@gadmin2n/schematics 0.0.152 → 0.0.153

package/dist/lib/application/files/gadmin2-game-angle-demo/CODEBUDDY.local.md

@@ -0,0 +1,8 @@
+## 与 Gadmin2 模板的关系
+
+本项目（gadmin-test）是 gadmin2 模板的**实例项目**，用于日常迭代新功能。迭代完成后需将新特性合并回 gadmin2 模板。
+
+| | 路径 |
+|------|------|
+| 实例（本项目） | `/Users/kavenma/Documents/work/code/oit/test/gadmin-test` |
+| 模板（上游） | `/Users/kavenma/Documents/work/code/common/gadmin2/schematics/src/lib/application/files/gadmin2-game-angle-demo` |

package/dist/lib/application/files/gadmin2-game-angle-demo/config/prisma/workflow.prisma

@@ -9,6 +9,7 @@ enum WorkflowStatus {
 enum WorkflowInstanceStatus {
   PENDING
   RUNNING
+  WAITING_RETRY
   COMPLETED
   FAILED
   CANCELLED

package/dist/lib/application/files/gadmin2-game-angle-demo/server/.seed-timestamp

@@ -0,0 +1 @@
+2026-09-18T04:59:46.662Z

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/index.ts

@@ -31,12 +31,13 @@ export async function main() {
 
   await seedBootstrap(prisma);
 
+  // Workflow 先建父菜单与「功能设置」页（含旧 4 页面的合并迁移），permission 随后。
+  await seedWorkflowModule(prisma);
   await seedPermissionModule(prisma);
   await seedAgendaModule(prisma);
   await seedAuditModule(prisma);
   await seedCanvasModule(prisma);
   await seedGameModule(prisma);
-  await seedWorkflowModule(prisma);
 
   await seedDataMngtPages(prisma);
 }

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/permission.seed.ts

@@ -12,8 +12,9 @@ import {
  *
  * 职责（仅本模块自家）：
  *   1. permission 父分组 page (顶级 admin/administration → permission)
- *   2. 7 个 leaf page: permission_readme / person_directory / user /
- *      people_group / role / page / resource
+ *   2. 5 个 leaf page，均挂在 permission 下
+ *    （原 person_directory / people_group 已并入 Workflow 的「功能设置」页，
+ *     由 workflow.seed.ts 声明并迁移）
  *   3. permission 模块所需 resource 及页面绑定
  *   4. PageResource 绑定（page ↔ resource，多对多）
  *   5. SYSTEM_ADMIN 对上述全部 page + resource 的全量授权
@@ -54,32 +55,35 @@ export async function seedPermissionModule(
       zhName: '菜单指引',
       enName: 'Menu Guide',
       sortOrder: 1005,
-    },
-    {
-      code: 'person_directory',
-      zhName: '人员目录',
-      enName: 'People Directory',
-      sortOrder: 1010,
+      parentId: permissionPage.id,
     },
     {
       code: 'user',
-      zhName: '访问授权',
-      enName: 'Access Grants',
+      zhName: '用户管理',
+      enName: 'User Mgnt',
       sortOrder: 1020,
+      parentId: permissionPage.id,
+    },
+    {
+      code: 'role',
+      zhName: '角色管理',
+      enName: 'Role Mgnt',
+      sortOrder: 1040,
+      parentId: permissionPage.id,
     },
     {
-      code: 'people_group',
-      zhName: '人员组',
-      enName: 'People Groups',
-      sortOrder: 1030,
+      code: 'page',
+      zhName: '页面管理',
+      enName: 'Page Mgnt',
+      sortOrder: 1050,
+      parentId: permissionPage.id,
     },
-    { code: 'role', zhName: '角色管理', enName: 'Role Mgnt', sortOrder: 1040 },
-    { code: 'page', zhName: '页面管理', enName: 'Page Mgnt', sortOrder: 1050 },
     {
       code: 'resource',
       zhName: '资源管理',
       enName: 'Resource Management',
       sortOrder: 1060,
+      parentId: permissionPage.id,
     },
   ];
 
