@goplusvn/core 0.1.45 → 0.1.47

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goplusvn/core",
   "description": "GoPlusVN Platform Kit - ERP kernel: layout, RBAC, CRUD, multi-tenant, system pages",
-  "version": "0.1.45",
+  "version": "0.1.47",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
@@ -36,6 +36,7 @@
     },
     "./assets/*": "./src/assets/*",
     "./styles/*": "./src/styles/*",
+    "./auth/api-handler": "./src/auth/api-handler.ts",
     "./auth/proxy-gate": "./src/auth/proxy-gate.ts",
     "./rbac/route-handlers": "./src/rbac/route-handlers.ts",
     "./rbac/permissions-version": "./src/rbac/permissions-version.ts",
@@ -54,6 +55,26 @@
     "./utils/cccd-parser": "./src/utils/cccd-parser.ts",
     "./configs/status": "./src/configs/status.ts",
     "./configs/entities": "./src/configs/entities/index.ts",
+    "./ui/primitives/button": "./src/ui/primitives/button.tsx",
+    "./ui/primitives/input": "./src/ui/primitives/input.tsx",
+    "./ui/primitives/switch": "./src/ui/primitives/switch.tsx",
+    "./ui/primitives/label": "./src/ui/primitives/label.tsx",
+    "./ui/primitives/dialog": "./src/ui/primitives/dialog.tsx",
+    "./ui/primitives/tabs": "./src/ui/primitives/tabs.tsx",
+    "./ui/primitives/sidebar": "./src/ui/primitives/sidebar.tsx",
+    "./ui/primitives/select": "./src/ui/primitives/select.tsx",
+    "./ui/forms/multi-select": "./src/ui/forms/multi-select.tsx",
+    "./ui/data-display/collapsible": "./src/ui/data-display/collapsible.tsx",
+    "./system/services/settings-service": "./src/system/services/settings-service.ts",
+    "./system/services/system-category-service": "./src/system/services/system-category-service.ts",
+    "./system/pages/system-settings-page": "./src/system/pages/system-settings-page.tsx",
+    "./system/pages/system-category-page": "./src/system/pages/system-category-page.tsx",
+    "./rbac/role-service": "./src/rbac/role-service.ts",
+    "./rbac/resource-service": "./src/rbac/resource-service.ts",
+    "./infrastructure/cron/cron-manager": "./src/infrastructure/cron/cron-manager.ts",
+    "./infrastructure/cron/types": "./src/infrastructure/cron/types.ts",
+    "./crud/pages/entity-crud-page": "./src/crud/pages/entity-crud-page.tsx",
+    "./auth/auth-service": "./src/auth/auth-service.ts",
     "./package.json": "./package.json",
     "./providers/brand-theme": "./src/providers/brand-theme.ts"
   },

