@southwind-ai/modules 0.1.0

package/src/system-admin-routes.ts

@@ -0,0 +1,136 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemAdminRoutes: ModuleManifest["adminRoutes"] = [
+  route(
+    "system.profile",
+    "/admin/profile",
+    "个人设置",
+    "account",
+    "system.profile.read",
+    "system.profile",
+  ),
+  route(
+    "system.user",
+    "/admin/system/users",
+    "用户体系",
+    "sidebar",
+    "system.user.read",
+    "system.rbac",
+  ),
+  route(
+    "system.role",
+    "/admin/system/roles",
+    "权限策略",
+    "sidebar",
+    "system.role.read",
+    "system.rbac",
+  ),
+  route(
+    "system.department",
+    "/admin/system/departments",
+    "部门组织",
+    "sidebar",
+    "system.department.read",
+    "system.rbac",
+  ),
+  // @windy-module system.settings begin
+  {
+    ...route(
+      "system.settings",
+      "/admin/settings",
+      "全局设置",
+      "sidebar",
+      "system.admin.access",
+      "system.admin",
+    ),
+    directAccess: "admin-admission",
+  },
+  // @windy-module system.settings end
+  route(
+    "system.menu",
+    "/admin/system/menus",
+    "菜单管理",
+    "sidebar",
+    "system.menu.read",
+    "system.rbac",
+  ),
+  route(
+    "system.dictionary",
+    "/admin/system/dictionaries",
+    "字典管理",
+    "sidebar",
+    "system.dict.read",
+    "system.rbac",
+  ),
+  route(
+    "system.feature",
+    "/admin/system/features",
+    "功能开关",
+    "sidebar",
+    "system.feature.read",
+  ),
+  // @windy-module system.notification begin
+  route(
+    "system.notification",
+    "/admin/system/notifications",
+    "通知管理",
+    "sidebar",
+    "system.notification.manage",
+    "system.notification",
+  ),
+  // @windy-module system.notification end
+  // @windy-module system.configuration begin
+  route(
+    "system.config",
+    "/admin/system/configurations",
+    "配置版本",
+    "sidebar",
+    "system.config.read",
+    "system.config",
+  ),
+  // @windy-module system.configuration end
+  // @windy-module system.license begin
+  {
+    ...route(
+      "system.license",
+      "/admin/system/license",
+      "License",
+      "sidebar",
+      "system.license.read",
+      "system.license",
+    ),
+    directAccess: "authenticated",
+  },
+  // @windy-module system.license end
+  // @windy-module system.audit begin
+  route(
+    "system.audit",
+    "/admin/system/audit",
+    "审计日志",
+    "sidebar",
+    "system.audit.read",
+    "system.audit",
+  ),
+  // @windy-module system.audit end
+  // @windy-module system.operations begin
+  route(
+    "system.ops",
+    "/admin/system/operations",
+    "运维总览",
+    "sidebar",
+    "system.ops.read",
+    "system.ops",
+  ),
+  // @windy-module system.operations end
+];
+
+function route(
+  key: string,
+  path: string,
+  title: string,
+  surface: ModuleManifest["adminRoutes"][number]["surface"],
+  permissionKey: string,
+  featureKey?: string,
+): ModuleManifest["adminRoutes"][number] {
+  return { key, path, title, surface, permissionKey, featureKey };
+}

package/src/system-agent-tools.ts

@@ -0,0 +1,28 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemAgentTools: ModuleManifest["tools"] = [
+  {
+    key: "system.users.list",
+    label: "查询用户",
+    description: "分页查询平台用户账号。",
+    permissionKey: "system.user.read",
+    featureKey: "system.rbac",
+    auditAction: "agent.tool.execute",
+  },
+  {
+    key: "system.features.list",
+    label: "查询功能开关",
+    description: "分页查询平台功能开关状态。",
+    permissionKey: "system.feature.read",
+    featureKey: "system.rbac",
+    auditAction: "agent.tool.execute",
+  },
+  {
+    key: "system.audit.list",
+    label: "查询审计日志",
+    description: "分页查询平台审计事件。",
+    permissionKey: "system.audit.read",
+    featureKey: "system.audit",
+    auditAction: "agent.tool.execute",
+  },
+];

