@gadmin2n/schematics 0.0.157 → 0.0.159

package/dist/lib/application/files/gadmin2-game-angle-demo/server/package.json

@@ -18,6 +18,7 @@
     "start:debug": "dotenv -e .env.local -e .env  -- nest start -c gadmin-cli.json --debug --watch",
     "start:prod": "/bin/sh start-prod.sh",
     "typecheck": "tsc --noEmit",
+    "check:swc-leak": "node scripts/check-swc-watch-leak.js",
     "lint": "oxlint src test",
     "lint:fix": "oxlint src test --fix",
     "test": "jest",
@@ -30,7 +31,7 @@
     "migrate:deploy": "dotenv -e .env.local -e .env  -- prisma migrate deploy",
     "migrate:status": "dotenv -e .env.local -e .env  -- prisma migrate status",
     "generate": "dotenv -e .env.local -e .env  -- npx prisma generate",
-    "generate:dev": "pnpm migrate:dev",
+    "generate:dev": "npm run migrate:dev",
     "postgenerate:dev": "dotenv -e .env.local -e .env  -- ts-node seed/data-mngt.seed.ts",
     "postgadminGenerate": "node scripts/notify-dev-servers.js",
     "push:db": "dotenv -e .env.local -e .env  -- prisma db push --skip-generate",
@@ -151,7 +152,7 @@
     "node": ">=22.13"
   },
   "prisma": {
-    "seed": "pnpm seed"
+    "seed": "npm run seed"
   },
   "lint-staged": {
     "**/*.{ts,tsx}": "oxfmt"

package/dist/lib/application/files/gadmin2-game-angle-demo/server/patches/@nestjs__cli@11.0.21.patch

@@ -0,0 +1,20 @@
+diff --git a/lib/compiler/swc/swc-compiler.js b/lib/compiler/swc/swc-compiler.js
+index 5e8fdad81ea71216755876461c3835a23df1c653..ff2441021b5f294fa859b1553924cc558f69de02 100644
+--- a/lib/compiler/swc/swc-compiler.js
++++ b/lib/compiler/swc/swc-compiler.js
+@@ -126,6 +126,15 @@ class SwcCompiler extends base_compiler_1.BaseCompiler {
+                     cliOptions: {
+                         ...swcCliOpts.cliOptions,
+                         filenames: [file],
++                        // PATCH: this call only transpiles the single newly-added file.
++                        // Leaving watch=true made swcDir() run watchCompilation() again,
++                        // leaking a chokidar watcher per event; and sync=false made it
++                        // spawn a Piscina pool (never destroyed upstream) just for one
++                        // file. sync=true takes the direct dirWorker path: no pool, no
++                        // watcher, and ~40x faster for a single file.
++                        // Upstream: https://github.com/swc-project/pkgs/issues/126
++                        watch: false,
++                        sync: true,
+                     },
+                 });
+             });

package/dist/lib/application/files/gadmin2-game-angle-demo/server/pnpm-workspace.yaml

@@ -24,3 +24,6 @@ allowBuilds:
 
 minimumReleaseAgeExclude:
   - '@gadmin2n/prisma-nest-generator@0.0.50'
+
+patchedDependencies:
+  '@nestjs/cli@11.0.21': patches/@nestjs__cli@11.0.21.patch

package/dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/check-swc-watch-leak.js

