@nocobase/app-template-default 1.0.0-beta.80 → 1.0.0-beta.81

package/client/locales/system/settings-en-US.ts

@@ -148,6 +148,9 @@ const settings = {
     'Contact an administrator to add users or grant the permissions needed to create users and assign roles.',
   rolesReadOnlyEmpty:
     'Contact an administrator to create a role or grant you permission to create roles.',
+  noRoleAccess:
+    'This user can still sign in and use account basics. No business access is granted by roles.',
+  noAssignedRoles: 'No assigned roles',
   noRoles: 'No roles yet',
   create: 'Create',
   edit: 'Edit',

package/client/locales/system/settings-zh-CN.ts

@@ -136,6 +136,8 @@ const settings = {
   usersReadOnlyEmpty:
     '请联系管理员添加用户，或授予创建用户和分配角色所需的权限。',
   rolesReadOnlyEmpty: '请联系管理员创建角色，或授予你创建角色的权限。',
+  noRoleAccess: '此用户仍可登录并使用账号基础功能，角色未授予业务访问。',
+  noAssignedRoles: '未分配角色',
   noRoles: '暂无角色',
   create: '创建',
   edit: '编辑',

package/client/pages/settings/user-form.tsx

@@ -174,6 +174,11 @@ export function RoleSelection({
           </ComboboxList>
         </ComboboxContent>
       </Combobox>
+      {scope.key === 'app' && selected.length === 0 && (
+        <p className='text-sm text-muted-foreground'>
+          {t('settings.noRoleAccess')}
+        </p>
+      )}
     </div>
   );
 }
@@ -223,7 +228,14 @@ function UserEditor(): ReactElement {
     password: '',
   };
   const [roleDraft, setRoleDraft] = useState<Record<string, UserRoleValue>>({});
-  const roles = { ...(initial?.roleScopes ?? {}), ...roleDraft };
+  const defaults = creating
+    ? Object.fromEntries(
+        (options.data?.data.roleScopes ?? [])
+          .filter((scope) => scope.defaultValue !== undefined)
+          .map((scope) => [scope.key, scope.defaultValue!]),
+      )
+    : {};
+  const roles = { ...defaults, ...(initial?.roleScopes ?? {}), ...roleDraft };
   const changedRoles = Object.fromEntries(
     Object.entries(roleDraft).filter(
       ([key, value]) =>

package/client/pages/settings/users.tsx

@@ -360,7 +360,7 @@ export default function UsersPage(): ReactElement {
                 },
               );
             })
-            .join(', ') || '—',
+            .join(', ') || t('settings.noAssignedRoles'),
       },
       {
         id: 'actions',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.80",
+  "version": "1.0.0-beta.81",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.80"
+    "defaultTemplateVersion": "1.0.0-beta.81"
   },
   "devDependencies": {
     "@ai-sdk/react": "4.0.131",
@@ -75,7 +75,7 @@
     "@types/jsdom": "^30.0.0",
     "@nocobase/app-client": "^4.0.0-beta.3",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.50",
+    "@nocobase/app-skills": "0.1.0-beta.51",
     "@nocobase/app-testing": "0.1.0-beta.6",
     "@nocobase/app-websocket": "^0.1.0-beta.1",
     "@nocobase/dev-config": "0.1.0-beta.25",
@@ -142,35 +142,35 @@
     "hono": "^4.13.2",
     "@nocobase/app-plugin-agents": "^1.0.0-beta.25",
     "@nocobase/app-plugin-api-keys": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.14",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.31",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.15",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.32",
     "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.16",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.26",
     "@nocobase/app-plugin-foundation": "^0.1.0-beta.7",
     "@nocobase/app-plugin-i18n": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-file": "^1.0.0-beta.26",
     "@nocobase/app-plugin-knowledge": "^0.1.0-beta.12",
     "@nocobase/app-plugin-mail": "^1.0.0-beta.17",
     "@nocobase/app-plugin-notification": "^2.0.0-beta.0",
     "@nocobase/app-plugin-notification-in-app": "^2.0.0-beta.0",
     "@nocobase/app-plugin-notification-providers": "^1.0.0-beta.15",
     "@nocobase/app-plugin-scheduler": "^1.0.0-beta.20",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.9",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.10",
     "@nocobase/app-server": "^3.0.0-beta.3",
     "@nocobase/config": "^0.1.0-beta.3",
     "@nocobase/db": "^1.0.0-beta.22",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
-    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.15",
     "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.15",
     "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.14",
     "@nocobase/authorization": "^1.0.0-beta.15",
     "@nocobase/queue": "^0.1.0-beta.9",
     "@nocobase/jobs": "^0.1.0-beta.4",
     "@nocobase/lifecycle": "^0.1.0-beta.3",
     "@nocobase/i18n": "^2.0.0-beta.1",
-    "@nocobase/repository-input": "^0.1.0-beta.3",
     "@nocobase/caching": "^0.1.0-beta.3",
+    "@nocobase/repository-input": "^0.1.0-beta.3",
     "@nocobase/app-cli": "^1.0.0-beta.27",
     "@nocobase/realtime": "^0.1.0-beta.3"
   },

