@oj-module/cli 0.2.28 → 0.2.30

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oj-module/cli",
   "type": "module",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "React Antd 模块工程命令行工具（含预构建宿主 shell-dist）",
   "license": "MIT",
   "exports": {
@@ -49,7 +49,7 @@
   ],
   "dependencies": {
     "@faker-js/faker": "^10.4.0",
-    "@oj-module/runtime": "0.2.28",
+    "@oj-module/runtime": "0.2.30",
     "@redocly/cli": "^2.51.0",
     "@tailwindcss/vite": "^4.3.0",
     "cac": "^6.7.14",

package/shell-dist/assets/{index-CtTVbohp.js → index-FYt9CjFd.js}

@@ -1,5 +1,5 @@
 import { StyleProvider } from "@ant-design/cssinjs";
-import { AntdApp, ErrorBoundary, LayoutEffects, PageError, getHostRoutes, loadAll, setupI18n, useAuthStore, usePreferences, useUserStore } from "@oj-module/runtime";
+import { AntdApp, ErrorBoundary, LayoutEffects, PageError, getHostRoutes, getRoutes, loadAll, setupI18n, useAccessStore, useAuthStore, usePreferences, useUserStore } from "@oj-module/runtime";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { ConfigProvider, theme } from "antd";
 import { useEffect, useState } from "react";
@@ -231,14 +231,58 @@ async function hydrateUser() {
 /**
 * 登录/登出都会经 auth store reset() 清空 user store（宿主链无 AuthGuard 重新
 * 拉取），token 变化即重新定角色。
-*
-* 已知偏差：角色变化只影响渲染期判断，侧栏菜单是 Boot 期按当时角色登记的，
-* 不登录直接进站再登录的场景菜单需刷新一次才对（后端 403 硬兜底，不是权限泄漏）。
 */
 useAuthStore.subscribe((state, prev) => {
-	if (state.token !== prev.token) hydrateUser();
+	if (state.token !== prev.token) hydrateUser().then(() => {
+		useAccessStore.getState().setAccessStore(getRoutes());
+		repatchShellRoutes();
+	});
 });
 /**
+* 宿主路由根 id：patchRoutes 重登记的 parentId（与 runtime 的 ROOT_ROUTE_ID
+* 同名无碍——各自作用于各自 router 实例）。
+*/
+var SHELL_ROOT_ID = "shell-root";
+/** Boot 建表后持有的宿主 router 实例；token 变化时按新角色快照重登记其路由表。 */
+var shellRouter = null;
+/**
+* 宿主路由表 children：index 重定向 + 模块路由（getHostRoutes 同源重写）+
+* catch-all 兜底。Boot 建表与登录后重登记共用同一构建口，保证两处同源。
+*/
+function buildShellChildren() {
+	const hostRoutes = getHostRoutes();
+	return [
+		{
+			index: true,
+			element: /* @__PURE__ */ jsx(Navigate, {
+				to: hostRoutes[0]?.path ?? "/",
