@hedeqiang/dsh-nl2sql 0.10.0 → 0.11.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hedeqiang/dsh-nl2sql",
-  "version": "0.10.0",
-  "description": "Data Q&A (NL2SQL) for DeepSeek Harness: ask MySQL / PostgreSQL / Elasticsearch / CSV in plain language, charts, dashboards, alerts, Lark push and bot, access control.",
+  "version": "0.11.1",
+  "description": "Data Q&A (NL2SQL) for DeepSeek Harness: ask MySQL / PostgreSQL / Elasticsearch / CSV in plain language, charts, dashboards, alerts, IM push and bots (Lark/Feishu, Telegram, WeCom, DingTalk), access control.",
   "type": "module",
   "exports": {
     ".": "./index.js",
@@ -12,6 +12,7 @@
   "files": [
     "index.js",
     "service/*.js",
+    "channels/*.js",
     "drivers.js",
     "policy.js",
     "filters.js",
@@ -30,7 +31,8 @@
     "README.md",
     "README.en.md",
     "LICENSE",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "docs/CHANNELS.md"
   ],
   "dependencies": {
     "@larksuiteoapi/node-sdk": "1.76.0",
@@ -67,17 +69,20 @@
   "license": "MIT",
   "author": "hedeqiang <laravel_code@163.com>",
   "keywords": [
+    "bi",
     "deepseek-harness",
+    "dingtalk",
     "dsh",
     "dsh-bundle",
-    "nl2sql",
-    "text-to-sql",
-    "bi",
-    "mysql",
-    "postgresql",
     "elasticsearch",
+    "feishu",
     "lark",
-    "feishu"
+    "mysql",
+    "nl2sql",
+    "postgresql",
+    "telegram",
+    "text-to-sql",
+    "wecom"
   ],
   "engines": {
     "node": ">=24"

package/service/access.js

@@ -4,6 +4,58 @@
  */
 import { ROLE_RANK, UserError, newId, oneOf, requireText, upsert } from './shared.js'
 
+export const PLATFORM_LABEL = { lark: '飞书', telegram: 'Telegram', wecom: '企业微信', dingtalk: '钉钉' }
+const PLATFORM_RE = /^[a-z][\w-]{0,31}$/
+
+/** Validate and dedupe an identities array: [{ platform, id, email? }]. */
+export function normalizeIdentities(list) {
+  if (!Array.isArray(list)) throw new UserError('nl2sql/invalid', 'identities 必须是数组')
+  const out = []
+  for (const raw of list.slice(0, 20)) {
+    if (!raw || typeof raw !== 'object') continue
+    const platform = String(raw.platform ?? '').trim().toLowerCase()
+    const id = String(raw.id ?? '').trim().slice(0, 200)
+    const email = String(raw.email ?? '').trim().slice(0, 200)
+    if (!id && !email) continue
+    if (!PLATFORM_RE.test(platform)) throw new UserError('nl2sql/invalid', `无效的平台：${raw.platform ?? ''}`)
+    if (!id) throw new UserError('nl2sql/invalid', `请填写 ${PLATFORM_LABEL[platform] ?? platform} 账号 ID`)
+    if (out.some(i => i.platform === platform && i.id === id)) continue
+    out.push({ platform, id, ...(email ? { email } : {}) })
+  }
+  return out
+}
+
+/** Keep the legacy larkOpenId / larkChatId fields mirroring the first Lark identity. */
+function mirrorLegacyIds(u) {
+  const lark = u.identities.find(i => i.platform === 'lark')?.id
+  delete u.larkOpenId
+  delete u.larkChatId
+  if (lark) { if (u.kind === 'chat') u.larkChatId = lark; else u.larkOpenId = lark }
+  return u
+}
+
+/** Legacy member fields → identities, in place (idempotent). */
+export function normalizeUserRecord(u) {
+  if (!u || typeof u !== 'object') return u
+  if (!Array.isArray(u.identities)) {
+    u.identities = []
+    const legacy = u.kind === 'chat' ? (u.larkChatId ?? u.larkOpenId) : (u.larkOpenId ?? u.larkChatId)
+    if (legacy) u.identities.push({ platform: 'lark', id: String(legacy) })
+  }
+  return mirrorLegacyIds(u)
+}
+
+/** Another member already owning one of u's identities (same platform + id) or its email. */
+export function findIdentityClash(users, u) {
+  const mail = u.email?.toLowerCase()
+  return users.find(x => {
+    if (x.id === u.id) return false
+    const ids = normalizeUserRecord({ ...x, identities: x.identities ? [...x.identities] : undefined }).identities
+    if (u.identities.some(a => ids.some(b => a.platform === b.platform && a.id === b.id))) return true
+    return Boolean(mail && x.email && x.email.toLowerCase() === mail)
+  })
+}
+
 export const methods = {
   // ------------------------------------------------------------ access
 