package/tests/client/user-drawer.test.tsx

@@ -68,6 +68,7 @@ async function renderUsers(
   actions: string[] = [],
   initialRoles: Record<string, string[]> = {},
   requiredRole = false,
+  defaultRole = false,
 ) {
   let current = { ...original, roleScopes: initialRoles };
   let roleFailure = false;
@@ -105,7 +106,9 @@ async function renderUsers(
                     label: 'Application',
                     selection: 'multiple',
                     requiredOnCreate: requiredRole,
+                    ...(defaultRole ? { defaultValue: ['member'] } : {}),
                     options: [
+                      { value: 'member', label: 'Member' },
                       { value: 'sales', label: 'Sales team' },
                       { value: 'finance', label: 'Finance team' },
                       {
@@ -535,3 +538,48 @@ it('focuses and describes the required role dropdown when creating without a rol
     view.calls.mock.calls.filter(([call]) => call.method === 'POST'),
   ).toHaveLength(0);
 });
+
+it('uses Member only as a creation default and respects explicitly cleared selection', async () => {
+  const user = userEvent.setup();
+  const view = await renderUsers(
+    '/users',
+    '/create',
+    true,
+    true,
+    [],
+    {},
+    false,
+    true,
+  );
+  const roles = await screen.findByRole('combobox', {
+    name: 'Application',
+    exact: true,
+  });
+  expect(roles).toHaveTextContent('Member');
+  await user.click(roles);
+  await user.click(
+    await screen.findByRole('option', { name: 'Member', exact: true }),
+  );
+  await user.keyboard('{Escape}');
+  expect(roles).not.toHaveTextContent('Member');
+  expect(screen.getByText(enUS.settings.noRoleAccess)).toBeVisible();
+  await user.type(screen.getByRole('textbox', { name: 'Name *' }), 'Roleless');
+  await user.type(
+    screen.getByRole('textbox', { name: 'Email *' }),
+    'roleless@example.test',
+  );
+  await user.type(
+    screen.getByLabelText(`${enUS.settings.password} *`),
+    'Roleless-test-123!',
+  );
+  await user.click(screen.getByRole('button', { name: 'Create', exact: true }));
+  await waitFor(() =>
+    expect(view.calls).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: 'POST',
+        path: 'users',
+        json: expect.objectContaining({ roleScopes: { app: [] } }),
+      }),
+    ),
+  );
+});

package/tests/server/authorization-assignment-safety.test.ts

@@ -11,14 +11,7 @@ type Assignment = {
 function unexpectedGlobalAssignments(
   assignments: readonly Assignment[],
 ): Assignment[] {
-  return assignments.filter(
-    (assignment) =>
-      assignment.subjectId === '*' &&
-      !(
-        assignment.subjectType === 'authenticated' &&
-        assignment.permissionSetKey === 'member'
-      ),
-  );
+  return assignments.filter((assignment) => assignment.subjectId === '*');
 }
 
 const test = createAppTest({
@@ -76,5 +69,13 @@ it('detects wildcard recipients regardless of the role name, while preserving ex
       global,
       { ...global, subjectType: 'everyone' },
     ]),
-  ).toEqual([global, { ...global, subjectType: 'everyone' }]);
+  ).toEqual([
+    {
+      subjectType: 'authenticated',
+      subjectId: '*',
+      permissionSetKey: 'member',
+    },
+    global,
+    { ...global, subjectType: 'everyone' },
+  ]);
 });