@@ -0,0 +1,309 @@
+#!/usr/bin/env node
+/**
+ * @nestjs/cli swc watch 模式的线程/句柄泄漏回归检测。
+ *
+ *   node scripts/check-swc-watch-leak.js
+ *
+ * 背景：
+ *   nest CLI 的 swc builder 在 watch 模式下，每个「新增文件」事件都会重新调用
+ *   @swc/cli 的 swcDir()，且传入的 cliOptions 仍带 watch:true / sync:false：
+ *
+ *     - sync:false  → swcDir 走 Piscina 分支，为编译 1 个文件创建一个 worker
+ *                     pool；而上游 @swc/cli 从不 destroy 它（issue 见下），
+ *                     于是每次事件永久钉住 cores/2 个 idle worker。
+ *     - watch:true  → swcDir 末尾又跑一次 watchCompilation()，每次事件多泄漏
+ *                     一个 chokidar watcher（各带 fd/kqueue）。
+ *
+ *   实测（14 核 macOS）：每次新增文件 +7 常驻线程，8 次后 RSS 从 90MB 涨到
+ *   681MB；长时间 dev 会话可累积上千线程、十余 GB 足迹。
+ *
+ *   上游 issue：https://github.com/swc-project/pkgs/issues/126
+ *   （@swc/cli 0.8.1 与 @nestjs/cli 11.0.24 均未修复）
+ *
+ * 本项目的处置：
+ *   patches/@nestjs__cli@<version>.patch 给 file-add 回调补上
+ *   watch:false + sync:true —— 单文件改走 dirWorker 直连，既不建 pool 也不建
+ *   watcher，且比原路径快约 40 倍。initial 全量编译不受影响（仍是 sync:false
+ *   并行），因为 nest 那里是 spread 出的独立对象。
+ *
+ * 何时需要跑本脚本：
+ *   升级 @nestjs/cli 或 @swc/cli 之后。patch 锚点是编译产物，上游重构可能让它
+ *   失效；pnpm 在 patch 无法应用时会直接报错，但「能应用却语义变了」只能靠这里
+ *   兜住。
+ *
+ * 退出码：0 = 正常，1 = 检测到回归。
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const SERVER_DIR = path.join(__dirname, '..');
+const SWC_COMPILER = path.join(
+  SERVER_DIR,
+  'node_modules/@nestjs/cli/lib/compiler/swc/swc-compiler.js',
+);
+const SWC_DIR_MOD = path.join(SERVER_DIR, 'node_modules/@swc/cli/lib/swc/dir.js');
+
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const DIM = '\x1b[90m';
+const RESET = '\x1b[0m';
+
+const problems = [];
+
+function ok(msg) {
+  console.log(`${GREEN}✓${RESET} ${msg}`);
+}
+function bad(msg) {
+  console.log(`${RED}✗${RESET} ${msg}`);
+  problems.push(msg);
+}
+function info(msg) {
+  console.log(`${DIM}  ${msg}${RESET}`);
+}
+
+/** 本进程线程数（不含主线程记账差异，仅用于相对比较）。 */
+function threadCount() {
+  if (process.platform === 'linux') {
+    return fs.readdirSync('/proc/self/task').length;
+  }
+  // darwin：ps -M 每行一个线程，首行是表头
+  const out = execSync(`ps -M ${process.pid}`, { encoding: 'utf8' });
+  return out.trim().split('\n').length - 1;
+}
+
+function handleCount() {
+  return typeof process._getActiveHandles === 'function'
+    ? process._getActiveHandles().length
+    : -1;
+}
+
+// ---------- 静态检查：patch 是否还在，且语义是我们要的 ----------
+
+function checkPatchApplied() {
+  if (!fs.existsSync(SWC_COMPILER)) {
+    bad(`找不到 ${path.relative(SERVER_DIR, SWC_COMPILER)}，@nestjs/cli 未安装？`);
+    return false;
+  }
+  const src = fs.readFileSync(SWC_COMPILER, 'utf8');
+
+  // 锚点：nest 自己的注释。上游若重构掉它，说明 patch 需要重新审查。
+  const anchor = 'Transpile newly added file';
+  const at = src.indexOf(anchor);
+  if (at === -1) {
+    bad(
+      `swc-compiler.js 里找不到锚点注释 "${anchor}"——上游结构已变，` +
+        `patch 可能已失效，需重新审查 patches/ 下的补丁`,
+    );
+    return false;
+  }
+
+  // 精确截出锚点之后那一次 swcCli.default(...) 的实参范围：
+  // 用括号配平，避免固定窗口切断（patch 注释较长）或越界到相邻函数。
+  const callAt = src.indexOf('swcCli.default(', at);
+  if (callAt === -1) {