@@ -45,26 +97,38 @@ export const methods = {
   },
 
   /**
-   * Members: people (Lark open_id / email) and Lark chats, each with a role
-   * (admin | analyst | viewer) and a data source scope. The local owner is
-   * implicit. Lark messages from unknown people fall back to
-   * settings.larkDefaultRole (none = refuse).
+   * Members: people and group chats on IM platforms, each with a role
+   * (admin | analyst | viewer), a data source scope and platform-scoped
+   * identities [{ platform, id, email? }] (see docs/CHANNELS.md). The local
+   * owner is implicit. Bot messages from unknown people fall back to
+   * settings.botDefaultRole (none = refuse).
    */
   listUsers() {
-    return (this.state.users ?? []).map(u => ({ ...u, datasourceNames: (u.datasourceIds ?? []).map(id => this.findDatasource(id)?.name ?? id) }))
+    return (this.state.users ?? []).map(u => ({ ...normalizeUserRecord(u), datasourceNames: (u.datasourceIds ?? []).map(id => this.findDatasource(id)?.name ?? id) }))
   },
 
   async saveUser(input) {
     const existing = input.id ? (this.state.users ?? []).find(u => u.id === input.id) : undefined
-    const u = existing ? { ...existing } : { id: newId('u'), createdAt: Date.now() }
+    const u = existing ? normalizeUserRecord({ ...existing, identities: structuredClone(existing.identities ?? []) }) : { id: newId('u'), createdAt: Date.now(), identities: [] }
     u.kind = oneOf(input.kind ?? u.kind ?? 'person', ['person', 'chat'], 'kind')
     u.name = requireText(input.name ?? u.name, 'name', 60)
     u.role = oneOf(input.role ?? u.role ?? 'analyst', ['admin', 'analyst', 'viewer'], 'role')
-    u.larkOpenId = String(input.larkOpenId ?? u.larkOpenId ?? '').trim().slice(0, 100) || undefined
     u.email = String(input.email ?? u.email ?? '').trim().slice(0, 200) || undefined
-    u.larkChatId = String(input.larkChatId ?? u.larkChatId ?? '').trim().slice(0, 100) || undefined
-    if (u.kind === 'person' && !u.larkOpenId && !u.email) throw new UserError('nl2sql/invalid', '成员需要填写飞书 open_id 或邮箱，用于识别身份')
-    if (u.kind === 'chat' && !u.larkChatId) throw new UserError('nl2sql/invalid', '群成员需要填写飞书 chat_id')
+    if (input.identities !== undefined) {
+      u.identities = normalizeIdentities(input.identities)
+    } else {
+      // Legacy single Lark ids: replace the Lark identity (an empty value removes it).
+      const legacy = u.kind === 'chat' ? input.larkChatId : input.larkOpenId
+      const other = u.kind === 'chat' ? input.larkOpenId : input.larkChatId
+      if (legacy !== undefined || other !== undefined) {
+        const value = String(legacy ?? '').trim().slice(0, 100)
+        u.identities = u.identities.filter(i => i.platform !== 'lark')
+        if (value) u.identities.unshift({ platform: 'lark', id: value })
+      }
+    }
+    mirrorLegacyIds(u)
+    if (u.kind === 'person' && !u.identities.length && !u.email) throw new UserError('nl2sql/invalid', '成员需要填写至少一个 IM 账号（如飞书 open_id、Telegram 用户 ID）或邮箱，用于识别身份')
+    if (u.kind === 'chat' && !u.identities.length) throw new UserError('nl2sql/invalid', '群成员需要填写群 ID（如飞书 chat_id、Telegram chat id）')
     const allDs = input.allDatasources ?? (input.datasourceIds === undefined ? u.datasourceIds === null : false)
     u.datasourceIds = allDs ? null : (input.datasourceIds ?? u.datasourceIds ?? []).filter(id => this.findDatasource(id))
     u.defaultDatasourceId = input.defaultDatasourceId && this.findDatasource(input.defaultDatasourceId) ? input.defaultDatasourceId : (u.datasourceIds?.[0] ?? null)
@@ -78,7 +142,7 @@ export const methods = {
       })).filter(r => r.values.length).slice(0, 20)
       if (u.rowRules.some(r => !/^[A-Za-z_\u4e00-\u9fa5][\w$\u4e00-\u9fa5]*$/.test(r.column))) throw new UserError('nl2sql/invalid', '行级规则的字段名只能包含字母、数字、下划线或中文')
     }
-    const dup = (this.state.users ?? []).find(x => x.id !== u.id && ((u.larkOpenId && x.larkOpenId === u.larkOpenId) || (u.email && x.email === u.email) || (u.larkChatId && x.larkChatId === u.larkChatId)))
+    const dup = findIdentityClash(this.state.users ?? [], u)
     if (dup) throw new UserError('nl2sql/duplicate', `该身份已属于成员「${dup.name}」`)
     u.updatedAt = Date.now()
     this.state.users = upsert(this.state.users ?? [], u)
@@ -95,34 +159,64 @@ export const methods = {
     return { deleted: id }
   },
 
