@southwind-ai/modules 0.1.0

package/src/system-features.ts

@@ -0,0 +1,145 @@
+import { featureKey, licenseVersionKey } from "@southwind-ai/shared";
+import type { ModuleManifest } from "./manifest.js";
+
+// @windy-module system.scheduler begin
+const standardAndAdvanced = ["standard", "advanced"].map(licenseVersionKey);
+// @windy-module system.scheduler end
+const advancedOnly = [licenseVersionKey("advanced")];
+
+export const systemFeatures: ModuleManifest["features"] = [
+  feature(
+    "system.admin",
+    "Windy 管理面",
+    "平台管理员、运维与授权审计人员使用的控制面准入能力。",
+  ),
+  feature(
+    "system.rbac",
+    "RBAC 权限链路",
+    "用户、角色、权限点与数据范围的统一访问控制链路。",
+  ),
+  feature(
+    "system.profile",
+    "个人设置",
+    "当前账号维护姓名、邮箱和手机等个人资料。",
+  ),
+  // @windy-module system.settings begin
+  feature("system.settings", "全局设置", "平台软件名、Logo 等全局品牌配置。"),
+  // @windy-module system.settings end
+  // @windy-module system.configuration begin
+  feature(
+    "system.config",
+    "配置版本",
+    "受控管理模块配置的版本、应用状态、差异与回滚。",
+  ),
+  // @windy-module system.configuration end
+  // @windy-module system.search begin
+  feature(
+    "system.search",
+    "平台功能搜索",
+    "搜索当前账号有权访问的平台菜单和功能入口。",
+  ),
+  // @windy-module system.search end
+  // @windy-module system.settings begin
+  feature(
+    "system.watermark",
+    "页面水印",
+    "带身份信息的页面水印与用户显示偏好。",
+  ),
+  // @windy-module system.settings end
+  // @windy-module system.license begin
+  feature(
+    "system.license",
+    "License 验证",
+    "客户 License 安装、验签、到期限制与运行状态检查。",
+  ),
+  // @windy-module system.license end
+  // @windy-module system.audit begin
+  feature(
+    "system.audit",
+    "审计日志",
+    "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
+  ),
+  // @windy-module system.audit end
+  // @windy-module system.storage begin
+  feature(
+    "system.storage",
+    "文件与对象存储",
+    "受控文件上传、续传、下载、过期和底层对象生命周期。",
+  ),
+  // @windy-module system.storage end
+  // @windy-module system.agent begin
+  feature(
+    "system.agent",
+    "Agent Tool",
+    "让受控 Agent 在权限、Feature 与审计保护下调用平台工具。",
+  ),
+  // @windy-module system.agent end
+  // @windy-module system.operations begin
+  feature(
+    "system.ops",
+    "运维总览",
+    "集中查看服务、数据库、缓存与调度任务的运行状态。",
+  ),
+  // @windy-module system.operations end
+  // @windy-module system.notification begin
+  feature(
+    "system.notification",
+    "站内通知",
+    "站内通知发布、管理、阅读和已读状态闭环。",
+  ),
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
+  feature(
+    "system.workflow",
+    "最小审批",
+    "候选角色领取、转交、决定、取消和到期终结的通用审批能力。",
+  ),
+  // @windy-module system.workflow end
+  // @windy-module system.scheduler begin
+  {
+    ...feature(
+      "system.scheduler",
+      "定时任务执行器",
+      "平台定时任务调度、重试、手动执行和历史追踪。",
+    ),
+    allowedLicenseVersions: standardAndAdvanced,
+  },
+  // @windy-module system.scheduler end
+  // @windy-module system.bulk-data begin
+  {
+    ...feature(
+      "system.bulk-data",
+      "批量数据任务",
+      "受控的大批量导入、导出、失败明细和结果留存。",
+    ),
+    allowedLicenseVersions: advancedOnly,
+  },
+  // @windy-module system.bulk-data end
+  {
+    ...feature(
+      "system.ruoyi-compat",
+      "RuoYi-Vue 兼容层",
+      "可选适配旧 RuoYi-Vue 数据与接口，不影响平台标准模型。",
+    ),
+    visible: "hidden",
+    enabled: false,
+    stage: "internal",
+    allowedLicenseVersions: advancedOnly,
+  },
+];
+
+function feature(
+  key: string,
+  label: string,
+  description?: string,
+): ModuleManifest["features"][number] {
+  return {
+    key: featureKey(key),
+    label,
+    module: "system",
+    description,
+    visible: "visible",
+    enabled: true,
+    stage: "stable",
+  };
+}

