@youzan-cloud/zan-saas-cli 0.0.0-stage → 0.1.0-beta.3

package/src/commands/native/access/role/list/schema.json

@@ -0,0 +1,393 @@
+{
+  "schemaVersion": 1,
+  "input": {
+    "type": "object",
+    "required": [
+      "kdtId"
+    ],
+    "additionalProperties": false,
+    "properties": {
+      "kdtId": {
+        "$ref": "#/definitions/shopId"
+      }
+    }
+  },
+  "output": {
+    "type": "object",
+    "required": [
+      "data"
+    ],
+    "additionalProperties": false,
+    "properties": {
+      "data": {
+        "type": "object",
+        "required": [
+          "roles"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "roles": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "roleId",
+                "name"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "roleId": {
+                  "$ref": "#/definitions/shopId",
+                  "description": "角色定义标识，正安全整数，不是员工或组织标识。"
+                },
+                "name": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "角色名称，原文保留。"
+                },
+                "bizCode": {
+                  "type": "string",
+                  "description": "角色所属业务编码，缺失或 null 时省略；空字符串保留。"
+                },
+                "roleType": {
+                  "type": "integer",
+                  "minimum": -9007199254740991,
+                  "maximum": 9007199254740991,
+                  "description": "角色类型原始整数码；未定义枚举含义，不推导 system/custom。"
+                },
+                "remark": {
+                  "type": "string",
+                  "description": "角色说明原文，缺失或 null 时省略；空字符串保留。"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "preview": {
+    "type": "object",
+    "required": [
+      "scope",
+      "requests",
+      "maxOrganizationPages"
+    ],
+    "additionalProperties": false,
+    "properties": {
+      "scope": {
+        "type": "object",
+        "required": [
+          "kdtId"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "kdtId": {
+            "$ref": "#/definitions/shopId"
+          }
+        }
+      },
+      "requests": {
+        "type": "array",
+        "minItems": 2,
+        "maxItems": 3,
+        "items": {
+          "oneOf": [
+            {
+              "type": "object",
+              "required": [
+                "stage",
+                "method",
+                "path",
+                "body"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "stage": {
+                  "const": "shop-binding"
+                },
+                "method": {
+                  "const": "POST"
+                },
+                "path": {
+                  "const": "youzan.shop.basic.get/3.0.0"
+                },
+                "body": {
+                  "type": "object",
+                  "required": [],
+                  "additionalProperties": false,
+                  "properties": {}
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "stage",
+                "method",
+                "path",
+                "body"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "stage": {
+                  "const": "target-membership"
+                },
+                "method": {
+                  "const": "POST"
+                },
+                "path": {
+                  "const": "youzan.shop.chain.descendent.organization.list/1.0.1"
+                },
+                "body": {
+                  "type": "object",
+                  "required": [
+                    "page_num",
+                    "page_size",
+                    "with_dept_info",
+                    "with_shop_status_and_lifecycle_end_time",
+                    "with_crm_shop"
+                  ],
+                  "additionalProperties": false,
+                  "properties": {
+                    "page_num": {
+                      "const": 1
+                    },
+                    "page_size": {
+                      "const": 50
+                    },
+                    "with_dept_info": {
+                      "const": false
+                    },
+                    "with_shop_status_and_lifecycle_end_time": {
+                      "const": false
+                    },
+                    "with_crm_shop": {
+                      "const": false
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "type": "object",
+              "required": [
+                "stage",
+                "method",
+                "path",
+                "body"
+              ],
+              "additionalProperties": false,
+              "properties": {
+                "stage": {
+                  "const": "roles"
+                },
+                "method": {
+                  "const": "POST"
+                },
+                "path": {
+                  "const": "youzan.shop.rig.list.role/1.0.0"
+                },
+                "body": {
+                  "type": "object",
+                  "required": [
+                    "third_tenant_id",
+                    "third_user_id",
+                    "namespace",
+                    "filter"
+                  ],
+                  "additionalProperties": false,
+                  "properties": {