+				replace: true
+			})
+		},
+		...hostRoutes,
+		{
+			path: "*",
+			element: /* @__PURE__ */ jsx(CatchAll, {})
+		}
+	];
+}
+/**
+* 按当前角色快照重登记宿主路由表（B16 回归，2026-10-24）。
+*
+* setAccessStore 内部的 router.patchRoutes 打的是 runtime 单例 router，而宿主
+* 渲染的是本文件 Boot 里自建的 router——仅调 setAccessStore 只会更新菜单
+* （access store），路由表保持 Boot 期快照。后果：Boot 期 user-info 失败
+* （后端闪断/过期 token 刷新失败）→ 角色空 → requiredRoles 门禁模块被过滤出
+* 路由表；随后 SPA 登录（不刷新页面）菜单回来了，但 /system/* 仍不在路由表里，
+* 直达恒落 catch-all 404「返回首页」，须硬刷新才恢复。
+*/
+function repatchShellRoutes() {
+	if (!shellRouter) return;
+	shellRouter.patchRoutes(SHELL_ROOT_ID, buildShellChildren());
+	const { pathname, search } = shellRouter.state.location;
+	shellRouter.navigate(`${pathname}${search}`, { replace: true }).catch(() => {});
+}
+/**
 * 直链兜底页（catch-all 路由元素）。无匹配路由时渲染框架 `PageError`，
 * 把 title 设为框架 404 文案（`exception.notFoundTitle` = "404"），
 * 观感与无权限面板同构，替代 React Router 默认的「Unexpected Application Error!」。
@@ -300,27 +344,14 @@ function Boot() {
 				await hydrateUser();
 				await loadAll(manifest);
 				if (cancelled) return;
-				const hostRoutes = getHostRoutes();
-				setRouter(createBrowserRouter([{
+				shellRouter = createBrowserRouter([{
 					path: "/",
+					id: SHELL_ROOT_ID,
 					element: /* @__PURE__ */ jsxs(ErrorBoundary, {
 						FallbackComponent: PageError,
 						children: [/* @__PURE__ */ jsx(LayoutEffects, {}), /* @__PURE__ */ jsx(Outlet, {})]
 					}),
-					children: [
-						{
-							index: true,
-							element: /* @__PURE__ */ jsx(Navigate, {
-								to: hostRoutes[0]?.path ?? "/",
-								replace: true
-							})
-						},
-						...hostRoutes,
-						{
-							path: "*",
-							element: /* @__PURE__ */ jsx(CatchAll, {})
-						}
-					]
+					children: buildShellChildren()
 				}], { 
 				/**
 				* 子路径部署（oj `mounts: [{ prefix: /oj, web: dist, spa: true }]`）：
@@ -331,7 +362,8 @@ function Boot() {
 				*
 				* 浏览器 URL 不受影响：react-router 只是在匹配/生成时剥/补前缀。
 				*/
-basename: base }));
+basename: base });
+				setRouter(shellRouter);
 			} catch (e) {
 				if (!cancelled) setError(e instanceof Error ? e.message : String(e));
 			}