+    bad('锚点之后找不到 swcCli.default(...) 调用——上游结构已变，需重新审查 patch');
+    return false;
+  }
+  let depth = 0;
+  let end = -1;
+  for (let i = src.indexOf('(', callAt); i < src.length; i++) {
+    if (src[i] === '(') depth += 1;
+    else if (src[i] === ')') {
+      depth -= 1;
+      if (depth === 0) {
+        end = i;
+        break;
+      }
+    }
+  }
+  if (end === -1) {
+    bad('swcCli.default(...) 括号无法配平，跳过静态检查');
+    return false;
+  }
+  const region = src.slice(callAt, end + 1);
+  // 合理性校验：这段必须是那个 cliOptions 对象，否则说明定位错了
+  if (!region.includes('filenames')) {
+    bad('定位到的 swcCli.default(...) 实参不含 filenames，静态检查定位失败');
+    return false;
+  }
+  const hasWatchFalse = /watch:\s*false/.test(region);
+  const hasSyncTrue = /sync:\s*true/.test(region);
+
+  if (hasWatchFalse && hasSyncTrue) {
+    ok('patch 已生效：file-add 回调带 watch:false + sync:true');
+    return true;
+  }
+  bad(
+    'patch 未生效：file-add 回调缺少 watch:false / sync:true' +
+      `（watch:false=${hasWatchFalse}, sync:true=${hasSyncTrue}）。` +
+      '执行 pnpm install 重新应用，或按新版本重打 patch',
+  );
+  return false;
+}
+
+/** 顺带提示 @swc/cli 上游是否已自行修复（届时可考虑撤掉本项目的 patch）。 */
+function checkUpstreamSwcCli() {
+  if (!fs.existsSync(SWC_DIR_MOD)) return;
+  const src = fs.readFileSync(SWC_DIR_MOD, 'utf8');
+  const hasPool = /new piscina_1\.default\(/.test(src);
+  const hasDestroy = /workers\.destroy\(\)/.test(src);
+  if (hasPool && hasDestroy) {
+    console.log(
+      `${YELLOW}!${RESET} @swc/cli 现在会 destroy worker pool（上游似已修复）——` +
+        '可复核是否还需要本项目的 nest patch',
+    );
+  } else if (hasPool) {
+    info('@swc/cli 仍未 destroy worker pool（上游未修复，patch 仍有必要）');
+  }
+}
+
+// ---------- 动态检查：按 nest 的调用形状实跑，量泄漏 ----------
+
+const swcOptions = {
+  sourceMaps: true,
+  module: { type: 'commonjs' },
+  jsc: {
+    target: 'es2020',
+    parser: { syntax: 'typescript', decorators: true, dynamicImport: true },
+    transform: { legacyDecorator: true, decoratorMetadata: true },
+    keepClassNames: true,
+  },
+  minify: false,
+  swcrc: false,
+};
+
+async function measure(swcDir, label, shape, rounds, tmpRoot) {
+  const src = path.join(tmpRoot, `${label}-src`);
+  const out = path.join(tmpRoot, `${label}-dist`);
+  fs.mkdirSync(src, { recursive: true });
+
+  const before = { t: threadCount(), h: handleCount() };
+  const times = [];
+
+  for (let i = 0; i < rounds; i++) {
+    const file = path.join(src, `probe${i}.ts`);
+    fs.writeFileSync(
+      file,
+      "import { Injectable } from '@nestjs/common';\n" +
+        `@Injectable()\nexport class Probe${i} {\n` +
+        `  private readonly n = ${i};\n` +
+        '  run(x: number): string { return `${this.n}:${x}`; }\n}\n',
+    );
+    const started = Date.now();
+    await swcDir({
+      cliOptions: {
+        outDir: out,
+        filenames: [path.relative(process.cwd(), file)],
+        extensions: ['.js', '.ts'],
+        copyFiles: false,
+        includeDotfiles: false,
+        quiet: true,
+        stripLeadingPaths: true,
+        ...shape,
+      },
+      swcOptions,
