@h-ai/cli 1.0.0-beta.2 → 1.0.0-beta.20

package/templates/apps/fullstack/packages/{{projectName}}-serv/src/server/security-roles.ts.hbs

@@ -8,14 +8,26 @@ export const APP_DUTIES = {
   admin: ['app.users.manage', 'app.roles.manage'],
   audit_admin: ['audit:read', 'audit:backup'],
   config_admin: ['app.config.manage'],
-  business_operator: ['feedback:create', 'feedback:read', 'feedback:process', 'feedback:reopen', 'feedback:export'],
+  business_operator: [
+    'feedback:create',
+    'feedback:read',
+    'feedback:process',
+    'feedback:reopen',
+    'feedback:export',
+  ],
   user: ['feedback:create'],
 } as const
 
 export async function seedAppDuties(): Promise<HaiResult<void>> {
   if (iam.config?.rbac.superAdminRole && iam.config.rbac.superAdminRole in APP_DUTIES)
     return err(HaiCommonError.VALIDATION_ERROR)
-  for (const code of ['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'] as const) {
+  for (const code of [
+    'admin',
+    'audit_admin',
+    'config_admin',
+    'business_operator',
+    'user',
+  ] as const) {
     const permissionIds: string[] = []
     for (const permissionCode of APP_DUTIES[code]) {
       let permission = await iam.authz.getPermissionByCode(permissionCode)
@@ -25,8 +37,11 @@ export async function seedAppDuties(): Promise<HaiResult<void>> {
         permission = await iam.authz.createPermission({ code: permissionCode, name: permissionCode, type: 'api' })
         if (!permission.success) {
           permission = await iam.authz.getPermissionByCode(permissionCode)
-          if (!permission.success || !permission.data)
-            return permission.success ? err(HaiCommonError.INTERNAL_ERROR) : permission
+          if (!permission.success || !permission.data) {
+            return permission.success
+              ? err(HaiCommonError.INTERNAL_ERROR)
+              : permission
+          }
         }
       }
       if (permission.data)
@@ -36,16 +51,26 @@ export async function seedAppDuties(): Promise<HaiResult<void>> {
     if (!role.success)
       return role
     if (!role.data) {
-      role = await iam.authz.createRole({ code, name: serverM(code), isSystem: true })
+      role = await iam.authz.createRole({
+        code,
+        name: serverM(code),
+        isSystem: true,
+      })
       if (!role.success) {
         role = await iam.authz.getRoleByCode(code)
-        if (!role.success || !role.data)
-          return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+        if (!role.success || !role.data) {
+          return role.success
+            ? err(HaiCommonError.INTERNAL_ERROR)
+            : role
+        }
       }
     }
     if (!role.data)
       return err(HaiCommonError.INTERNAL_ERROR)
-    const updated = await iam.authz.updateRole(role.data.id, { name: serverM(code), permissionIds })
+    const updated = await iam.authz.updateRole(role.data.id, {
+      name: serverM(code),
+      permissionIds,
+    })
     if (!updated.success)
       return updated
   }
@@ -58,11 +83,17 @@ export async function bootstrapDutyAccount(username: 'audit_admin' | 'config_adm
   if (!password)
     return ok(undefined)
   const created = await iam.user.createUser({ username, password })
-  if (!created.success)
-    return created.error.code === HaiIamError.USER_ALREADY_EXISTS.code ? ok(undefined) : created
+  if (!created.success) {
+    return created.error.code === HaiIamError.USER_ALREADY_EXISTS.code
+      ? ok(undefined)
+      : created
+  }
   const role = await iam.authz.getRoleByCode(username)
-  if (!role.success || !role.data)
-    return role.success ? err(HaiCommonError.INTERNAL_ERROR) : role
+  if (!role.success || !role.data) {
+    return role.success
+      ? err(HaiCommonError.INTERNAL_ERROR)
+      : role
+  }
   const assigned = await iam.authz.syncRoles(created.data.user.id, [role.data.id])
   if (!assigned.success) {
     const removed = await iam.user.deleteUser(created.data.user.id)

