@oj-module/cli 0.2.50 → 0.2.54

package/templates/src/_platform/api/_shared/service/domain/users.ts

@@ -59,13 +59,30 @@ function assertNotSelf(actorId: number, targetUid: number): void {
 		fail(400, "cannot operate on yourself");
 }
 
-/** AC1-8：成员资格（superadmin/admin 分配）仅 superadmin 可动。 */
+/**
+ * AC1-8（已修订）：成员资格提权守卫——按**被授予的角色**分层，不再一刀切。
+ *
+ *   · `superadmin` —— 仍严格只许 superadmin 授。它是**平台级**角色：握着它就能进
+ *     /system/wecom 那类跨租户页面（listApps 列出**所有企业**的档案），一旦租户内可授
+ *     即为跨租户越权，故这条不因下面的修订而放宽。
+ *   · `admin` —— 允许本租户内握有 `admin` 或 `superadmin` 的人任命。
+ *     判定与写入两侧都被租户作用域约束：`rolesOf()` 读 sys_user_role 走请求租户注入，
+ *     下面的写入同样带 tenant_id，所以租户管理员只能影响**自己租户**，不会越到别家。
+ *     动机：企业租户是隐式具象化的，平台 superadmin 因租户隔离查不到企业租户的用户
+ *     （实测 404），若 admin 任命也只许 superadmin，企业租户就永远配不出管理员。
+ *   · 其余角色（editor/viewer 等）—— 不校验，保持原行为。
+ */
 async function assertMembershipAllowed(actorId: number, nextRoles: string[]): Promise<void> {
 	if (!nextRoles.includes("superadmin") && !nextRoles.includes("admin"))
 		return;
 	const actorRoles = await rolesOf(Number(actorId));
-	if (!actorRoles.includes("superadmin"))
-		fail(403, "membership management requires superadmin");
+	const isSuper = actorRoles.includes("superadmin");
+	// 提权到平台级：只许 superadmin
+	if (nextRoles.includes("superadmin") && !isSuper)
+		fail(403, "granting superadmin requires superadmin");
+	// 任命本租户管理员：本租户的 admin 或 superadmin 均可
+	if (nextRoles.includes("admin") && !isSuper && !actorRoles.includes("admin"))
+		fail(403, "membership management requires admin or superadmin");
 }
 
 export async function listUsers(): Promise<UserRow[]> {
@@ -206,11 +223,30 @@ export async function updateUserRoles(actorId: number, targetUid: number, roles:
 			await t.table("sys_user_role").insert({ user_id: targetUid, role_name: role }).run();
 	});
 	invalidateUser(Number(targetUid));
+	// 提权类变更（牵涉 admin / superadmin）单列严重级：任命管理员＝把该租户的最高权限交出去，
+	// 不该和「勾了个 editor」落在同一噪声水平上。收回也算——撤销提权同样是安全事件。
+	const touchesPrivilege = (r: string) => r === "admin" || r === "superadmin";
+	const elevated = next.some(touchesPrivilege) || [...beforeSet].some(touchesPrivilege);
 	await recordOp({
 		action: "user.roles.update",
 		module: "framework",
 		target: await usernameOf(Number(targetUid)),
-		detail: { added: next.filter(r => !beforeSet.has(r)), removed: [...beforeSet].filter(r => !next.includes(r)) },
+		detail: {
+			added: next.filter(r => !beforeSet.has(r)),
+			removed: [...beforeSet].filter(r => !next.includes(r)),
+			// —— 租户维度 ——
+			// 每个租户都有自己的管理员，且**用户名撞车**（都叫 admin）：只记 username 分不清
+			// 「哪个租户的 admin 任命了谁」。sys_oplog.tenant_id 虽由请求租户注入，但那是隐式列，
+			// 显式落一份 + 双方 uid，审计才能直接按租户筛、也能定位到具体两个账号。
+			tenant: http.tenantId ?? "",
+			actorUid: Number(actorId),
+			targetUid: Number(targetUid),
+			// 便于直接筛出「任命/撤销管理员」这类高价值条目，不必去解析 added/removed
+			elevated,
+		},
+		// 4=warning（与「重设租户管理员口令」同级）：提权变更按安全事件留痕；
+		// 普通角色变更（editor/viewer）保持默认 6=info，避免审计被噪声淹没。
+		level: elevated ? 4 : 6,
 	});
 }
 

package/templates/src/_platform/api/contacts/api.ts

@@ -6,7 +6,7 @@ import { searchContacts } from "../_shared/service/domain/contacts";
 import { assertTenantSelf } from "../_shared/service/infra/access";
 import { rateLimit } from "../_shared/service/infra/rate";
 