+    });
+    times.push(Date.now() - started);
+  }
+
+  // 给 piscina 的 eager spawn 留出时间，避免低估
+  await new Promise((r) => setTimeout(r, 500));
+
+  const after = { t: threadCount(), h: handleCount() };
+  const compiled = fs.existsSync(out) ? fs.readdirSync(out).length : 0;
+  return {
+    dThreads: after.t - before.t,
+    dHandles: after.h - before.h,
+    avgMs: times.reduce((a, b) => a + b, 0) / times.length,
+    compiled,
+  };
+}
+
+async function main() {
+  console.log('swc watch 泄漏回归检测\n');
+
+  const patchOk = checkPatchApplied();
+  checkUpstreamSwcCli();
+  console.log('');
+
+  if (!fs.existsSync(SWC_DIR_MOD)) {
+    bad('找不到 @swc/cli，跳过动态检测');
+    return finish();
+  }
+
+  const swcDir = require(SWC_DIR_MOD).default;
+  const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'swc-leak-'));
+  const ROUNDS = 6;
+
+  try {
+    // 预热：@swc/core 的原生 binding 首次编译时会建自己的线程池，那是固有开销、
+    // 不是泄漏。用 sync:true 预热（该路径不创建 Piscina pool），免得记到第一组头上。
+    await measure(swcDir, 'warmup', { watch: false, sync: true }, 1, tmpRoot);
+
+    // 与 patch 后 nest 实际传参一致
+    const fixed = await measure(swcDir, 'fixed', { watch: false, sync: true }, ROUNDS, tmpRoot);
+    // 未打 patch 时 nest 的传参，作为对照，确认探针本身有区分力
+    const leaky = await measure(swcDir, 'leaky', { watch: true, sync: false }, ROUNDS, tmpRoot);
+
+    console.log(`${ROUNDS} 次 file-add（cpus=${os.cpus().length}）：\n`);
+    console.log('  调用形状                     Δ线程  Δ句柄   平均耗时  产物');
+    console.log('  ' + '-'.repeat(62));
+    const row = (name, r) =>
+      `  ${name.padEnd(28)} ${String(r.dThreads).padStart(5)} ${String(r.dHandles).padStart(6)}` +
+      `  ${r.avgMs.toFixed(1).padStart(7)}ms  ${r.compiled}`;
+    console.log(row('watch:false + sync:true', fixed));
+    console.log(row('watch:true + sync:false', leaky));
+    console.log('');
+
+    if (fixed.compiled === 0) {
+      bad('patch 形状下没有产物，编译链路异常');
+    }
+
+    if (fixed.dThreads > 0 || fixed.dHandles > 0) {
+      bad(
+        `patch 形状仍在泄漏（Δ线程=${fixed.dThreads}, Δ句柄=${fixed.dHandles}），` +
+          '预期均为 0——@swc/cli 行为可能已改变',
+      );
+    } else {
+      ok('patch 形状零泄漏（Δ线程=0, Δ句柄=0）');
+    }
+
+    if (leaky.dThreads <= 0 && leaky.dHandles <= 0) {
+      console.log(
+        `${YELLOW}!${RESET} 对照组也没泄漏——上游可能已修复，` +
+          '本项目的 patch 或许可以撤掉（请复核后再决定）',
+      );
+    } else {
+      info(
+        `对照组确认仍会泄漏（Δ线程=${leaky.dThreads}, Δ句柄=${leaky.dHandles}），` +
+          '探针有区分力',
+      );
+    }
+  } finally {
+    fs.rmSync(tmpRoot, { recursive: true, force: true });
+  }
+
+  if (!patchOk) {
+    info('静态检查未通过，即使动态指标正常也应复核 patch');
+  }
+  finish();
+}
+
+function finish() {
+  console.log('');
+  if (problems.length) {
+    console.log(`${RED}检测到 ${problems.length} 个问题${RESET}`);
+    process.exit(1);
+  }
+  console.log(`${GREEN}全部通过${RESET}`);
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.error(`${RED}探针异常${RESET}: ${e && e.stack ? e.stack : e}`);
+  process.exit(1);
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/notify-dev-servers.js