package/shell-dist/assets/runtime.js

@@ -304,10 +304,10 @@ function getAppInfo() {
 	return {
 		"pkg": {
 			"name": "@oj-module/runtime",
-			"version": "0.2.28",
+			"version": "0.2.30",
 			"license": "MIT"
 		},
-		"lastBuildTime": "2026-10-24 18:30:15"
+		"lastBuildTime": "2026-10-24 23:41:26"
 	};
 }
 var init_get_app_info = __esmMin((() => {}));
@@ -28190,6 +28190,7 @@ init_layout_effects();
 init_locales();
 init_module_loader();
 init_slots();
+init_access();
 init_auth();
 init_tabs();
 init_user();
@@ -28203,4 +28204,4 @@ init_ri();
 init_menu_icons();
 init_tree();
 //#endregion
-export { AccessControl, AccessControlRoles, AntdApp, BasicButton, BasicContent, BasicTable, EmbeddedIcon, ErrorBoundary, ExternalIcon, FormAvatarItem, FormTreeItem, Iframe, LayoutCenterIcon, LayoutEffects, LayoutLeftIcon, LayoutRightIcon, MixedNavigationIcon, OutsidePageIcon, PageError, ProfileCardIcon, RiAccountCircleLine, RiContrastFill, RiFullscreenExitLine, RiFullscreenLine, RiMailCheckLine, RiMoonIcon, RiReactjsLine, RiSunIcon, RiUserSettingsLine, ServerErrorIcon, SideNavigationIcon, TopNavigationIcon, TwoColumnNavigationIcon, accessControlCodes, bindingDiff, canAssignRole, canDeleteRole, canEditRoleBindings, defineModule, fetchAddMenuItem, fetchAddRoleItem, fetchAsyncRoutes, fetchChangePassword, fetchDeleteMenuItem, fetchDeleteRoleItem, fetchLdapLogin, fetchLogin, fetchLoginMethods, fetchLogout, fetchMenuByRoleId, fetchMenuList, fetchRbacAdminResetPassword, fetchRbacContactDetail, fetchRbacContacts, fetchRbacCreateRole, fetchRbacCreateUser, fetchRbacDeleteRole, fetchRbacOplog, fetchRbacOplogPost, fetchRbacPermissionList, fetchRbacRoleList, fetchRbacSetForbidden, fetchRbacSettings, fetchRbacUpdateBindings, fetchRbacUpdateSetting, fetchRbacUpdateUserRoles, fetchRbacUserList, fetchRefreshToken, fetchRoleList, fetchRoleMenu, fetchSolutionRoutes, fetchUpdateMenuItem, fetchUpdateRoleItem, fetchUserInfo, filterTree, getAllExpandedKeys, getAppInfo, getBooleanOptions, getHostRoutes, getModule, getModuleRoutePrefix, getModules, getRedirectPath, getRegisteredApiPrefix, getRegisteredStore, getRoutes, getYesNoOptions, groupByModule, groupSettingsByModule, handleTree, loadAll, mapTree, menuIcons, notify, permissionPrefix, request, resolveSiteBase, roleLabel, setupI18n, traverseTreeValues, unloadModule, useAccess, useAuthStore, usePreferences, useSlotNodes, useSolutionRoutes, useTabKey, useTabsStore, useUserStore, withSiteBase, external_exports as z };
+export { AccessControl, AccessControlRoles, AntdApp, BasicButton, BasicContent, BasicTable, EmbeddedIcon, ErrorBoundary, ExternalIcon, FormAvatarItem, FormTreeItem, Iframe, LayoutCenterIcon, LayoutEffects, LayoutLeftIcon, LayoutRightIcon, MixedNavigationIcon, OutsidePageIcon, PageError, ProfileCardIcon, RiAccountCircleLine, RiContrastFill, RiFullscreenExitLine, RiFullscreenLine, RiMailCheckLine, RiMoonIcon, RiReactjsLine, RiSunIcon, RiUserSettingsLine, ServerErrorIcon, SideNavigationIcon, TopNavigationIcon, TwoColumnNavigationIcon, accessControlCodes, bindingDiff, canAssignRole, canDeleteRole, canEditRoleBindings, defineModule, fetchAddMenuItem, fetchAddRoleItem, fetchAsyncRoutes, fetchChangePassword, fetchDeleteMenuItem, fetchDeleteRoleItem, fetchLdapLogin, fetchLogin, fetchLoginMethods, fetchLogout, fetchMenuByRoleId, fetchMenuList, fetchRbacAdminResetPassword, fetchRbacContactDetail, fetchRbacContacts, fetchRbacCreateRole, fetchRbacCreateUser, fetchRbacDeleteRole, fetchRbacOplog, fetchRbacOplogPost, fetchRbacPermissionList, fetchRbacRoleList, fetchRbacSetForbidden, fetchRbacSettings, fetchRbacUpdateBindings, fetchRbacUpdateSetting, fetchRbacUpdateUserRoles, fetchRbacUserList, fetchRefreshToken, fetchRoleList, fetchRoleMenu, fetchSolutionRoutes, fetchUpdateMenuItem, fetchUpdateRoleItem, fetchUserInfo, filterTree, getAllExpandedKeys, getAppInfo, getBooleanOptions, getHostRoutes, getModule, getModuleRoutePrefix, getModules, getRedirectPath, getRegisteredApiPrefix, getRegisteredStore, getRoutes, getYesNoOptions, groupByModule, groupSettingsByModule, handleTree, loadAll, mapTree, menuIcons, notify, permissionPrefix, request, resolveSiteBase, roleLabel, setupI18n, traverseTreeValues, unloadModule, useAccess, useAccessStore, useAuthStore, usePreferences, useSlotNodes, useSolutionRoutes, useTabKey, useTabsStore, useUserStore, withSiteBase, external_exports as z };