-export default {
+const handler = {
 	// GET /api/_platform/contacts?keyword=&limit= —— 人员目录（AC1-22~24）。
 	async get() {
 		await respond(async () => {
@@ -23,3 +23,31 @@ export default {
 		});
 	},
 };
+
+// 入参：keyword 必填（服务层红线 2~64 字符），limit 可选（钳 200）
+handler.get.schema = {
+	query: {
+		type: "object",
+		required: ["keyword"],
+		properties: {
+			keyword: { type: "string", minLength: 2 },
+			limit: { type: "number" },
+		},
+	},
+};
+
+// 出参：目录红线只出 id/username/display_name（不含 email/avatar/roles）
+handler.get.response = {
+	type: "array",
+	items: {
+		type: "object",
+		required: ["id", "username", "display_name"],
+		properties: {
+			id: { type: "number" },
+			username: { type: "string" },
+			display_name: { type: ["string", "null"] },
+		},
+	},
+};
+
+export default handler;

package/templates/src/_platform/api/contacts/detail/api.ts

@@ -4,7 +4,7 @@ import { contactDetail } from "../../_shared/service/domain/contacts";
 import { assertTenantSelf } from "../../_shared/service/infra/access";
 import { rateLimit } from "../../_shared/service/infra/rate";
 
-export default {
+const handler = {
 	async get() {
 		await respond(async () => {
 			const uid = http.user?.id;
@@ -19,3 +19,27 @@ export default {
 		});
 	},
 };
+
+// 入参：id 必填（详情按 id 取单条）
+handler.get.schema = {
+	query: {
+		type: "object",
+		required: ["id"],
+		properties: { id: { type: "number" } },
+	},
+};
+
+// 出参：详情比目录多 email/avatar（安全评审 P2：仅详情端点给）
+handler.get.response = {
+	type: "object",
+	required: ["id", "username", "display_name", "email", "avatar_base64"],
+	properties: {
+		id: { type: "number" },
+		username: { type: "string" },
+		display_name: { type: ["string", "null"] },
+		email: { type: ["string", "null"] },
+		avatar_base64: { type: ["string", "null"] },
+	},
+};
+
+export default handler;

package/templates/src/_platform/api/solutions/api.ts

@@ -167,7 +167,7 @@ async function listMigrationFiles(env: SolutionsEnv, name: string, version: stri
 }
 
 export function createSolutionsApi(env: SolutionsEnv) {
-	return {
+	const api = {
 		// GET /api/_platform/solutions/routes —— 前端归并数据源（登录即可）。
 		routes: {
 			async get() {
@@ -217,6 +217,65 @@ export function createSolutionsApi(env: SolutionsEnv) {
 			},
 		},
 	};
+
+	// ---- 契约（v0.1.72：入参 .schema / 出参平级 .response）----
+	// 路由行出参：SolutionRouteRow（前端归并与深检共用形状）
+	const routeRow = {
+		type: "object",
+		required: ["path", "module", "category", "order", "title_key", "required_permission", "enabled"],
+		properties: {
+			path: { type: "string" },
+			module: { type: "string" },
+			category: { type: "string", enum: ["main", "admin", "hidden"] },
+			order: { type: "number" },
+			title_key: { type: ["string", "null"] },
+			required_permission: { type: ["string", "null"] },
+			enabled: { type: "boolean" },
+		},
+	};
+	api.routes.get.response = { type: "array", items: routeRow };
+
+	// 深检报告出参：VerifyReport（ok/checks/advise）
+	const verifyReport = {
+		type: "object",
+		required: ["ok", "checks", "advise"],
+		properties: {
+			ok: { type: "boolean" },
+			checks: {
+				type: "array",
+				items: {
+					type: "object",
+					required: ["id", "severity", "subject", "advise_key"],
+					properties: {
+						id: { type: "string" },
+						severity: { type: "string", enum: ["error", "warn", "info"] },
+						subject: { type: "string" },
+						advise_key: { type: "string" },
+					},
+				},
+			},
+			advise: { type: "array", items: { type: "string" } },
+		},
+	};
+	// verify：name 必填（端点门，缺参 400）
+	api.verify.post.schema = {
+		query: {
+			type: "object",
+			required: ["name"],
+			properties: { name: { type: "string", minLength: 1 } },
+		},
+	};
+	api.verify.post.response = verifyReport;
+	api.verify.last.get.schema = {
+		query: {
+			type: "object",
+			required: ["name"],
+			properties: { name: { type: "string", minLength: 1 } },
+		},
+	};
+	api.verify.last.get.response = verifyReport;
+
+	return api;
 }
 
 export default createSolutionsApi(solutionsEnv());

package/templates/src/_platform/web/__client/api.schemas.ts

@@ -4,6 +4,29 @@
 import { z } from "@oj-module/runtime";
 
 export const schemas = {
+	"platformContactsGet": {
+		query: z.object({
+	"keyword": z.string().min(2),
+	"limit": z.number().optional()
+}),
+		data: z.array(z.object({
+	"id": z.number(),
+	"username": z.string(),
+	"display_name": z.string().nullable()
+})),
+	},
+	"platformContactsDetailGet": {
+		query: z.object({
+	"id": z.number()
+}),
+		data: z.object({
+	"id": z.number(),
+	"username": z.string(),
+	"display_name": z.string().nullable(),
+	"email": z.string().nullable(),
+	"avatar_base64": z.string().nullable()
+}),
+	},
 	"platformMarketInstallPost": {
 		body: z.object({
 	"source": z.enum(["cdn", "file"]),
@@ -101,19 +124,6 @@ export const schemas = {
 		data: z.array(z.object({
 
