@gadmin2n/schematics 0.0.70 → 0.0.71

package/src/lib/application/files/gadmin2-game-angle-demo/server/seed/permissions.ts

@@ -0,0 +1,244 @@
+import { PrismaClient } from '@prisma/client';
+import {
+  bindResourceToPage,
+  FULL_ACTIONS,
+  upsertPage,
+  upsertResource,
+} from '../scripts/lib/page-helpers';
+
+/**
+ * Seed permission-related tables so that the SYSTEM_ADMIN role is recognised
+ * by nest-access-control on first startup.
+ *
+ * Covers the two prisma schema files that define the admin/permission modules:
+ *   - config/prisma/default-schema.prisma  → user, audit resources
+ *   - config/prisma/page.prisma            → role, page, resource resources
+ *
+ * Safe to re-run: every write uses upsert / createMany + skipDuplicates.
+ *
+ * Data model (single source of truth):
+ *   resourceDefs[].pageCode  — which page "owns" this resource.
+ *     • undefined  → pure system resource, no page binding (currently unused)
+ *     • string     → creates a t_page_resource row linking the resource to that page
+ *   Multiple resources can share the same pageCode (e.g. rolePages + roleResource
+ *   both belong to the 'role' page because that page's UI calls both APIs).
+ */
+export async function seedPermissions(prisma: PrismaClient) {
+  // ------------------------------------------------------------------ Role --
+  const systemAdminRole = await prisma.role.upsert({
+    where: { name: 'SYSTEM_ADMIN' },
+    update: {},
+    create: {
+      name: 'SYSTEM_ADMIN',
+      description: 'System administrator with full access',
+    },
+  });
+  console.log(`[seed] Role: SYSTEM_ADMIN (id=${systemAdminRole.id})`);
+
+  // --------------------------------------------------------------- Resources -
+  // pageCode: which leaf page "owns" this resource (drives t_page_resource rows).
+  const resourceDefs: {
+    code: string;
+    description: string;
+    pageCode?: string;
+  }[] = [
+    // ── permission module ────────────────────────────────────────────────────
+    { code: 'user', description: 'User management', pageCode: 'user' },
+    { code: 'role', description: 'Role management', pageCode: 'role' },
+    {
+      code: 'rolePages',
+      description: 'Role-page assignments',
+      pageCode: 'role',
+    },
+    {
+      code: 'roleResource',
+      description: 'Role-resource grants',
+      pageCode: 'role',
+    },
+    { code: 'page', description: 'Page / menu management', pageCode: 'page' },
+    {
+      code: 'pageResource',
+      description: 'Page-resource configuration',
+      pageCode: 'page',
+    },
+    {
+      code: 'resource',
+      description: 'Resource management',
+      pageCode: 'resource',
+    },
+    { code: 'audit', description: 'Audit logs', pageCode: 'audits' },
+    // ── business module ──────────────────────────────────────────────────────
+    {
+      code: 'game',
+      description: 'Business / Game management',
+      pageCode: 'game',
+    },
+    { code: 'canvas', description: 'Canvas management', pageCode: 'canvas' },
+  ];
+
+  const resources: { id: number; code: string }[] = [];
+  for (const def of resourceDefs) {
+    const r = await upsertResource(prisma, def.code, def.description);
+    resources.push({ id: r.id, code: r.code });
+    console.log(`[seed] Resource: ${r.code} (id=${r.id})`);
+  }
+
+  // ------------------------------------------------------------------ Pages --
+  // Created in order (parent first) so that parentId can be resolved.
+
+  const pages: { id: number; code: string }[] = [];
+
+  // Level 1: top-level group (系统管理)
+  const adminPage = await upsertPage(prisma, {
+    code: 'admin',
+    name: 'admin',
+    zhName: '系统管理',
+    enName: 'System Mgnt',
+    sortOrder: 1000,
+  });
+  pages.push({ id: adminPage.id, code: adminPage.code });
+  console.log(`[seed] Page: ${adminPage.code} (id=${adminPage.id})`);
+
+  // Level 2: 数据管理 — child of admin
