@southwind-ai/modules 0.1.0

package/src/system-modules.ts

@@ -0,0 +1,335 @@
+import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { systemAgentTools } from "./system-agent-tools.js";
+// @windy-module system.agent end
+import { systemAdminRoutes } from "./system-admin-routes.js";
+import { systemApiPermissionBindings } from "./system-api-permissions.js";
+import { systemAuditActions } from "./system-audit-actions.js";
+// @windy-module system.data-governance begin
+import { systemDataPolicies } from "./system-data-governance.js";
+// @windy-module system.data-governance end
+import { systemFeatures } from "./system-features.js";
+import { systemPermissions } from "./system-permissions.js";
+
+export function systemFoundationModule(): ModuleManifest {
+  return {
+    name: "system",
+    version: "0.1.0",
+    label: "系统基础设施",
+    description: "用户、角色、菜单、功能开关与平台治理基础能力。",
+    menus: [
+      {
+        key: "system.identity",
+        title: "组织与权限",
+        type: "catalog",
+        order: 10,
+        visible: true,
+        icon: "users",
+        children: [
+          {
+            key: "system.profile",
+            title: "个人设置",
+            type: "button",
+            order: 5,
+            visible: true,
+            path: "/admin/profile",
+            icon: "user-round-cog",
+            permissionKey: "system.profile.read",
+            featureKey: "system.profile",
+          },
+          {
+            key: "system.user",
+            title: "用户管理",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/users",
+            icon: "users",
+            permissionKey: "system.user.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.role",
+            title: "角色权限",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/roles",
+            icon: "shield-check",
+            permissionKey: "system.role.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.department",
+            title: "部门组织",
+            type: "menu",
+            order: 25,
+            visible: true,
+            path: "/admin/system/departments",
+            icon: "building-2",
+            permissionKey: "system.department.read",
+            featureKey: "system.rbac",
+          },
+        ],
+      },
+      {
+        key: "system.configuration",
+        title: "平台配置",
+        type: "catalog",
+        order: 20,
+        visible: true,
+        icon: "settings",
+        children: [
+          // @windy-module system.settings begin
+          {
+            key: "system.settings",
+            title: "全局设置",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/settings",
+            icon: "settings",
+            permissionKey: "system.settings.read",
+            featureKey: "system.settings",
+          },
+          // @windy-module system.settings end
+          // @windy-module system.storage begin
+          {
+            key: "system.storage",
+            title: "文件存储",
+            type: "button",
+            order: 15,
+            visible: true,
+            path: "/admin/settings",
+            icon: "file-up",
+            permissionKey: "system.storage.read",
+            featureKey: "system.storage",
+          },
+          // @windy-module system.storage end
+          {
+            key: "system.menu",
+            title: "菜单管理",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/menus",
+            icon: "panel-left",
+            permissionKey: "system.menu.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.dictionary",
+            title: "字典管理",
+            type: "menu",
+            order: 30,
+            visible: true,
+            path: "/admin/system/dictionaries",
+            icon: "book-open",
+            permissionKey: "system.dict.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.feature",
+            title: "功能开关",
+            type: "menu",
+            order: 40,
+            visible: true,
+            path: "/admin/system/features",
+            icon: "flag",
+            permissionKey: "system.feature.read",
+          },
+          // @windy-module system.notification begin
+          {
+            key: "system.notification",
+            title: "通知管理",
+            type: "menu",
+            order: 50,
+            visible: true,
+            path: "/admin/system/notifications",
+            icon: "bell",
+            permissionKey: "system.notification.manage",
+            featureKey: "system.notification",
+          },
+          // @windy-module system.notification end
+          // @windy-module system.configuration begin
+          {
+            key: "system.config",
+            title: "配置版本",
+            type: "menu",