@@ -27,7 +27,7 @@
  *   POSTGEN_POLL_MS               健康 poll 间隔，默认 250ms
  *   POSTGEN_INITIAL_STABLE_MS     初始稳定窗口，默认 3000ms
  *   POSTGEN_MAX_STABLE_MS         稳定窗口上限，默认 15000ms
- *   POSTGEN_OBSERVE_DOWN_TIMEOUT_MS  等待第一次 down 的超时，默认 15000ms
+ *   POSTGEN_OBSERVE_DOWN_TIMEOUT_MS  等待第一次 down 的超时，默认 5000ms
  *   POSTGEN_TOTAL_TIMEOUT_MS      Phase 2 硬超时，默认 60000ms
  *
  * 与 CLI 通信约定：

package/dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/wait-for-nest-ready.js

@@ -25,7 +25,9 @@ const DEFAULTS = {
   initialStableMs: 3000,
   maxStableMs: 15000,
   observeDownTimeoutMs: 5000,
-  totalTimeoutMs: 15000,
+  // 必须显著大于 maxStableMs：否则窗口一旦扩到上限，这里的硬超时总会先触发，
+  // 自适应窗口永远等不到"稳定"就被 timeout 放行（等于退化成固定等待）。
+  totalTimeoutMs: 60000,
 };
 
 /**

package/dist/lib/application/files/gadmin2-game-angle-demo/server/scripts/wait-for-nest-ready.test.js

@@ -58,7 +58,8 @@ test('nest 一开始就没跑：直接跳过', async () => {
 });
 
 test('Phase 1 超时（一直 up）：跳过', async () => {
-  // 100 次 up，覆盖 15s / 250ms = 60 次以上的 poll。
+  // 下面显式把 observeDownTimeoutMs 压到 1000ms，只需 1000/250 = 4 次 poll
+  // 就会命中 Phase 1 超时；100 次 up 是富余量。
   const env = makeEnv(new Array(100).fill('up'));
   const res = await waitForNestReady({
     ping: env.ping,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/canvas/canvas.controller.ts

@@ -18,6 +18,7 @@ import { ApiTags } from '@nestjs/swagger';
 import { UseRoles } from 'nest-access-control';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { ImportPayloadDto } from './canvas-export.dto';
 import { CanvasExportService } from './canvas-export.service';
 import {
@@ -149,7 +150,7 @@ export class CanvasController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/page/page.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/page/dto/page-types.dto';
 import { UpdatePageDto } from '../../generated/page/dto/update-page.dto';
 import { PageEntity } from '../../generated/page/entities/page.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { PageTransferService } from '../permTransfer/page-transfer.service';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { PageService } from './page.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -248,7 +248,7 @@ export class PageController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/transfer-export.decorator.spec.ts

@@ -0,0 +1,34 @@
+import { setCredentialedExportCorsHeaders } from './transfer-export.decorator';
+
+describe('setCredentialedExportCorsHeaders', () => {
+  it('reflects the request origin for credentialed export responses', () => {
+    const response = {
+      setHeader: jest.fn(),
+      vary: jest.fn(),
+    };
+
+    setCredentialedExportCorsHeaders('https://target.example.com', response);
+
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Access-Control-Allow-Origin',
+      'https://target.example.com',
+    );
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'Access-Control-Allow-Credentials',
+      'true',
+    );
+    expect(response.vary).toHaveBeenCalledWith('Origin');
+  });
+
+  it('leaves non-browser responses unchanged when Origin is absent', () => {
+    const response = {
+      setHeader: jest.fn(),
+      vary: jest.fn(),
+    };
+
+    setCredentialedExportCorsHeaders(undefined, response);
+
+    expect(response.setHeader).not.toHaveBeenCalled();
+    expect(response.vary).not.toHaveBeenCalled();
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/permTransfer/transfer-export.decorator.ts

