null : codeById.get(row.parentId) ?? null,
+      );
+    }
+
+    const resourceIds = [
+      ...new Set(
+        rows.flatMap((r) => r.pageResources.map((pr) => pr.resourceId)),
+      ),
+    ];
+    const resources = resourceIds.length
+      ? await client.resource.findMany({
+          where: { id: { in: resourceIds } },
+          select: { id: true, code: true },
+        })
+      : [];
+    const resourceCodeById = new Map(resources.map((r) => [r.id, r.code]));
+
+    const pages: PageTransferItem[] = rows.map((row) => ({
+      code: row.code,
+      name: row.name,
+      path: row.path,
+      iframeUrl: row.iframeUrl,
+      externalRedirectUrl: row.externalRedirectUrl,
+      description: row.description,
+      zhName: row.zhName,
+      enName: row.enName,
+      i18nKey: row.i18nKey,
+      parentCode: parentCodeById.get(row.id) ?? null,
+      sortOrder: row.sortOrder,
+      isVirtual: row.isVirtual,
+    }));
+    const pageResources: PageResourceTransferItem[] = rows.flatMap((row) =>
+      row.pageResources.flatMap((pr) => {
+        const resourceCode = resourceCodeById.get(pr.resourceId);
+        // skip dangling bindings rather than emitting an empty code that the
+        // importer would reject with a confusing "resource does not exist: "
+        if (!resourceCode) return [];
+        return [{ pageCode: row.code, resourceCode, actions: pr.actions }];
+      }),
+    );
+    return { pages, pageResources };
+  }
+
+  async getExportPayload(
+    code: string,
+    token: string,
+  ): Promise<PageExportPayload> {
+    this.tokenService.verify(token, 'page', code);
+
+    const subtree = await this.collectSubtree(code);
+    if (!subtree) throw new NotFoundException('Page not found');
+
+    return {
+      version: TRANSFER_PAYLOAD_VERSION,
+      exportedAt: new Date().toISOString(),
+      entity: 'page',
+      pages: subtree.pages,
+      pageResources: subtree.pageResources,
+    };
+  }
+
+  /** referenced resource / parentPage codes that must exist in the target DB */
+  private findMissingRefs(
+    pages: PageTransferItem[],
+    pageResources: PageResourceTransferItem[],
+    existingResourceCodes: Set<string>,
+    existingPageCodes: Set<string>,
+  ): MissingRef[] {
+    const payloadCodes = new Set(pages.map((p) => p.code));
+    const missing: MissingRef[] = [];
+
+    for (const pr of pageResources) {
+      if (!existingResourceCodes.has(pr.resourceCode)) {
+        missing.push({ type: 'resource', code: pr.resourceCode });
+      }
+    }
+    for (const p of pages) {
+      if (
+        p.parentCode &&
+        !payloadCodes.has(p.parentCode) &&
+        !existingPageCodes.has(p.parentCode)
+      ) {
+        missing.push({ type: 'parentPage', code: p.parentCode });
+      }
+    }
+    // de-duplicate
+    const seen = new Set<string>();
+    return missing.filter((m) => {
+      const k = `${m.type}:${m.code}`;
+      if (seen.has(k)) return false;
+      seen.add(k);
+      return true;
+    });
+  }
+
+  private async resolveRefs(
+    pages: PageTransferItem[],
+    pageResources: PageResourceTransferItem[],
+  ) {
+    const resourceCodes = [
+      ...new Set(pageResources.map((pr) => pr.resourceCode)),
+    ];
+    const payloadCodes = new Set(pages.map((p) => p.code));
+    const parentCodes = [
+      ...new Set(
+        pages
+          .map((p) => p.parentCode)
+          .filter((c): c is string => !!c && !payloadCodes.has(c)),
+      ),
+    ];
+    const [resources, parents] = await Promise.all([
+      resourceCodes.length
+        ? this.prisma.resource.findMany({
+            where: { code: { in: resourceCodes } },
+            select: { code: true },
+          })
+        : [],
+      parentCodes.length
+        ? this.prisma.page.findMany({
+            where: { code: { in: parentCodes } },
+            select: { code: true },
+          })
+        : [],
+    ]);
+    return {
+      existingResourceCodes: new Set(resources.map((r) => r.code)),
+      existingPageCodes: new Set(parents.map((p) => p.code)),
+    };
+  }
+
+  async importPreview(
+    payload: TransferPayload,
+  ): Promise<ImportPreviewResponse> {
+    assertTransferPayload(payload, 'page');
+    const { pages, pageResources } = payload as PageExportPayload;
+    if (!pages?.length) {
+      throw new BadRequestException('Invalid page payload: pages is empty');
+    }
+
+    const refs = await this.resolveRefs(pages, pageResources);
+    const missingRefs = this.findMissingRefs(
+      pages,
+      pageResources,
+      refs.existingResourceCodes,
+      refs.existingPageCodes,
+    );
+
+    // Import only writes the pages carried by the payload; child pages that
+    // exist solely in the target are left untouched. Restrict `current` to the
+    // payload's codes so the diff reflects exactly what will change.