@@ -95,13 +99,13 @@ export async function seedPermissionModule(
         zhName: def.zhName,
         enName: def.enName,
         sortOrder: def.sortOrder,
-        parentId: permissionPage.id,
+        parentId: def.parentId,
       },
       {
         zhName: def.zhName,
         enName: def.enName,
         sortOrder: def.sortOrder,
-        parentId: permissionPage.id,
+        parentId: def.parentId,
       },
     );
     pagesByCode.set(p.code, p.id);
@@ -114,32 +118,7 @@ export async function seedPermissionModule(
     description: string;
     pageCode: string;
   }[] = [
-    {
-      code: 'user',
-      description: 'People directory',
-      pageCode: 'person_directory',
-    },
-    {
-      code: 'staffDirectory',
-      description: 'Search the shared staff directory',
-      pageCode: 'person_directory',
-    },
-    { code: 'user', description: 'Access grants', pageCode: 'user' },
-    {
-      code: 'userGroup:read',
-      description: 'Read reusable people groups',
-      pageCode: 'people_group',
-    },
-    {
-      code: 'userGroup:create',
-      description: 'Maintain reusable people groups',
-      pageCode: 'people_group',
-    },
-    {
-      code: 'user',
-      description: 'Read people for group membership',
-      pageCode: 'people_group',
-    },
+    { code: 'user', description: 'User management', pageCode: 'user' },
     { code: 'role', description: 'Role management', pageCode: 'role' },
     {
       code: 'rolePages',

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflow-node-types.ts

@@ -452,12 +452,17 @@ const NODE_DEFINITIONS: BaseNodeTypeSeed[] = [
   {
     type: 'db_execute',
     category: 'ACTION',
-    label: '数据库 Function',
+    label: '数据库操作',
     icon: 'ConsoleSqlOutlined',
-    description: '调用当前 GAdmin 数据库 workflow_api 中的 Function',
+    description: '执行 Raw SQL 或调用当前 GAdmin 数据库中的 Function',
     configSchema: {
       type: 'object',
       properties: {
+        mode: {
+          type: 'string',
+          enum: ['FUNCTION', 'SQL'],
+          description: '执行方式',
+        },
         functionRef: {
           type: 'object',
           properties: {
@@ -473,6 +478,19 @@ const NODE_DEFINITIONS: BaseNodeTypeSeed[] = [
           items: PARAMETER_BINDING_SCHEMA,
           description: '按 Function 参数顺序提供的值',
         },
+        allowWrite: {
+          type: 'boolean',
+          description: 'Raw SQL 是否允许新增、更新或删除数据',
+        },
+        sql: {
+          type: 'string',
+          description: '要执行的单条 SQL',
+        },
+        parameters: {
+          type: 'array',
+          items: PARAMETER_BINDING_SCHEMA,
+          description: 'Raw SQL 参数占位符对应的值',
+        },
         timeoutSeconds: {
           type: 'integer',
           minimum: 1,
@@ -480,7 +498,6 @@ const NODE_DEFINITIONS: BaseNodeTypeSeed[] = [
           description: '执行超时时间（秒）',
         },
       },
-      required: ['functionRef', 'argumentBindings'],
       additionalProperties: false,
     },
     inputSchema: { description: '上一个节点的完整结果' },
@@ -488,6 +505,10 @@ const NODE_DEFINITIONS: BaseNodeTypeSeed[] = [
       type: 'object',
       properties: {
         result: { description: 'Function 返回值' },
+        rows: { type: 'array' },
+        rowCount: { type: 'number' },
+        affectedRows: { type: 'number' },
+        insertedId: { type: 'string' },
       },
     },
     outputs: [],
@@ -1316,7 +1337,7 @@ const dedicatedEditorNodes: NodeTypeSeed[] = [
     type === 'event_trigger'
       ? 6
       : type === 'db_execute'
-      ? 5
+      ? 6
       : type === 'parallel'
       ? 6
       : ['if_else', 'switch'].includes(type)

package/dist/lib/application/files/gadmin2-game-angle-demo/server/seed/workflow.seed.ts

@@ -67,38 +67,22 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       resourceCode: 'workflowNodeInstance',
       resourceDescription: 'Workflow node instance management',
     },
-    {
-      code: 'workflow_connections',
-      zhName: '连接管理',
-      enName: 'Connections',
-      sortOrder: 3,
-      resourceCode: 'integrationConnection',
-      resourceDescription: 'Reusable external system connections',
-    },
-    {
-      code: 'workflow_temporal_tenant',
-      zhName: '服务注册',
-      enName: 'Service Registration',
-      sortOrder: 4,
-      resourceCode: 'temporalTenantConfig',
-      resourceDescription: 'Temporal tenant config management',
-    },
-    {
-      code: 'workflow_event_catalog',
-      zhName: '业务事件',
-      enName: 'Business Events',
-      sortOrder: 5,
-      resourceCode: 'workflow',
-      resourceDescription: 'Read registered Workflow business events',
-    },
     {
       code: 'approval_tasks',
       zhName: '审批任务',
       enName: 'Approval Tasks',
-      sortOrder: 6,
+      sortOrder: 3,
       resourceCode: 'humanApproval',
       resourceDescription: 'Read and decide assigned Human Approval tasks',
     },
+    {
+      code: 'workflow_settings',
+      zhName: '功能设置',
+      enName: 'Feature Settings',
+      sortOrder: 6,
+      resourceCode: 'integrationConnection',
+      resourceDescription: 'Reusable external system connections',
+    },
   ];
 