package/shell-dist/index.html

@@ -5,9 +5,9 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<link rel="icon" href="/favicon.ico" />
 		<title>React Antd Admin · Shell</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-mh43xEkINEUP2sZNPLqVdA=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
+		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'self' https://modules.cdn.example.com 'wasm-unsafe-eval' 'nonce-6NpMECPEhWQb/Ob12W+5HQ=='; script-src-attr 'none'; connect-src 'self' data: https://modules.cdn.example.com; style-src 'self' https://modules.cdn.example.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-src https://ant.design https://react.dev https://condorheroblog.github.io; form-action 'none'; base-uri 'none'; object-src 'none'; upgrade-insecure-requests" />
 
-		<script type="importmap" nonce="mh43xEkINEUP2sZNPLqVdA==">{
+		<script type="importmap" nonce="6NpMECPEhWQb/Ob12W+5HQ==">{
   "imports": {
     "react": "/assets/react.js",
     "react/jsx-runtime": "/assets/jsx-runtime.js",
@@ -133,7 +133,7 @@
     "dayjs/locale/zh-cn": "/assets/ojm-dayjs-locale-zh-cn.js"
   }
 }</script>
-		<script type="module" crossorigin src="/assets/index-CtTVbohp.js"></script>
+		<script type="module" crossorigin src="/assets/index-FYt9CjFd.js"></script>
 	</head>
 	<body>
 		<div id="root"></div>

package/shell-dist/versions.json

@@ -7,9 +7,9 @@
   "react-router": "7.18.2",
   "react-router/dom": "7.18.2",
   "@tanstack/react-query": "5.102.8",
-  "@oj-module/runtime": "0.2.28",
-  "@oj-module/runtime/contract": "0.2.28",
-  "@oj-module/runtime/contract/errors": "0.2.28",
+  "@oj-module/runtime": "0.2.30",
+  "@oj-module/runtime/contract": "0.2.30",
+  "@oj-module/runtime/contract/errors": "0.2.30",
   "@plane/kit": "0.1.20",
   "@plane/editor": "0.1.20",
   "antd": "6.6.1",

package/src/__tests__/listen-on-free-port.test.ts

@@ -0,0 +1,39 @@
+import type { Server } from "node:http";
+import type { AddressInfo } from "node:net";
+
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { listenOnFreePort } from "../static-handler";
+
+// 回归：listen(port, cb) 的 cb 在重试成功后以旧端口先 resolve——
+// 日志「改用 5175」与「已启动 5174」并存且实际监听在 5175（2026-10-24）。
+describe("listenOnFreePort", () => {
+	const cleanup: Server[] = [];
+
+	afterEach(() => {
+		for (const s of cleanup.splice(0))
+			s.close();
+	});
+
+	it("占用首端口时顺延，返回端口与实际监听端口一致", async () => {
+		const occupier = http.createServer(() => {}).listen(0);
+		cleanup.push(occupier);
+		await new Promise<void>(r => occupier.on("listening", r));
+		const busy = (occupier.address() as AddressInfo).port;
+
+		const server = http.createServer(() => {});
+		cleanup.push(server);
+		const port = await listenOnFreePort(server, busy);
+		expect(port).toBe(busy + 1);
+		// 旧 bug 在此暴露：resolve 的是 busy，实际却监听在 busy+1
+		expect((server.address() as AddressInfo).port).toBe(port);
+	});
+
+	it("首端口空闲时原样监听", async () => {
+		const server = http.createServer(() => {});
+		cleanup.push(server);
+		const port = await listenOnFreePort(server, 0);
+		expect((server.address() as AddressInfo).port).toBe(port);
+	});
+});