+    const existing = await this.collectSubtree(pages[0].code);
+    const payloadCodes = new Set(pages.map((p) => p.code));
+    const current = existing
+      ? {
+          pages: existing.pages.filter((p) => payloadCodes.has(p.code)),
+          pageResources: existing.pageResources.filter((pr) =>
+            payloadCodes.has(pr.pageCode),
+          ),
+        }
+      : null;
+
+    return {
+      current,
+      incoming: { pages, pageResources },
+      missingRefs,
+      conflicts: [],
+    };
+  }
+
+  async importConfirm(
+    payload: TransferPayload,
+    operator: string,
+  ): Promise<{ success: true; key: string }> {
+    assertTransferPayload(payload, 'page');
+    const { pages, pageResources } = payload as PageExportPayload;
+    if (!pages?.length) {
+      throw new BadRequestException('Invalid page payload: pages is empty');
+    }
+    const rootCode = pages[0].code;
+    this.logger.info(
+      `[permTransfer] page import_confirm - root: ${rootCode}, pages: ${pages.length}, operator: ${operator}`,
+    );
+
+    await this.prisma.$transaction(async (tx) => {
+      // Re-validate refs inside the transaction so a mismatch rolls back.
+      const resourceCodes = [
+        ...new Set(pageResources.map((pr) => pr.resourceCode)),
+      ];
+      const resources = resourceCodes.length
+        ? await tx.resource.findMany({
+            where: { code: { in: resourceCodes } },
+            select: { id: true, code: true },
+          })
+        : [];
+      const resourceIdByCode = new Map<string, number>(
+        resources.map((r) => [r.code, r.id] as [string, number]),
+      );
+      const missingResource = resourceCodes.find(
+        (c) => !resourceIdByCode.has(c),
+      );
+      if (missingResource) {
+        throw new BadRequestException(
+          `Referenced resource does not exist: ${missingResource}`,
+        );
+      }
+
+      const payloadCodes = new Set(pages.map((p) => p.code));
+      const idByCode = new Map<string, number>();
+
+      // pages arrive parents-first (BFS); upsert in order so parentId resolves
+      for (const p of pages) {
+        let parentId: number | null = null;
+        if (p.parentCode) {
+          if (idByCode.has(p.parentCode)) {
+            parentId = idByCode.get(p.parentCode)!;
+          } else if (!payloadCodes.has(p.parentCode)) {
+            const parent = await tx.page.findUnique({
+              where: { code: p.parentCode },
+              select: { id: true },
+            });
+            if (!parent) {
+              throw new BadRequestException(
+                `Parent page does not exist: ${p.parentCode}`,
+              );
+            }
+            parentId = parent.id;
+          } else {
+            throw new BadRequestException(
+              `Payload pages are not in parents-first order: ${p.code} before ${p.parentCode}`,
+            );
+          }
+        }
+
+        const data = {
+          name: p.name,
+          path: p.path,
+          iframeUrl: p.iframeUrl,
+          externalRedirectUrl: p.externalRedirectUrl,
+          description: p.description,
+          zhName: p.zhName,
+          enName: p.enName,
+          i18nKey: p.i18nKey,
+          parentId,
+          sortOrder: p.sortOrder,
+          isVirtual: p.isVirtual,
+        };
+        const saved = await tx.page.upsert({
+          where: { code: p.code },
+          create: { code: p.code, ...data, creator: operator },
+          update: data,
+          select: { id: true },
+        });
+        idByCode.set(p.code, saved.id);
+      }
+
+      // rebuild pageResource bindings for the payload pages only
+      const pageIds = [...idByCode.values()];
+      // snapshot the bindings we are about to drop so roleResource can be
+      // reconciled for resources that this import *removes* from a page
+      const previousBindings = await tx.pageResource.findMany({
+        where: { pageId: { in: pageIds } },
+        select: { resourceId: true },
+      });
