@steedos/service-core-objects 3.0.0-beta.8

package/main/default/services/spaces.service.js

@@ -0,0 +1,323 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2022-12-02 16:53:23
+ * @LastEditors: 孙浩林 sunhaolin@steedos.com
+ * @LastEditTime: 2025-02-18 10:27:48
+ * @Description: 
+ */
+"use strict";
+const _ = require("lodash");
+const { getObject, getSteedosConfig } = require("@steedos/objectql")
+const metadataCore = require('@steedos/metadata-core');
+const { Random } = require('@steedos/auth');
+/**
+ * @typedef {import('moleculer').Context} Context Moleculer's Context
+ */
+module.exports = {
+    name: 'spaces',
+    namespace: "steedos",
+    mixins: [],
+    /**
+     * Settings
+     */
+    settings: {
+
+    },
+
+    /**
+     * Dependencies
+     */
+    dependencies: [],
+
+    /**
+     * Actions
+     */
+    actions: {
+        /**
+         * @api {post} /api/v4/spaces/register/tenant 注册工作区
+         * @apiName register_tenant
+         * @apiGroup spaces.service.js
+         * @apiParam {String} name 工作区名称
+         * @apiSuccess {Object} 返回创建后的工作区记录
+         */
+        register_tenant: {
+            rest: {
+                method: "POST",
+                fullPath: "/api/v4/spaces/register/tenant",
+            },
+            params: {
+                name: { type: "string" }
+            },
+            async handler(ctx) {
+                this.broker.logger.info('[service][spaces]===>', '/api/v4/spaces/register/tenant', ctx.params.name)
+                return await this.register_tenant(ctx.params.name, ctx.meta.user)
+            }
+        },
+        /**
+         * @api {call} addSpaceUsers 工作区添加用户
+         * @apiName addSpaceUsers
+         * @apiGroup spaces.service.js
+         * @apiParam {String} spaceId 工作区ID
+         * @apiParam {String} userId 用户ID
+         * @apiParam {Boolean} user_accepted 是否有效
+         * @apiParam {String} organization_id 组织ID
+         * @apiSuccess {Boolean} 是否添加成功
+         */
+        addSpaceUsers: {
+            params: {
+                spaceId: { type: "string" },
+                userId: { type: "string" },
+                user_accepted: { type: "boolean" },
+                organization_id: { type: "string", optional: true },
+            },
+            async handler(ctx) {
+                this.broker.logger.info('[service][spaces]===>', 'addSpaceUsers', ctx.params)
+                return await this.addSpaceUsers(ctx.params.spaceId, ctx.params.userId, ctx.params.user_accepted, ctx.params.organization_id)
+            }
+        },
+        /**
+         * @api {call} isSpaceAdmin 是否工作区管理员
+         * @apiName isSpaceAdmin
+         * @apiGroup spaces.service.js
+         * @apiParam {String} spaceId 工作区ID
+         * @apiParam {String} userId 用户ID
+         * @apiSuccess {Boolean} 是否工作区管理员
+         */
+        isSpaceAdmin: {
+            params: {
+                spaceId: { type: "string" },
+                userId: { type: "string" },
+            },
+            async handler(ctx) {
+                this.broker.logger.info('[service][spaces]===>', 'isSpaceAdmin', ctx.params)
+                return await this.isSpaceAdmin(ctx.params.spaceId, ctx.params.userId)
+            }
+        },
+        /**
+         * @api {call} isSpaceOwner 是否工作区拥有者
+         * @apiName isSpaceOwner
+         * @apiGroup spaces.service.js
+         * @apiParam {String} spaceId 工作区ID
+         * @apiParam {String} userId 用户ID
+         * @apiSuccess {Boolean} 是否工作区拥有者
+         */
+        isSpaceOwner: {
+            params: {
+                spaceId: { type: "string" },
+                userId: { type: "string" },
+            },
+            async handler(ctx) {
+                this.broker.logger.info('[service][spaces]===>', 'isSpaceOwner', ctx.params)
+                return await this.isSpaceOwner(ctx.params.spaceId, ctx.params.userId)
+            }
+        },
+    },
+
+    /**
+     * Events
+     */
+    events: {
+
+    },
+
+    /**
+     * Methods
+     */
+    methods: {
+        /**
+         * 注册工作区
+         */
+        async register_tenant(spaceName, userSession) {
+            const spaceObj = getObject('spaces')
+
+            const config = getSteedosConfig();
+            let tenant = {
+                name: "Steedos",
+                logo_url: undefined,
+                background_url: undefined,
+                enable_create_tenant: true,
+                enable_register: true,
+                enable_forget_password: true
+            }
+
+            if (config.tenant) {
+                _.assignIn(tenant, config.tenant)
+            }
+
+            if (!tenant.enable_create_tenant) {
+                throw new Error(500, "禁止注册企业")
+            }
+
+            if (!spaceName) {
+                throw new Error("名称不能为空")
+            }
+
+            if (userSession) {
+                const userId = userSession.userId
+                const spaceId = await spaceObj._makeNewID()
+                const spaceDoc = {
+                    _id: spaceId,
+                    space: spaceId,
+                    name: spaceName,
+                    owner: userId
+                }
+
+                await spaceObj.insert(spaceDoc);
+                const newSpace = await spaceObj.findOne(spaceId);
+                return newSpace
