@h-ai/cli 0.1.0-alpha.56 → 0.1.0-alpha.58

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/admin-procedures.ts.hbs

@@ -0,0 +1,94 @@
+import type { ServContext } from '@h-ai/serv'
+import { audit } from '@h-ai/audit'
+import { err, HaiCommonError, ok } from '@h-ai/core'
+import { iam } from '@h-ai/iam'
+import { serv } from '@h-ai/serv'
+import { createIamProcedures } from '@h-ai/serv/features/iam'
+import { adminContract, authContract, profileContract } from '{{fullstack.contractPackageName}}'
+import {
+  createAdminUser,
+  getAdminRoles,
+  isRoleCode,
+  recordAudit,
+  toAdminUser,
+  updateAdminUser,
+  updateProfile,
+  uploadAvatar,
+  withAdminMutation,
+} from '../admin-service.js'
+import { serverM } from '../messages.js'
+
+/** 身份认证沿用框架公共契约与 refresh-cookie 传输。 */
+export function createAuthProcedures() {
+  const { currentUser, refresh } = createIamProcedures({ iam }).auth
+  const { login, logout, changePassword } = authContract
+  // 仅覆写需要业务审计的认证操作，其余直接复用框架；未选认证入口不挂载。
+  const audited = serv.implement({ login, logout, changePassword }).context<ServContext>().route('login', async ({ input, context }) => {
+    const result = await iam.auth.login(input)
+    if (!result.success)
+      return result
+    await recordAudit({ ...context, session: { userId: result.data.user.id, roles: result.data.roles, permissions: result.data.permissions } }, 'login', 'auth')
+    return result
+  }).route('logout').auth().handle(async ({ context }) => {
+    const result = await iam.auth.logout(context.accessToken ?? '')
+    if (!result.success)
+      return result
+    await recordAudit(context, 'logout', 'auth')
+    return result
+  }).route('changePassword').auth().handle(async ({ input, context }) => {
+    const result = await iam.user.changeCurrentUserPassword(context.accessToken ?? '', input.oldPassword, input.newPassword)
+    if (!result.success)
+      return result
+    await recordAudit(context, 'password-change', 'profile', context.session.userId)
+    return result
+  }).build()
+  return { ...audited, currentUser, refresh }
+}
+
+export function createAdminProcedures() {
+  return serv.implement(adminContract).context<ServContext>().route('users.list').role('admin').handle(async ({ input }) => {
+    const users = await iam.user.listUsers(input)
+    if (!users.success)
+      return users
+    const roles = await iam.authz.getUserRolesForMany(users.data.items.map(user => user.id))
+    if (!roles.success)
+      return roles
+    return ok({ ...users.data, items: users.data.items.map(user => toAdminUser(user, roles.data.get(user.id) ?? [])) })
+  }).route('users.create').role('admin').handle(({ input, context }) => withAdminMutation(context, () => createAdminUser(input, context))).route('users.update').role('admin').handle(({ input, context }) => withAdminMutation(context, () => updateAdminUser(input, context))).route('users.delete').role('admin').handle(({ input, context }) => withAdminMutation(context, async () => {
+    if (context.session.userId === input.id)
+      return err(HaiCommonError.FORBIDDEN, serverM('selfProtection', { locale: context.locale }))
+    const result = await iam.user.deleteUser(input.id)
+    if (!result.success)
+      return result
+    await recordAudit(context, 'delete', 'users', input.id)
+    return ok({ deleted: true as const })
+  })).route('users.avatar').role('admin').handle(({ input, context }) => withAdminMutation(context, () => uploadAvatar(input.id, input, context))).route('roles.list').role('admin').handle(() => getAdminRoles()).route('roles.update').role('admin').handle(({ input, context }) => withAdminMutation(context, async () => {
+    const role = await iam.authz.getRole(input.id)
+    if (!role.success)
+      return role
+    if (!role.data || !isRoleCode(role.data.code))
+      return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
+    const updated = await iam.authz.updateRole(input.id, { description: input.description })
+    if (!updated.success)
+      return updated
+    const roles = await getAdminRoles()
+    if (!roles.success)
+      return roles
+    const result = roles.data.items.find(item => item.id === input.id)
+    if (!result)
+      return err(HaiCommonError.NOT_FOUND, serverM('notFound', { locale: context.locale }))
+    await recordAudit(context, 'update', 'roles', input.id, { fields: ['description'] })
+    return ok(result)
+  })).route('audit.list').role('admin').handle(async ({ input, context }) => {
+    if (input.startDate && input.endDate && input.startDate > input.endDate)
+      return err(HaiCommonError.VALIDATION_ERROR, serverM('invalidDateRange', { locale: context.locale }))
+    const result = await audit.list({ ...input, startDate: input.startDate ? new Date(input.startDate) : undefined, endDate: input.endDate ? new Date(input.endDate) : undefined })
+    if (!result.success)
+      return result
+    return ok({ ...result.data, page: input.page, pageSize: input.pageSize, items: result.data.items.map(item => ({ ...item, createdAt: new Date(item.createdAt).toISOString() })) })
+  }).build()
+}
+
+export function createProfileProcedures() {
+  return serv.implement(profileContract).context<ServContext>().route('update').auth().handle(({ input, context }) => updateProfile(input, context)).route('avatar').auth().handle(({ input, context }) => uploadAvatar(context.session.userId, input, context)).build()
+}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/app-procedures.ts.hbs

