@svadmin/core 0.38.0 → 0.39.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.38.0",
+  "version": "0.39.1",
   "author": "zuohuadong",
   "repository": {
     "type": "git",

package/src/audit.ts

@@ -2,6 +2,7 @@
 // Full AuditLogProvider interface
 
 export interface AuditEntry {
+  id?: string | number;
   timestamp: string;
   action: 'create' | 'update' | 'delete' | 'login' | 'logout';
   resource?: string;
@@ -11,6 +12,13 @@ export interface AuditEntry {
   data?: Record<string, unknown>;
   previousData?: Record<string, unknown>;
   meta?: Record<string, unknown>;
+  outcome?: 'success' | 'failure';
+  tenantId?: string | number;
+  requestId?: string;
+  traceId?: string;
+  ipAddress?: string;
+  userAgent?: string;
+  error?: { message: string; code?: string };
 }
 
 export type AuditHandler = (entry: AuditEntry) => void | Promise<void>;
@@ -22,9 +30,20 @@ export type AuditHandler = (entry: AuditEntry) => void | Promise<void>;
  * - update: update an existing entry (e.g. mark as reviewed)
  */
 export interface AuditLogProvider {
-  create: (params: { resource: string; action: string; data?: Record<string, unknown>; previousData?: Record<string, unknown>; meta?: Record<string, unknown> }) => Promise<AuditEntry>;
+  create: (params: {
+    resource: string;
+    action: string;
+    timestamp?: string;
+    recordId?: string | number;
+    userId?: string;
+    outcome?: AuditEntry['outcome'];
+    data?: Record<string, unknown>;
+    previousData?: Record<string, unknown>;
+    meta?: Record<string, unknown>;
+  }) => Promise<AuditEntry>;
   get: (params: { resource: string; action?: string; meta?: Record<string, unknown>; author?: Record<string, unknown> }) => Promise<AuditEntry[]>;
-  update: (params: { id: string | number; name: string; meta?: Record<string, unknown> }) => Promise<AuditEntry>;
+  /** @deprecated 合规审计应保持追加写入；仅为旧实现兼容保留。 */
+  update?: (params: { id: string | number; name: string; meta?: Record<string, unknown> }) => Promise<AuditEntry>;
 }
 
 let handler: AuditHandler = (entry) => {
@@ -68,6 +87,10 @@ export function auditWithProvider(
     provider.create({
       resource: entry.resource ?? '',
       action: entry.action,
+      timestamp: fullEntry.timestamp,
+      recordId: entry.recordId,
+      userId: entry.userId,
+      outcome: entry.outcome,
       data: entry.data ?? entry.details,
       previousData: entry.previousData,
       meta: entry.meta,
@@ -78,3 +101,38 @@ export function auditWithProvider(
 export function audit(entry: Omit<AuditEntry, 'timestamp'>): void {
   auditWithProvider(entry, auditLogProvider);
 }
+
+/**
+ * 严格写入审计记录。与兼容的 best-effort `audit` 不同，此函数会等待所有
+ * 写入并传播失败，适合权限、凭据、策略等必须和业务结果一起验证的流程。
+ */
+export async function writeAuditEntry(
+  entry: Omit<AuditEntry, 'timestamp'>,
+  provider: AuditLogProvider | null | undefined = auditLogProvider,
+): Promise<AuditEntry> {
+  const fullEntry: AuditEntry = { ...entry, timestamp: new Date().toISOString() };
+  if (!provider) {
+    throw new Error('Strict audit logging requires an AuditLogProvider.');
+  }
+  await handler(fullEntry);
+  return provider.create({
+    resource: entry.resource ?? '',
+    action: entry.action,
+    timestamp: fullEntry.timestamp,
+    recordId: entry.recordId,
+    userId: entry.userId,
+    outcome: entry.outcome,
+    data: entry.data ?? entry.details,
+    previousData: entry.previousData,
+    meta: {
+      ...(entry.meta ?? {}),
+      ...(entry.outcome === undefined ? {} : { outcome: entry.outcome }),
+      ...(entry.tenantId === undefined ? {} : { tenantId: entry.tenantId }),
+      ...(entry.requestId === undefined ? {} : { requestId: entry.requestId }),
+      ...(entry.traceId === undefined ? {} : { traceId: entry.traceId }),
+      ...(entry.ipAddress === undefined ? {} : { ipAddress: entry.ipAddress }),
+      ...(entry.userAgent === undefined ? {} : { userAgent: entry.userAgent }),
+      ...(entry.error === undefined ? {} : { error: entry.error }),
+    },
+  });
+}