+  const dataMngt = await upsertPage(prisma, {
+    code: 'dataMngt',
+    name: '数据管理',
+    zhName: '数据管理',
+    enName: 'Data Management',
+    sortOrder: 1000,
+    parentId: adminPage.id,
+  });
+  pages.push({ id: dataMngt.id, code: dataMngt.code });
+  console.log(`[seed] Page: ${dataMngt.code} (id=${dataMngt.id})`);
+
+  // Level 2: permission group (权限管理) — child of admin
+  const permissionPage = await upsertPage(prisma, {
+    code: 'permission',
+    name: 'permission',
+    zhName: '权限管理',
+    enName: 'Permission Mgnt',
+    sortOrder: 1010,
+    parentId: adminPage.id,
+  });
+  pages.push({ id: permissionPage.id, code: permissionPage.code });
+  console.log(`[seed] Page: ${permissionPage.code} (id=${permissionPage.id})`);
+
+  // Level 3: leaf pages under permission group
+  const permissionChildDefs = [
+    {
+      code: 'permission_readme',
+      name: 'permission_readme',
+      zhName: '菜单指引',
+      enName: 'Menu Guide',
+      sortOrder: 1005,
+    },
+    {
+      code: 'user',
+      name: 'user',
+      zhName: '用户管理',
+      enName: 'User Mgnt',
+      sortOrder: 1010,
+    },
+    {
+      code: 'role',
+      name: 'role',
+      zhName: '角色管理',
+      enName: 'Role Mgnt',
+      sortOrder: 1020,
+    },
+    {
+      code: 'page',
+      name: 'page',
+      zhName: '页面管理',
+      enName: 'Page Mgnt',
+      sortOrder: 1030,
+    },
+    {
+      code: 'resource',
+      name: 'resource',
+      zhName: '资源管理',
+      enName: 'Resource Management',
+      sortOrder: 1040,
+    },
+  ];
+
+  for (const def of permissionChildDefs) {
+    const p = await upsertPage(prisma, { ...def, parentId: permissionPage.id });
+    pages.push({ id: p.id, code: p.code });
+    console.log(`[seed] Page: ${p.code} (id=${p.id})`);
+  }
+
+  // Level 2: other top-level children of admin (业务、审计日志)
+  const adminChildDefs = [
+    {
+      code: 'canvas',
+      name: 'canvas',
+      zhName: 'Canvas',
+      enName: 'Canvas',
+      sortOrder: 1005,
+    },
+    {
+      code: 'game',
+      name: 'game',
+      zhName: '业务管理',
+      enName: 'Business Mgnt',
+      sortOrder: 1050,
+    },
+    {
+      code: 'audits',
+      name: 'audits',
+      zhName: '审计日志',
+      enName: 'Audit Log',
+      sortOrder: 1060,
+    },
+  ];
+
+  for (const def of adminChildDefs) {
+    const p = await upsertPage(prisma, { ...def, parentId: adminPage.id });
+    pages.push({ id: p.id, code: p.code });
+    console.log(`[seed] Page: ${p.code} (id=${p.id})`);
+  }
+
+  // ------------------------------------------------------- PageResource links -
+  for (const def of resourceDefs) {
+    if (!def.pageCode) continue;
+
+    const targetPage = pages.find((p) => p.code === def.pageCode);
+    if (!targetPage) {
+      console.warn(
+        `[seed] PageResource: page "${def.pageCode}" not found — skipping ${def.code}`,
+      );
+      continue;
+    }
+
+    await bindResourceToPage(prisma, targetPage.id, def.code, def.description);
+    console.log(
+      `[seed] PageResource: page(${def.pageCode}) ↔ resource(${def.code})`,
+    );
+  }
+
+  // --------------------------------------------------- RoleResource (grants) -
+  await prisma.roleResource.createMany({
+    data: resources.map((r) => ({
+      roleId: systemAdminRole.id,
+      resourceId: r.id,
+      actions: FULL_ACTIONS,
+    })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `[seed] RoleResource: SYSTEM_ADMIN granted full access to ${resources.length} resources`,
+  );
+
+  // ------------------------------------------------------ RolePages (access) -
+  await prisma.rolePages.createMany({
+    data: pages.map((p) => ({
+      roleId: systemAdminRole.id,
+      pageId: p.id,
+    })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `[seed] RolePages: SYSTEM_ADMIN granted access to ${pages.length} pages`,
+  );
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/seed/users.ts