+  /** Migrate legacy member fields to identities (idempotent). Returns true when something changed. */
+  migrateUsers() {
+    let changed = false
+    for (const u of this.state.users ?? []) {
+      const before = JSON.stringify(u)
+      normalizeUserRecord(u)
+      if (JSON.stringify(u) !== before) changed = true
+    }
+    return changed
+  },
+
+  /** Default role / data sources for unknown bot users (new keys, falling back to the legacy lark* keys). */
+  botDefaults() {
+    const s = this.state.settings
+    return {
+      role: s.botDefaultRole ?? s.larkDefaultRole ?? 'none',
+      datasourceIds: s.botDefaultDatasourceIds !== undefined ? s.botDefaultDatasourceIds : s.larkDefaultDatasourceIds,
+    }
+  },
+
   /**
-   * Resolve the effective actor for a Lark message: the person's own scope,
-   * narrowed by the chat's scope in group chats. Returns { actor } or { refused }.
+   * Resolve the effective actor for a bot message or action: the person's own
+   * scope, narrowed by the chat's scope in group chats. People match by
+   * (platform, userId) or email; chats by (platform, chatId).
+   * Returns { actor } or { refused }.
    */
-  resolveLarkActor({ openId, email, name, chatId, chatType }) {
-    const users = (this.state.users ?? []).filter(u => !u.disabled)
-    const person = users.find(u => u.kind === 'person' && ((openId && u.larkOpenId === openId) || (email && u.email && u.email.toLowerCase() === String(email).toLowerCase())))
-    const chat = chatType === 'group' ? users.find(u => u.kind === 'chat' && u.larkChatId === chatId) : undefined
-    const fallbackRole = this.state.settings.larkDefaultRole ?? 'none'
-    if (!person && !chat && fallbackRole === 'none') return { refused: '你还没有开通数据问答权限，请联系管理员在「数据问答 → 成员」中添加你的飞书账号。' }
+  resolveActor({ platform = 'lark', userId, email, name, chatId, chatType }) {
+    const users = (this.state.users ?? []).filter(u => !u.disabled).map(u => normalizeUserRecord(u))
+    const mail = email ? String(email).toLowerCase() : ''
+    const person = users.find(u => u.kind === 'person' && userId && u.identities.some(i => i.platform === platform && i.id === String(userId)))
+      ?? (mail ? users.find(u => u.kind === 'person' && ((u.email && u.email.toLowerCase() === mail) || u.identities.some(i => i.email && i.email.toLowerCase() === mail))) : undefined)
+    const chat = chatType === 'group' && chatId ? users.find(u => u.kind === 'chat' && u.identities.some(i => i.platform === platform && i.id === String(chatId))) : undefined
+    const defaults = this.botDefaults()
+    const fallbackRole = defaults.role
+    if (!person && !chat && fallbackRole === 'none') return { refused: `你还没有开通数据问答权限，请联系管理员在「数据问答 → 成员」中添加你的${PLATFORM_LABEL[platform] ?? platform}账号。` }
     const scopes = [person?.datasourceIds, chat?.datasourceIds].filter(x => x !== undefined)
     let datasourceIds = null
     for (const sc of scopes) if (Array.isArray(sc)) datasourceIds = datasourceIds === null ? [...sc] : datasourceIds.filter(id => sc.includes(id))
-    if (!person && !chat) datasourceIds = this.state.settings.larkDefaultDatasourceIds ?? []
+    if (!person && !chat) datasourceIds = defaults.datasourceIds ?? []
     const role = person?.role ?? chat?.role ?? fallbackRole
     if (Array.isArray(datasourceIds) && datasourceIds.length === 0) return { refused: '你在当前群里没有可访问的数据源。' }
     return {
       actor: {
-        kind: 'lark', id: person?.id ?? `lark:${openId}`, name: person?.name ?? name ?? openId,
+        kind: platform, platform, id: person?.id ?? `${platform}:${userId}`, name: person?.name ?? name ?? userId,
         // Group chats: the narrower of the person's and the group's role.
         role: [person?.role, chat?.role, (!person && !chat) ? fallbackRole : undefined].filter(Boolean).sort((a, b) => ROLE_RANK[a] - ROLE_RANK[b])[0] ?? role,
-        openId, chatId, chatName: chat?.name, datasourceIds,
+        userId, ...(platform === 'lark' ? { openId: userId } : {}), chatId, chatName: chat?.name, datasourceIds,
         rowRules: [...(person?.rowRules ?? []), ...(chat?.rowRules ?? [])],
         defaultDatasourceId: chat?.defaultDatasourceId ?? person?.defaultDatasourceId ?? (datasourceIds?.[0] ?? null),
       },
     }
   },
 