   const allPages = [{ id: workflowPage.id, code: workflowPage.code }];
@@ -114,7 +98,7 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
         sortOrder: def.sortOrder,
         parentId: workflowPage.id,
       },
-      def.code === 'approval_tasks'
+      def.code === 'approval_tasks' || def.code === 'workflow_settings'
         ? { parentId: workflowPage.id, sortOrder: def.sortOrder }
         : {},
     );
@@ -129,18 +113,6 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
     );
     console.log(`[workflow] PageResource: ${def.code} ↔ ${def.resourceCode}`);
 
-    if (def.code === 'workflow_event_catalog') {
-      await bindResourceToPage(
-        prisma,
-        p.id,
-        'workflowEventRegistration',
-        'Register database-backed Workflow business events',
-      );
-      console.log(
-        '[workflow] PageResource: workflow_event_catalog ↔ workflowEventRegistration',
-      );
-    }
-
     if (def.code === 'workflow_list') {
       await bindResourceToPage(
         prisma,
@@ -151,6 +123,26 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
       console.log('[workflow] PageResource: workflow_list ↔ workflowExecution');
     }
 
+    // 功能设置合并了原服务注册/连接管理/业务事件/人员目录/人员组 5 个页面的全部资源
+    if (def.code === 'workflow_settings') {
+      const mergedResources = [
+        ['temporalTenantConfig', 'Temporal tenant config management'],
+        ['workflow', 'Read registered Workflow business events'],
+        [
+          'workflowEventRegistration',
+          'Register database-backed Workflow business events',
+        ],
+        ['user', 'People directory'],
+        ['staffDirectory', 'Search the shared staff directory'],
+        ['userGroup:read', 'Read reusable people groups'],
+        ['userGroup:create', 'Maintain reusable people groups'],
+      ] as const;
+      for (const [code, description] of mergedResources) {
+        await bindResourceToPage(prisma, p.id, code, description);
+        console.log(`[workflow] PageResource: ${def.code} ↔ ${code}`);
+      }
+    }
+
     // Provider actions live inside the existing Node Instance page. Resolve is
     // seeded now for the later publish/runtime call path; it has no HTTP route yet.
     if (def.code === 'workflow_node_instance') {
@@ -197,35 +189,53 @@ export async function seedWorkflowModule(prisma: PrismaClient): Promise<void> {
     }
   }
 
-  // Connection management is part of creating and maintaining reusable Node
-  // Templates. Keep its page access aligned with the existing Node Template
-  // page instead of limiting it to SYSTEM_ADMIN on installations that already
-  // granted workflow authoring to other roles.
-  const nodeTemplatePage = allPages.find(
-    (page) => page.code === 'workflow_node_instance',
-  );
-  const connectionsPage = allPages.find(
-    (page) => page.code === 'workflow_connections',
+  // ── 旧页面合并迁移 ─────────────────────────────────────────────────────────
+  // 「功能设置」(workflow_settings) 取代了服务注册/连接管理/业务事件/人员目录/
+  // 人员组 5 个旧页面：已授权旧页面的角色改授新页面以保留访问，随后删除旧 page
+  // 及其 RolePages/PageResource 关联（RoleResource 保留——资源仍绑定在新页面上）。
+  // 旧页面已删除的环境重跑 seed 时本块为 no-op。
+  const settingsPage = allPages.find(
+    (page) => page.code === 'workflow_settings',
   );
-  if (nodeTemplatePage && connectionsPage) {
-    const authorRoles = await prisma.rolePages.findMany({
-      where: { pageId: nodeTemplatePage.id },
-      select: { roleId: true },
-    });
-    const connectionResourceIds = await getPageResourceIds(
+  if (settingsPage) {
+    const settingsResourceIds = await getPageResourceIds(
       prisma,
-      connectionsPage.id,
+      settingsPage.id,
     );
-    for (const { roleId } of authorRoles) {
-      await grantRoleAccess(
-        prisma,
-        roleId,
-        connectionsPage.id,
-        connectionResourceIds,
-      );
-      console.log(
-        `[workflow] Grant: role#${roleId} → workflow_connections (inherits Node Template access)`,
-      );
+    const legacyPages = await prisma.page.findMany({
+      where: {
+        code: {
+          in: [
+            'workflow_temporal_tenant',
+            'workflow_connections',
+            'workflow_event_catalog',
+            'person_directory',
+            'people_group',
+          ],
+        },
+      },
+      select: { id: true, code: true },
+    });
+    for (const legacy of legacyPages) {
+      const grants = await prisma.rolePages.findMany({
+        where: { pageId: legacy.id },
+        select: { roleId: true },
+      });
+      for (const { roleId } of grants) {
+        await grantRoleAccess(
+          prisma,
+          roleId,
+          settingsPage.id,
+          settingsResourceIds,
+        );
+        console.log(
+          `[workflow] Migrate: role#${roleId} ${legacy.code} → workflow_settings`,
+        );
+      }
+      await prisma.rolePages.deleteMany({ where: { pageId: legacy.id } });
+      await prisma.pageResource.deleteMany({ where: { pageId: legacy.id } });
+      await prisma.page.delete({ where: { id: legacy.id } });
+      console.log(`[workflow] Migrate: removed legacy page ${legacy.code}`);
     }
   }
 