package/src/context.svelte.ts

@@ -8,6 +8,7 @@ import type { LiveProvider } from './live.svelte';
 import type { AccessControlProvider } from './permissions.svelte';
 import type { AuditLogProvider } from './audit';
 import type { AgentProvider, ChatProvider } from './chatProvider.svelte';
+import type { EnterpriseRequestContext } from './enterprise';
 import {
   createTenantCacheKey,
   resolveTenantProviderMeta,
@@ -77,6 +78,10 @@ export interface AdminContextValue {
   readonly notificationProvider: ProviderBundle['notificationProvider'];
   readonly chatProvider: ChatProvider | null;
   readonly agentProvider: AgentProvider | null;
+  readonly organizationProvider: ProviderBundle['organizationProvider'];
+  readonly identityGovernanceProvider: ProviderBundle['identityGovernanceProvider'];
+  readonly sessionProvider: ProviderBundle['sessionProvider'];
+  readonly credentialProvider: ProviderBundle['credentialProvider'];
   readonly tenant: TenantContext | undefined;
   readonly tenantAdapter: TenantAdapter | undefined;
 }
@@ -102,9 +107,14 @@ export interface AdminContextAccessor {
   readonly notificationProvider: ProviderBundle['notificationProvider'];
   readonly chatProvider: ChatProvider | null;
   readonly agentProvider: AgentProvider | null;
+  readonly organizationProvider: ProviderBundle['organizationProvider'];
+  readonly identityGovernanceProvider: ProviderBundle['identityGovernanceProvider'];
+  readonly sessionProvider: ProviderBundle['sessionProvider'];
+  readonly credentialProvider: ProviderBundle['credentialProvider'];
   readonly tenant: TenantContext | undefined;
   readonly tenantAdapter: TenantAdapter | undefined;
   readonly tenantCacheKey: TenantCacheKey | undefined;
+  readonly enterpriseRequestContext: EnterpriseRequestContext;
   getDataProvider(name?: string): DataProvider;
   getDataProviderNames(): string[];
   resolveDataProviderName(resourceName: string, overrideName?: string): string;
@@ -166,6 +176,18 @@ function resolveProviderBundle(source: AdminContextSource): ProviderBundle {
     taskProvider: source.taskProvider ?? bundled?.taskProvider,
     routerProvider: source.routerProvider ?? bundled?.routerProvider,
     tenantAdapter: source.tenantAdapter ?? bundled?.tenantAdapter,
+    organizationProvider: source.organizationProvider !== undefined
+      ? source.organizationProvider
+      : bundled?.organizationProvider,
+    identityGovernanceProvider: source.identityGovernanceProvider !== undefined
+      ? source.identityGovernanceProvider
+      : bundled?.identityGovernanceProvider,
+    sessionProvider: source.sessionProvider !== undefined
+      ? source.sessionProvider
+      : bundled?.sessionProvider,
+    credentialProvider: source.credentialProvider !== undefined
+      ? source.credentialProvider
+      : bundled?.credentialProvider,
   };
 }
 