+  /** Back-compat alias of resolveActor for Lark. */
+  resolveLarkActor({ openId, email, name, chatId, chatType }) {
+    return this.resolveActor({ platform: 'lark', userId: openId, email, name, chatId, chatType })
+  },
+
   auditAdmin(action, detail, actor) {
     this.records.put('admin', { id: newId('ad'), at: Date.now(), action, detail: String(detail).slice(0, 300), ...(actor ? { actor: { id: actor.id, name: actor.name, kind: actor.kind } } : {}) })
   },

package/service/admin.js

@@ -9,6 +9,9 @@ import { join } from 'node:path'
 import { DatabaseSync } from 'node:sqlite'
 import { DEFAULT_SETTINGS, RECORD_LIMITS, UserError, newId, pick } from './shared.js'
 import { widgetWidth } from './dashboards.js'
+import { kindOf } from '../channels/index.js'
+import { findIdentityClash, normalizeIdentities, normalizeUserRecord } from './access.js'
+import { migrateChannelRecord } from './channels.js'
 
 const PKG = (() => { try { return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) } catch { return {} } })()
 
@@ -18,7 +21,7 @@ const SECTIONS = ['settings', 'datasources', 'knowledge', 'dashboards', 'alerts'
 const DS_FIELDS = ['id', 'name', 'type', 'host', 'port', 'database', 'user', 'charset', 'timezone', 'ssl', 'schemas', 'description', 'privacy', 'policy']
 const ALERT_RUNTIME = ['state', 'lastCheckedAt', 'lastValue', 'lastResultId', 'lastFiredAt', 'lastError']
 const REPORT_FIELDS = ['id', 'title', 'scope', 'question', 'instructions', 'period', 'time', 'weekdays', 'timeZone', 'target']
-const CHANNEL_FIELDS = ['id', 'name', 'type', 'domain', 'appId', 'receiveIdType', 'receiveId', 'description', 'isDefault', 'chartMode']
+const CHANNEL_FIELDS = ['id', 'name', 'type', 'platform', 'domain', 'appId', 'receiveIdType', 'receiveId', 'description', 'isDefault', 'chartMode', 'config', 'bot']
 