+      await tx.pageResource.deleteMany({ where: { pageId: { in: pageIds } } });
+      if (pageResources.length > 0) {
+        await tx.pageResource.createMany({
+          data: pageResources.map((pr) => ({
+            pageId: idByCode.get(pr.pageCode)!,
+            resourceId: resourceIdByCode.get(pr.resourceCode)!,
+            actions: pr.actions as Prisma.InputJsonValue,
+            creator: operator,
+          })),
+        });
+      }
+
+      const touchedResourceIds = [
+        ...new Set([
+          ...previousBindings.map((b) => b.resourceId),
+          ...pageResources.map((pr) => resourceIdByCode.get(pr.resourceCode)!),
+        ]),
+      ];
+      await this.syncRoleResources(tx, pageIds, touchedResourceIds, operator);
+
+      await tx.audit.create({
+        data: {
+          creator: operator,
+          authorName: operator,
+          action: 'IMPORT_PAGE',
+          resource: 'page',
+          resourceId: rootCode,
+          data: JSON.stringify({
+            rootCode,
+            pageCount: pages.length,
+            pageCodes: pages.map((p) => p.code),
+            pageResourceCount: pageResources.length,
+          }),
+        },
+      });
+    });
+
+    return { success: true, key: rootCode };
+  }
+
+  /**
+   * Keep the documented invariant "roleResource = union of the resources of
+   * all pages granted to the role" (see page.service.updatePageWithResources).
+   * Changing a page's pageResource rows silently breaks API permissions for
+   * every role holding that page, so reconcile them here.
+   *
+   * Scope is limited to `touchedResourceIds` so manually-tuned grants on
+   * unrelated resources are left alone.
+   */
+  private async syncRoleResources(
+    tx: Prisma.TransactionClient,
+    pageIds: number[],
+    touchedResourceIds: number[],
+    operator: string,
+  ): Promise<void> {
+    if (touchedResourceIds.length === 0) return;
+
+    const affectedRoles = await tx.rolePages.findMany({
+      where: { pageId: { in: pageIds } },
+      select: { roleId: true },
+      distinct: ['roleId'],
+    });
+
+    for (const { roleId } of affectedRoles) {
+      const grantedPages = await tx.rolePages.findMany({
+        where: { roleId },
+        select: { pageId: true },
+      });
+      const bindings = await tx.pageResource.findMany({
+        where: {
+          pageId: { in: grantedPages.map((g) => g.pageId) },
+          resourceId: { in: touchedResourceIds },
+        },
+        select: { resourceId: true, actions: true },
+      });
+
+      const desired = new Map<number, Set<string>>();
+      for (const b of bindings) {
+        const set = desired.get(b.resourceId) ?? new Set<string>();
+        parseActions(b.actions).forEach((a) => set.add(a));
+        desired.set(b.resourceId, set);
+      }
+
+      for (const resourceId of touchedResourceIds) {
+        const actions = desired.get(resourceId);
+        if (!actions || actions.size === 0) {
+          // no page of this role provides the resource any more
+          await tx.roleResource.deleteMany({ where: { roleId, resourceId } });
+          continue;
+        }
+        const actionList = [...actions];
+        await tx.roleResource.upsert({
+          where: { roleId_resourceId: { roleId, resourceId } },
+          create: {
+            roleId,
+            resourceId,
+            actions: actionList,
+            creator: operator,
+          },
+          update: { actions: actionList },
+        });
+      }
+    }
+
+    this.logger.info(
+      `[permTransfer] page import roleResource synced - roles: ${affectedRoles.length}, resources: ${touchedResourceIds.length}`,
+    );
+  }
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/perm-transfer.dto.ts

@@ -0,0 +1,213 @@
+import { BadRequestException } from '@nestjs/common';
+import { IsObject } from 'class-validator';
+
+/**
+ * Cross-environment transfer payloads for permission data
+ * (user / role / page / resource). Independent from workflow's
+ * export payload version (v4) — bump when the shape changes.