package/src/auth/__tests__/api-handler.test.ts

@@ -0,0 +1,141 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { createActionGuard, createApiHandler } from "../api-handler";
+
+interface FakeSession {
+  user: { id: string };
+  perms: string[];
+}
+
+const makeDeps = (session: FakeSession | null) => ({
+  getSession: vi.fn(async () => session),
+  checkPermission: vi.fn(
+    (s: FakeSession, resource: string, action: string) =>
+      s.perms.includes(`${resource}:${action}`),
+  ),
+});
+
+const okHandler = vi.fn(async () =>
+  new Response(JSON.stringify({ ok: true }), { status: 200 }),
+);
+
+const req = () => new Request("http://test/api/x");
+
+describe("createApiHandler", () => {
+  it("401 khi chưa đăng nhập", async () => {
+    const apiHandler = createApiHandler(makeDeps(null));
+    const route = apiHandler(okHandler);
+    const res = await route(req());
+    expect(res.status).toBe(401);
+  });
+
+  it("403 khi khai resource+action mà thiếu quyền", async () => {
+    const apiHandler = createApiHandler(
+      makeDeps({ user: { id: "u1" }, perms: [] }),
+    );
+    const route = apiHandler(okHandler, { resource: "customer", action: "create" });
+    const res = await route(req());
+    expect(res.status).toBe(403);
+  });
+
+  it("chạy handler khi đủ quyền; params mặc định cho route tĩnh", async () => {
+    const handler = vi.fn(async (_r: Request, ctx: any) => {
+      expect(await ctx.params).toEqual({});
+      expect(ctx.session.user.id).toBe("u1");
+      return new Response("ok");
+    });
+    const apiHandler = createApiHandler(
+      makeDeps({ user: { id: "u1" }, perms: ["customer:create"] }),
+    );
+    const route = apiHandler(handler, { resource: "customer", action: "create" });
+    const res = await route(req());
+    expect(res.status).toBe(200);
+    expect(handler).toHaveBeenCalledOnce();
+  });
+
+  it("public: bỏ qua authN, không gọi getSession", async () => {
+    const deps = makeDeps(null);
+    const apiHandler = createApiHandler(deps);
+    const route = apiHandler(okHandler, { public: true });
+    const res = await route(req());
+    expect(res.status).toBe(200);
+    expect(deps.getSession).not.toHaveBeenCalled();
+  });
+
+  it("assertResource được gọi lúc ĐĂNG KÝ (module load), không phải mỗi request", async () => {
+    const assertResource = vi.fn();
+    const apiHandler = createApiHandler({
+      ...makeDeps({ user: { id: "u1" }, perms: ["a:view"] }),
+      assertResource,
+    });
+    const route = apiHandler(okHandler, { resource: "a", action: "view" });
+    expect(assertResource).toHaveBeenCalledExactlyOnceWith("a");
+    await route(req());
+    await route(req());
+    expect(assertResource).toHaveBeenCalledTimes(1);
+  });
+
+  it("wrap chạy NGOÀI→TRONG theo thứ tự mảng, quanh handler", async () => {
+    const order: string[] = [];
+    const mw = (tag: string) => async (next: () => Promise<Response>) => {
+      order.push(`${tag}:in`);
+      const r = await next();
+      order.push(`${tag}:out`);
+      return r;
+    };
+    const apiHandler = createApiHandler({
+      ...makeDeps({ user: { id: "u1" }, perms: [] }),
+      wrap: [mw("A"), mw("B")],
+    });
+    const route = apiHandler(async () => {
+      order.push("handler");
+      return new Response("ok");
+    });
+    await route(req());
+    expect(order).toEqual(["A:in", "B:in", "handler", "B:out", "A:out"]);
+  });
+
+  it("onError nhận lỗi từ handler và quyết định response", async () => {
+    const onError = vi.fn(async () => new Response("mapped", { status: 500 }));
+    const apiHandler = createApiHandler({
+      ...makeDeps({ user: { id: "u1" }, perms: [] }),
+      onError,
+    });
+    const boom = new Error("boom");
+    const route = apiHandler(async () => {
+      throw boom;
+    });
+    const res = await route(req());
+    expect(res.status).toBe(500);
+    expect(onError).toHaveBeenCalledWith(boom, expect.any(Request));
+  });
+
+  it("override unauthorized/forbidden (message riêng của app)", async () => {
+    const apiHandler = createApiHandler({
+      ...makeDeps(null),
+      unauthorized: () => new Response("custom-401", { status: 401 }),
+    });
+    const res = await apiHandler(okHandler)(req());
+    expect(await res.text()).toBe("custom-401");
+  });
+});
+
+describe("createActionGuard", () => {
+  it("null khi chưa đăng nhập; null khi thiếu quyền; session khi đủ", async () => {
+    const guardAnon = createActionGuard(makeDeps(null));
+    expect(await guardAnon("receipt", "view")).toBeNull();
+
+    const s = { user: { id: "u1" }, perms: ["receipt:view"] };
+    const guard = createActionGuard(makeDeps(s));
+    expect(await guard("receipt", "view")).toBe(s);
+    expect(await guard("receipt", "delete")).toBeNull();
+  });
+
+  it("action mặc định là view; assertResource chạy mỗi lần gọi", async () => {
+    const assertResource = vi.fn();
+    const s = { user: { id: "u1" }, perms: ["receipt:view"] };
+    const guard = createActionGuard({ ...makeDeps(s), assertResource });
+    expect(await guard("receipt")).toBe(s);
+    expect(assertResource).toHaveBeenCalledWith("receipt");
+  });
+});

