@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/runtime.ts.hbs

@@ -0,0 +1,159 @@
+import type { CoreConfig, HaiResult } from '@h-ai/core'
+import { mkdir } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+{{#if features.ai}}
+import { ai, AIConfigSchema } from '@h-ai/ai'
+{{/if}}
+import { audit, AuditInitConfigSchema } from '@h-ai/audit'
+import { cache, CacheConfigSchema } from '@h-ai/cache'
+import { core, HaiConfigError } from '@h-ai/core'
+import { crypto } from '@h-ai/crypto'
+{{#if features.feedback}}
+import { feedback } from '@h-ai/feedback'
+{{/if}}
+import { iam, IamConfigSchema } from '@h-ai/iam'
+import { reach, ReachConfigSchema } from '@h-ai/reach'
+import { reldb, ReldbConfigSchema } from '@h-ai/reldb'
+import { scheduler } from '@h-ai/scheduler'
+import { ServConfigSchema } from '@h-ai/serv'
+import { storage, StorageConfigSchema } from '@h-ai/storage'
+{{#if features.vecdb}}
+import { vecdb, VecdbConfigSchema } from '@h-ai/vecdb'
+{{/if}}
+{{#if features.feedback}}
+import { buildMetadata } from '../build-metadata.js'
+{{/if}}
+import { startAuditJobs } from './audit-jobs.js'
+import { initBusinessSettings } from './business-settings.js'
+import { serverM } from './messages.js'
+import { bootstrapDutyAccount, seedAppDuties } from './security-roles.js'
+
+{{#if features.feedback}}
+let feedbackRetry: ReturnType<typeof setTimeout> | undefined
+let feedbackStarting: Promise<void> | undefined
+let feedbackClosing = false
+let feedbackFailure: string | number | undefined
+
+/** 可选辅助能力独立重试；不能回滚已经就绪的 IAM 与业务模块。 */
+function startFeedback(): Promise<void> {
+  if (feedbackStarting)
+    return feedbackStarting
+  feedbackClosing = false
+  feedbackStarting = (async () => {
+    try {
+      const result = await feedback.init({ ...core.config.getOrThrow<import('@h-ai/feedback').FeedbackConfigInput>('feedback'), ...buildMetadata })
+      if (!result.success) {
+        if (feedbackFailure !== result.error.code)
+          core.logger.warn('Optional feedback unavailable; business runtime remains ready', { module: 'feedback', code: result.error.code })
+        feedbackFailure = result.error.code
+      }
+      else {
+        feedbackFailure = undefined
+      }
+    }
+    catch {
+      if (feedbackFailure !== 'configuration')
+        core.logger.warn('Optional feedback configuration unavailable; business runtime remains ready', { module: 'feedback' })
+      feedbackFailure = 'configuration'
+    }
+    if (feedbackFailure && !feedbackClosing) {
+      feedbackRetry = setTimeout(() => {
+        feedbackRetry = undefined
+        void startFeedback()
+      }, 30000)
+      feedbackRetry.unref()
+    }
+  })().finally(() => { feedbackStarting = undefined })
+  return feedbackStarting
+}
+
+async function closeFeedback() {
+  feedbackClosing = true
+  if (feedbackRetry)
+    clearTimeout(feedbackRetry)
+  feedbackRetry = undefined
+  await feedbackStarting
+  return feedback.close()
+}
+
+{{/if}}
+const runtime = core.module.createRuntime([
+  { name: 'serv-config', start: () => core.config.validate('serv', ServConfigSchema), close: () => {} },
+  { name: 'reldb', start: async () => {
+    const config = ReldbConfigSchema.parse(core.config.getOrThrow('db'))
+    if (config.type === 'sqlite' && config.database !== ':memory:')
+      await mkdir(path.dirname(config.database), { recursive: true })
+    return reldb.init(config)
+  }, close: () => reldb.close() },
+  { name: 'cache', start: () => cache.init(CacheConfigSchema.parse(core.config.getOrThrow('cache'))), close: () => cache.close() },
+{{#if features.vecdb}}
+  { name: 'vecdb', start: () => vecdb.init(VecdbConfigSchema.parse(core.config.getOrThrow('vecdb'))), close: () => vecdb.close() },