package/src/system-api-binding.ts

@@ -0,0 +1,37 @@
+import type { ApiPermissionBinding, HttpMethod } from "@southwind-ai/shared";
+
+interface ResourceBindingInput {
+  path: string;
+  permissionResource: string;
+  featureKey?: string;
+  backupExport?: boolean;
+}
+
+export function resourceBindings(
+  input: ResourceBindingInput,
+): ApiPermissionBinding[] {
+  const base = `/api/system/${input.path}`;
+  const read = `system.${input.permissionResource}.read`;
+  const manage = `system.${input.permissionResource}.manage`;
+  return [
+    binding("GET", base, read, input.featureKey),
+    ...(input.backupExport === false
+      ? []
+      : [binding("GET", `${base}/export`, read, input.featureKey)]),
+    binding("GET", `${base}/:id`, read, input.featureKey),
+    binding("POST", `${base}/import`, manage, input.featureKey),
+    binding("POST", base, manage, input.featureKey),
+    binding("PUT", `${base}/:id`, manage, input.featureKey),
+    binding("DELETE", `${base}/:id`, manage, input.featureKey),
+  ];
+}
+
+export function binding(
+  method: HttpMethod,
+  path: string,
+  permissionKey: string,
+  featureKey?: string,
+  anonymous?: boolean,
+): ApiPermissionBinding {
+  return { method, path, permissionKey, featureKey, anonymous };
+}

package/src/system-api-data-governance.ts

@@ -0,0 +1,21 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding } from "./system-api-binding.js";
+import { governedUserExportBindings } from "./system-governed-export-bindings.js";
+
+export function dataGovernanceApiPermissionBindings(): ApiPermissionBinding[] {
+  return [
+    ...governedUserExportBindings(),
+    binding(
+      "GET",
+      "/api/system/users/:id/plaintext",
+      "system.user.reveal",
+      "system.rbac",
+    ),
+    binding(
+      "POST",
+      "/api/system/users/plaintext/batch",
+      "system.user.reveal",
+      "system.rbac",
+    ),
+  ];
+}