@@ -184,6 +206,10 @@ export function createAdminContext(source: AdminContextSource): AdminContextValu
     get notificationProvider() { return resolveProviderBundle(source).notificationProvider ?? null; },
     get chatProvider() { return resolveProviderBundle(source).chatProvider ?? null; },
     get agentProvider() { return resolveProviderBundle(source).agentProvider ?? null; },
+    get organizationProvider() { return resolveProviderBundle(source).organizationProvider ?? null; },
+    get identityGovernanceProvider() { return resolveProviderBundle(source).identityGovernanceProvider ?? null; },
+    get sessionProvider() { return resolveProviderBundle(source).sessionProvider ?? null; },
+    get credentialProvider() { return resolveProviderBundle(source).credentialProvider ?? null; },
     get tenant() { return source.tenant ?? inheritedTenant; },
     get tenantAdapter() { return resolveProviderBundle(source).tenantAdapter; },
   };
@@ -254,11 +280,24 @@ export function captureAdminContext(): AdminContextAccessor {
     },
     get chatProvider() { return scopedContext ? scopedContext.chatProvider : getLegacyChatProvider(); },
     get agentProvider() { return scopedContext ? scopedContext.agentProvider : getLegacyAgentProvider(); },
+    get organizationProvider() { return scopedContext?.organizationProvider ?? null; },
+    get identityGovernanceProvider() { return scopedContext?.identityGovernanceProvider ?? null; },
+    get sessionProvider() { return scopedContext?.sessionProvider ?? null; },
+    get credentialProvider() { return scopedContext?.credentialProvider ?? null; },
     get tenant() { return scopedContext?.tenant; },
     get tenantAdapter() { return scopedContext?.tenantAdapter; },
     get tenantCacheKey() {
       return accessor.tenant ? createTenantCacheKey(accessor.tenant, accessor.tenantAdapter) : undefined;
     },
+    get enterpriseRequestContext() {
+      const tenant = accessor.tenant;
+      return {
+        tenantId: tenant?.tenantId,
+        requestId: typeof tenant?.meta?.requestId === 'string' ? tenant.meta.requestId : undefined,
+        traceId: typeof tenant?.meta?.traceId === 'string' ? tenant.meta.traceId : undefined,
+        meta: tenant?.meta,
+      };
+    },
     getDataProvider(name) {
       const activeProviders = accessor.providers;
       if (!activeProviders) throw new Error('DataProvider not found. Did you call setDataProvider in App.svelte?');