+ */
+export const TRANSFER_PAYLOAD_VERSION = 1;
+
+export type TransferEntityKind = 'user' | 'role' | 'page' | 'resource';
+
+interface TransferEnvelopeBase {
+  version: number;
+  exportedAt: string;
+  entity: TransferEntityKind;
+}
+
+// ─── user ────────────────────────────────────────────────────────────────────
+// NOTE: apiKey / isApiKey / lastUsedAt are intentionally excluded —
+// credentials must not travel across environments.
+export interface UserTransferData {
+  userid: string;
+  username: string | null;
+  /** string[] when the stored JSON parses cleanly, otherwise the raw string */
+  roles: unknown;
+  description: string | null;
+  isActive: boolean;
+}
+
+export interface UserExportPayload extends TransferEnvelopeBase {
+  entity: 'user';
+  user: UserTransferData;
+}
+
+// ─── resource ────────────────────────────────────────────────────────────────
+export interface ResourceTransferData {
+  code: string;
+  name: string;
+  description: string | null;
+  isCommonResource: boolean;
+}
+
+export interface ResourceExportPayload extends TransferEnvelopeBase {
+  entity: 'resource';
+  resource: ResourceTransferData;
+}
+
+// ─── role ────────────────────────────────────────────────────────────────────
+export interface RoleTransferData {
+  name: string;
+  description: string | null;
+}
+
+export interface RoleResourceTransferItem {
+  resourceCode: string;
+  actions: unknown;
+}
+
+export interface RoleExportPayload extends TransferEnvelopeBase {
+  entity: 'role';
+  role: RoleTransferData;
+  /** page.code list */
+  rolePages: string[];
+  roleResources: RoleResourceTransferItem[];
+}
+
+// ─── page ────────────────────────────────────────────────────────────────────
+export interface PageTransferItem {
+  code: string;
+  name: string;
+  path: string | null;
+  iframeUrl: string | null;
+  externalRedirectUrl: string | null;
+  description: string | null;
+  zhName: string | null;
+  enName: string | null;
+  i18nKey: string | null;
+  /** null for the exported root; otherwise the parent page's code */
+  parentCode: string | null;
+  sortOrder: number | null;
+  isVirtual: boolean;
+}
+
+export interface PageResourceTransferItem {
+  pageCode: string;
+  resourceCode: string;
+  actions: unknown;
+}
+
+export interface PageExportPayload extends TransferEnvelopeBase {
+  entity: 'page';
+  /** root page + all descendants, parents before children (BFS order) */
+  pages: PageTransferItem[];
+  pageResources: PageResourceTransferItem[];
+}
+
+export type TransferPayload =
+  | UserExportPayload
+  | ResourceExportPayload
+  | RoleExportPayload
+  | PageExportPayload;
+
+// ─── import ──────────────────────────────────────────────────────────────────
+export class ImportPayloadDto {
+  @IsObject()
+  payload: TransferPayload;
+}
+
+export interface MissingRef {
+  type: 'page' | 'resource' | 'parentPage';
+  code: string;
+}
+
+/** Comparable shape used by both preview sides (diff view). */
+export type TransferComparable =
+  | Pick<UserExportPayload, 'user'>
+  | Pick<ResourceExportPayload, 'resource'>
+  | Pick<RoleExportPayload, 'role' | 'rolePages' | 'roleResources'>
+  | Pick<PageExportPayload, 'pages' | 'pageResources'>;
+
+export interface ImportPreviewResponse {