package/src/system-governed-export-bindings.ts

@@ -0,0 +1,31 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding } from "./system-api-binding.js";
+
+export function governedUserExportBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "POST",
+      "/api/system/users/exports",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "GET",
+      "/api/system/users/exports/:id",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "POST",
+      "/api/system/users/exports/:id/cancel",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "GET",
+      "/api/system/users/exports/:id/download",
+      "system.user.export",
+      "system.rbac",
+    ),
+  ];
+}

package/src/system-module-catalog.ts

@@ -0,0 +1,250 @@
+import type { MenuNode } from "@southwind-ai/shared";
+import type { ModuleFactory, ModuleManifest } from "./manifest.js";
+import { systemFoundationModule } from "./system-modules.js";
+
+interface SystemModuleDefinition {
+  name: string;
+  version: string;
+  label: string;
+  description: string;
+  resources: readonly string[];
+  permissionKeys?: readonly string[];
+  excludedPermissionKeys?: readonly string[];
+  featureKeys: readonly string[];
+}
+
+export const systemModuleDefinitions = [
+  {
+    name: "system",
+    version: "0.1.0",
+    label: "系统核心",
+    description: "管理面准入、Feature 治理、数据库基线与审计动作目录。",
+    resources: ["admin", "feature"],
+    featureKeys: ["system.admin", "system.ruoyi-compat"],
+  },
+  {
+    name: "system.identity",
+    version: "0.1.0",
+    label: "身份与权限",
+    description: "用户、角色、部门、菜单、字典、个人资料和数据范围。",
+    resources: ["user", "role", "department", "menu", "dict", "profile"],
+    excludedPermissionKeys: ["system.user.reveal", "system.user.export"],
+    featureKeys: ["system.rbac", "system.profile"],
+  },
+  // @windy-module system.settings begin
+  {
+    name: "system.settings",
+    version: "0.1.0",
+    label: "平台设置",
+    description: "品牌设置、Logo 与页面水印。",
+    resources: ["settings", "watermark"],
+    featureKeys: ["system.settings", "system.watermark"],
+  },
+  // @windy-module system.settings end
+  // @windy-module system.configuration begin
+  {
+    name: "system.configuration",
+    version: "0.1.0",
+    label: "配置版本",
+    description: "类型化模块配置、版本、差异、应用与回滚。",
+    resources: ["config"],
+    featureKeys: ["system.config"],
+  },
+  // @windy-module system.configuration end
+  // @windy-module system.license begin
+  {
+    name: "system.license",
+    version: "0.1.0",
+    label: "License",
+    description: "License 安装、验签、到期限制与版本授权。",
+    resources: ["license"],
+    featureKeys: ["system.license"],
+  },
+  // @windy-module system.license end
+  // @windy-module system.audit begin
+  {
+    name: "system.audit",
+    version: "0.1.0",
+    label: "审计日志",
+    description: "关键操作、权限拒绝和系统异常的安全追溯。",
+    resources: ["audit"],
+    featureKeys: ["system.audit"],
+  },
+  // @windy-module system.audit end
+  // @windy-module system.storage begin
+  {
+    name: "system.storage",
+    version: "0.1.0",
+    label: "文件存储",
+    description: "上传、续传、下载与对象生命周期管理。",
+    resources: ["storage"],
+    featureKeys: ["system.storage"],
+  },
+  // @windy-module system.storage end
+  // @windy-module system.agent begin
+  {
+    name: "system.agent",
+    version: "0.1.0",
+    label: "Agent Tool",
+    description: "受 Feature、RBAC 和审计保护的 Agent 工具调用。",
+    resources: ["agent"],
+    featureKeys: ["system.agent"],
+  },
+  // @windy-module system.agent end
+  // @windy-module system.operations begin
+  {
+    name: "system.operations",
+    version: "0.1.0",
+    label: "运维与调度",
+    description: "服务、数据库、缓存、磁盘与在线会话监控。",
+    resources: ["ops"],
+    featureKeys: ["system.ops"],
+  },
+  // @windy-module system.operations end
+  // @windy-module system.scheduler begin
+  {
+    name: "system.scheduler",
+    version: "0.1.0",
+    label: "任务调度",
+    description: "定时任务注册、执行、重试、历史与恢复。",
+    resources: ["scheduler"],
+    featureKeys: ["system.scheduler"],
+  },
+  // @windy-module system.scheduler end
+  // @windy-module system.notification begin
+  {
+    name: "system.notification",
+    version: "0.1.0",
+    label: "站内通知",
+    description: "通知发布、阅读、归档与状态管理。",
+    resources: ["notification"],
+    featureKeys: ["system.notification"],
+  },
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
+  {
+    name: "system.workflow",
+    version: "0.1.0",