@@ -7,6 +7,9 @@ import { appContract } from '{{fullstack.contractPackageName}}'
 export interface CreateAppProceduresOptions {
   readonly name: string
   readonly version: string
+  readonly env: string
+  readonly defaultLocale: string
+  readonly supportedLocales: readonly string[]
   readonly startedAt: string
   readonly frontends: readonly AppFrontendTarget[]
 }
@@ -32,6 +35,9 @@ function createAppInfo(options: CreateAppProceduresOptions): AppInfoOutputData {
   return {
     name: options.name,
     version: options.version,
+    env: options.env,
+    defaultLocale: options.defaultLocale,
+    supportedLocales: [...options.supportedLocales],
     startedAt: options.startedAt,
     frontends: [...options.frontends],
   }

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/procedures/index.ts.hbs

@@ -1,4 +1,5 @@
 import type { CreateAppProceduresOptions } from './app-procedures.js'
+import { createAdminProcedures, createAuthProcedures, createProfileProcedures } from './admin-procedures.js'
 import { createAppProcedures } from './app-procedures.js'
 
 export interface CreateServerProceduresOptions {
@@ -9,5 +10,8 @@ export interface CreateServerProceduresOptions {
 export function createServerProcedures(options: CreateServerProceduresOptions) {
   return {
     app: createAppProcedures(options.app),
+    iam: { auth: createAuthProcedures() },
+    admin: createAdminProcedures(),
+    profile: createProfileProcedures(),
   }
-}
+}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -0,0 +1,98 @@
+import type { CoreConfig, HaiResult } from '@h-ai/core'
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { audit, AuditInitConfigSchema } from '@h-ai/audit'
+import { cache, CacheConfigSchema } from '@h-ai/cache'
+import { core } from '@h-ai/core'
+import { crypto } from '@h-ai/crypto'
+import { iam, IamConfigSchema } from '@h-ai/iam'
+import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
+import { ServConfigSchema } from '@h-ai/serv'
+import { storage, StorageConfigSchema } from '@h-ai/storage'
+import { serverM } from './messages.js'
+
+let initialized = false
+let initializing: Promise<void> | undefined
+
+/** 初始化失败停止启动并反序释放资源；不把功能缺失降级为成功。 */
+export async function initializeModules(): Promise<void> {
+  if (initialized)
+    return
+  initializing ??= runInitialization().finally(() => {
+    initializing = undefined
+  })
+  return initializing
+}
+
+async function runInitialization(): Promise<void> {
+  try {
+    requireInitialized(core.config.validate('serv', ServConfigSchema), 'serv-config')
+    const db = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+    const cacheConfig = CacheConfigSchema.parse(core.config.getOrThrow('cache'))
+    const storageConfig = StorageConfigSchema.parse(core.config.getOrThrow('storage'))
+    const iamConfig = IamConfigSchema.parse(core.config.getOrThrow('iam'))
+    const auditConfig = AuditInitConfigSchema.parse(core.config.get('audit') ?? {})
+    if (db.type === 'sqlite' && db.database !== ':memory:')