+                    "third_tenant_id": {
+                      "type": "string",
+                      "pattern": "^[1-9]\\d*$"
+                    },
+                    "third_user_id": {
+                      "const": "-1"
+                    },
+                    "namespace": {
+                      "const": "np_yz_shop"
+                    },
+                    "filter": {
+                      "type": "object",
+                      "required": ["biz_key_group"],
+                      "additionalProperties": false,
+                      "properties": {
+                        "biz_key_group": { "const": "shop_ability" }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          ]
+        }
+      },
+      "maxOrganizationPages": {
+        "const": 20
+      }
+    }
+  },
+  "error": {
+    "type": "object",
+    "required": [
+      "success",
+      "code",
+      "message",
+      "details"
+    ],
+    "additionalProperties": false,
+    "properties": {
+      "success": {
+        "const": false
+      },
+      "code": {
+        "const": -10001
+      },
+      "message": {
+        "type": "string",
+        "minLength": 1
+      },
+      "details": {
+        "type": "object",
+        "required": [
+          "category",
+          "stage",
+          "command",
+          "targetScope",
+          "requestState",
+          "nextStep"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "category": {
+            "type": "string",
+            "enum": [
+              "validation",
+              "configuration",
+              "parameter",
+              "permission",
+              "authentication",
+              "scope_unresolved",
+              "transport",
+              "http",
+              "protocol",
+              "business_rejected"
+            ]
+          },
+          "stage": {
+            "type": "string",
+            "enum": [
+              "validation",
+              "context",
+              "scope",
+              "input",
+              "configuration",
+              "shop-binding",
+              "target-membership",
+              "roles",
+              "roles-model",
+              "transport",
+              "http",
+              "response"
+            ]
+          },
+          "command": {
+            "const": "access.role.list"
+          },
+          "targetScope": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "kdtId": {
+                "$ref": "#/definitions/shopId"
+              }
+            }
+          },
+          "requestState": {
+            "enum": [
+              "not_sent",
+              "sent",
+              "unknown"
+            ]
+          },
+          "nextStep": {
+            "type": "string",
+            "minLength": 1
+          },
+          "api": {
+            "type": "string"
+          },
+          "httpStatus": {
+            "type": "integer"
+          },
+          "businessCode": {
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": -9007199254740991,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "string",
+                "pattern": "^-?\\d{1,12}$"
+              }
+            ]
+          },
+          "gatewayCode": {
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": -9007199254740991,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "string",
+                "pattern": "^-?\\d{1,12}$"
+              }
+            ]
+          },
+          "trace_id": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9_-]{1,128}$"
+          },
+          "request_id": {
+            "type": "string",
+            "pattern": "^[a-zA-Z0-9_-]{1,128}$"
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "shopId": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991,
+      "description": "目标店铺正安全整数；默认上下文 shopId。真实执行先核实凭证绑定，非总部不可跨店，总部跨店另核实归属。"
+    }
+  },
+  "modules": {
+    "roles": {
+      "base": true,
+      "upstreamPath": "data",
+      "required": true,
+      "description": "角色定义目录，必须明确返回数组和核心字段；不代表员工角色或权限。"
+    }
+  },
+  "api": {
+    "method": "POST",
+    "path": "youzan.shop.rig.list.role/1.0.0"
+  },
+  "success": {
+    "description": "已核实当前凭证主体与目标归属，取得完整且模型有效的本次角色目录，返回 data.roles。仅明确空数组表示本次结果为空。"
+  },
+  "notes": [
+    "查询角色定义，不按员工或角色类型筛选；不支持调用者增加目录过滤条件。",
+    "角色保留顺序与重复，不排序、截断或分页。空数组只表示本次结果为空。",
+    "可选字段缺失或 null 时省略，非 null 错型整体失败；未选字段忽略。",
+    "同店最多两次请求；总部跨店最多一次主体回读、20 页每页 50 条归属核验、一次目录读取；不重试。",
+    "预算用尽或归属未核实只表示不能安全继续，不证明目标不属于总部。",
+    "目录成功不代表店铺员工身份授权与权限隔离验收通过。"
+  ]
+}

package/src/commands/native/access/staff-perms/get/command.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const { withTargetShopDefault } = require('../../../../../execution/target-shop-default');
+
+const { Option } = require('commander');
+const { DiagnosticCommand } = require('../../../../../cli/diagnostic-command');
+const { withInputScope, constraints, modelAt } = require('../../../../../execution/error-details');
+const schema = require('./schema.json');
+const { validateCommandValue } = require('../../../../../execution/command-schema');
+const { object } = require('../../../../../execution/query-api');