package/src/build.ts

@@ -106,6 +106,7 @@ export const accessControlCodes = _obj;
 export const AccessControlRoles = _obj;
 export const permissionPrefix = "permission:button";
 // store
+export const useAccessStore = _fn;
 export const useAuthStore = _fn;
 // 方案路由归并 store（token 就绪自动重拉，R21）
 export const useSolutionRoutes = _fn;

package/src/static-handler.ts

@@ -229,7 +229,14 @@ export function createStaticHandler(opts: StaticHandlerOptions): (req: http.Inco
 export function listenOnFreePort(server: http.Server, startPort: number, maxTries = 10): Promise<number> {
 	return new Promise((resolve, reject) => {
 		const attempt = (port: number) => {
-			server.once("error", (err: NodeJS.ErrnoException) => {
+			// 回调手动挂/摘（listen(port, cb) 的 cb 摘不掉前次失败的滞留闭包，
+			// 重试成功时会以旧端口先 resolve——日志与实listen端口漂移，2026-10-24 实测）
+			function cleanup() {
+				server.off("error", onError);
+				server.off("listening", onListen);
+			}
+			function onError(err: NodeJS.ErrnoException) {
+				cleanup();
 				if (err.code === "EADDRINUSE" && port - startPort < maxTries) {
 					console.warn(`[ojm] 端口 ${port} 已被占用，改用 ${port + 1}`);
 					attempt(port + 1);
@@ -237,8 +244,16 @@ export function listenOnFreePort(server: http.Server, startPort: number, maxTrie
 				else {
 					reject(err);
 				}
-			});
-			server.listen(port, () => resolve(port));
+			}
+			function onListen() {
+				cleanup();
+				// 取实绑端口（startPort=0 时 OS 自分随机端口，闭包 port 不可信）
+				const addr = server.address();
+				resolve(typeof addr === "object" && addr ? addr.port : port);
+			}
+			server.once("error", onError);
+			server.once("listening", onListen);
+			server.listen(port);
 		};
 		attempt(startPort);
 	});

package/templates/src/system/web/entry.ts

@@ -73,8 +73,11 @@ export default defineModule({
 	peerRuntime: ">=0.0.0",
 	// 路由级门禁（B16）：非系统管理员不注入 /system 路由、菜单不可见；
 	// API 级 403 由 assertSystemAdmin + service 层硬 enforcement 兜底。
-	// 角色口径对齐后端 assertSystemAdmin（access.ts:90）——superadmin **或**
-	// admin 均可；seed 的 admin 账号只有 superadmin，写 ["admin"] 会把它自己挡在门外。
+	// 角色口径对齐后端 assertSystemAdmin（access.ts:87）——superadmin **或**
+	// admin 均可，两者必须同时保留：D12（2026-10-22）起账号名=角色名，admin 与
+	// superadmin 是两个独立账号（seed.sql），只留 ["admin"] 会把 superadmin 挡在
+	// 门外（注册期过滤 → 路由消失 → 登录后 404 兜底）。改这两个值前先跑
+	// tests/system-guard.regression.spec.ts（只留 ["admin"] 会立刻变红）。
 	config: { requiredRoles: ["admin", "superadmin"] },
 	routes,
 	i18n: {

package/vendor/host-versions.json

@@ -8,9 +8,9 @@
 		"react-router": "7.18.2",
 		"react-router/dom": "7.18.2",
 		"@tanstack/react-query": "5.102.8",
-		"@oj-module/runtime": "0.2.28",
-		"@oj-module/runtime/contract": "0.2.28",
-		"@oj-module/runtime/contract/errors": "0.2.28",
+		"@oj-module/runtime": "0.2.30",
+		"@oj-module/runtime/contract": "0.2.30",
+		"@oj-module/runtime/contract/errors": "0.2.30",
 		"@plane/kit": "0.1.20",
 		"@plane/editor": "0.1.20",
 		"antd": "6.6.1",