package/tests/server/member-role.test.ts

@@ -0,0 +1,299 @@
+// @vitest-environment node
+import { expect } from 'vitest';
+import { createAppTest } from '@nocobase/app-testing/server';
+import {
+  signIn,
+  DEFAULT_ADMIN_CREDENTIALS,
+} from '@nocobase/app-plugin-authentication/testing';
+import { userManagementServiceToken } from '@nocobase/app-plugin-users/server/tokens';
+import {
+  authenticationToken,
+  userAdministrationServiceToken,
+} from '@nocobase/app-plugin-authentication';
+import { authorizationToken } from '@nocobase/app-plugin-authorization';
+import { createStandaloneServer } from '../../server/standalone.js';
+
+const test = createAppTest({
+  createServer: createStandaloneServer,
+  config: {
+    app: { publicOrigin: 'http://localhost' },
+    auth: { secret: 'test-auth-secret-at-least-32-characters' },
+  },
+});
+const json = (body: unknown, method = 'POST') => ({
+  method,
+  headers: { 'content-type': 'application/json', origin: 'http://localhost' },
+  body: JSON.stringify(body),
+});
+
+test('saved roles control direct API access while account basics remain usable', async ({
+  testApp,
+  app,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  const sets = app.container.resolve(authorizationToken).permissionSets;
+  const grants = [
+    { resource: { type: 'user', id: '*' }, actions: [{ action: 'read' }] },
+  ];
+  await sets.update('member', { key: 'member', grants });
+  await sets.create({ key: 'reader', grants });
+  const create = async (
+    name: string,
+    roleScopes?: Record<string, string[]>,
+  ) => {
+    const response = await admin.fetch(
+      '/users',
+      json({
+        name,
+        username: name,
+        email: `${name}@example.test`,
+        password: 'Member-test-123!',
+        ...(roleScopes === undefined ? {} : { roleScopes }),
+      }),
+    );
+    expect(response.status).toBe(201);
+    return (await response.json()).data;
+  };
+  const member = await create('membercase');
+  expect(member.roleScopes.app).toEqual(['member']);
+  expect((await create('emptycase', { app: [] })).roleScopes.app).toEqual([]);
+  expect(
+    (await create('replacecase', { app: ['reader'] })).roleScopes.app,
+  ).toEqual(['reader']);
+  expect(
+    (
+      await create('appendcase', { app: ['member', 'reader'] })
+    ).roleScopes.app.sort(),
+  ).toEqual(['member', 'reader']);
+  expect((await create('omittedscope', {})).roleScopes.app).toEqual(['member']);
+  let session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Member-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(200);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: [] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ name: 'Updated member' }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect(
+    (await (await admin.fetch(`/users/${member.id}`)).json()).data.roleScopes
+      .app,
+  ).toEqual([]);
+  session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Member-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect((await session.fetch('/users/me/preferences')).status).toBe(200);
+  expect(
+    (
+      await session.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: ['root'] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(403);
+  expect(
+    (
+      await session.fetch(
+        `/users/${admin.user.id}`,
+        json({ name: 'Forbidden' }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(403);
+  expect(
+    (
+      await session.fetch(
+        '/auth/change-password',
+        json({
+          currentPassword: 'Member-test-123!',
+          newPassword: 'Changed-test-123!',
+        }),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/auth/sign-out', json({}))).status).toBe(200);
+  session = await signIn(testApp, {
+    username: 'membercase',
+    password: 'Changed-test-123!',
+  });
+  expect((await session.fetch('/users')).status).toBe(403);
+  expect(
+    (
+      await admin.fetch(
+        `/users/${member.id}`,
+        json({ roleScopes: { app: ['reader'] } }, 'PATCH'),
+      )
+    ).status,
+  ).toBe(200);
+  expect((await session.fetch('/users')).status).toBe(200);
+  const protectedRole = await admin.fetch(
+    `/users/${member.id}`,
+    json({ roleScopes: { app: ['root'] } }, 'PATCH'),
+  );
+  expect(protectedRole.status).toBe(400);
+  expect((await protectedRole.json()).error.reason).toBe(
+    'PROTECTED_ROLE_ASSIGNMENT',
+  );
+  await expect(
+    sets.assign({
+      subject: { type: 'authenticated', id: '*' },
+      permissionSet: 'member',
+    }),
+  ).rejects.toThrow();
+});
+