+            order: 60,
+            visible: true,
+            path: "/admin/system/configurations",
+            icon: "settings",
+            permissionKey: "system.config.read",
+            featureKey: "system.config",
+          },
+          // @windy-module system.configuration end
+        ],
+      },
+      {
+        key: "system.compliance",
+        title: "安全与合规",
+        type: "catalog",
+        order: 30,
+        visible: true,
+        icon: "shield-check",
+        children: [
+          // @windy-module system.license begin
+          {
+            key: "system.license",
+            title: "License",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/license",
+            icon: "key-round",
+            permissionKey: "system.license.read",
+            featureKey: "system.license",
+          },
+          // @windy-module system.license end
+          // @windy-module system.audit begin
+          {
+            key: "system.audit",
+            title: "审计日志",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/audit",
+            icon: "clipboard-list",
+            permissionKey: "system.audit.read",
+            featureKey: "system.audit",
+          },
+          // @windy-module system.audit end
+        ],
+      },
+      {
+        key: "system.operations",
+        title: "运维",
+        type: "catalog",
+        order: 40,
+        visible: true,
+        icon: "activity",
+        children: [
+          // @windy-module system.operations begin
+          {
+            key: "system.ops",
+            title: "运维总览",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/operations",
+            icon: "activity",
+            permissionKey: "system.ops.read",
+            featureKey: "system.ops",
+          },
+          // @windy-module system.operations end
+          // @windy-module system.workflow begin
+          {
+            key: "system.workflow",
+            title: "审批任务",
+            type: "button",
+            order: 20,
+            visible: false,
+            permissionKey: "system.workflow.read",
+            featureKey: "system.workflow",
+          },
+          // @windy-module system.workflow end
+        ],
+      },
+    ],
+    adminRoutes: systemAdminRoutes,
+    permissions: systemPermissions,
+    apiPermissions: systemApiPermissionBindings(),
+    features: systemFeatures,
+    migrations: [],
+    schemaExports: [
+      {
+        key: "system.database.schema",
+        exportName: "systemSchema",
+        migrationIds: ["0000..0028"],
+      },
+    ],
+    tasks: [
+      // @windy-module system.scheduler begin
+      {
+        key: "system.scheduler.health-snapshot",
+        label: "调度器健康快照",
+        description: "周期验证调度、Guard、执行历史和重试链路可用。",
+        permissionKey: "system.scheduler.manage",
+        featureKey: "system.scheduler",
+        intervalSeconds: 300,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.scheduler end
+      // @windy-module system.bulk-data begin
+      {
+        key: "system.bulk-data.dispatch",
+        label: "批量数据任务派发",
+        description: "领取一个已排队或到期重试的批量导入导出任务。",
+        permissionKey: "system.bulk-data.manage",
+        featureKey: "system.bulk-data",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      {
+        key: "system.bulk-data.cleanup",
+        label: "批量数据文件清理",
+        description: "清理超过留存期限的源文件、结果和失败明细。",
+        permissionKey: "system.bulk-data.manage",
+        featureKey: "system.bulk-data",
+        intervalSeconds: 3_600,
+        maxAttempts: 3,
+        retryDelaySeconds: 60,
+      },
+      // @windy-module system.bulk-data end
+      // @windy-module system.storage begin
+      {
+        key: "system.storage.cleanup",
+        label: "文件存储清理",
+        description: "清理过期上传、文件、临时分片和超过宽限期的孤儿对象。",
+        permissionKey: "system.storage.manage",
+        featureKey: "system.storage",
+        intervalSeconds: 3_600,
+        maxAttempts: 3,
+        retryDelaySeconds: 60,
+      },
+      // @windy-module system.storage end
+      // @windy-module system.workflow begin
+      {
+        key: "system.workflow.timeout-dispatch",
+        label: "审批超时派发",
+        description: "补偿登记并执行一个到期审批任务，进程重启后继续处理。",
+        permissionKey: "system.workflow.manage",
+        featureKey: "system.workflow",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.workflow end
+      // @windy-module system.data-governance begin
+      {
+        key: "system.governed-export.dispatch",
+        label: "受治理导出派发",
+        description: "领取并执行一个已批准的敏感数据导出任务。",
+        permissionKey: "system.user.export",
+        featureKey: "system.rbac",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.data-governance end