package/src/enterprise.ts

@@ -0,0 +1,206 @@
+/** 企业级管理能力的正式 Provider 契约。 */
+
+export interface EnterpriseActionError {
+  message: string;
+  code?: string;
+}
+
+export interface EnterpriseActionResult {
+  success: boolean;
+  error?: EnterpriseActionError;
+}
+
+/** 每次企业能力调用都必须显式携带当前请求树的租户与追踪上下文。 */
+export interface EnterpriseRequestContext {
+  tenantId?: string | number;
+  requestId?: string;
+  traceId?: string;
+  meta?: Readonly<Record<string, unknown>>;
+}
+
+/** Provider 调用使用的严格请求上下文；三项边界标识不可省略。 */
+export interface StrictEnterpriseRequestContext {
+  tenantId: string | number;
+  requestId: string;
+  traceId: string;
+  meta?: Readonly<Record<string, unknown>>;
+}
+
+export interface EnterpriseRequestContextInput {
+  tenantId: string | number;
+  requestId?: string;
+  traceId?: string;
+  meta?: Readonly<Record<string, unknown>>;
+}
+
+function nonEmpty(value: string, field: string): string {
+  const normalized = value.trim();
+  if (!normalized) throw new Error(`${field} must not be empty.`);
+  return normalized;
+}
+
+function validatedTenantId(tenantId: string | number): string | number {
+  if (typeof tenantId === 'string') return nonEmpty(tenantId, 'tenantId');
+  if (!Number.isFinite(tenantId)) throw new Error('tenantId must be a finite number.');
+  return tenantId;
+}
+
+function createRequestId(): string {
+  const randomUUID = globalThis.crypto?.randomUUID;
+  if (!randomUUID) throw new Error('crypto.randomUUID is required to create an enterprise request context.');
+  return randomUUID.call(globalThis.crypto);
+}
+
+/** Create a validated provider context while preserving one trace across the request tree. */
+export function createEnterpriseRequestContext(
+  input: EnterpriseRequestContextInput,
+): StrictEnterpriseRequestContext {
+  const requestId = nonEmpty(input.requestId || createRequestId(), 'requestId');
+  return {
+    tenantId: validatedTenantId(input.tenantId),
+    requestId,
+    traceId: nonEmpty(input.traceId || requestId, 'traceId'),
+    ...(input.meta ? { meta: input.meta } : {}),
+  };
+}
+
+/** Narrow a legacy optional context at the provider boundary and fail closed on missing identity. */
+export function assertEnterpriseRequestContext(
+  context: EnterpriseRequestContext,
+): asserts context is StrictEnterpriseRequestContext {
+  if (context.tenantId === undefined || context.tenantId === null) {
+    throw new Error('tenantId must not be empty.');
+  }
+  validatedTenantId(context.tenantId);
+  nonEmpty(context.requestId ?? '', 'requestId');
+  nonEmpty(context.traceId ?? '', 'traceId');
+}
+
+export type EnterpriseProviderRequestContext = StrictEnterpriseRequestContext;
+
+export interface Organization {
+  id: string;
+  name: string;
+  slug?: string;
+  domain?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface OrganizationProvider {
+  getCurrentOrganization: (context: EnterpriseRequestContext) => Promise<Organization | null>;
+  updateCurrentOrganization?: (
+    input: Partial<Omit<Organization, 'id'>>,
+    context: EnterpriseRequestContext,
+  ) => Promise<Organization>;
+}
+
+export interface EnterpriseSecurityPolicy {
+  sessionTimeoutMinutes: number;
+  auditRetentionDays: number;
+  auditLoggingEnabled: boolean;
+  requireSso: boolean;
+}
+
+export type IdentityProviderProtocol = 'oidc' | 'saml' | (string & {});
+export type IdentityProviderStatus = 'connected' | 'disabled' | 'error' | (string & {});
+
+export interface IdentityProviderSummary {
+  id: string;
+  name: string;
+  protocol: IdentityProviderProtocol;
+  status: IdentityProviderStatus;
+  metadataUrl?: string;
+  domain?: string;
+}
+
+export interface EnterpriseSecurityEvent {
+  id: string;
+  event: string;
+  actor?: string;
+  location?: string;
+  createdAt: string | Date;
+  severity?: 'info' | 'warning' | 'critical';
+  tenantId?: string | number;
+  requestId?: string;
+  traceId?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface IdentityGovernanceProvider {
+  getSecurityPolicy: (context: EnterpriseRequestContext) => Promise<EnterpriseSecurityPolicy>;
+  updateSecurityPolicy: (
+    policy: EnterpriseSecurityPolicy,
+    context: EnterpriseRequestContext,
+  ) => Promise<EnterpriseSecurityPolicy>;
+  listIdentityProviders: (context: EnterpriseRequestContext) => Promise<IdentityProviderSummary[]>;
+  testIdentityProvider: (params: {
+    id?: string;
+    protocol?: IdentityProviderProtocol;
+    metadataUrl?: string;
+  }, context: EnterpriseRequestContext) => Promise<EnterpriseActionResult>;
+  listSecurityEvents?: (params: {
+    page?: number;
+    pageSize?: number;
+  } | undefined, context: EnterpriseRequestContext) => Promise<{ data: EnterpriseSecurityEvent[]; total: number }>;
+}
+
+export interface SessionInfo {
+  id: string;
+  os?: string;
+  browser?: string;
+  ipAddress?: string;
+  lastActiveAt?: string | Date;
+  current: boolean;
+}
+
+export interface MfaState {
+  enabled: boolean;
+  methods?: string[];
+}
+
+export interface SessionProvider {
+  listSessions: (context: EnterpriseRequestContext) => Promise<SessionInfo[]>;
+  revokeSession: (sessionId: string, context: EnterpriseRequestContext) => Promise<EnterpriseActionResult>;
+  revokeOtherSessions: (context: EnterpriseRequestContext) => Promise<EnterpriseActionResult>;
+  getMfaState?: (context: EnterpriseRequestContext) => Promise<MfaState>;
+  setMfaEnabled?: (enabled: boolean, context: EnterpriseRequestContext) => Promise<MfaState>;
+}
+
+export interface ApiCredentialSummary {
+  id: string;
+  name: string;
+  prefix: string;
+  createdAt: string | Date;
+  lastUsedAt?: string | Date;
+  permissions: string[];
+}
+
+export interface CreatedApiCredential {
+  credential: ApiCredentialSummary;
+  /** 只在创建时返回一次；列表接口不得返回此字段。 */
+  secret: string;
+}
+
+export interface WebhookSummary {
+  id: string;
+  name: string;
+  url: string;
+  eventType: string;
+  enabled?: boolean;
+}
+
+export interface CredentialProvider {
+  listApiCredentials: (context: EnterpriseRequestContext) => Promise<ApiCredentialSummary[]>;
+  createApiCredential: (params: {
+    name: string;
+    permissions: string[];
+  }, context: EnterpriseRequestContext) => Promise<CreatedApiCredential>;
+  revokeApiCredential: (credentialId: string, context: EnterpriseRequestContext) => Promise<EnterpriseActionResult>;
+  listWebhooks: (context: EnterpriseRequestContext) => Promise<WebhookSummary[]>;
+  createWebhook: (params: {
+    name: string;
+    url: string;
+    eventType: string;
+  }, context: EnterpriseRequestContext) => Promise<WebhookSummary>;
+  deleteWebhook: (webhookId: string, context: EnterpriseRequestContext) => Promise<EnterpriseActionResult>;
+}

