@yss123/cage-admin 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 shunshunyue and Cage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,50 @@
-# Temporary Holding Version
+# @yss123/cage-admin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+组织模型声明与 /admin 系统管理
+
+Cage 是通过 TypeScript 声明业务、由框架统一执行权限和数据规则的中后台框架。此包是框架的一部分。
+
+## 使用
+
+```powershell
+pnpm add @yss123/cage-admin
+```
+
+首次使用建议通过脚手架创建完整项目，所需依赖由模板统一配置。需要 Node.js 24 或更新版本。
+
+## 中文管理界面
+
+启动 API 后访问 `/admin/`。页面包含审批待办、用户与部门、角色与授权、操作审计、异步任务和第三方同步。角色页按业务对象分组展示权限，支持中文或代码搜索；操作权限即时保存，数据范围与审批额度需要点击各自的保存按钮。中文显示不改变真实权限标识，也不会自动给角色增加权限。
+
+业务聚合和命令应填写中文 `description`。项目根目录 `cage.config.json` 的 `graph.labels` 同时用于图谱和系统管理，无需再维护一份翻译：
+
+```json
+{
+  "graph": {
+    "labels": {
+      "aggregate:PurchaseOrder": "采购单",
+      "command:PurchaseOrder.submit": "提交审批",
+      "capability:PurchaseOrder.export": "导出采购单",
+      "approval:poApproval": "采购审批流程",
+      "event:OrderSubmitted": "采购单已提交",
+      "job:expireStaleOrders": "清理过期草稿"
+    }
+  }
+}
+```
+
+以上是合并进已有配置的片段，不要覆盖项目中的 domain、contracts 等设置。修改显示名后重启 API。API 进程应在项目根目录启动；Docker 模板也会复制这份配置到运行时镜像。
+
+名称优先级：权限专用 `capability:` → `command:` → 命令 `description` → 常用动作中文；业务对象使用 `aggregate:` → 聚合 `description`。read/export 会自动组合对象中文名，敏感字段明文权限和调用方也会显示中文。框架无法凭代码猜测自定义业务术语，缺少中文时需要在声明或配置中补充。
+
+直接集成 HTTP 服务时，也可以通过 `createServer({ domain, adminLabels: { 'aggregate:Document': '业务单据' } })` 提供显示名；它覆盖本地 `graph.labels`。此选项属于 `@yss123/cage-http`，不是领域授权配置。
+
+## 维护管理前端
+
+`ui/src/app` 负责页面组合，`ui/src/modules` 按管理功能组织，`ui/src/shared` 放请求、标签和 DOM 组件。界面由 TypeScript 编译成原生浏览器模块，不要求业务项目使用特定前端框架。执行 `pnpm build` 同时构建接口与界面；发布时分发 `ui/dist`、HTML 和 CSS，不直接执行 TypeScript 源码。
+
+- [完整使用说明](https://github.com/shunshunyue/cage/blob/main/docs/使用说明.md)
+- [框架源码与范例](https://github.com/shunshunyue/cage)
+- [问题反馈](https://github.com/shunshunyue/cage/issues)
+
+许可证：[MIT](https://github.com/shunshunyue/cage/blob/main/LICENSE)。

package/dist/bootstrap.d.ts

@@ -0,0 +1,17 @@
+import { type Kernel } from '@yss123/cage-kernel';
+export interface BootstrapResult {
+    created: boolean;
+    username?: string;
+    password?: string;
+    rootDeptId?: string;
+    superadminRoleId?: string;
+}
+export declare function bootstrapOrg(k: Kernel, opts?: {
+    tenantId?: string;
+    adminUsername?: string;
+    adminPassword?: string;
+    rootDeptName?: string;
+}): Promise<BootstrapResult>;
+/** 把能力目录里的全部能力授给某个角色（cage dev 在声明新增命令后调用，生产环境由管理员在 /admin 操作） */
+export declare function grantAll(k: Kernel, roleId: string, tenantId?: string): Promise<number>;
+export declare function grantAllToSuperadmin(k: Kernel, tenantId?: string): Promise<number>;