+test('registration and trusted external identity creation receive defaults atomically', async ({
+  testApp,
+  app,
+  connection,
+}) => {
+  const response = await testApp.request(
+    '/auth/sign-up/email',
+    json({
+      name: 'Signup',
+      email: 'signup@example.test',
+      password: 'Signup-test-123!',
+      roleScopes: { app: ['root'] },
+    }),
+  );
+  expect(response.status).toBe(200);
+  const registered = (await response.json()).user;
+  const roles = async (id: string) =>
+    (
+      await connection.query
+        .selectFrom('authorizationPermissionSetAssignments')
+        .select('permissionSetKey')
+        .where('subjectType', '=', 'user')
+        .where('subjectId', '=', id)
+        .execute()
+    ).map((r) => r.permissionSetKey);
+  expect(await roles(registered.id)).toEqual(['member']);
+  const auth = app.container.resolve(authenticationToken);
+  const context = await auth.administrationContext();
+  const external = await context.internalAdapter.createUser({
+    name: 'External',
+    email: 'external@example.test',
+    emailVerified: true,
+  });
+  expect(await roles(external.id)).toEqual(['member']);
+  const service = await app.container
+    .resolve(userAdministrationServiceToken)
+    .createServiceAccount({ name: 'Service verification' });
+  expect(await roles(service.id)).toEqual([]);
+  const remove = auth.addUserInitializer(async () => {
+    throw new Error('Synthetic initialization failure');
+  });
+  try {
+    await expect(
+      context.internalAdapter.createUser({
+        name: 'Failed',
+        email: 'failed@example.test',
+        emailVerified: true,
+      }),
+    ).rejects.toThrow('Synthetic initialization failure');
+    expect(
+      await connection.query
+        .selectFrom('user')
+        .select('id')
+        .where('email', '=', 'failed@example.test')
+        .execute(),
+    ).toEqual([]);
+  } finally {
+    remove();
+  }
+});
+
+test('invitations preserve explicit empty roles and existing account decisions', async ({
+  testApp,
+  app,
+}) => {
+  const admin = await signIn(testApp, DEFAULT_ADMIN_CREDENTIALS);
+  const users = app.container.resolve(userManagementServiceToken);
+  await app.container.resolve(authorizationToken).permissionSets.create({
+    key: 'invitation-reader',
+    grants: [],
+  });
+  for (const [name, scopes, expected] of [
+    ['invite-default', undefined, ['member']],
+    ['invite-empty', { app: [] }, []],
+    ['invite-replace', { app: ['invitation-reader'] }, ['invitation-reader']],
+  ] as const) {
+    const [invitation] = await users.invite({
+      emails: [`${name}@example.test`],
+      invitedBy: admin.user.id,
+      origin: 'http://localhost',
+      sendEmail: false,
+      ...(scopes ? { roleScopes: scopes } : {}),
+    });
+    const token = invitation.inviteUrl!.split('/').at(-1)!;
+    const accepted = await users.acceptInvitation({
+      token,
+      name,
+      password: 'Invite-test-123!',
+    });
+    expect((await users.get(accepted.userId)).roleScopes.app).toEqual(expected);
+    await expect(
+      users.acceptInvitation({ token, name, password: 'Invite-test-123!' }),
+    ).rejects.toThrow();
+    await users.update(accepted.userId, { roleScopes: { app: [] } });
+    const [again] = await users.invite({
+      emails: [`${name}@example.test`],
+      invitedBy: admin.user.id,
+      origin: 'http://localhost',
+      sendEmail: false,
+    });
+    expect(again.outcome).toBe('existingUser');
+    expect((await users.get(accepted.userId)).roleScopes.app).toEqual([]);
+  }
+  const [pending] = await users.invite({
+    emails: ['preaccepted@example.test'],
+    invitedBy: admin.user.id,
+    origin: 'http://localhost',
+    sendEmail: false,
+  });
+  const existing = await users.create({
+    name: 'Existing',
+    email: 'preaccepted@example.test',
+    password: 'Existing-test-123!',
+    roleScopes: { app: [] },
+  });
+  await users.acceptInvitation(
+    {
+      token: pending.inviteUrl!.split('/').at(-1)!,
+      name: 'Existing',
+      password: 'Existing-test-123!',
+    },
+    existing.id,
+  );
+  expect((await users.get(existing.id)).roleScopes.app).toEqual([]);
+  const created = await Promise.all(
+    Array.from({ length: 4 }, (_, index) =>
+      users.create({
+        name: `Concurrent ${index}`,
+        email: `concurrent-${index}@example.test`,
+        password: 'Concurrent-test-123!',
+        ...(index % 2 ? { roleScopes: { app: [] } } : {}),
+      }),
+    ),
+  );
+  expect(created.map((user) => user.roleScopes.app)).toEqual([
+    ['member'],
+    [],
+    ['member'],
+    [],
+  ]);
+});