+            } else {
+                if (!userSession) {
+                    throw new Error(401, "");
+                }
+            }
+        },
+        /**
+         * 工作区添加用户
+         */
+        async addSpaceUsers(spaceId, userId, user_accepted, organization_id) {
+            const now = new Date();
+            const suObj = getObject('space_users');
+            const spaceObj = getObject('spaces')
+            const orgObj = getObject('organizations')
+
+            const suDoc = (await suObj.directFind({
+                filters: [
+                    ['space', '=', spaceId],
+                    ['user', '=', userId]
+                ]
+            }))[0]
+            // 如果工作区已存在此用户则不重复添加
+            if (suDoc) {
+                return;
+            }
+
+            let profile = process.env.STEEDOS_TENANT_REGISTER_DEFAULT_PROFILE || 'user';
+
+            const space = await spaceObj.findOne(spaceId, { fields: ['default_profile', 'default_organization'] })
+            if (space) {
+                if (space.default_profile) {
+                    profile = space.default_profile
+                }
+                if (!organization_id && space.default_organization) {
+                    organization_id = space.default_organization
+                }
+            }
+
+            if(process.env.STEEDOS_TENANT_REGISTER_PROFILE ){
+                profile = process.env.STEEDOS_TENANT_REGISTER_PROFILE;
+            }
+
+            if (!organization_id) {
+                const rootOrg = (await orgObj.find({
+                    filters: [
+                        ['space', '=', spaceId],
+                        ['parent', '=', null]
+                    ]
+                }))[0]
+                organization_id = rootOrg._id
+            }
+
+            //company_id,company_ids,organizations_parents由triggers维护
+            const spaceUsersDoc = {
+                user: userId,
+                user_accepted: user_accepted,
+                organization: organization_id,
+                organizations: [organization_id],
+                profile: profile,
+                space: spaceId,
+                owner: userId,
+                created_by: userId,
+                created: now,
+                modified_by: userId,
+                modified: now
+            }
+            const newsuDoc = await suObj.insert(spaceUsersDoc)
+
+            if (await this.isSpaceAdmin(spaceId, userId)) {
+                await suObj.directUpdate(newsuDoc._id, {
+                    profile: 'admin'
+                })
+            }
+            // 如果开发环境且创建第一条space_users记录时, 自动生成api key 并写入.env.local 文件
+            if (process.env.NODE_ENV != 'production' && (await suObj.count({ filters: [['space', '=', spaceId]] })) === 1) {
+                // 创建api key
+                getObject('api_keys').insert({
+                    api_key: process.env.STEEDOS_INITIAL_API_KEY || Random.secret(),
+                    space: spaceId,
+                    owner: userId,
+                    active: true
+                }).then(function (record) {
+                    // 写入.env.local 文件
+                    const rootUrl = metadataCore.getRootUrl();
+                    if (!rootUrl) {
+                        rootUrl = process.env.ROOT_URL
+                    }
+                    if (!rootUrl) {
+                        rootUrl = 'http://localhost:5000'
+                    }
+                    const server = rootUrl
+                    if (!server.startsWith('http')) {
+                        server = `http://${server}`
+                    }
+                    if (server.endsWith('/')) {
+                        server = server.substring(0, server.length - 1);
+                    }
+                    metadataCore.saveSourceConfig({
+                        server: server,
+                        apikey: record.api_key
+                    })
+                }).catch(function (error) {
+                    console.log(error)
+                })
+            }
+            return true;
+        },
+
+        /**
+         * 是否工作区管理员
+         * @param {*} spaceId 
+         * @param {*} userId 
+         * @return boolean
+         */
+        async isSpaceAdmin(spaceId, userId) {
+            const spaceObj = getObject('spaces')
+            const space = await spaceObj.findOne(spaceId, { fields: ['admins'] })
+            if (space && space.admins) {
+                return space.admins.indexOf(userId) >= 0
+            }
+            return false
+        },
+        /**
+         * 是否工作区拥有者
+         * @param {*} spaceId 
+         * @param {*} userId 
+         * @return boolean
+         */
+        async isSpaceOwner(spaceId, userId) {
+            const spaceObj = getObject('spaces')
+            const count = await spaceObj.count({filters: [['_id', '=', spaceId], ['owner', '=', userId]]})
+            return count > 0
+        }
+    },
+
+    /**
+     * Service created lifecycle event handler
+     */
+    created() {
+
+    },
+
+    /**
+     * Service started lifecycle event handler
+     */
+    async started() {
+        this.broker.logger.info('[service][spaces]===>', 'started')
+    },
+
+    /**
+     * Service stopped lifecycle event handler
+     */
+    async stopped() {
+
+    }
+};