@@ -0,0 +1,7 @@
+export default [
+  { userid: 'junrujrwang', username: 'junrujrwang', roles: '["SYSTEM_ADMIN"]' },
+  { userid: 'kavenma', username: 'kavenma', roles: '["SYSTEM_ADMIN"]' },
+  { userid: 'jasonlan', username: 'jasonlan', roles: '["SYSTEM_ADMIN"]' },
+  { userid: 'davywang', username: 'davywang', roles: '["SYSTEM_ADMIN"]' },
+  { userid: 'ypengxu', username: 'ypengxu', roles: '["SYSTEM_ADMIN"]' },
+];

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/alias.config.ts

@@ -0,0 +1,7 @@
+const moduleAlias = require('module-alias');
+import { join } from 'path';
+
+// 注册别名（与 tsconfig.json 保持一致）
+moduleAlias.addAliases({
+  '@': join(__dirname, '.'), // 指向 src 目录
+});

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/app.controller.spec.ts

@@ -0,0 +1,22 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { AppController } from './app.controller';
+import { AppService } from './app.service';
+
+describe('AppController', () => {
+  let appController: AppController;
+
+  beforeEach(async () => {
+    const app: TestingModule = await Test.createTestingModule({
+      controllers: [AppController],
+      providers: [AppService],
+    }).compile();
+
+    appController = app.get<AppController>(AppController);
+  });
+
+  describe('root', () => {
+    it('should return "Hello World!"', () => {
+      expect(appController.getHello()).toBe('Hello World!');
+    });
+  });
+});

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/app.controller.ts

@@ -0,0 +1,192 @@
+import { UserType } from '@gadmin2n/nest-common';
+import { CacheInterceptor, CacheTTL } from '@nestjs/cache-manager';
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Get,
+  Inject,
+  Post,
+  Query,
+  Req,
+  Res,
+  UseInterceptors,
+} from '@nestjs/common';
+import {
+  ApiOkResponse,
+  ApiOperation,
+  ApiProperty,
+  ApiQuery,
+} from '@nestjs/swagger';
+import { trace } from '@opentelemetry/api';
+import { Request, Response } from 'express';
+import { UseRoles } from 'nest-access-control';
+import { WINSTON_MODULE_PROVIDER } from 'nest-winston';
+import { PrismaService } from 'nestjs-prisma';
+import * as path from 'path';
+import { Logger } from 'winston';
+import { AppService } from './app.service';
+import { AllowUnauthorizedRequest } from './lib/auth.guard';
+
+class UserInfo {
+  @ApiProperty()
+  userid: string;
+
+  @ApiProperty()
+  username: string;
+}
+@Controller()
+export class AppController {
+  constructor(
+    private readonly appService: AppService,
+    private readonly prisma: PrismaService,
+    @Inject(WINSTON_MODULE_PROVIDER) private readonly logger: Logger,
+  ) {
+    this.logger = this.logger.child({
+      file: path.basename(__filename),
+    });
+  }
+
+  @Get('userinfo')
+  @ApiOkResponse({ type: UserInfo })
+  userInfo(@Req() request: Request & { user: UserType }) {
+    return request?.user || { userid: '', username: '' };
+  }
+
+  @Get('hello')
+  hello(): string {
+    this.logger.info('hello');
+    return this.appService.getHello();
+  }
+
+  /**
+   * 调试端点：验证 Prisma OpenTelemetry tracing 是否正常工作
+   * 调用后查看 APM 中是否有 prisma:client:* 和 prisma:engine:* spans
+   */
+  @Get('debug/tracing')
+  @AllowUnauthorizedRequest()
+  @ApiOperation({ summary: '调试 Prisma tracing' })
+  async debugTracing() {
+    const globalAny = global as any;
+    const currentSpan = trace.getActiveSpan();
+    const spanContext = currentSpan?.spanContext();
+
+    // 执行一个简单的 Prisma 查询来触发 tracing
+    const userCount = await this.prisma.user.count();
+
+    return {
+      message: 'Prisma tracing debug endpoint',
+      tracerProvider: trace.getTracerProvider()?.constructor?.name,
+      currentSpan: {
+        traceId: spanContext?.traceId,
+        spanId: spanContext?.spanId,
+        traceFlags: spanContext?.traceFlags,
+        sampled: spanContext?.traceFlags === 1,
+      },
+      prismaInstrumentation: {
+        PRISMA_INSTRUMENTATION: !!globalAny.PRISMA_INSTRUMENTATION,
+        V6_PRISMA_INSTRUMENTATION: !!globalAny.V6_PRISMA_INSTRUMENTATION,
+        helperEnabled:
+          globalAny.PRISMA_INSTRUMENTATION?.helper?.isEnabled() ?? false,
+      },
+      testQuery: {
+        userCount,
+      },
+      env: {
+        OTEL_SERVICE_NAME: process.env.OTEL_SERVICE_NAME,
+        OTEL_EXPORTER_OTLP_ENDPOINT: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
+      },
+    };
+  }
+
+  @UseInterceptors(CacheInterceptor)
+  @CacheTTL(10 * 1000) //10 seconds
+  @Get('get-number')
+  getNumber(): number {
+    // 随机生成一个0-100之间的数字
+    return Math.floor(Math.random() * 100);
+  }
+
+  @Get('login-callback')
+  @AllowUnauthorizedRequest()
+  loginCallback(@Req() request: Request, @Res() res) {
+    return this.appService.loginCallback(request, res);
+  }
+
+  @Get('login')
+  @AllowUnauthorizedRequest()
+  login(@Req() request: Request, @Res() res) {
+    return this.appService.login(request, res);
+  }
+
+  @Get('logout')
+  @AllowUnauthorizedRequest()
+  logout(@Req() request: Request, @Res() res) {
+    return this.appService.logout(request, res);
+  }
+
+  // ============ External Page 路由 ============
+
+  @Get('gtdr-page/sign-url')
+  @UseRoles({
+    resource: 'gtdrReport',
+    action: 'create',
+    possession: 'any',
+  })
+  @ApiOperation({ summary: '获取带签名的外部页面访问URL，302重定向' })
+  @ApiQuery({ name: 'domain', required: true, description: 'Domain 编码' })
+  @ApiQuery({ name: 'pageCode', required: true, description: '页面编码' })
+  getExternalPageSignedUrl(
+    @Query('domain') domain: string,
+    @Query('pageCode') pageCode: string,
+    @Req() req: Request & { user?: UserType },
+    @Res() res: Response,
+  ): void {
+    if (!domain) {
+      throw new BadRequestException('domain is required');
+    }
+    if (!pageCode) {
+      throw new BadRequestException('pageCode is required');
+    }
+
+    const userid = req.user?.userid || 'anonymous';
+
+    this.logger.info(
+      `external_page_sign_url_request - 请求签名URL - userid: ${userid}, domain: ${domain}, pageCode: ${pageCode}`,
+    );
+
+    const { url } = this.appService.generateExternalPageSignedUrl(
+      domain,
+      pageCode,
+      userid,
+    );
+    res.redirect(302, url);
+  }
+
+  @Post('external-page/verify')
+  @ApiOperation({ summary: '验证外部页面签名（用于测试）' })
+  verifyExternalPageSignature(
+    @Body()
+    body: {
+      domain: string;
+      pageCode: string;
+      userid: string;
+      timestamp: string;
+      signature: string;
+    },
+  ): { valid: boolean; reason?: string } {
+    const { domain, pageCode, userid, timestamp, signature } = body;
+
+    if (!domain || !pageCode || !userid || !timestamp || !signature) {
+      throw new BadRequestException('Missing required parameters');
+    }
+
+    return this.appService.verifyExternalPageSignature(
+      domain,
+      pageCode,
+      userid,
+      timestamp,
+      signature,
+    );
+  }
+}