 }).catchall(z.unknown())),
-	},
-	"platformOrgTreeGet": {
-		query: z.object({
-	"scope": z.enum(["self", "all"]).optional()
-}),
-		data: z.array(z.object({
-	"id": z.number(),
-	"parentId": z.number().nullable(),
-	"name": z.string().nullable(),
-	"nameEn": z.string().nullable().optional(),
-	"orderNo": z.number(),
-	"memberCount": z.number()
-})),
 	},
 	"platformOrgDepartmentsGet": {
 		query: z.object({
@@ -136,6 +146,16 @@ export const schemas = {
 	"page": z.number(),
 	"size": z.number(),
 	"truncated": z.boolean()
+}),
+	},
+	"platformOrgIsMemberGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional(),
+	"uid": z.number().optional(),
+	"dept": z.number()
+}),
+		data: z.object({
+	"isMember": z.boolean()
 }),
 	},
 	"platformOrgMembersGet": {
@@ -160,24 +180,6 @@ export const schemas = {
 	"page": z.number(),
 	"size": z.number(),
 	"truncated": z.boolean()
-}),
-	},
-	"platformOrgUserGet": {
-		query: z.object({
-	"scope": z.enum(["self", "all"]).optional(),
-	"uid": z.number().optional()
-}),
-		data: z.object({
-	"userId": z.number(),
-	"username": z.string(),
-	"displayName": z.string().nullable().optional(),
-	"position": z.string().nullable(),
-	"mainDeptId": z.number().nullable(),
-	"mainDeptPath": z.array(z.string()),
-	"departments": z.array(z.object({
-	"deptId": z.number(),
-	"deptPath": z.array(z.string())
-}))
 }),
 	},
 	"platformOrgPickerGet": {
@@ -218,14 +220,76 @@ export const schemas = {
 	"userIds": z.array(z.number())
 }),
 	},
-	"platformOrgIsMemberGet": {
+	"platformOrgTreeGet": {
+		query: z.object({
+	"scope": z.enum(["self", "all"]).optional()
+}),
+		data: z.array(z.object({
+	"id": z.number(),
+	"parentId": z.number().nullable(),
+	"name": z.string().nullable(),
+	"nameEn": z.string().nullable().optional(),
+	"orderNo": z.number(),
+	"memberCount": z.number()
+})),
+	},
+	"platformOrgUserGet": {
 		query: z.object({
 	"scope": z.enum(["self", "all"]).optional(),
-	"uid": z.number().optional(),
-	"dept": z.number()
+	"uid": z.number().optional()
 }),
 		data: z.object({
-	"isMember": z.boolean()
+	"userId": z.number(),
+	"username": z.string(),
+	"displayName": z.string().nullable().optional(),
+	"position": z.string().nullable(),
+	"mainDeptId": z.number().nullable(),
+	"mainDeptPath": z.array(z.string()),
+	"departments": z.array(z.object({
+	"deptId": z.number(),
+	"deptPath": z.array(z.string())
+}))
+}),
+	},
+	"platformSolutionsRoutesGet": {
+		data: z.array(z.object({
+	"path": z.string(),
+	"module": z.string(),
+	"category": z.enum(["main", "admin", "hidden"]),
+	"order": z.number(),
+	"title_key": z.string().nullable(),
+	"required_permission": z.string().nullable(),
+	"enabled": z.boolean()
+})),
+	},
+	"platformSolutionsVerifyPost": {
+		query: z.object({
+	"name": z.string().min(1)
+}),
+		data: z.object({
+	"ok": z.boolean(),
+	"checks": z.array(z.object({
+	"id": z.string(),
+	"severity": z.enum(["error", "warn", "info"]),
+	"subject": z.string(),
+	"advise_key": z.string()
+})),
+	"advise": z.array(z.string())
+}),
+	},
+	"platformSolutionsVerifyLastGet": {
+		query: z.object({
+	"name": z.string().min(1)
+}),
+		data: z.object({
+	"ok": z.boolean(),
+	"checks": z.array(z.object({
+	"id": z.string(),
+	"severity": z.enum(["error", "warn", "info"]),
+	"subject": z.string(),
+	"advise_key": z.string()
+})),
+	"advise": z.array(z.string())
 }),
 	},
 };