@@ -0,0 +1,42 @@
+import {
+  applyDecorators,
+  NestInterceptor,
+  UseInterceptors,
+} from '@nestjs/common';
+import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+
+interface CorsResponse {
+  setHeader(name: string, value: string): unknown;
+  vary(field: string): unknown;
+}
+
+export function setCredentialedExportCorsHeaders(
+  origin: unknown,
+  response: CorsResponse,
+): void {
+  if (typeof origin !== 'string' || !origin) return;
+
+  response.setHeader('Access-Control-Allow-Origin', origin);
+  response.setHeader('Access-Control-Allow-Credentials', 'true');
+  response.vary('Origin');
+}
+
+const credentialedExportCorsInterceptor: NestInterceptor = {
+  intercept(context, next) {
+    const request = context.switchToHttp().getRequest();
+    const response = context.switchToHttp().getResponse();
+
+    setCredentialedExportCorsHeaders(request.headers.origin, response);
+    return next.handle();
+  },
+};
+
+/**
+ * Public export endpoints authenticate with their short-lived transfer token,
+ * while the browser may include its gateway cookie from any deployment origin.
+ */
+export const AllowTransferExportRequest = () =>
+  applyDecorators(
+    AllowUnauthorizedRequest(),
+    UseInterceptors(credentialedExportCorsInterceptor),
+  );

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/resource/resource.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/resource/dto/resource-types.dto';
 import { UpdateResourceDto } from '../../generated/resource/dto/update-resource.dto';
 import { ResourceEntity } from '../../generated/resource/entities/resource.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
 import { ResourceTransferService } from '../permTransfer/resource-transfer.service';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { ResourceService } from './resource.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -194,7 +194,7 @@ export class ResourceController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/role/role.controller.ts

@@ -46,9 +46,9 @@ import {
 } from '../../generated/role/dto/role-types.dto';
 import { UpdateRoleDto } from '../../generated/role/dto/update-role.dto';
 import { RoleEntity } from '../../generated/role/entities/role.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
 import { RoleTransferService } from '../permTransfer/role-transfer.service';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { RoleService } from './role.service';
 
 import { ConfigService } from '@nestjs/config';
@@ -208,7 +208,7 @@ export class RoleController {
   }
 
   @Get('export/:name')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('name') name: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/user/user.controller.ts

@@ -46,8 +46,8 @@ import {
   UserWhereSelect,
 } from '../../generated/user/dto/user-types.dto';
 import { UserEntity } from '../../generated/user/entities/user.entity';
-import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
 import { ImportPayloadDto } from '../permTransfer/perm-transfer.dto';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { UserTransferService } from '../permTransfer/user-transfer.service';
 import { UserService } from './user.service';
 
@@ -207,7 +207,7 @@ export class UserController {
   }
 
   @Get('export/:userid')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('userid') userid: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/require-user-group.decorator.spec.ts

@@ -0,0 +1,23 @@
+import {
+  REQUIRED_USER_GROUP_KEY,
+  RequireUserGroup,
+} from './require-user-group.decorator';
+
+describe('RequireUserGroup', () => {
+  it('stores a normalized group code as route metadata', () => {
+    class Controller {
+      @RequireUserGroup('  it_ops  ')
+      create() {}
+    }
+
+    expect(
+      Reflect.getMetadata(REQUIRED_USER_GROUP_KEY, Controller.prototype.create),
+    ).toBe('it_ops');
+  });
+
+  it('rejects an empty group code instead of disabling authorization', () => {
+    expect(() => RequireUserGroup('   ')).toThrow(
+      'RequireUserGroup requires a non-empty group code',
+    );
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/require-user-group.decorator.ts