package/src/auth/api-handler.ts

@@ -0,0 +1,141 @@
+// @goerp/core/auth/api-handler — SKELETON cổng route/server-action cho app.
+//
+// Bằng chứng cần nó: block `getSession → 401 → checkPermission → 403` bị chép
+// ~12 lần trong chính route-handlers của core, và mỗi app (vinhhoa, wu,
+// thingtodo…) lại tự viết một `apiHandler` gói cùng các concern platform
+// (authN, authZ + registry-assert, audit-context, branch-scope, persist lỗi).
+//
+// Core CHỈ giữ khung + thứ tự chạy; mọi thứ app-specific vào qua injection:
+//   - getSession / checkPermission: nguồn phiên + luật quyền của app.
+//   - assertResource: validate resource có trong Permission Registry
+//     (fail-closed dev, warn prod — app quyết trong callback).
+//   - wrap: chuỗi middleware bọc quanh handler (audit-context AsyncLocalStorage,
+//     branch-scope…) — core KHÔNG kéo các logic đó vào.
+//   - onError: mapper lỗi của app (serverError persist error_logs).
+//
+// Usage (app side):
+//   export const apiHandler = createApiHandler({
+//     getSession, checkPermission, assertResource,
+//     wrap: [withAuditContextMw, withBranchScopeMw],
+//     onError: (e, req) => serverError(e, req),
+//   })
+//   export const requirePermission = createActionGuard({ getSession, checkPermission, assertResource })
+
+type MaybePromise<T> = T | Promise<T>;
+
+export interface ApiHandlerContext<S> {
+  session: S;
+  params: Promise<Record<string, string>>;
+}
+
+export type ApiRouteHandler<S> = (
+  req: Request,
+  ctx: ApiHandlerContext<S>,
+) => Promise<Response>;
+
+export interface ApiHandlerOptions {
+  /** Resource + action để authZ. Thiếu một trong hai → chỉ authN. */
+  resource?: string;
+  action?: string;
+  /** true → bỏ qua cả authN (endpoint public). */
+  public?: boolean;
+}
+
+/** Middleware bọc quanh handler — gọi next() để chạy tiếp chuỗi. */
+export type ApiHandlerMiddleware<S> = (
+  next: () => Promise<Response>,
+  ctx: { req: Request; session: S | null },
+) => Promise<Response>;
+
+export interface ApiHandlerFactoryDeps<S> {
+  getSession: () => MaybePromise<S | null>;
+  checkPermission: (session: S, resource: string, action: string) => boolean;
+  /** Validate resource đã khai trong registry — gọi lúc ĐĂNG KÝ handler
+   *  (module load), không phải mỗi request. */
+  assertResource?: (resource: string) => void;
+  /** Chuỗi middleware chạy NGOÀI→TRONG theo thứ tự mảng, quanh handler. */
+  wrap?: ApiHandlerMiddleware<S>[];
+  /** Mapper lỗi của app (vd serverError). Default: JSON 500 generic. */
+  onError?: (error: unknown, req: Request) => MaybePromise<Response>;
+  /** Override response 401/403 (message riêng của app). */
+  unauthorized?: () => Response;
+  forbidden?: () => Response;
+}
+
+const json = (data: unknown, status: number) =>
+  new Response(JSON.stringify(data), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+
+export function createApiHandler<S>(deps: ApiHandlerFactoryDeps<S>) {
+  const unauthorized =
+    deps.unauthorized ?? (() => json({ error: "Unauthorized" }, 401));
+  const forbidden =
+    deps.forbidden ??
+    (() => json({ error: "Bạn không có quyền thực hiện hành động này" }, 403));
+
+  return function apiHandler(
+    handler: ApiRouteHandler<S>,
+    options?: ApiHandlerOptions,
+  ) {
+    if (options?.resource) deps.assertResource?.(options.resource);
+
+    return async function route(
+      req: Request,
+      // Route tĩnh được Next gọi không có ctx.
+      routeCtx?: { params: Promise<Record<string, string>> },
+    ): Promise<Response> {
+      const params = routeCtx?.params ?? Promise.resolve({});
+      try {
+        if (options?.public) {
+          return await handler(req, { session: null as S, params });
+        }
+
+        const session = await deps.getSession();
+        if (!session) return unauthorized();
+
+        if (
+          options?.resource &&
+          options?.action &&
+          !deps.checkPermission(session, options.resource, options.action)
+        ) {
+          return forbidden();
+        }
+
+        const run = () => handler(req, { session, params });
+        const chain = (deps.wrap ?? []).reduceRight<() => Promise<Response>>(
+          (next, mw) => () => mw(next, { req, session }),
+          run,
+        );
+        return await chain();
+      } catch (error) {
+        if (deps.onError) return await deps.onError(error, req);
+        return json({ error: "Internal error" }, 500);
+      }
+    };
+  };
+}
+
+/**
+ * Cổng cho SERVER ACTIONS — bản đối xứng của apiHandler: action trả dữ liệu
+ * (không phải Response) nên guard là hàm lấy-session-kèm-check-quyền, trả
+ * `Session` khi đủ quyền và `null` khi chưa đăng nhập/thiếu quyền.
+ */
+export function createActionGuard<S>(
+  deps: Pick<
+    ApiHandlerFactoryDeps<S>,
+    "getSession" | "checkPermission" | "assertResource"
+  >,
+) {
+  return async function requirePermission(
+    resource: string,
+    action = "view",
+  ): Promise<S | null> {
+    deps.assertResource?.(resource);
+    const session = await deps.getSession();
+    if (!session) return null;
+    if (!deps.checkPermission(session, resource, action)) return null;
+    return session;
+  };
+}