package/dist/bootstrap.js

@@ -0,0 +1,43 @@
+// 初始化组织：第一次启动时建根部门、超级管理员角色和初始管理员账号。
+// 超级管理员只是一个拥有全部能力、范围为 all 的角色，是数据而不是代码里的特例。
+import { randomBytes } from 'node:crypto';
+import { DEFAULT_TENANT, systemCtx } from '@yss123/cage-kernel';
+function bootstrapCtx(k, tenantId) {
+    return systemCtx({ kind: 'system', name: 'bootstrap', tenantId, capabilities: k.catalogCaps() });
+}
+export async function bootstrapOrg(k, opts = {}) {
+    const tenantId = opts.tenantId ?? DEFAULT_TENANT;
+    const existing = await k.app.selectFrom('sys.user').select((eb) => eb.fn.countAll().as('n')).where('tenant_id', '=', tenantId).executeTakeFirst();
+    if (Number(existing?.n ?? 0) > 0)
+        return { created: false };
+    const ctx = bootstrapCtx(k, tenantId);
+    const root = await k.execute('Dept.create', { name: opts.rootDeptName ?? '总部', code: 'root' }, ctx);
+    const role = await k.execute('Role.create', { code: 'superadmin', name: '超级管理员' }, ctx);
+    await grantAll(k, role.id, tenantId);
+    await k.execute('Role.setScope', { id: role.id, aggregate: '*', combinator: 'all' }, ctx);
+    const username = opts.adminUsername ?? 'admin';
+    const password = opts.adminPassword ?? randomBytes(9).toString('base64url');
+    const user = await k.execute('User.create', { username, name: '管理员', deptId: root.id }, ctx);
+    await k.execute('User.assignRoles', { id: user.id, roleIds: [role.id] }, ctx);
+    await k.execute('User.setPassword', { id: user.id, password }, ctx);
+    return { created: true, username, password, rootDeptId: root.id, superadminRoleId: role.id };
+}
+/** 把能力目录里的全部能力授给某个角色（cage dev 在声明新增命令后调用，生产环境由管理员在 /admin 操作） */
+export async function grantAll(k, roleId, tenantId = DEFAULT_TENANT) {
+    const ctx = bootstrapCtx(k, tenantId);
+    const role = await k.app.selectFrom('sys.role').select('capabilities').where('id', '=', roleId).executeTakeFirst();
+    const have = new Set((role?.capabilities ?? []).map((c) => c.capability));
+    let n = 0;
+    for (const cap of k.catalogCaps()) {
+        if (have.has(cap))
+            continue;
+        await k.execute('Role.grantCapability', { id: roleId, capability: cap, params: cap.endsWith('.approve') ? { ceiling: 1_000_000_000 } : undefined }, ctx);
+        n++;
+    }
+    return n;
+}
+export async function grantAllToSuperadmin(k, tenantId = DEFAULT_TENANT) {
+    const r = await k.app.selectFrom('sys.role').select('id').where('code', '=', 'superadmin').where('tenant_id', '=', tenantId).executeTakeFirst();
+    return r ? grantAll(k, r.id, tenantId) : 0;
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../src/bootstrap.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,4CAA4C;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAyB,MAAM,qBAAqB,CAAC;AAUvF,SAAS,YAAY,CAAC,CAAS,EAAE,QAAgB;IAC/C,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,CAAS,EACT,OAAqG,EAAE;IAEvG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC1J,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AAC/F,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,CAAS,EAAE,MAAc,EAAE,QAAQ,GAAG,cAAc;IACjF,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;IACnH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACzJ,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,CAAS,EAAE,QAAQ,GAAG,cAAc;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChJ,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/catalog.d.ts

@@ -0,0 +1,43 @@
+import { type Registry } from '@yss123/cage-kernel';
+/** 显示名沿用图谱的节点键；只影响文案，不重命名权限、命令、表或业务字段。 */
+export type AdminLabels = Record<string, string>;
+/**
+ * 展示目录独立于内核的授权目录。原始字段继续提供给 API 调用者，额外 label 专供界面使用。
+ * 自定义业务名称来自项目声明或 labels，框架不猜测客户术语；缺少中文时明确提示需要命名。
+ */
+export declare function adminCatalog(registry: Registry, labels?: AdminLabels): {
+    capabilities: {
+        label: string;
+        capability: string;
+        kind: "command" | "read" | "export" | "unmask" | "system";
+        aggregate?: string;
+        description?: string;
+        invokedBy?: readonly string[];
+    }[];
+    aggregates: {
+        name: string;
+        description: string | null;
+        label: string;
+        states: readonly any[];
+        scope: {
+            deptField: string | null;
+            ownerField: string | null;
+        };
+        sensitive: Record<string, string>;
+    }[];
+    combinators: string[];
+    approvals: {
+        name: string;
+        process: string;
+        aggregate: string;
+        routable: readonly string[];
+        label: string;
+    }[];
+    jobs: {
+        name: string;
+        cron: string;
+        description: string | null;
+        label: string;
+    }[];
+    labels: AdminLabels;
+};