@@ -0,0 +1,15 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const REQUIRED_USER_GROUP_KEY = 'required_user_group';
+
+/**
+ * Restricts an endpoint to authenticated users resolved from the given active
+ * user group. Nested active child groups are included by UserGroupService.
+ */
+export function RequireUserGroup(groupCode: string) {
+  const normalizedGroupCode = groupCode.trim();
+  if (!normalizedGroupCode) {
+    throw new Error('RequireUserGroup requires a non-empty group code');
+  }
+  return SetMetadata(REQUIRED_USER_GROUP_KEY, normalizedGroupCode);
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.guard.spec.ts

@@ -0,0 +1,90 @@
+import {
+  ExecutionContext,
+  ForbiddenException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { UserGroupDomainError } from './user-group.errors';
+import { UserGroupGuard } from './user-group.guard';
+import { UserGroupService } from './user-group.service';
+
+function context(user?: { userid?: string | number; username?: string }) {
+  return {
+    getHandler: () => function handler() {},
+    getClass: () => class Controller {},
+    switchToHttp: () => ({ getRequest: () => ({ user }) }),
+  } as unknown as ExecutionContext;
+}
+
+describe('UserGroupGuard', () => {
+  const reflector = {
+    getAllAndOverride: jest.fn(),
+  };
+  const groups = {
+    isUserInGroup: jest.fn(),
+  };
+  const guard = new UserGroupGuard(
+    reflector as unknown as Reflector,
+    groups as unknown as UserGroupService,
+  );
+
+  beforeEach(() => jest.clearAllMocks());
+
+  it('allows endpoints without a required user group', async () => {
+    reflector.getAllAndOverride.mockReturnValue(undefined);
+
+    await expect(guard.canActivate(context())).resolves.toBe(true);
+    expect(groups.isUserInGroup).not.toHaveBeenCalled();
+  });
+
+  it('allows an authenticated member of the required group', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(true);
+
+    await expect(guard.canActivate(context({ userid: 'alice' }))).resolves.toBe(
+      true,
+    );
+    expect(groups.isUserInGroup).toHaveBeenCalledWith('it_ops', 'alice');
+  });
+
+  it('falls back to username when userid is unavailable', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(true);
+
+    await guard.canActivate(context({ username: 'alice' }));
+
+    expect(groups.isUserInGroup).toHaveBeenCalledWith('it_ops', 'alice');
+  });
+
+  it('rejects a request without an authenticated identity', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+
+    await expect(guard.canActivate(context())).rejects.toBeInstanceOf(
+      UnauthorizedException,
+    );
+  });
+
+  it('rejects a user outside the required group', async () => {
+    reflector.getAllAndOverride.mockReturnValue('it_ops');
+    groups.isUserInGroup.mockResolvedValue(false);
+
+    await expect(
+      guard.canActivate(context({ userid: 'bob' })),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it('fails closed when the configured group is missing', async () => {
+    reflector.getAllAndOverride.mockReturnValue('missing');
+    groups.isUserInGroup.mockRejectedValue(
+      new UserGroupDomainError(
+        'USER_GROUP_NOT_FOUND',
+        'User group not found',
+        404,
+      ),
+    );
+
+    await expect(
+      guard.canActivate(context({ userid: 'alice' })),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+});

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.guard.ts

@@ -0,0 +1,51 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Request } from 'express';
+import { UserGroupDomainError } from './user-group.errors';
+import { REQUIRED_USER_GROUP_KEY } from './require-user-group.decorator';
+import { UserGroupService } from './user-group.service';
+
+type AuthenticatedRequest = Request & {
+  user?: {
+    userid?: string | number;
+    username?: string;
+  };
+};
+
+@Injectable()
+export class UserGroupGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly groups: UserGroupService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const groupCode = this.reflector.getAllAndOverride<string>(
+      REQUIRED_USER_GROUP_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (!groupCode) return true;
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const userId = request.user?.userid ?? request.user?.username;
+    if (userId === undefined || String(userId).trim() === '') {
+      throw new UnauthorizedException('Authenticated user is required');
+    }
+
+    try {
+      if (await this.groups.isUserInGroup(groupCode, String(userId))) {
+        return true;
+      }
+    } catch (error) {
+      if (!(error instanceof UserGroupDomainError)) throw error;
+    }
+
+    throw new ForbiddenException('User is not a member of the required group');
+  }
+}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.service.spec.ts