+      await mkdir(path.dirname(db.database), { recursive: true })
+    requireInitialized(await reldb.init(db), 'reldb')
+    requireInitialized(await cache.init(cacheConfig), 'cache')
+    requireInitialized(await crypto.init(), 'crypto')
+    requireInitialized(await storage.init(storageConfig), 'storage')
+    requireInitialized(await iam.init(iamConfig), 'iam')
+    requireInitialized(await audit.init(auditConfig), 'audit')
+    await ensureRolesAndAdmin()
+    initialized = true
+    const app = core.config.getOrThrow<CoreConfig>('core')
+    core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
+  }
+  catch (error) {
+    await closeModules()
+    throw error
+  }
+}
+
+/** 此函数仅用于进程启动边界，业务请求继续返回 HaiResult。 */
+function requireInitialized<T>(result: HaiResult<T>, moduleName: string): T {
+  if (!result.success)
+    throw new Error(`Failed to initialize ${moduleName}: ${result.error.message} (${result.error.code})`)
+  return result.data
+}
+
+async function ensureRolesAndAdmin(): Promise<void> {
+  for (const code of ['admin', 'user'] as const) {
+    const existing = requireInitialized(await iam.authz.getRoleByCode(code), 'iam-role')
+    if (!existing)
+      requireInitialized(await iam.authz.createRole({ code, name: serverM(code), description: serverM(code === 'admin' ? 'adminDescription' : 'userDescription'), isSystem: true }), 'iam-role')
+  }
+  const users = requireInitialized(await iam.user.listUsers({ page: 1, pageSize: 1 }), 'iam-users')
+  if (users.total > 0)
+    return
+  const password = process.env.HAI_ADMIN_DEFAULT_PASSWORD?.trim()
+  if (!password)
+    throw new Error('Set HAI_ADMIN_DEFAULT_PASSWORD before the first start to create the administrator account')
+  const registered = requireInitialized(await iam.user.register({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
+  const adminRole = requireInitialized(await iam.authz.getRoleByCode('admin'), 'iam-role')
+  if (!adminRole)
+    throw new Error('Administrator role is missing')
+  const assigned = await iam.authz.syncRoles(registered.user.id, [adminRole.id])
+  if (!assigned.success) {
+    const removed = await iam.user.deleteUser(registered.user.id)
+    if (!removed.success)
+      core.logger.error('Failed to clean up administrator bootstrap', { error: removed.error.code })
+    requireInitialized(assigned, 'iam-bootstrap-role')
+  }
+  core.logger.info('Initial administrator created', { username: 'admin', passwordSource: 'HAI_ADMIN_DEFAULT_PASSWORD' })
+}
+
+/** 关闭顺序与依赖初始化顺序相反，同时覆盖启动失败路径。 */
+export async function closeModules(): Promise<void> {
+  for (const [name, module] of [['audit', audit], ['iam', iam], ['storage', storage], ['crypto', crypto], ['cache', cache], ['reldb', reldb]] as const) {
+    if (!module.isInitialized)
+      continue
+    const result = await module.close()
+    if (result && !result.success)
+      core.logger.error('Failed to close application module', { module: name, error: result.error.code })
+  }
+  initialized = false
+}