+    label: "审批工作流",
+    description: "审批领取、转交、决定、取消与超时补偿。",
+    resources: ["workflow"],
+    featureKeys: ["system.workflow"],
+  },
+  // @windy-module system.workflow end
+  // @windy-module system.bulk-data begin
+  {
+    name: "system.bulk-data",
+    version: "0.1.0",
+    label: "批量数据",
+    description: "批量导入导出、失败明细、结果留存与清理。",
+    resources: ["bulk-data"],
+    featureKeys: ["system.bulk-data"],
+  },
+  // @windy-module system.bulk-data end
+  // @windy-module system.search begin
+  {
+    name: "system.search",
+    version: "0.1.0",
+    label: "平台搜索",
+    description: "权限感知的功能搜索与业务 SearchProvider 聚合。",
+    resources: ["search"],
+    featureKeys: ["system.search"],
+  },
+  // @windy-module system.search end
+  // @windy-module system.data-governance begin
+  {
+    name: "system.data-governance",
+    version: "0.1.0",
+    label: "数据治理",
+    description: "敏感字段投影、明文访问与受治理导出。",
+    resources: [],
+    permissionKeys: ["system.user.reveal", "system.user.export"],
+    featureKeys: [],
+  },
+  // @windy-module system.data-governance end
+] as const satisfies readonly SystemModuleDefinition[];
+
+export type SystemModuleName = (typeof systemModuleDefinitions)[number]["name"];
+
+export const systemModuleFactories: readonly ModuleFactory[] =
+  systemModuleDefinitions.map(
+    (definition) => () => createSystemCapabilityModule(definition),
+  );
+
+export function systemModuleManifests(): ModuleManifest[] {
+  return systemModuleFactories.map((factory) => factory());
+}
+
+export function systemModuleManifest(name: SystemModuleName): ModuleManifest {
+  const definition = systemModuleDefinitions.find((item) => item.name === name);
+  if (!definition) throw new Error(`未知系统模块：${name}`);
+  return createSystemCapabilityModule(definition);
+}
+
+function createSystemCapabilityModule(
+  definition: SystemModuleDefinition,
+): ModuleManifest {
+  const aggregate = systemFoundationModule();
+  const ownsPermission = (permissionKey: string) =>
+    !definition.excludedPermissionKeys?.includes(permissionKey) &&
+    (Boolean(definition.permissionKeys?.includes(permissionKey)) ||
+      definition.resources.includes(permissionResource(permissionKey)));
+  const ownsFeature = (featureKey: string | undefined) =>
+    Boolean(featureKey && definition.featureKeys.includes(featureKey));
+  const ownsGuard = (guard: { permissionKey?: string; featureKey?: string }) =>
+    guard.permissionKey
+      ? ownsPermission(guard.permissionKey)
+      : ownsFeature(guard.featureKey);
+  const isCore = definition.name === "system";
+
+  return {
+    name: definition.name,
+    version: definition.version,
+    label: definition.label,
+    description: definition.description,
+    dependencies: isCore ? [] : ["system"],
+    menus: selectMenus(aggregate.menus, ownsGuard),
+    adminRoutes: aggregate.adminRoutes.filter(ownsGuard),
+    permissions: aggregate.permissions
+      .filter(({ key }) => ownsPermission(key))
+      .map((permission) => ({
+        ...permission,
+        module: definition.name,
+        moduleLabel: definition.label,
+      })),
+    apiPermissions: aggregate.apiPermissions.filter(ownsGuard),
+    features: aggregate.features
+      .filter(({ key }) => ownsFeature(key))
+      .map((feature) => ({ ...feature, module: definition.name })),
+    migrations: isCore ? aggregate.migrations : [],
+    schemaExports: isCore ? aggregate.schemaExports : [],
+    tasks: aggregate.tasks.filter(ownsGuard),
+    tools: aggregate.tools.filter(ownsGuard),
+    providers: aggregate.providers.filter(ownsGuard),
+    dataPolicies:
+      definition.name === "system.data-governance"
+        ? aggregate.dataPolicies
+        : [],
+    auditActions: isCore ? aggregate.auditActions : [],
+    metadata: { kind: "platform-capability" },
+  };
+}
+
+function permissionResource(permissionKey: string): string {
+  const parts = permissionKey.split(".");
+  return parts.length >= 3 ? parts.slice(1, -1).join(".") : "";
+}
+
+function selectMenus(
+  menus: readonly MenuNode[],
+  ownsGuard: (guard: {
+    permissionKey?: string;
+    featureKey?: string;
+  }) => boolean,
+): MenuNode[] {
+  return menus.flatMap((menu) => {
+    const children = selectMenus(menu.children || [], ownsGuard);
+    if (!children.length && !ownsGuard(menu)) return [];
+    return [{ ...menu, children: children.length ? children : undefined }];
+  });
+}