package/src/i18n.svelte.ts

@@ -90,6 +90,7 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.toggleSidebar': '切换侧边栏',
     'common.configRequired': '需要配置',
     'common.removeImage': '移除图片',
+    'common.skipToMainContent': '跳到主要内容',
     // Field
     'field.enterValue': '输入{label}',
     'field.selectPlaceholder': '请选择',
@@ -721,6 +722,7 @@ const baseLocales: Record<string, Record<string, string>> = {
     'common.toggleSidebar': 'Toggle sidebar',
     'common.configRequired': 'Configuration Required',
     'common.removeImage': 'Remove image',
+    'common.skipToMainContent': 'Skip to main content',
     // Field
     'field.enterValue': 'Enter {label}',
     'field.selectPlaceholder': 'Select...',

package/src/index.ts

@@ -84,8 +84,32 @@ export {
 export type { NotificationParams } from './notification.svelte';
 export { t, setLocale, getLocale, getAvailableLocales, addTranslations, useTranslation, setI18nProvider, getI18nProvider, createI18nScope, provideI18nScope, getI18nScope, resetI18n } from './i18n.svelte';
 export type { I18nProvider, I18nScope, I18nScopeOptions } from './i18n.svelte';
-export { audit, auditWithProvider, setAuditHandler, setAuditLogProvider, getAuditLogProvider } from './audit';
+export { audit, auditWithProvider, writeAuditEntry, setAuditHandler, setAuditLogProvider, getAuditLogProvider } from './audit';
 export type { AuditLogProvider } from './audit';
+export type {
+  ApiCredentialSummary,
+  CreatedApiCredential,
+  CredentialProvider,
+  EnterpriseActionError,
+  EnterpriseActionResult,
+  EnterpriseRequestContext,
+  EnterpriseRequestContextInput,
+  EnterpriseProviderRequestContext,
+  StrictEnterpriseRequestContext,
+  EnterpriseSecurityEvent,
+  EnterpriseSecurityPolicy,
+  IdentityGovernanceProvider,
+  IdentityProviderProtocol,
+  IdentityProviderStatus,
+  IdentityProviderSummary,
+  MfaState,
+  Organization,
+  OrganizationProvider,
+  SessionInfo,
+  SessionProvider,
+  WebhookSummary,
+} from './enterprise';
+export { assertEnterpriseRequestContext, createEnterpriseRequestContext } from './enterprise';
 export { setChatProvider, getChatProvider, setChatContext, getChatContext, setAgentProvider, getAgentProvider, registerApproval, resolveApproval, hasPendingApprovals, resetChatProvider } from './chatProvider.svelte';
 export type { ChatProvider, ChatMessage, ChatContext, ChatAction, AgentProvider, AgentEvent, AgentOptions, AdminTool, AdminToolParameter, ToolResult } from './chatProvider.svelte';
 export { getTheme, setTheme, toggleTheme, getResolvedTheme, getColorTheme, setColorTheme, getColorThemes, configureTheme, getThemeConfig, clearCssOverrides, builtinPresets, registerColorPreset, getColorPresets, registerThemeOwner, updateThemeOwner, unregisterThemeOwner, resetTheme } from './theme.svelte';