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/app-server.test.ts.hbs

@@ -34,8 +34,17 @@ interface LoginData { user: { id: string }, tokens: { accessToken: string, refre
 async function call<T>(route: string, input?: object, token?: string, method = 'POST'): Promise<HaiResult<T>> {
   const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
     method,
-    headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
-    ...(input ? { body: JSON.stringify(input) } : {}),
+    headers: {
+      'content-type': 'application/json',
+      ...(token
+        ? { authorization: `Bearer ${token}` }
+        : {}),
+    },
+    ...(input
+      ? {
+          body: JSON.stringify(input),
+        }
+      : {}),
   })
   return response.json() as Promise<HaiResult<T>>
 }
@@ -45,12 +54,14 @@ beforeAll(async () => {
   vi.stubEnv('HAI_DB_DATABASE', '":memory:"')
   vi.stubEnv('HAI_STORAGE_ROOT', storageRoot)
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', TEST_PASSWORD)
-  core.init({ configDir: './config' })
   await initializeModules()
   const key = crypto.asymmetric.generateKeyPair()
   if (!key.success)
     throw new Error(key.error.message)
-  vi.stubEnv('HAI_CRYPTO_TRANSPORT_SERVERKEYRING', JSON.stringify({ activeKeyId: 'test-v1', keys: { 'test-v1': key.data } }))
+  vi.stubEnv('HAI_CRYPTO_TRANSPORT_SERVERKEYRING', JSON.stringify({
+    activeKeyId: 'test-v1',
+    keys: { 'test-v1': key.data },
+  }))
   app = createServerApp()
   transport = crypto.transport.createClient({
     keyExchangeUrl: `http://localhost${PREFIX}/_hai/key-exchange`,
@@ -100,7 +111,12 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     if (!result.success)
       return
     const config = core.config.getOrThrow<CoreConfig>('core')
-    expect(result.data).toMatchObject({ name: config.name, version: config.version, env: config.env, defaultLocale: config.defaultLocale })
+    expect(result.data).toMatchObject({
+      name: config.name,
+      version: config.version,
+      env: config.env,
+      defaultLocale: config.defaultLocale,
+    })
     const invalid = await transport.encryptedFetch(`http://localhost${PREFIX}/app/echo`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -130,7 +146,14 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
   it('mounts public auth routes while keeping default IAM administration routes private', async () => {
     const config = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/config`)
     expect(config.status).toBe(200)
-    for (const route of ['/auth/register', '/auth/login/ldap', '/auth/login/otp', '/auth/otp/send', '/auth/password-reset/request', '/auth/password-reset/confirm']) {
+    for (const route of [
+      '/auth/register',
+      '/auth/login/ldap',
+      '/auth/login/otp',
+      '/auth/otp/send',
+      '/auth/password-reset/request',
+      '/auth/password-reset/confirm',
+    ]) {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
@@ -145,14 +168,21 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}${route}`, {
         method,
         headers: { 'content-type': 'application/json', 'authorization': `Bearer ${adminToken}` },
-        ...(method === 'POST' ? { body: '{}' } : {}),
+        ...(method === 'POST'
+          ? { body: '{}' }
+          : {}),
       })
       expect(response.status).toBe(404)
     }
   })
 
   it('creates a normal user and enforces guards on every administration API', async () => {
-    const created = await call<AdminUser>('/admin/users/create', { username: 'normal-user', password: TEST_PASSWORD, role: 'user', accountStatus: 'active' }, adminToken)
+    const created = await call<AdminUser>('/admin/users/create', {
+      username: 'normal-user',
+      password: TEST_PASSWORD,
+      role: 'user',
+      accountStatus: 'active',
+    }, adminToken)
     expect(created.success).toBe(true)
     if (!created.success)
       return
@@ -163,14 +193,35 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       return
     userToken = loggedIn.data.tokens.accessToken
     for (const [route, input] of [
-      ['/admin/users/list', { page: 1, pageSize: 20 }],
-      ['/admin/users/create', { username: 'forbidden', password: TEST_PASSWORD }],
-      ['/admin/users/update', { id: adminId, accountStatus: 'dormant' }],
-      ['/admin/users/delete', { id: adminId }],
-      ['/admin/users/avatar', { id: adminId, contentType: 'image/png', base64: PNG }],
+      [
+        '/admin/users/list',
+        { page: 1, pageSize: 20 },
+      ],
+      [
+        '/admin/users/create',
+        { username: 'forbidden', password: TEST_PASSWORD },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, accountStatus: 'dormant' },
+      ],
+      [
+        '/admin/users/delete',
+        { id: adminId },
+      ],
+      [
+        '/admin/users/avatar',
+        { id: adminId, contentType: 'image/png', base64: PNG },
+      ],
       ['/admin/roles/list', undefined],
-      ['/admin/roles/update', { id: 'missing', description: 'x' }],
-      ['/admin/audit/list', { page: 1, pageSize: 20 }],
+      [
+        '/admin/roles/update',
+        { id: 'missing', description: 'x' },
+      ],
+      [
+        '/admin/audit/list',
+        { page: 1, pageSize: 20 },
+      ],
     ] as const) {
       const denied = await call(route, input, userToken)
       expect(denied.success).toBe(false)
@@ -180,8 +231,16 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
   })
 