+const { failure } = require('../../../../../execution/shop-query');
+const { staffInput, staffPreview, readSingleShopStaffIdentity } = require('../../../org/shared/single-staff');
+
+const command = 'access.staff-perms.get';
+const maxResponseBytes = 8 * 1024 * 1024;
+const reject = (category, stage, scope, state, facts) =>
+  failure(command, category, stage, scope, state, facts);
+
+function buildInput(options, context) {
+  const input = staffInput(options, context, command, schema);
+  return withInputScope({ kdtId: input.kdtId }, () => {
+    const normalized = { ...input,
+      ...(options.permKey === undefined ? {} : { permKey: options.permKey }) };
+    validateCommandValue(schema, 'input', normalized);
+    return Object.freeze(normalized);
+  });
+}
+
+function permissionBody(input, staffId) {
+  return { kdt_id: input.kdtId, yz_open_id: staffId, platform: 0,
+    ...(input.permKey === undefined ? {} : { perm_keys: JSON.stringify([input.permKey]) }) };
+}
+
+function previewFor(input) {
+  const preview = staffPreview(input);
+  return { scope: preview.scope, requests: [...preview.requests,
+    { stage: 'permissions', method: 'POST', path: schema.api.path,
+      body: permissionBody(input, '***') }
+  ] };
+}
+
+async function execute(input) {
+  const { read, staff, facts } = await readSingleShopStaffIdentity(input, command, {
+    transportOptions: { maxResponseBytes: () => maxResponseBytes }
+  });
+  if (typeof staff.yz_open_id !== 'string' || !/\S/.test(staff.yz_open_id)) {
+    const error = reject('protocol', 'staff-model', { kdtId: input.kdtId }, 'sent', facts);
+    error.diagnosticReason = 'staff_identity_invalid';
+    throw error;
+  }
+  if (typeof staff.account === 'string' && /^1\d{10}$/.test(staff.account) && staff.account !== input.mobile) {
+    const error = reject('scope_unresolved', 'staff-model', { kdtId: input.kdtId }, 'sent', facts);
+    error.diagnosticReason = 'staff_account_mismatch';
+    redactDiagnostics(error, [input.mobile, staff.yz_open_id]);
+    throw error;
+  }
+  let response;
+  try {
+    response = await read(schema.api.path, permissionBody(input, staff.yz_open_id), 'permissions');
+  } catch (error) {
+    redactDiagnostics(error, [input.mobile, staff.yz_open_id]);
+    throw error;
+  }
+  const invalid = (path, reason) => {
+    const error = reject('protocol', 'permissions-model', { kdtId: input.kdtId }, 'sent', response.facts);
+    if (path) error.issues = [{ source: 'output', path, reason,
+      expected: constraints(modelAt(schema, 'output', path)) }];
+    return error;
+  };
+  try {
+    if (!Array.isArray(response.data)) throw invalid('/data/permissions', response.data === undefined ? 'required' : 'invalid_type');
+    const permissions = response.data.map((permission, index) => {
+      if (!object(permission)) throw invalid(`/data/permissions/${index}`, 'invalid_type');
+      return { permId: permission.perm_id, permKey: permission.perm_key, name: permission.name };
+    });
+    const result = { data: { permissions } };
+    validateCommandValue(schema, 'output', result);
+    return result;
+  } catch (cause) {
+    const error = cause.cliDetails ? cause : invalid();
+    if (cause.issues) error.issues = cause.issues;
+    if (cause.issuesTruncated) error.issuesTruncated = true;
+    redactDiagnostics(error, [input.mobile, staff.yz_open_id]);
+    throw error;
+  }
+}
+
+function redactDiagnostics(error, values) {
+  for (const field of ['businessCode', 'gatewayCode', 'trace_id', 'request_id']) {
+    if (values.some(value => String(error.cliDetails?.[field]).includes(value))) delete error.cliDetails[field];
+  }
+}
+
+function createCommand({ context } = {}) {
+  return new DiagnosticCommand('get', { path: command, schema, parameterCategory: 'parameter' })
+    .description('按登录账号手机号读取当前单店员工权限点，可核对一个指定 key')
+    .allowExcessArguments(false)
+    .requiredOption('--mobile <phone>', '必填：员工登录账号的 11 位手机号，不是客户或联系人号码')
+    .option('--kdt-id <id>', '当前单店正安全整数；省略取上下文 shopId，不支持跨店或总部')
+    .option('--perm-key <key>', '单个权限 key，不拆分逗号；省略查询全部权限点')
+    .addOption(new Option('--format <format>', 'json 或 pretty，仅改变缩进')
+      .choices(['json', 'pretty']).default('json'))
+    .option('--dry-run', '仅本地预览，手机号和派生员工标识脱敏；零请求')
+    .addHelpText('after', '\n先核验同店及单店组织角色，再定位员工并查询权限，最多三请求，不重试或切店。\n每次响应最多 8 MiB，超限整体失败，不输出部分权限。\n空数组仅表示本次筛选范围没有返回权限点；指定 key 的空结果不代表员工没有其他权限。角色关联、角色目录不等于权限事实。\n单店组织角色不证明产品类型或员工授权，网关决定实际可读范围。\n契约：zan-saas schema access.staff-perms.get\n示例：zan-saas access staff-perms get --mobile 13800000000 --dry-run')
+    .action(async options => {
+      const input = buildInput(options, context);
+      const preview = previewFor(input);
+      validateCommandValue(schema, 'preview', preview);
+      try {
+        const result = options.dryRun ? preview : await execute(input);
+        console.log(JSON.stringify(result, null, options.format === 'pretty' ? 2 : 0));
+      } catch (error) {
+        redactDiagnostics(error, [input.mobile]);
+        throw error;
+      }
+    });
+}
+
+module.exports = { kind: 'atomic', risk: 'read', at: 'shop', createCommand: withTargetShopDefault(createCommand) };