 async function fileBytes(file) {
   try { return (await stat(file)).size } catch { return 0 }
@@ -199,8 +202,10 @@ export const methods = {
     const dsName = (id) => this.findDatasource(id)?.name ?? null
     const chName = (id) => this.state.channels.find(c => c.id === id)?.name ?? null
     const settings = structuredClone(this.state.settings)
-    if (Array.isArray(settings.larkDefaultDatasourceIds)) settings.larkDefaultDatasources = settings.larkDefaultDatasourceIds.map(dsName).filter(Boolean)
-    delete settings.larkDefaultDatasourceIds
+    const botDs = settings.botDefaultDatasourceIds !== undefined ? settings.botDefaultDatasourceIds : settings.larkDefaultDatasourceIds
+    if (Array.isArray(botDs)) settings.botDefaultDatasources = botDs.map(dsName).filter(Boolean)
+    if (settings.larkDefaultRole !== undefined && settings.botDefaultRole === undefined) settings.botDefaultRole = settings.larkDefaultRole
+    delete settings.larkDefaultDatasourceIds; delete settings.botDefaultDatasourceIds; delete settings.larkDefaultRole
     if (settings.schemaNotifyChannel) settings.schemaNotifyChannelName = chName(settings.schemaNotifyChannel)
     delete settings.schemaNotifyChannel
     return {
@@ -234,9 +239,9 @@ export const methods = {
         channelName: chName(r.channelId),
         dashboardName: this.state.dashboards.find(d => d.id === r.dashboardId)?.name ?? null,
       })),
-      channels: this.state.channels.map(c => ({ ...pick(c, CHANNEL_FIELDS), hasSecret: Boolean(c.hasSecret), hasSign: Boolean(c.hasSign) })),
+      channels: this.state.channels.map(c => { migrateChannelRecord(c); return { ...structuredClone(pick(c, CHANNEL_FIELDS)), secretsSet: { ...(c.secretsSet ?? {}) }, hasSecret: Boolean(c.hasSecret ?? Object.keys(c.secretsSet ?? {}).length), hasSign: Boolean(c.hasSign) } }),
       users: (this.state.users ?? []).map(u => {
-        const out = structuredClone(u)
+        const out = normalizeUserRecord(structuredClone(u))
         out.datasources = Array.isArray(u.datasourceIds) ? u.datasourceIds.map(dsName).filter(Boolean) : null
         out.defaultDatasource = dsName(u.defaultDatasourceId)
         out.rowRules = (u.rowRules ?? []).map(r => ({ ...r, datasource: r.datasourceId ? dsName(r.datasourceId) : null, datasourceId: undefined }))
@@ -337,18 +342,24 @@ export const methods = {
       if (mode === 'replace') chMap.clear()
       for (const src of doc.channels ?? []) {
         const name = String(src?.name ?? '').trim().slice(0, 64)
-        if (!name || !['lark_webhook', 'lark_app'].includes(src.type)) { r.skipped++; warn('channels', `渠道「${name || '?'}」无效，已跳过`); continue }
+        const found = kindOf(src?.type)
+        if (!name || !found) { r.skipped++; warn('channels', `渠道「${name || '?'}」无效${src?.type && !found ? `（不支持的类型 ${src.type}）` : ''}，已跳过`); continue }
         const current = mode === 'replace' ? this.state.channels.find(c => c.name === name) : next.find(c => c.name === name)
-        const fields = pick(src, CHANNEL_FIELDS.filter(k => k !== 'id' && k !== 'isDefault'))
+        const fields = structuredClone(pick(src, CHANNEL_FIELDS.filter(k => k !== 'id' && k !== 'isDefault')))
+        fields.platform = found.adapter.id
+        if (fields.bot) fields.bot = this.normalizeBotConfig(fields.bot, {})
+        if (current && current.type !== src.type) { delete current.config; delete current.secretsSet }
         if (current) {
-          const c = { ...current, ...fields, name, updatedAt: Date.now() }
+          const c = migrateChannelRecord({ ...current, ...fields, name, ...(src.config ? {} : { config: undefined }), updatedAt: Date.now() })
           const i = next.findIndex(x => x.id === current.id)