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/temporal.service.ts

@@ -36,12 +36,6 @@ export type CronScheduleStatus =
   | 'MISSING'
   | 'UNAVAILABLE';
 
-export interface WorkflowRetryCheckpoint {
-  startNodeId: string;
-  completedNodeIds: string[];
-  outputs: Record<string, unknown>;
-}
-
 @Injectable()
 export class TemporalService implements OnModuleInit, OnModuleDestroy {
   private connection: Connection;
@@ -82,7 +76,6 @@ export class TemporalService implements OnModuleInit, OnModuleDestroy {
     versionId: number;
     dsl: any;
     context: Record<string, any>;
-    retryCheckpoint?: WorkflowRetryCheckpoint;
   }): Promise<{ temporalRunId: string }> {
     if (!this.client) {
       throw new Error('Temporal client not connected');

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow-cancellation.spec.ts

@@ -167,6 +167,23 @@ describe('Workflow cancellation', () => {
     expect(temporal.cancelWorkflow).not.toHaveBeenCalled();
   });
 
+  it('allows cancellation while the Workflow is waiting for a node retry', async () => {
+    const { runtime, tx } = setup({ status: 'WAITING_RETRY' });
+
+    await expect(
+      runtime.cancelExecution({
+        tx: tx as any,
+        instanceId: BigInt(11),
+        requestedBy: 'admin-user',
+      }),
+    ).resolves.toEqual({ instanceId: '11', status: 'CANCELLED' });
+    expect(tx.workflowInstance.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ status: 'CANCELLED' }),
+      }),
+    );
+  });
+
   it('rejects cancellation after a blocking approval has resolved', async () => {
     const { runtime, temporal, tx } = setup({
       cancellationBlockedAt: new Date('2026-08-20T01:00:00.000Z'),

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow-compiler.service.spec.ts

@@ -949,7 +949,7 @@ describe('WorkflowCompilerService', () => {
     ).resolves.toBeUndefined();
   });
 
-  it('rejects legacy raw SQL database configuration', async () => {
+  it('accepts a safe Raw SQL database configuration', async () => {
     const prisma = {
       workflowNodeType: {
         findMany: jest.fn().mockResolvedValue([
@@ -982,7 +982,62 @@ describe('WorkflowCompilerService', () => {
               type: 'db_execute',
               config: {
                 allowWrite: true,
-                sql: 'UPDATE users SET active = false',
+                sql: 'UPDATE users SET active = false WHERE id = $1',
+                parameters: [{ source: 'INPUT', path: 'id' }],
+              },
+            },
+          ],
+          edges: [],
+        },
+        { userId: 'author' },
+      ),
+    ).resolves.toMatchObject({
+      nodes: [
+        expect.objectContaining({
+          id: 'database-1',
+          config: expect.objectContaining({
+            sql: 'UPDATE users SET active = false WHERE id = $1',
+          }),
+        }),
+      ],
+    });
+  });
+
+  it('rejects unsafe Raw SQL database configuration', async () => {
+    const prisma = {
+      workflowNodeType: {
+        findMany: jest.fn().mockResolvedValue([
+          {
+            id: BigInt(10),
+            type: 'db_execute',
+            runtimeKey: 'db_execute',
+            instancePolicy: 'INLINE_ONLY',
+            schemaVersion: 6,
+            configSchema: { type: 'object' },
+            uiSchema: {},
+          },
+        ]),
+      },
+      workflowNodeInstance: { findMany: jest.fn().mockResolvedValue([]) },
+    };
+    const service = new WorkflowCompilerService(
+      prisma as any,
+      { validateOrThrow: jest.fn() } as any,
+      { assertUiSchemaSupported: jest.fn() } as any,
+      { validateSubjects: jest.fn() } as any,
+    );
+
+    await expect(
+      service.compile(
+        {
+          nodes: [
+            {
+              id: 'database-1',
+              type: 'db_execute',
+              config: {
+                mode: 'SQL',
+                allowWrite: true,
+                sql: 'DROP TABLE users',
               },
             },
           ],
@@ -992,7 +1047,7 @@ describe('WorkflowCompilerService', () => {
       ),
     ).rejects.toMatchObject({
       response: {
-        message: '数据库节点不再支持 SQL，请选择 workflow_api 中的 Function',
+        message: '数据库操作只允许单条查询、新增、更新或删除语句',
         nodeId: 'database-1',
       },
     });