   it('allows refresh-token body transport only for an identified trusted native origin', async () => {
-    for (const [clientName, origin] of [['{{projectName}}-app', 'capacitor://localhost'], ['{{projectName}}-desktop', 'http://tauri.localhost']] as const) {
-      const headers = { 'content-type': 'application/json', 'x-request-client': clientName, 'x-hai-token-transport': 'body', origin }
+    for (const [clientName, origin] of [
+      ['{{projectName}}-app', 'capacitor://localhost'],
+      ['{{projectName}}-desktop', 'http://tauri.localhost'],
+    ] as const) {
+      const headers = {
+        'content-type': 'application/json',
+        'x-request-client': clientName,
+        'x-hai-token-transport': 'body',
+        origin,
+      }
       const login = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/login`, {
         method: 'POST',
         headers,
@@ -203,10 +262,18 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       if (refreshed.success)
         expect(refreshed.data.tokens.refreshToken).not.toBe(result.data.tokens.refreshToken)
     }
-    for (const [clientName, origin] of [['{{projectName}}-app', 'http://untrusted.example'], ['unrecognized-client', 'capacitor://localhost']] as const) {
+    for (const [clientName, origin] of [
+      ['{{projectName}}-app', 'http://untrusted.example'],
+      ['unrecognized-client', 'capacitor://localhost'],
+    ] as const) {
       const response = await transport.encryptedFetch(`http://localhost${PREFIX}/auth/login`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json', 'x-request-client': clientName, 'x-hai-token-transport': 'body', origin },
+        headers: {
+          'content-type': 'application/json',
+          'x-request-client': clientName,
+          'x-hai-token-transport': 'body',
+          origin,
+        },
         body: JSON.stringify({ identifier: 'admin', password: TEST_PASSWORD }),
       })
       const result = await response.json() as HaiResult<LoginData>
@@ -223,7 +290,20 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       expect(listed.data.items).toHaveLength(1)
       expect(listed.data.total).toBe(2)
     }
-    for (const [route, input] of [['/admin/users/delete', { id: adminId }], ['/admin/users/update', { id: adminId, accountStatus: 'dormant' }], ['/admin/users/update', { id: adminId, role: 'user' }]] as const) {
+    for (const [route, input] of [
+      [
+        '/admin/users/delete',
+        { id: adminId },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, accountStatus: 'dormant' },
+      ],
+      [
+        '/admin/users/update',
+        { id: adminId, role: 'user' },
+      ],
+    ] as const) {
       const denied = await call(route, input, adminToken)
       expect(denied.success).toBe(false)
       if (!denied.success)
@@ -231,7 +311,7 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     }
   })
 