           if (i >= 0) next[i] = c; else next.push(c)
           chMap.set(name, c.id)
           r.update++
         } else {
           const id = src.id && /^ch-[\w-]+$/.test(src.id) && !next.some(c => c.id === src.id) && !this.state.channels.some(c => c.id === src.id) ? src.id : newId('ch')
-          const c = { id, ...fields, name, hasSecret: false, hasSign: false, needsSecret: true, createdAt: Date.now(), updatedAt: Date.now(), isDefault: false }
+          const c = migrateChannelRecord({ id, ...fields, name, hasSecret: false, hasSign: false, secretsSet: {}, needsSecret: true, createdAt: Date.now(), updatedAt: Date.now(), isDefault: false })
+          // Bots need their secret back first.
+          if (c.bot) c.bot.enabled = false
           next.push(c)
           chMap.set(name, id)
           r.add++
@@ -496,14 +507,17 @@ export const methods = {
         if (!name || !['person', 'chat'].includes(src.kind ?? 'person') || !['admin', 'analyst', 'viewer'].includes(src.role ?? 'analyst')) { r.skipped++; continue }
         const ids = src.datasources === null || src.datasources === undefined ? null : (src.datasources ?? []).map(resolveDs).filter(Boolean)
         if (Array.isArray(src.datasources) && ids.length < src.datasources.length) warn('users', `成员「${name}」的部分数据源不存在，已忽略`)
-        const u = {
+        let identities
+        try { identities = Array.isArray(src.identities) ? normalizeIdentities(src.identities) : undefined } catch (error) { r.skipped++; warn('users', `成员「${name}」：${error.message}`); continue }
+        const u = normalizeUserRecord({
           ...pick(src, ['kind', 'role', 'larkOpenId', 'email', 'larkChatId', 'disabled', 'note']),
+          ...(identities ? { identities } : {}),
           kind: src.kind ?? 'person', role: src.role ?? 'analyst', name,
           datasourceIds: ids, defaultDatasourceId: resolveDs(src.defaultDatasource) ?? ids?.[0] ?? null,
           rowRules: (src.rowRules ?? []).map(x => ({ datasourceId: x.datasource ? resolveDs(x.datasource) ?? null : null, column: x.column, values: x.values ?? [] })).filter(x => x.column && x.values.length),
           updatedAt: Date.now(),
-        }
-        const existing = next.find(x => (u.larkOpenId && x.larkOpenId === u.larkOpenId) || (u.email && x.email === u.email) || (u.larkChatId && x.larkChatId === u.larkChatId)) ?? next.find(x => x.name === name)
+        })
+        const existing = findIdentityClash(next, { ...u, id: undefined }) ?? next.find(x => x.name === name)
         if (existing) { next[next.indexOf(existing)] = { ...u, id: existing.id, createdAt: existing.createdAt }; r.update++ }
         else {
           const id = src.id && /^u-[\w-]+$/.test(src.id) && !next.some(x => x.id === src.id) ? src.id : newId('u')
@@ -518,7 +532,9 @@ export const methods = {
     if (want.has('settings') && doc.settings && typeof doc.settings === 'object') {
       const r = sec('settings')
       const input = pick(doc.settings, Object.keys(DEFAULT_SETTINGS).concat(['schemaCheckDaily']))
-      if (Array.isArray(doc.settings.larkDefaultDatasources)) input.larkDefaultDatasourceIds = doc.settings.larkDefaultDatasources.map(resolveDs).filter(Boolean)
+      if (doc.settings.larkDefaultRole !== undefined && input.botDefaultRole === undefined) input.botDefaultRole = doc.settings.larkDefaultRole
+      const botDs = doc.settings.botDefaultDatasources ?? doc.settings.larkDefaultDatasources
+      if (Array.isArray(botDs)) input.botDefaultDatasourceIds = botDs.map(resolveDs).filter(Boolean)
       if (doc.settings.schemaNotifyChannelName) input.schemaNotifyChannel = resolveCh(doc.settings.schemaNotifyChannelName) ?? ''
       if (apply) {
         const before = structuredClone(this.state.settings)