package/src/lib/application/files/gadmin2-game-angle-demo/server/src/app.module.ts

@@ -0,0 +1,91 @@
+import { Module } from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+// import { ScheduleModule } from '@nestjs/schedule';
+import { CacheModule } from '@nestjs/cache-manager';
+import { AccessControlModule } from 'nest-access-control';
+import {
+  // utilities as nestWinstonModuleUtilities,
+  WinstonModule,
+} from 'nest-winston';
+import { PrismaModule } from 'nestjs-prisma';
+import * as winston from 'winston';
+import config from '../config';
+import { AppController } from './app.controller';
+import { AppService } from './app.service';
+import modules from './modules';
+
+import { ScheduleModule } from '@nestjs/schedule';
+import { ServeStaticModule } from '@nestjs/serve-static';
+import { join } from 'path';
+import { LogFormat } from './lib/logger';
+import { RoleModule } from './modules/role/role.module';
+import { RoleService } from './modules/role/role.service';
+import { RolesRefresherService } from './modules/role/roles-refresher.service';
+
+@Module({
+  imports: [
+    ScheduleModule.forRoot(),
+
+    ServeStaticModule.forRoot({
+      rootPath: join(__dirname, '..', 'www'),
+      exclude: ['/api/(.*)'],
+    }),
+
+    ConfigModule.forRoot({ isGlobal: true, load: [config] }),
+
+    AccessControlModule.forRootAsync({
+      imports: [
+        /* Any modules providing RoleService */
+        RoleModule,
+      ],
+      inject: [RoleService],
+      useFactory: async (roleService: RoleService) => {
+        const rolesData = await roleService.getBuilder(); // Fetch roles from DB
+        return rolesData;
+      },
+    }),
+
+    WinstonModule.forRootAsync({
+      useFactory: (configService: ConfigService) => {
+        const loggerConfig = configService.get('logger');
+        return {
+          level: loggerConfig.level,
+          transports: [
+            new winston.transports.Console({
+              format: LogFormat,
+            }),
+          ],
+        };
+      },
+      inject: [ConfigService],
+    }),
+
+    PrismaModule.forRootAsync({
+      isGlobal: true,
+      useFactory: async (configService: ConfigService) => {
+        const prismaConfig = configService.get('prisma');
+        return {
+          prismaOptions: {
+            log:
+              process.env.NODE_ENV === 'development'
+                ? prismaConfig.log
+                : ['warn', 'error'],
+          },
+          explicitConnect: prismaConfig.explicit,
+        };
+      },
+      inject: [ConfigService],
+    }),
+
+    CacheModule.register({
+      isGlobal: true,
+      ttl: 5 * 60 * 1000, // 5 minutes
+    }),
+
+    ...modules,
+  ],
+
+  controllers: [AppController],
+  providers: [AppService, RoleService, RolesRefresherService],
+})
+export class AppModule {}