-  it('updates personal preferences, validates images and serves only allowed avatar resources', async () => {
+  it('updates personal preferences and clears the email address', async () => {
     expect((await call('/profile/update', { displayName: 'Updated', locale: 'en-US', theme: '{{fullstack.theme.defaultTheme}}' }, userToken)).success).toBe(true)
     const current = await call<{ metadata: { locale: string, theme: string } }>('/auth/me', undefined, userToken, 'GET')
     expect(current.success).toBe(true)
@@ -242,16 +322,25 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(cleared.success).toBe(true)
     if (cleared.success)
       expect(cleared.data.email).toBe('')
+  })
+
+  it('rejects invalid images, oversized payloads and anonymous avatar uploads', async () => {
     const invalid = await call('/profile/avatar', { contentType: 'image/png', base64: 'PHN2Zz48L3N2Zz4=' }, userToken)
     expect(invalid.success).toBe(false)
     if (!invalid.success)
       expect(invalid.error.httpStatus).toBe(400)
-    const oversized = await call('/profile/avatar', { contentType: 'image/png', base64: Buffer.alloc(512 * 1024 + 1).toString('base64') }, userToken)
+    const oversized = await call('/profile/avatar', {
+      contentType: 'image/png',
+      base64: Buffer.alloc(512 * 1024 + 1).toString('base64'),
+    }, userToken)
     expect(oversized.success).toBe(false)
     const anonymous = await call('/profile/avatar', { contentType: 'image/png', base64: PNG })
     expect(anonymous.success).toBe(false)
     if (!anonymous.success)
       expect(anonymous.error.httpStatus).toBe(401)
+  })
+
+  it('serves only uploaded avatar resources and restricts profile fields', async () => {
     const injected = await transport.encryptedFetch(`http://localhost${PREFIX}/profile/update`, {
       method: 'POST',
       headers: { 'content-type': 'application/json', 'authorization': `Bearer ${userToken}` },
@@ -291,7 +380,13 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const roles = await call<{ items: { id: string, code: string, userCount: number }[] }>('/admin/roles/list', undefined, adminToken)
     expect(roles.success).toBe(true)
     if (roles.success) {
-      expect(roles.data.items.map(item => item.code).sort()).toEqual(['admin', 'audit_admin', 'business_operator', 'config_admin', 'user'])
+      expect(roles.data.items.map(item => item.code).sort()).toEqual([
+        'admin',
+        'audit_admin',
+        'business_operator',
+        'config_admin',
+        'user',
+      ])
       const role = roles.data.items.find(item => item.code === 'user')!
       expect(role.userCount).toBe(1)
       expect((await call('/admin/roles/update', { id: role.id, description: 'Updated description' }, adminToken)).success).toBe(true)
@@ -319,7 +414,12 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const before = await iam.user.getUser(user.id)
     expect(before.success).toBe(true)
     const sync = vi.spyOn(iam.authz, 'syncRoles').mockResolvedValueOnce(err(HaiCommonError.API_ERROR, 'Injected role persistence failure'))
-    const failed = await call('/admin/users/update', { id: user.id, role: 'admin', email: 'changed@example.com', displayName: 'Should not change' }, adminToken)
+    const failed = await call('/admin/users/update', {
+      id: user.id,
+      role: 'admin',
+      email: 'changed@example.com',
+      displayName: 'Should not change',
+    }, adminToken)
     sync.mockRestore()
     expect(failed.success).toBe(false)
     const after = await iam.user.getUser(user.id)
@@ -333,7 +433,7 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const log = vi.spyOn(audit, 'log').mockImplementation((input, tx) => input.action === 'update' && input.resource === 'profile'
       ? Promise.resolve(err(HaiCommonError.API_ERROR, 'Injected audit persistence failure'))
       : originalLog(input, tx))
-    const logger = vi.spyOn(core.logger, 'error').mockImplementation(() => {})
+    const logger = vi.spyOn(core.logger, 'error').mockImplementation(() => { })
     try {
       const result = await call<AdminUser>('/profile/update', { displayName: 'Committed profile' }, userToken)
       expect(result.success).toBe(true)
@@ -369,9 +469,22 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     const snapshot = await iam.session.get(userToken)
     if (!snapshot.success || !snapshot.data)
       throw new Error('Session unavailable')
-    const stale = await iam.session.update(userToken, { roles: ['admin'], permissions: ['*'] }, snapshot.data.version)
+    const stale = await iam.session.update(userToken, {
+      roles: ['admin'],
+      permissions: ['*'],
+    }, snapshot.data.version)
     expect(stale.success).toBe(true)
-    for (const [route, input] of [['/admin/users/list', { page: 1, pageSize: 20 }], ['/admin/roles/list', undefined], ['/admin/audit/list', { page: 1, pageSize: 20 }]] as const) {
+    for (const [route, input] of [
+      [
+        '/admin/users/list',
+        { page: 1, pageSize: 20 },
+      ],
+      ['/admin/roles/list', undefined],
+      [
+        '/admin/audit/list',
+        { page: 1, pageSize: 20 },
+      ],
+    ] as const) {
       const denied = await call(route, input, userToken)
       expect(denied.success).toBe(false)
       if (!denied.success)
@@ -410,8 +523,8 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
     expect(otherLogin.success).toBe(true)
     if (!otherLogin.success)
       return
-    let resume: () => void = () => {}
-    let entered: () => void = () => {}
+    let resume: () => void = () => { }
+    let entered: () => void = () => { }
     const paused = new Promise<void>((resolve) => {
       resume = resolve
     })
@@ -462,7 +575,10 @@ describe('{{fullstack.servPackageName}} mini administration', () => {
       call('/admin/users/update', { id: adminId, accountStatus: 'dormant' }, loggedIn.data.tokens.accessToken),
     ])
     expect(results.filter(result => result.success)).toHaveLength(1)
-    const admins = await iam.user.listUsers({ accountStatus: 'active', include: ['roles'] })
+    const admins = await iam.user.listUsers({
+      accountStatus: 'active',
+      include: ['roles'],
+    })
     expect(admins.success).toBe(true)
     if (admins.success) {
       const surviving = admins.data.items.filter(item => item.roles?.some(role => role.code === 'admin'))