package/src/system-api-permissions.ts

@@ -0,0 +1,344 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding, resourceBindings } from "./system-api-binding.js";
+// @windy-module system.data-governance begin
+import { dataGovernanceApiPermissionBindings } from "./system-api-data-governance.js";
+// @windy-module system.data-governance end
+
+export function systemApiPermissionBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "GET",
+      "/api/admin/bootstrap",
+      "system.admin.access",
+      "system.admin",
+    ),
+    binding("GET", "/api/foundation", "system.menu.read", "system.rbac", true),
+    // @windy-module system.search begin
+    binding(
+      "GET",
+      "/api/search/providers",
+      "system.search.read",
+      "system.search",
+    ),
+    binding("POST", "/api/search", "system.search.read", "system.search"),
+    // @windy-module system.search end
+    ...resourceBindings({
+      path: "users",
+      permissionResource: "user",
+      featureKey: "system.rbac",
+      backupExport: false,
+    }),
+    // @windy-module system.data-governance begin
+    ...dataGovernanceApiPermissionBindings(),
+    // @windy-module system.data-governance end
+    binding(
+      "POST",
+      "/api/auth/users/:id/password",
+      "system.user.manage",
+      "system.rbac",
+    ),
+    ...resourceBindings({
+      path: "roles",
+      permissionResource: "role",
+      featureKey: "system.rbac",
+    }),
+    ...resourceBindings({
+      path: "departments",
+      permissionResource: "department",
+      featureKey: "system.rbac",
+    }),
+    binding(
+      "POST",
+      "/api/system/departments/quick",
+      "system.department.create",
+      "system.rbac",
+    ),
+    binding("GET", "/api/system/menus", "system.menu.read", "system.rbac"),
+    binding(
+      "GET",
+      "/api/system/menus/export",
+      "system.menu.read",
+      "system.rbac",
+    ),
+    binding("GET", "/api/system/menus/:id", "system.menu.read", "system.rbac"),
+    binding(
+      "PUT",
+      "/api/system/menus/:id/placement",
+      "system.menu.manage",
+      "system.rbac",
+    ),
+    binding(
+      "PUT",
+      "/api/system/menus/placements",
+      "system.menu.manage",
+      "system.rbac",
+    ),
+    ...resourceBindings({
+      path: "dictionaries",
+      permissionResource: "dict",
+      featureKey: "system.rbac",
+    }),
+    // @windy-module system.license begin
+    ...resourceBindings({
+      path: "licenses",
+      permissionResource: "license",
+      featureKey: "system.license",
+    }),
+    // @windy-module system.license end
+    binding("GET", "/api/system/features", "system.feature.read"),
+    binding("GET", "/api/system/features/export", "system.feature.read"),
+    binding("GET", "/api/system/features/:id", "system.feature.read"),
+    binding("PUT", "/api/system/features/:id", "system.feature.manage"),
+    // @windy-module system.settings begin
+    binding(
+      "GET",
+      "/api/platform/branding",
+      "system.settings.read",
+      undefined,
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/system/settings/branding",
+      "system.settings.read",
+      "system.settings",
+    ),
+    binding(
+      "PUT",
+      "/api/system/settings/branding",
+      "system.settings.manage",
+      "system.settings",
+    ),
+    // @windy-module system.settings end
+    // @windy-module system.configuration begin
+    binding(
+      "GET",
+      "/api/system/configurations",
+      "system.config.read",
+      "system.config",
+    ),
+    binding(
+      "GET",
+      "/api/system/configurations/:moduleKey/versions",
+      "system.config.read",
+      "system.config",
+    ),
+    binding(
+      "POST",
+      "/api/system/configurations/:moduleKey/versions",
+      "system.config.manage",
+      "system.config",
+    ),
+    binding(
+      "POST",
+      "/api/system/configurations/:moduleKey/versions/:version/rollback",
+      "system.config.manage",
+      "system.config",
+    ),
+    // @windy-module system.configuration end
+    binding(
+      "GET",
+      "/api/system/profile",
+      "system.profile.read",
+      "system.profile",
+    ),
+    binding(
+      "PUT",
+      "/api/system/profile",
+      "system.profile.manage",
+      "system.profile",
+    ),
+    // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/audit-logs",
+      "system.audit.read",
+      "system.audit",
+    ),
+    binding(
+      "GET",
+      "/api/system/audit-logs/export",
+      "system.audit.read",
+      "system.audit",
+    ),
+    // @windy-module system.audit end
+    // @windy-module system.storage begin
+    binding(
+      "POST",
+      "/api/system/storage/uploads",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "PUT",
+      "/api/system/storage/uploads/:id/parts/:partNumber",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "POST",
+      "/api/system/storage/uploads/:id/complete",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/files/:id",
+      "system.storage.read",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/platform/files/:id",
+      "system.settings.read",
+      "system.settings",
+      true,
+    ),
+    // @windy-module system.storage end
+    // @windy-module system.operations begin
+    binding("GET", "/api/system/operations", "system.ops.read", "system.ops"),
+    // @windy-module system.operations end
+    // @windy-module system.notification begin
+    binding(
+      "GET",
+      "/api/notifications",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/notifications/:id/read",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/notifications/:id",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    // @windy-module system.notification end
+    // @windy-module system.workflow begin
+    binding(
+      "GET",
+      "/api/workflow/work-items",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id/history",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "POST",
+      "/api/workflow/work-items",
+      "system.workflow.create",
+      "system.workflow",
+    ),
+    ...["claim", "transfer", "approve", "reject", "cancel"].map((command) =>
+      binding(
+        "POST",
+        `/api/workflow/work-items/:id/${command}`,
+        "system.workflow.approve",
+        "system.workflow",
+      ),
+    ),
+    // @windy-module system.workflow end
+    // @windy-module system.scheduler begin
+    binding(
+      "GET",
+      "/api/system/scheduled-tasks",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/scheduled-task-runs",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/operations/scheduler",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/trigger",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/runs/:runId/recover",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    // @windy-module system.scheduler end
+    // @windy-module system.bulk-data begin
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id/artifacts/:kind",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/import",
+      "system.dict.manage",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/export",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    // @windy-module system.bulk-data end
+  ];
+}