+{{/if}}
+  { name: 'crypto', start: () => crypto.init(), close: () => crypto.close() },
+  { name: 'storage', start: () => storage.init(StorageConfigSchema.parse(core.config.getOrThrow('storage'))), close: () => storage.close() },
+  { name: 'reach', enabled: () => Boolean(core.config.get('reach')), start: () => reach.init(ReachConfigSchema.parse(core.config.getOrThrow('reach'))), close: () => reach.close() },
+  { name: 'audit', start: () => audit.init({ ...AuditInitConfigSchema.parse(core.config.get('audit') ?? {}), storage, reach }), close: () => audit.close() },
+  { name: 'iam', start: () => iam.init({ ...IamConfigSchema.parse(core.config.getOrThrow('iam')), reach }), close: () => iam.close() },
+  { name: 'audit-jobs', enabled: () => Boolean(audit.schedulerPlan), start: startAuditJobs, close: () => scheduler.close() },
+{{#if features.feedback}}
+  { name: 'feedback', enabled: () => Boolean(core.config.get('feedback')), start: startFeedback, close: closeFeedback },
+{{/if}}
+{{#if features.ai}}
+  { name: 'ai', start: () => ai.init(AIConfigSchema.parse(core.config.getOrThrow('ai'))), close: () => ai.close() },
+{{/if}}
+  { name: 'bootstrap', start: async () => {
+    requireInitialized(await initBusinessSettings(), 'business-settings')
+    await ensureRolesAndAdmin()
+    const app = core.config.getOrThrow<CoreConfig>('core')
+    core.logger.info('Application initialized', { name: app.name, version: app.version, environment: app.env })
+  }, close: () => {} },
+])
+
+/** 仅声明模块和业务钩子，失败回滚、并发及关闭重试由 core 负责。 */
+export async function initializeModules(): Promise<void> {
+  const result = await runtime.start()
+  if (!result.success)
+    throw new Error(result.error.message, { cause: result.error })
+}
+
+export async function closeModules(): Promise<void> {
+  const result = await runtime.close()
+  if (!result.success)
+    throw new Error(result.error.message, { cause: result.error })
+}
+
+/** 此函数仅用于进程启动边界，业务请求继续返回 HaiResult。 */
+function requireInitialized<T>(result: HaiResult<T>, moduleName: string): T {
+  if (!result.success)
+    throw Object.assign(new Error(moduleName), { code: result.error.code, ext: { fields: moduleName === 'iam-bootstrap' ? ['HAI_ADMIN_DEFAULT_PASSWORD'] : [] } })
+  return result.data
+}
+
+async function ensureRolesAndAdmin(): Promise<void> {
+  requireInitialized(await seedAppDuties(), 'app-duties')
+  await ensureInitialSystemAdmin()
+  for (const [username, password] of [['audit_admin', process.env.HAI_AUDIT_ADMIN_PASSWORD], ['config_admin', process.env.HAI_CONFIG_ADMIN_PASSWORD], ['business_operator', process.env.HAI_BUSINESS_OPERATOR_PASSWORD]] as const)
+    requireInitialized(await bootstrapDutyAccount(username, password), 'app-duty-bootstrap')
+}
+
+async function ensureInitialSystemAdmin(): Promise<void> {
+  const users = requireInitialized(await iam.user.listUsers({ page: 1, pageSize: 1 }), 'iam-users')
+  if (users.total > 0)
+    return
+  const password = process.env.HAI_ADMIN_DEFAULT_PASSWORD?.trim()
+  if (!password)
+    throw Object.assign(new Error('Administrator bootstrap configuration required'), { code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code, ext: { fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } })
+  const registered = requireInitialized(await iam.user.createUser({ username: 'admin', password, displayName: serverM('admin') }), 'iam-bootstrap')
+  const adminRole = requireInitialized(await iam.authz.getRoleByCode('admin'), 'iam-role')
+  if (!adminRole)
+    throw new Error('Administrator role is missing')
+  const assigned = await iam.authz.syncRoles(registered.user.id, [adminRole.id])
+  if (!assigned.success) {
+    const removed = await iam.user.deleteUser(registered.user.id)