package/src/ui/layout/top-bar-header-menubar.tsx

@@ -12,8 +12,6 @@ import type {
   NavigationType,
 } from "../../types";
 
-import { navigationsData as defaultNavigationsData } from "../../configs/data/navigations";
-
 import { ensureLocalizedPathname } from "../../utils";
 import { i18n } from "../../configs";
 import {
@@ -48,8 +46,9 @@ export function TopBarHeaderMenubar({
 
   const locale = (params.lang as LocaleType) || i18n.defaultLocale;
 
-  // Use app-provided navigation, fall back to core default if not provided
-  const navItems = navigation ?? defaultNavigationsData;
+  // Navigation do APP truyền vào — core không bake menu demo nào nữa
+  // (trước 2026-07 default là 781 dòng menu mẫu GoEat ship trong npm).
+  const navItems = navigation ?? [];
 
   // SAP Fiori Logic: Show first 5 items, group rest under "More"
   const MAX_VISIBLE_ITEMS = 5;

package/src/ui/shared/status-indicator.tsx

@@ -46,6 +46,8 @@ const STATUS_MAP: Record<string, { color: string; dotClass: string; label: strin
   accounting_revision: { color: "text-warning-text", dotClass: "bg-warning",       label: "Chỉnh sửa" },
   waiting_supplier:{ color: "text-warning-text", dotClass: "bg-warning",           label: "Chờ NCC" },
   partially_received: { color: "text-warning-text", dotClass: "bg-warning",        label: "Nhận một phần" },
+  // Key dữ liệu THẬT của PurchaseOrder vinhhoa (bản local từng drift vì core thiếu key này — 2026-07 hợp nhất về core).
+  partial_received: { color: "text-warning-text", dotClass: "bg-warning",        label: "Nhận một phần" },
   delivery_adjustment: { color: "text-warning-text", dotClass: "bg-warning",       label: "Điều chỉnh giao hàng" },
 
   // Info / In-progress