@h-ai/iam 0.1.0-alpha.53 → 0.1.0-alpha.54

package/README.md

@@ -160,6 +160,8 @@ verifyToken(accessToken)
 
 #### 使用方式
 
+`authz.createRole({ ..., permissionIds })` 和 `authz.updateRole(id, { ..., permissionIds })` 在同一事务中保存角色资料和完整权限集合；任一步失败均回滚。`permissionIds: []` 清空权限，省略则保持不变；重复 ID 去重，未知权限失败。并发更新以最后提交的完整集合为准，不合并两个集合。自管事务提交后同步现有用户会话；使用外部事务时，调用方仍须在提交后同步会话。Admin Console 直接使用此接口，不再拆分更新或补偿删除角色。
+
 ```ts
 // 密码登录
 const result = await iam.auth.login({ identifier: 'admin', password: 'Password123' })
@@ -546,3 +548,5 @@ pnpm test
 ## 许可证
 
 Apache-2.0
+
+角色列表通过 `iam.authz.getRoleUserCounts(roleIds)` 一次聚合当前页角色的真实成员数，返回 `HaiResult<Map<string, number>>`。无关联为 0；查询失败显示加载错误，不生成零统计。

package/dist/index.d.ts

@@ -483,7 +483,9 @@ interface AuthzOperations {
      * @param role - 角色数据（code、name、description、isSystem）
      * @returns 成功返回创建的角色（含 id 和时间戳）
      */
-    createRole: (role: Omit<Role, 'id' | 'createdAt' | 'updatedAt'>, tx?: DmlWithTxOperations) => Promise<HaiResult<Role>>;
+    createRole: (role: Omit<Role, 'id' | 'createdAt' | 'updatedAt'> & {
+        permissionIds?: string[];
+    }, tx?: DmlWithTxOperations) => Promise<HaiResult<Role>>;
     /**
      * 获取角色
      *
@@ -505,14 +507,18 @@ interface AuthzOperations {
      * @returns 成功返回分页角色列表
      */
     getAllRoles: (options?: PaginationOptionsInput) => Promise<HaiResult<PaginatedResult<Role>>>;
+    /** 批量统计角色成员数；成功时无关联返回 0，查询失败返回错误 */
+    getRoleUserCounts: (roleIds: string[]) => Promise<HaiResult<Map<string, number>>>;
     /**
      * 更新角色
      *
      * @param roleId - 角色 ID
-     * @param data - 要更新的字段（name、description 等）
+     * @param data - 要更新的字段；permissionIds 在同一事务内全量替换，未传则保持权限不变
      * @returns 成功返回更新后的角色；角色不存在返回 ROLE_NOT_FOUND
      */
-    updateRole: (roleId: string, data: Partial<Omit<Role, 'id' | 'createdAt' | 'updatedAt'>>, tx?: DmlWithTxOperations) => Promise<HaiResult<Role>>;
+    updateRole: (roleId: string, data: Partial<Omit<Role, 'id' | 'createdAt' | 'updatedAt'>> & {
+        permissionIds?: string[];
+    }, tx?: DmlWithTxOperations) => Promise<HaiResult<Role>>;
     /**
      * 删除角色
      *

package/dist/index.js

@@ -2540,6 +2540,21 @@ async function createDbUserRoleRepository(roleRepository) {
       }
       return ok(result.data.map((r) => r.user_id));
     },
+    async getUserCounts(roleIds) {
+      const ids = [...new Set(roleIds)];
+      const counts = new Map(ids.map((id) => [id, 0]));
+      if (ids.length === 0)
+        return ok(counts);
+      const result = await reldb.sql.query(
+        `SELECT role_id, COUNT(DISTINCT user_id) AS user_count FROM ${USER_ROLE_TABLE} WHERE role_id IN (${ids.map(() => "?").join(", ")}) GROUP BY role_id`,
+        ids
+      );
+      if (!result.success)
+        return err(HaiIamError.REPOSITORY_ERROR, iamM("iam_queryRoleFailed", { params: { message: result.error.message } }), result.error);
+      for (const row of result.data)
+        counts.set(row.role_id, Number(row.user_count));
+      return ok(counts);
+    },
     async getRolesForUsers(userIds) {
       const result = /* @__PURE__ */ new Map();
       if (userIds.length === 0) {
@@ -2665,6 +2680,9 @@ async function createDbRoleRepository() {
   return repo;
 }
 var DbRoleRepository = class extends BaseReldbCrudRepository {
+  async touch(roleId, tx) {
+    return tx.execute(`UPDATE ${TABLE_NAME4} SET updated_at = ? WHERE id = ?`, [(/* @__PURE__ */ new Date()).toISOString(), roleId]);
+  }
   constructor() {
     super(reldb, {
       table: TABLE_NAME4,