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow-compiler.service.ts

@@ -240,12 +240,27 @@ export class WorkflowCompilerService {
       }
       if (nodeType.runtimeKey === 'db_execute') {
         const databaseConfig = config as Record<string, unknown>;
-        if ('sql' in databaseConfig || 'allowWrite' in databaseConfig)
-          this.fail(
-            'NODE_TYPE_MISMATCH',
-            node,
-            '数据库节点不再支持 SQL，请选择 workflow_api 中的 Function',
-          );
+        const databaseMode = databaseExecutionMode(databaseConfig);
+        if (!databaseMode)
+          this.fail('NODE_TYPE_MISMATCH', node, '数据库节点的执行方式无效');
+        if (databaseMode === 'SQL') {
+          const allowWrite = databaseConfig.allowWrite === true;
+          const sql = String(databaseConfig.sql ?? '');
+          if (!isDatabaseSqlAllowed(sql, allowWrite))
+            this.fail(
+              'NODE_TYPE_MISMATCH',
+              node,
+              allowWrite
+                ? '数据库操作只允许单条查询、新增、更新或删除语句'
+                : '当前数据库操作节点只允许单条只读查询',
+            );
+          compiledNodes.push({
+            ...clone(node),
+            config,
+            runtimeKey: nodeType.runtimeKey || nodeType.type,
+          });
+          continue;
+        }
         const functionRef = asObject(databaseConfig.functionRef);
         const argumentBindings = Array.isArray(databaseConfig.argumentBindings)
           ? databaseConfig.argumentBindings
@@ -503,6 +518,51 @@ function clone<T>(value: T): T {
   return JSON.parse(JSON.stringify(value)) as T;
 }
 
+function databaseExecutionMode(
+  config: Record<string, unknown>,
+): 'FUNCTION' | 'SQL' | null {
+  if (config.mode === 'FUNCTION' || config.mode === 'SQL') return config.mode;
+  if (config.mode !== undefined) return null;
+  return 'sql' in config || 'allowWrite' in config || 'parameters' in config
+    ? 'SQL'
+    : 'FUNCTION';
+}
+
+function isSingleReadOnlySql(sql: string): boolean {
+  const normalized = normalizeSqlForPolicy(sql);
+  if (!/^(select|with)\b/i.test(normalized)) return false;
+  return !/\b(insert|update|delete|merge|call|copy|create|alter|drop|truncate|grant|revoke|vacuum|refresh)\b/i.test(
+    normalized,
+  );
+}
+
+function isDatabaseSqlAllowed(sql: string, allowWrite: boolean): boolean {
+  const normalized = normalizeSqlForPolicy(sql);
+  const writableCte =
+    /^with\b/i.test(normalized) &&
+    /\b(insert|update|delete)\b/i.test(normalized) &&
+    !/\b(merge|call|copy|create|alter|drop|truncate|grant|revoke|vacuum|refresh)\b/i.test(
+      normalized,
+    );
+  return (
+    isSingleReadOnlySql(sql) ||
+    (allowWrite &&
+      (/^(insert|update|delete)\b/i.test(normalized) || writableCte))
+  );
+}
+
+function normalizeSqlForPolicy(sql: string): string {
+  const withoutContent = sql
+    .replace(/\$(\w*)\$[\s\S]*?\$\1\$/g, ' ')
+    .replace(/'(?:''|[^'])*'/g, ' ')
+    .replace(/"(?:""|[^"])*"/g, ' ')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/--[^\r\n]*/g, ' ')
+    .trim();
+  const withoutTrailingSemicolon = withoutContent.replace(/;\s*$/, '').trim();
+  return withoutTrailingSemicolon.includes(';') ? '' : withoutTrailingSemicolon;
+}
+
 function asObject(value: unknown): Record<string, unknown> {
   return value && typeof value === 'object' && !Array.isArray(value)
     ? (value as Record<string, unknown>)