@@ -78,6 +78,24 @@ describe('UserGroupService', () => {
     });
   });
 
+  it('checks membership using resolved active users', async () => {
+    const { service } = createHarness();
+    jest
+      .spyOn(service, 'resolveUsers')
+      .mockResolvedValue([{ userid: 'alice', username: 'Alice' }]);
+
+    await expect(service.isUserInGroup('finance', 'alice')).resolves.toBe(true);
+    await expect(service.isUserInGroup('finance', 'bob')).resolves.toBe(false);
+  });
+
+  it('rejects blank membership identities without resolving the group', async () => {
+    const { service } = createHarness();
+    const resolveUsers = jest.spyOn(service, 'resolveUsers');
+
+    await expect(service.isUserInGroup('finance', '   ')).resolves.toBe(false);
+    expect(resolveUsers).not.toHaveBeenCalled();
+  });
+
   it('replaces members and bumps revision', async () => {
     const { service, tx } = createHarness();
     tx.user.findMany.mockResolvedValue([{ userid: 'u1' }]);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/user-group.service.ts

@@ -334,6 +334,13 @@ export class UserGroupService {
     return [...users.values()].sort((a, b) => a.userid.localeCompare(b.userid));
   }
 
+  async isUserInGroup(code: string, userId: string): Promise<boolean> {
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) return false;
+    const users = await this.resolveUsers(code);
+    return users.some((user) => user.userid === normalizedUserId);
+  }
+
   private async findGroup(tx: Transaction, code: string) {
     const group = await tx.userGroup.findUnique({ where: { code } });
     if (!group) throw userGroupNotFound(code);

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/userGroup/userGroup.module.ts

@@ -1,10 +1,11 @@
 import { Module } from '@nestjs/common';
 import { UserGroupController } from './user-group.controller';
+import { UserGroupGuard } from './user-group.guard';
 import { UserGroupService } from './user-group.service';
 
 @Module({
   controllers: [UserGroupController],
-  providers: [UserGroupService],
-  exports: [UserGroupService],
+  providers: [UserGroupService, UserGroupGuard],
+  exports: [UserGroupService, UserGroupGuard],
 })
 export class UserGroupModule {}

package/dist/lib/application/files/gadmin2-game-angle-demo/server/src/modules/workflow/workflow.controller.ts

@@ -24,6 +24,7 @@ import { Request } from 'express';
 import { UseRoles } from 'nest-access-control';
 import { PrismaService } from 'nestjs-prisma';
 import { AllowUnauthorizedRequest } from '../../lib/auth.guard';
+import { AllowTransferExportRequest } from '../permTransfer/transfer-export.decorator';
 import { TemporalService } from './temporal.service';
 import { listWorkflowDatabaseFunctions } from './workflow-database-function';
 import {
@@ -196,7 +197,7 @@ export class WorkflowController {
   }
 
   @Get('export/:code')
-  @AllowUnauthorizedRequest()
+  @AllowTransferExportRequest()
   async getExportPayload(
     @Param('code') code: string,
     @Query('token') token: string,

package/dist/lib/application/files/gadmin2-game-angle-demo/web/vite.config.ts

@@ -96,7 +96,7 @@ export default defineConfig(({ mode }) => {
           '**/.vite/**',
           // 生成物不参与 HMR：分发期间会有几百个 add/change 事件，
           // 若不 ignore 会触发大量级联失效。改由 gadminRestartPlugin
-          // 在分发全部完成后一次性 server.restart() 加载最新内容。
+          // 在分发全部完成后一次性 invalidate + full-reload（见文件顶部说明）。
           '**/src/generated/**',
         ],
         awaitWriteFinish: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gadmin2n/schematics",
-  "version": "0.0.157",
+  "version": "0.0.159",
   "description": "Gadmin - modern, fast, powerful node.js web framework (@schematics)",
   "main": "dist/index.js",
   "files": [