package/dist/catalog.js

@@ -0,0 +1,91 @@
+import { sensitiveFields } from '@yss123/cage-kernel';
+const actions = {
+    create: '新建',
+    read: '查看',
+    export: '导出',
+    update: '编辑',
+    rename: '修改名称',
+    delete: '删除',
+    archive: '停用',
+    enable: '启用',
+    disable: '停用',
+    submit: '提交',
+    approve: '审批通过',
+    reject: '驳回',
+    cancel: '取消',
+    revoke: '撤回',
+    confirm: '确认',
+    void: '作废',
+    receive: '确认收货',
+    markReceived: '确认收货',
+    recordErpNo: '回写外部单号',
+    acquire: '占用资源',
+    release: '释放资源',
+    assignRoles: '分配角色',
+    setPassword: '重置密码',
+    grantCapability: '授予操作权限',
+    revokeCapability: '收回操作权限',
+    setScope: '设置数据范围',
+};
+const sensitive = {
+    phone: '手机号',
+    email: '邮箱',
+    idCard: '身份证号',
+    bankCard: '银行卡号',
+    name: '姓名',
+    address: '地址',
+};
+/**
+ * 展示目录独立于内核的授权目录。原始字段继续提供给 API 调用者，额外 label 专供界面使用。
+ * 自定义业务名称来自项目声明或 labels，框架不猜测客户术语；缺少中文时明确提示需要命名。
+ */
+export function adminCatalog(registry, labels = {}) {
+    const aggregates = registry.aggregates.map((a) => {
+        const label = labels[`aggregate:${a.name}`] || a.description || a.name;
+        return {
+            name: a.name,
+            description: a.description ?? null,
+            label,
+            states: a.states.values,
+            scope: { deptField: a.scope.deptField ?? null, ownerField: a.scope.ownerField ?? null },
+            sensitive: sensitiveFields(a),
+        };
+    });
+    const names = new Map(aggregates.map((a) => [a.name, a.label]));
+    const capabilities = registry.capabilityCatalog().map((c) => {
+        const subject = names.get(c.aggregate ?? '') ?? '';
+        const action = c.capability.split('.').at(-1);
+        const override = labels[`capability:${c.capability}`] || labels[`command:${c.capability}`];
+        // 内核的 read/export 文案可能含英文聚合名，重组后才能复用项目提供的中文名称。
+        const label = override ||
+            (c.kind === 'read'
+                ? `查看${subject}`
+                : c.kind === 'export'
+                    ? `导出${subject}`
+                    : c.kind === 'unmask'
+                        ? `查看${sensitive[action] ?? '敏感字段'}明文`
+                        : c.description || actions[action] || '自定义操作');
+        return { ...c, label };
+    });
+    return {
+        capabilities,
+        aggregates,
+        combinators: ['self', 'dept', 'deptSubtree', 'deptSet', 'all'],
+        approvals: registry.approvals.map(({ a, name }) => ({
+            name,
+            process: a.process,
+            aggregate: a.agg.name,
+            routable: a.routable,
+            label: labels[`approval:${name}`] || a.process,
+        })),
+        jobs: registry.jobs.map((j) => ({
+            name: j.name,
+            cron: j.cron,
+            description: j.description ?? null,
+            label: labels[`job:${j.name}`] || j.description || j.name,
+        })),
+        // 事件、状态和连接器也能复用图谱文案，供审计、待办和运维页面解释业务标识。
+        labels,
+    };
+}
+//# sourceMappingURL=catalog.js.map

package/dist/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAiB,MAAM,qBAAqB,CAAC;AAKrE,MAAM,OAAO,GAA2B;IACtC,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,MAAM;IACf,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,MAAM;IACf,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,MAAM;IACf,WAAW,EAAE,MAAM;IACnB,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,QAAQ;IACzB,gBAAgB,EAAE,QAAQ;IAC1B,QAAQ,EAAE,QAAQ;CACnB,CAAC;AACF,MAAM,SAAS,GAA2B;IACxC,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;CACd,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,SAAsB,EAAE;IACvE,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC;QACvE,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;YAClC,KAAK;YACL,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YACvB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE;YACvF,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3F,+CAA+C;QAC/C,MAAM,KAAK,GACT,QAAQ;YACR,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;gBAChB,CAAC,CAAC,KAAK,OAAO,EAAE;gBAChB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ;oBACnB,CAAC,CAAC,KAAK,OAAO,EAAE;oBAChB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ;wBACnB,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI;wBACtC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;QACvD,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,YAAY;QACZ,UAAU;QACV,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC;QAC9D,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;YACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO;SAC/C,CAAC,CAAC;QACH,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;YAClC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI;SAC1D,CAAC,CAAC;QACH,uCAAuC;QACvC,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/domain/constraints.d.ts