@@ -2853,6 +2871,25 @@ function createRbacManager(config) {
       }
     }
   }
+  async function replaceRolePermissions(roleId, permissionIds, tx) {
+    const uniqueIds = [...new Set(permissionIds)];
+    for (const id of uniqueIds) {
+      const permission = await permissionRepository.findById(id, tx);
+      if (!permission.success)
+        return permission;
+      if (!permission.data)
+        return err(HaiIamError.PERMISSION_NOT_FOUND, iamM("iam_permissionNotExist"));
+    }
+    const removed = await rolePermissionRepository.removeByRoleId(roleId, tx);
+    if (!removed.success)
+      return removed;
+    for (const id of uniqueIds) {
+      const assigned = await rolePermissionRepository.assign(roleId, id, tx);
+      if (!assigned.success)
+        return assigned;
+    }
+    return ok(void 0);
+  }
   return {
     async checkPermission(userId, permission) {
       if (!rbacConfig.enabled) {
@@ -2978,6 +3015,7 @@ function createRbacManager(config) {
     },
     // ─── 角色管理 ───
     async createRole(role, tx) {
+      const { permissionIds, ...metadata } = role;
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -2987,7 +3025,7 @@ function createRbacManager(config) {
         tx = txResult.data;
       }
       try {
-        const createResult = await roleRepository.create(role, tx);
+        const createResult = await roleRepository.create(metadata, tx);
         if (!createResult.success) {
           if (ownTx)
             await tx.rollback();
@@ -3008,6 +3046,14 @@ function createRbacManager(config) {
             await tx.rollback();
           return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
         }
+        if (permissionIds !== void 0) {
+          const replaced = await replaceRolePermissions(createdResult.data.id, permissionIds, tx);
+          if (!replaced.success) {
+            if (ownTx)
+              await tx.rollback();
+            return replaced;
+          }
+        }
         if (ownTx) {
           const commitResult = await tx.commit();
           if (!commitResult.success) {
@@ -3058,7 +3104,11 @@ function createRbacManager(config) {
       }
       return ok(result.data);
     },
+    getRoleUserCounts(roleIds) {
+      return userRoleRepository.getUserCounts(roleIds);
+    },
     async updateRole(roleId, data, tx) {
+      const { permissionIds, ...metadata } = data;
       const ownTx = !tx;
       if (!tx) {
         const txResult = await reldb.tx.begin();
@@ -3068,7 +3118,7 @@ function createRbacManager(config) {
         tx = txResult.data;
       }
       try {
-        const updateResult = await roleRepository.updateById(roleId, data, tx);
+        const updateResult = Object.values(metadata).some((value) => value !== void 0) ? await roleRepository.updateById(roleId, metadata, tx) : await roleRepository.touch(roleId, tx);
         if (!updateResult.success) {
           if (ownTx)
             await tx.rollback();
@@ -3079,6 +3129,14 @@ function createRbacManager(config) {
             await tx.rollback();
           return err(HaiIamError.ROLE_NOT_FOUND, iamM("iam_roleNotExist"));
         }
+        if (permissionIds !== void 0) {
+          const replaced = await replaceRolePermissions(roleId, permissionIds, tx);
+          if (!replaced.success) {
+            if (ownTx)
+              await tx.rollback();
+            return replaced;
+          }
+        }
         const updatedResult = await roleRepository.findById(roleId, tx);
         if (!updatedResult.success) {
           if (ownTx)