package/src/provider-bundle.ts

@@ -6,6 +6,12 @@ import type { AuditLogProvider } from './audit';
 import type { AccessControlProvider } from './permissions.svelte';
 import type { LiveProvider } from './live.svelte';
 import type { RouterProvider } from './router-provider';
+import type {
+  CredentialProvider,
+  IdentityGovernanceProvider,
+  OrganizationProvider,
+  SessionProvider,
+} from './enterprise';
 import type {
   AuthProvider,
   BaseRecord,
@@ -52,6 +58,10 @@ export interface ProviderBundle {
   readonly taskProvider?: TaskProvider;
   readonly routerProvider?: RouterProvider;
   readonly tenantAdapter?: TenantAdapter;
+  readonly organizationProvider?: OrganizationProvider | null;
+  readonly identityGovernanceProvider?: IdentityGovernanceProvider | null;
+  readonly sessionProvider?: SessionProvider | null;
+  readonly credentialProvider?: CredentialProvider | null;
 }
 
 /** 保留传入对象的精确类型，同时执行 ProviderBundle 的编译期校验。 */

package/src/route-parsing.ts

@@ -0,0 +1,14 @@
+export type ParsedResourceAction = {
+  action: 'list' | 'create' | 'edit' | 'show' | 'clone';
+  id?: string;
+};
+
+export function parseResourceActionSegments(restSegments: string[]): ParsedResourceAction {
+  if (restSegments.length === 0) return { action: 'list' };
+  if (restSegments[0] === 'create') return { action: 'create' };
+  if (restSegments[0] === 'edit' && restSegments[1]) return { action: 'edit', id: restSegments[1] };
+  if (restSegments[0] === 'show' && restSegments[1]) return { action: 'show', id: restSegments[1] };
+  if (restSegments[0] === 'clone' && restSegments[1]) return { action: 'clone', id: restSegments[1] };
+  if (restSegments[1] === 'edit') return { action: 'edit', id: restSegments[0] };
+  return { action: 'show', id: restSegments[0] };
+}

package/src/useParsed.svelte.ts

@@ -3,6 +3,7 @@
 
 import { registerRouterSync } from './router';
 import { captureAdminContext } from './context.svelte';
+import { parseResourceActionSegments } from './route-parsing';
 
 interface ParsedRoute {
   resource?: string;
@@ -107,47 +108,13 @@ export function useParsed(): ParsedRoute {
         }
       }
 
-      const restSegments = segments.slice(resourceIndex + 1);
-      if (restSegments.length === 0) {
-        result.action = 'list';
-      } else if (restSegments[0] === 'create') {
-        result.action = 'create';
-      } else if (restSegments[0] === 'edit' && restSegments[1]) {
-        result.action = 'edit';
-        result.id = restSegments[1];
-      } else if (restSegments[0] === 'show' && restSegments[1]) {
-        result.action = 'show';
-        result.id = restSegments[1];
-      } else if (restSegments[0] === 'clone' && restSegments[1]) {
-        result.action = 'clone';
-        result.id = restSegments[1];
-      } else if (restSegments[0]) {
-        // Legacy: /:resource/:id
-        result.action = 'show';
-        result.id = restSegments[0];
-      }
+      Object.assign(result, parseResourceActionSegments(segments.slice(resourceIndex + 1)));
     } else {
       // Fallback if resource definitions are not loaded yet
       result.resource = segments[0];
       result.resourcePath = segments[0];
 
-      if (segments.length === 1) {
-        result.action = 'list';
-      } else if (segments[1] === 'create') {
-        result.action = 'create';
-      } else if (segments[1] === 'edit' && segments[2]) {
-        result.action = 'edit';
-        result.id = segments[2];
-      } else if (segments[1] === 'show' && segments[2]) {
-        result.action = 'show';
-        result.id = segments[2];
-      } else if (segments[1] === 'clone' && segments[2]) {
-        result.action = 'clone';
-        result.id = segments[2];
-      } else if (segments[1]) {
-        result.action = 'show';
-        result.id = segments[1];
-      }
+      Object.assign(result, parseResourceActionSegments(segments.slice(1)));
     }
 
     return result;