+  current: TransferComparable | null;
+  incoming: TransferComparable;
+  missingRefs: MissingRef[];
+  /** human-readable conflict descriptions (e.g. unique-name clashes) */
+  conflicts: string[];
+}
+
+function requireString(value: unknown, field: string): void {
+  if (typeof value !== 'string' || value.length === 0) {
+    throw new BadRequestException(
+      `Invalid import payload: ${field} is required`,
+    );
+  }
+}
+
+function requireArray(value: unknown, field: string): void {
+  if (!Array.isArray(value)) {
+    throw new BadRequestException(
+      `Invalid import payload: ${field} must be an array`,
+    );
+  }
+}
+
+/**
+ * Validate the transfer envelope *and* the entity-specific shape.
+ * The payload is fetched from a user-supplied URL, so this is a trust
+ * boundary — a malformed body must surface as 400, never as a 500.
+ */
+export function assertTransferPayload(
+  payload: TransferPayload,
+  entity: TransferEntityKind,
+): void {
+  if (!payload || typeof payload !== 'object') {
+    throw new BadRequestException('Invalid import payload');
+  }
+  if (payload.version !== TRANSFER_PAYLOAD_VERSION) {
+    throw new BadRequestException(
+      `Unsupported payload version: ${payload.version} (expected ${TRANSFER_PAYLOAD_VERSION})`,
+    );
+  }
+  if (payload.entity !== entity) {
+    throw new BadRequestException(
+      `Payload entity mismatch: ${payload.entity} (expected ${entity})`,
+    );
+  }
+
+  switch (payload.entity) {
+    case 'user':
+      requireString(payload.user?.userid, 'user.userid');
+      break;
+    case 'resource':
+      requireString(payload.resource?.code, 'resource.code');
+      requireString(payload.resource?.name, 'resource.name');
+      break;
+    case 'role':
+      requireString(payload.role?.name, 'role.name');
+      requireArray(payload.rolePages, 'rolePages');
+      requireArray(payload.roleResources, 'roleResources');
+      payload.rolePages.forEach((code, i) =>
+        requireString(code, `rolePages[${i}]`),
+      );
+      payload.roleResources.forEach((rr, i) =>
+        requireString(rr?.resourceCode, `roleResources[${i}].resourceCode`),
+      );
+      break;
+    case 'page': {
+      requireArray(payload.pages, 'pages');
+      requireArray(payload.pageResources, 'pageResources');
+      if (payload.pages.length === 0) {
+        throw new BadRequestException('Invalid import payload: pages is empty');
+      }
+      payload.pages.forEach((p, i) => {
+        requireString(p?.code, `pages[${i}].code`);
+        requireString(p?.name, `pages[${i}].name`);
+      });
+      const pageCodes = new Set(payload.pages.map((p) => p.code));
+      payload.pageResources.forEach((pr, i) => {
+        requireString(pr?.pageCode, `pageResources[${i}].pageCode`);
+        requireString(pr?.resourceCode, `pageResources[${i}].resourceCode`);
+        // every binding must target a page carried by this payload, otherwise
+        // the importer would have no id to write the row against
+        if (!pageCodes.has(pr.pageCode)) {
+          throw new BadRequestException(
+            `Invalid import payload: pageResources[${i}].pageCode "${pr.pageCode}" is not in pages`,
+          );
+        }
+      });
+      break;
+    }
+  }
+}