+    if (!removed.success)
+      core.logger.error('Failed to clean up administrator bootstrap', { error: removed.error.code })
+    requireInitialized(assigned, 'iam-bootstrap-role')
+  }
+  core.logger.info('Initial administrator created', { username: 'admin', passwordSource: 'HAI_ADMIN_DEFAULT_PASSWORD' })
+}

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/security-roles.ts.hbs

@@ -0,0 +1,73 @@
+/** 示例应用职责配置；可按项目需求调整，不改变框架 IAM 的通用规则。 */
+import type { HaiResult } from '@h-ai/core'
+import { core, err, HaiCommonError, ok } from '@h-ai/core'
+import { HaiIamError, iam } from '@h-ai/iam'
+import { serverM } from './messages.js'
+
+export const APP_DUTIES = {
+  admin: ['app.users.manage', 'app.roles.manage'],
+  audit_admin: ['audit:read', 'audit:backup'],
+  config_admin: ['app.config.manage'],
+  business_operator: ['feedback:create', 'feedback:read', 'feedback:process', 'feedback:reopen', 'feedback:export'],
+  user: ['feedback:create'],
+} as const
+
+export async function seedAppDuties(): Promise<HaiResult<void>> {
+  if (iam.config?.rbac.superAdminRole && iam.config.rbac.superAdminRole in APP_DUTIES)
+    return err(HaiCommonError.VALIDATION_ERROR)
+  for (const code of ['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'] as const) {
+    const permissionIds: string[] = []
+    for (const permissionCode of APP_DUTIES[code]) {
+      let permission = await iam.authz.getPermissionByCode(permissionCode)
+      if (!permission.success)
+        return permission
+      if (!permission.data) {
+        permission = await iam.authz.createPermission({ code: permissionCode, name: permissionCode, type: 'api' })
+        if (!permission.success) {
+          permission = await iam.authz.getPermissionByCode(permissionCode)
+          if (!permission.success || !permission.data)
+            return permission.success ? err(HaiCommonError.INTERNAL_ERROR) : permission
+        }
+      }
+      if (permission.data)
+        permissionIds.push(permission.data.id)
+    }
+    let role = await iam.authz.getRoleByCode(code)
+    if (!role.success)
+      return role
+    if (!role.data) {
+      role = await iam.authz.createRole({ code, name: serverM(code), isSystem: true })
+      if (!role.success) {
+        role = await iam.authz.getRoleByCode(code)
+        if (!role.success || !role.data)
+          return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+      }
+    }
+    if (!role.data)
+      return err(HaiCommonError.INTERNAL_ERROR)
+    const updated = await iam.authz.updateRole(role.data.id, { name: serverM(code), permissionIds })
+    if (!updated.success)
+      return updated
+  }
+  return ok(undefined)
+}
+
+/** 部署者独立设置初始凭据；不重设已有账号；后续账号管理由系统管理员统一负责。 */
+export async function bootstrapDutyAccount(username: 'audit_admin' | 'config_admin' | 'business_operator', providedPassword?: string): Promise<HaiResult<void>> {
+  const password = providedPassword?.trim()
+  if (!password)
+    return ok(undefined)
+  const created = await iam.user.createUser({ username, password })
+  if (!created.success)
+    return created.error.code === HaiIamError.USER_ALREADY_EXISTS.code ? ok(undefined) : created
+  const role = await iam.authz.getRoleByCode(username)
+  if (!role.success || !role.data)
+    return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+  const assigned = await iam.authz.syncRoles(created.data.user.id, [role.data.id])
+  if (!assigned.success) {
+    const removed = await iam.user.deleteUser(created.data.user.id)
+    if (!removed.success)
+      core.logger.error('Failed to roll back duty account bootstrap', { userId: created.data.user.id, errorCode: removed.error.code })
+  }
+  return assigned
+}