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/runtime.test.ts.hbs

@@ -15,7 +15,6 @@ import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 import { closeModules, initializeModules } from '../src/server/runtime.js'
 
 let storageRoot: string
-
 beforeEach(async () => {
   storageRoot = await mkdtemp(path.join(os.tmpdir(), '{{projectName}}-bootstrap-'))
   vi.stubEnv('HAI_DB_DATABASE', '":memory:"')
@@ -23,22 +22,33 @@ beforeEach(async () => {
   vi.stubEnv('HAI_IAM_PASSWORD_REQUIREUPPERCASE', 'true')
   core.init({ configDir: './config' })
 })
-
 afterEach(async () => {
   await closeModules()
   vi.unstubAllEnvs()
   await rm(storageRoot, { recursive: true, force: true })
 })
-
 it.each([
   { password: 'abc' },
   { password: 'lowercase123!' },
 ])('startup explains the failed password policy and permits a clean retry: $password', async ({ password }) => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', password)
-  await expect(initializeModules()).rejects.toMatchObject({ cause: { ext: { module: 'bootstrap', fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } } })
-  for (const module of [audit, iam, storage, crypto, cache, reldb])
+  await expect(initializeModules()).rejects.toMatchObject({
+    cause: {
+      ext: {
+        module: 'bootstrap',
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    },
+  })
+  for (const module of [
+    audit,
+    iam,
+    storage,
+    crypto,
+    cache,
+    reldb,
+  ])
     expect(module.isInitialized).toBe(false)
-
   // 失败后再次初始化，确认未保留半成品管理员或未释放的模块。
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', 'Bootstrap-retry-Admin123!')
   await initializeModules()
@@ -49,14 +59,27 @@ it.each([
     expect(users.data.items[0]?.username).toBe('admin')
   }
 })
-
 it.each(['', '   '])('startup identifies an unset administrator password without exposing its value', async (password) => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', password)
-  await expect(initializeModules()).rejects.toMatchObject({ cause: { ext: { module: 'bootstrap', code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code, fields: ['HAI_ADMIN_DEFAULT_PASSWORD'] } } })
-  for (const module of [audit, iam, storage, crypto, cache, reldb])
+  await expect(initializeModules()).rejects.toMatchObject({
+    cause: {
+      ext: {
+        module: 'bootstrap',
+        code: HaiConfigError.CONFIG_ENV_VAR_MISSING.code,
+        fields: ['HAI_ADMIN_DEFAULT_PASSWORD'],
+      },
+    },
+  })
+  for (const module of [
+    audit,
+    iam,
+    storage,
+    crypto,
+    cache,
+    reldb,
+  ])
     expect(module.isInitialized).toBe(false)
 })
-
 {{#if features.feedback}}
 it('optional feedback failure does not roll back authentication and business modules', async () => {
   vi.stubEnv('HAI_ADMIN_DEFAULT_PASSWORD', 'Bootstrap-retry-Admin123!')