package/main/default/services/users.service.js

@@ -0,0 +1,198 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2022-12-02 16:53:23
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2024-02-27 15:20:23
+ * @Description: 
+ */
+"use strict";
+const { getObject, getSteedosConfig } = require("@steedos/objectql")
+const validator = require('validator');
+
+/**
+ * @typedef {import('moleculer').Context} Context Moleculer's Context
+ */
+module.exports = {
+    name: 'users',
+    namespace: "steedos",
+    mixins: [],
+    /**
+     * Settings
+     */
+    settings: {
+
+    },
+
+    /**
+     * Dependencies
+     */
+    dependencies: [],
+
+    /**
+     * Actions
+     */
+    actions: {
+        /**
+         * @api {call} validateUsername 验证用户名格式
+         * @apiName validateUsername
+         * @apiGroup users.service.js
+         * @apiParam {String} username 用户名
+         * @apiParam {String} userId 用户ID
+         */
+        validateUsername: {
+            params: {
+                username: { type: "string" },
+                userId: { type: "string" },
+            },
+            async handler(ctx) {
+                this.broker.logger.info('[service][users]===>', 'validateUsername', ctx.params)
+                return await this.validateUsername(ctx.params.username, ctx.params.userId)
+            }
+        },
+        clearLoginTokens: {
+            rest: {
+                method: "GET",
+                fullPath: "/api/users/:userId/clear_login_tokens",
+            },
+            params: {
+                userId: { type: "string" }
+            },
+            async handler(ctx) {
+                const { user, userAgent, clientIp } = ctx.meta;
+                const { userId } = ctx.params;
+                if(!user.is_space_admin){
+                    return '非管理员无权操作'
+                }
+                if(!userId){
+                    return "缺少参数"
+                }
+
+                // 如果是saas环境, 禁止清理登录tokens.
+                const enableSaas = validator.toBoolean(process.env.STEEDOS_TENANT_ENABLE_SAAS || 'false', true);
+                if(enableSaas){
+                    return "禁止操作"
+                }
+
+                const dbUser = await getObject('users').findOne(userId)
+                if(dbUser){
+                    // 1 清空 登录tokens
+                    await getObject('users').update(userId, {"services.resume.loginTokens": []})
+                    // 2 设置 sessions 无效
+                    await getObject('sessions').directUpdateMany(["userId", "=", userId], {"valid": false}) 
+                    // 3 记录操作日志
+                    await getObject('operation_logs').insert({
+                        name: '注销所有登录',
+                        type: 'clear_login_tokens',
+                        remote_user: user.userId,
+                        remote_addr: clientIp,
+                        http_user_agent: userAgent,
+                        object: 'users',
+                        status: 'success',
+                        create: new Date(),
+                        space: user.spaceId,
+                        message: `[系统管理员]清理用户[${dbUser.name}]的登录tokens`,
+                        data: JSON.stringify(ctx.params),
+                        related_to: {
+                          o: "users",
+                          ids: [dbUser._id]
+                        }
+                    })
+                }
+            }
+        },
+        invite_user: {
+            rest: {
+                method: "GET",
+                fullPath: "/api/users/:userId/invite_user",
+            },
+            params: {
+                userId: { type: "string" }
+            },
+            async handler(ctx) {
+                const { user, userAgent, clientIp } = ctx.meta;
+                const { userId } = ctx.params;
+                const { spaceId } = user;
+                if(!user.is_space_admin){
+                    return '非管理员无权操作'
+                }
+                if(!userId){
+                    return "缺少参数"
+                }
+                const su = await getObject('space_users').find({filters: [['user', '=', userId], ['space', '=', spaceId], ['user_accepted', '=', false], ['invite_state', '=', 'refused']]})
+                if(su.length == 1){
+                    await getObject('space_users').directUpdate(su[0]._id, {invite_state: 'pending', user_accepted: false})
+                }
+            }
+        }
+    },
+
+    /**
+     * Events
+     */
+    events: {
+
+    },
+
+    /**
+     * Methods
+     */
+    methods: {
+        /**
+         * 验证用户名格式
+         * @param {*} username 
+         * @param {*} userId 
+         */
+        async validateUsername(username, userId) {
+            const userObj = getObject('users')
+            var nameValidation, user;
+            user = (await userObj.find({
+                filters: [
+                    ['username', '=', username],
+                    ['_id', '!=', userId]
+                ]
+            }))[0];
+            if (user) {
+                throw new Error('username-unavailable', 'username-unavailable');
+            }
+            const steedosConfig = getSteedosConfig();
+            const accountsConfig = steedosConfig.public.accounts || {};
+            const usernameMinLength = accountsConfig.username_min_length ? Number(accountsConfig.username_min_length) : 6
+            if (username.length <  usernameMinLength) {
+                throw new Error(`用户名最小长度不能小于 ${usernameMinLength} 位字符`);
+            }
+            try {
+                if (accountsConfig.UTF8_Names_Validation) {
+                    nameValidation = new RegExp('^' + accountsConfig.UTF8_Names_Validation + '$');
+                } else {
+                    nameValidation = new RegExp('^[A-Za-z0-9-_.\u00C0-\u017F\u4e00-\u9fa5]+$');
+                }
+            } catch (error) {
+                nameValidation = new RegExp('^[A-Za-z0-9-_.\u00C0-\u017F\u4e00-\u9fa5]+$');
+            }
+            if (!nameValidation.test(username)) {
+                throw new Error('username-invalid', "username-invalid");
+            }
+        }
+    },
+
+    /**
+     * Service created lifecycle event handler
+     */
+    created() {
+
+    },
+
+    /**
+     * Service started lifecycle event handler
+     */
+    async started() {
+        this.broker.logger.info('[service][users]===>', 'started')
+    },
+
+    /**
+     * Service stopped lifecycle event handler
+     */
+    async stopped() {
+
+    }
+};