package/src/system-audit-actions.ts

@@ -0,0 +1,70 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemAuditActions: ModuleManifest["auditActions"] = [
+  "auth.login",
+  "auth.password.update",
+  "auth.session.revoke",
+  "user.profile.update",
+  "crud.create",
+  "crud.update",
+  "crud.delete",
+  // @windy-module system.configuration begin
+  "config.update",
+  "config.rollback",
+  // @windy-module system.configuration end
+  // @windy-module system.license begin
+  "license.verify",
+  // @windy-module system.license end
+  "feature.update",
+  "menu.structure.update",
+  // @windy-module system.notification begin
+  "notification.publish",
+  "notification.read",
+  "notification.archive",
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
+  "workflow.create",
+  "workflow.claim",
+  "workflow.transfer",
+  "workflow.decide",
+  "workflow.cancel",
+  "workflow.timeout",
+  // @windy-module system.workflow end
+  // @windy-module system.scheduler begin
+  "task.trigger",
+  "task.read",
+  "task.execute",
+  "task.recover",
+  // @windy-module system.scheduler end
+  // @windy-module system.search begin
+  "data.search",
+  // @windy-module system.search end
+  // @windy-module system.data-governance begin
+  "data.plaintext.read",
+  "data.plaintext.batch-read",
+  "data.governed-export.request",
+  "data.governed-export.generate",
+  "data.governed-export.download",
+  "data.governed-export.cancel",
+  // @windy-module system.data-governance end
+  // @windy-module system.search begin
+  "search.query",
+  "search.result.access",
+  // @windy-module system.search end
+  // @windy-module system.bulk-data begin
+  "data.bulk-import.create",
+  "data.bulk-export.create",
+  "data.bulk-artifact.download",
+  // @windy-module system.bulk-data end
+  // @windy-module system.storage begin
+  "file.upload.create",
+  "file.upload.complete",
+  "file.upload.abort",
+  "file.download",
+  // @windy-module system.storage end
+  // @windy-module system.agent begin
+  "agent.tool.execute",
+  // @windy-module system.agent end
+  "security.denied",
+  "system.error",
+];

package/src/system-data-governance.ts

@@ -0,0 +1,30 @@
+import { featureKey, type DataGovernancePolicyDefinition } from "@southwind-ai/shared";
+
+export const systemDataPolicies: DataGovernancePolicyDefinition[] = [
+  {
+    key: "system.user.fields",
+    resourceType: "system.user",
+    version: "1",
+    featureKey: featureKey("system.rbac"),
+    readPermissionKey: "system.user.read",
+    revealPermissionKey: "system.user.reveal",
+    exportPermissionKey: "system.user.export",
+    display: {
+      read: "masked",
+      reveal: "plaintext",
+      unauthorized: "hidden",
+    },
+    fields: [
+      {
+        fieldKey: "email",
+        classification: "personal",
+        mask: { kind: "partial", prefix: 2, suffix: 4 },
+      },
+      {
+        fieldKey: "phone",
+        classification: "sensitive",
+        mask: { kind: "partial", prefix: 3, suffix: 4 },
+      },
+    ],
+  },
+];