+    ],
+    tools: [
+      // @windy-module system.agent begin
+      ...systemAgentTools,
+      // @windy-module system.agent end
+    ],
+    providers: [],
+    // @windy-module system.data-governance begin
+    dataPolicies: systemDataPolicies,
+    // @windy-module system.data-governance end
+    auditActions: systemAuditActions,
+  };
+}

package/src/system-permissions.ts

@@ -0,0 +1,142 @@
+import type { ModuleManifest } from "./manifest.js";
+
+const systemResourceLabels = {
+  admin: "管理面准入",
+  user: "用户管理",
+  role: "角色与权限",
+  department: "部门组织",
+  menu: "菜单管理",
+  dict: "字典管理",
+  feature: "功能开关",
+  search: "全局搜索",
+  settings: "全局设置",
+  config: "配置版本",
+  watermark: "水印设置",
+  profile: "个人设置",
+  license: "许可证管理",
+  audit: "审计日志",
+  agent: "智能代理",
+  ops: "运维总览",
+  scheduler: "定时任务",
+  notification: "通知管理",
+  "bulk-data": "批量数据",
+  storage: "文件存储",
+  workflow: "审批任务",
+} as const;
+
+type SystemResource = keyof typeof systemResourceLabels;
+type SystemAction =
+  | "access"
+  | "read"
+  | "create"
+  | "approve"
+  | "export"
+  | "reveal"
+  | "manage";
+
+function permission(
+  resource: SystemResource,
+  action: SystemAction,
+  accessRisk:
+    | "sensitive-disclosure"
+    | "governed-export"
+    | undefined = undefined,
+) {
+  return {
+    key: `system.${resource}.${action}`,
+    label:
+      action === "access"
+        ? "进入"
+        : action === "read"
+          ? "查看"
+          : action === "create"
+            ? "新建"
+            : action === "approve"
+              ? "处理"
+              : action === "reveal"
+                ? "查看明文"
+                : action === "export"
+                  ? "治理导出"
+                  : "管理",
+    module: "system",
+    moduleLabel: "系统基础设施",
+    resource,
+    resourceLabel: systemResourceLabels[resource],
+    action,
+    accessRisk,
+  };
+}
+
+export const systemPermissions: ModuleManifest["permissions"] = [
+  permission("admin", "access"),
+  permission("user", "read"),
+  // @windy-module system.data-governance begin
+  permission("user", "reveal", "sensitive-disclosure"),
+  permission("user", "export", "governed-export"),
+  // @windy-module system.data-governance end
+  permission("user", "manage"),
+  permission("role", "read"),
+  permission("role", "manage"),
+  permission("department", "read"),
+  permission("department", "create"),
+  permission("department", "manage"),
+  permission("menu", "read"),
+  permission("menu", "manage"),
+  permission("dict", "read"),
+  permission("dict", "manage"),
+  permission("feature", "read"),
+  permission("feature", "manage"),
+  // @windy-module system.search begin
+  permission("search", "read"),
+  permission("search", "manage"),
+  // @windy-module system.search end
+  // @windy-module system.settings begin
+  permission("settings", "read"),
+  permission("settings", "manage"),
+  // @windy-module system.settings end
+  // @windy-module system.configuration begin
+  permission("config", "read"),
+  permission("config", "manage"),
+  // @windy-module system.configuration end
+  // @windy-module system.settings begin
+  permission("watermark", "read"),
+  permission("watermark", "manage"),
+  // @windy-module system.settings end
+  permission("profile", "read"),
+  permission("profile", "manage"),
+  // @windy-module system.license begin
+  permission("license", "read"),
+  permission("license", "manage"),
+  // @windy-module system.license end
+  // @windy-module system.audit begin
+  permission("audit", "read"),
+  // @windy-module system.audit end
+  // @windy-module system.agent begin
+  permission("agent", "read"),
+  // @windy-module system.agent end
+  // @windy-module system.operations begin
+  permission("ops", "read"),
+  // @windy-module system.operations end
+  // @windy-module system.scheduler begin
+  permission("scheduler", "read"),
+  permission("scheduler", "manage"),
+  // @windy-module system.scheduler end
+  // @windy-module system.notification begin
+  permission("notification", "read"),
+  permission("notification", "manage"),
+  // @windy-module system.notification end
+  // @windy-module system.bulk-data begin
+  permission("bulk-data", "manage"),
+  // @windy-module system.bulk-data end
+  // @windy-module system.storage begin
+  permission("storage", "read"),
+  permission("storage", "create"),
+  permission("storage", "manage"),
+  // @windy-module system.storage end
+  // @windy-module system.workflow begin
+  permission("workflow", "read"),
+  permission("workflow", "create"),
+  permission("workflow", "approve"),
+  permission("workflow", "manage"),
+  // @windy-module system.workflow end
+];