package/main/default/tabs/admin_action_field_updates.tab.yml

@@ -0,0 +1,21 @@
+name: admin_action_field_updates
+desktop: true
+icon: record
+is_new_window: false
+label: 字段更新
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: action_field_updates

package/main/default/tabs/admin_api_keys.tab.yml

@@ -0,0 +1,21 @@
+name: admin_api_keys
+desktop: true
+icon: omni_supervisor
+is_new_window: false
+label: API Key
+mobile: true
+permissions:
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: api_keys

package/main/default/tabs/admin_apps.tab.yml

@@ -0,0 +1,21 @@
+name: admin_apps
+desktop: true
+icon: apps
+is_new_window: false
+label: 应用程序
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: apps

package/main/default/tabs/admin_audit_records.tab.yml

@@ -0,0 +1,21 @@
+name: admin_audit_records
+desktop: true
+icon: medication
+is_new_window: false
+label: 审计日志
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: audit_records

package/main/default/tabs/admin_autonumber.tab.yml

@@ -0,0 +1,21 @@
+name: admin_autonumber
+desktop: true
+icon: formula
+is_new_window: false
+label: 自动编号
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: autonumber

package/main/default/tabs/admin_business_hours.tab.yml

@@ -0,0 +1,21 @@
+name: admin_business_hours
+desktop: true
+icon: date_time
+is_new_window: false
+label: 工作时间
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: business_hours

package/main/default/tabs/admin_categories.tab.yml

@@ -0,0 +1,21 @@
+name: admin_categories
+desktop: true
+icon: hierarchy
+is_new_window: false
+label: 流程分类
+mobile: true
+permissions:
+  - permission: 'on'
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: categories

package/main/default/tabs/admin_charts.tab.yml

@@ -0,0 +1,21 @@
+name: admin_charts
+desktop: true
+icon: case
+is_new_window: false
+label: 图表
+mobile: true
+permissions:
+  - permission: 'off' # 2.4禁用图表功能
+    permission_set: admin
+  - permission: 'off'
+    permission_set: user
+  - permission: 'off'
+    permission_set: customer
+  - permission: 'off'
+    permission_set: supplier
+  - permission: 'off'
+    permission_set: organization_admin
+  - permission: 'off'
+    permission_set: workflow_admin
+type: object
+object: charts