@@ -0,0 +1,9 @@
+import { type Constraint } from '@yss123/cage-kernel';
+/** 只能授出能力目录里存在的能力点 */
+export declare const knownCapability: () => Constraint;
+/** 防提权：不能授出自己没有的能力点；数值参数（额度）不能超过自己的 */
+export declare const noEscalation: () => Constraint;
+/** 不能授出比自己更宽的数据范围 */
+export declare const noWiderScope: () => Constraint;
+/** 分配角色也是授权：被分配角色里的每个能力点和范围，操作人自己都必须有 */
+export declare const noEscalationViaRoles: () => Constraint;

package/dist/domain/constraints.js

@@ -0,0 +1,61 @@
+// 授权类命令的内置硬约束：代码里不存在「管理员跳过检查」的分支，超级管理员也一样要过这些约束。
+import { COMBINATOR_WIDTH, ok, violation } from '@yss123/cage-kernel';
+function ownWidth(ctx, aggregate) {
+    const grants = ctx.scopes[aggregate] ?? ctx.scopes['*'] ?? [{ combinator: 'self' }];
+    return Math.max(...grants.map((g) => COMBINATOR_WIDTH[g.combinator] ?? 0));
+}
+/** 只能授出能力目录里存在的能力点 */
+export const knownCapability = () => ({
+    name: 'knownCapability',
+    check: (_role, _ctx, input, meta) => meta.catalog().includes(input.capability) ? ok() : violation(`[CAGE-GRANT-003] 能力点 ${input.capability} 不在能力目录里`),
+});
+/** 防提权：不能授出自己没有的能力点；数值参数（额度）不能超过自己的 */
+export const noEscalation = () => ({
+    name: 'noEscalation',
+    check: (_role, ctx, input) => {
+        const mine = ctx.capabilities.get(input.capability);
+        if (!mine)
+            return violation('[CAGE-GRANT-001] 不能授出自己没有的能力点');
+        for (const [k, v] of Object.entries(input.params ?? {})) {
+            if (typeof v === 'number' && typeof mine[k] === 'number' && v > mine[k]) {
+                return violation(`[CAGE-GRANT-001] 参数 ${k}=${v} 超过了你自己的 ${mine[k]}`);
+            }
+        }
+        return ok();
+    },
+});
+/** 不能授出比自己更宽的数据范围 */
+export const noWiderScope = () => ({
+    name: 'noWiderScope',
+    check: (_role, ctx, input) => {
+        if (!input.combinator)
+            return ok();
+        const want = COMBINATOR_WIDTH[input.combinator] ?? 99;
+        return want <= ownWidth(ctx, input.aggregate) ? ok() : violation('[CAGE-GRANT-002] 不能授出比自己更宽的数据范围');
+    },
+});
+/** 分配角色也是授权：被分配角色里的每个能力点和范围，操作人自己都必须有 */
+export const noEscalationViaRoles = () => ({
+    name: 'noEscalationViaRoles',
+    check: async (user, ctx, input, meta) => {
+        const before = new Set(user.roleIds ?? []);
+        for (const rid of input.roleIds) {
+            if (before.has(rid))
+                continue;
+            const role = await meta.load('Role', rid);
+            if (!role)
+                continue; // 交给 handler 报 ROLE_NOT_FOUND
+            for (const c of role.capabilities ?? []) {
+                if (!ctx.capabilities.has(c.capability))
+                    return violation(`[CAGE-GRANT-001] 角色 ${role.code} 含有你没有的能力点 ${c.capability}`);
+            }
+            for (const s of role.scopes ?? []) {
+                if ((COMBINATOR_WIDTH[s.combinator] ?? 99) > ownWidth(ctx, s.aggregate)) {
+                    return violation(`[CAGE-GRANT-002] 角色 ${role.code} 在 ${s.aggregate} 上的范围比你更宽`);
+                }
+            }
+        }
+        return ok();
+    },
+});
+//# sourceMappingURL=constraints.js.map

package/dist/domain/constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../src/domain/constraints.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,gBAAgB,EAA8C,EAAE,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElH,SAAS,QAAQ,CAAC,GAAQ,EAAE,SAAiB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAoB,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,sBAAsB;AACtB,MAAM,CAAC,MAAM,eAAe,GAAG,GAAe,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,KAAK,CAAC,UAAU,UAAU,CAAC;CACnH,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,qBAAqB;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtG,CAAC;CACF,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAe,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAmB,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI;gBAAE,SAAS,CAAC,8BAA8B;YACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;oBAAE,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtF,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/domain/index.d.ts

@@ -0,0 +1 @@
+export { Dept, User, Role, createDept, updateDept, archiveDept, createUser, updateUser, assignRoles, disableUser, enableUser, setPassword, createRole, renameRole, grantCapability, revokeCapability, setScope, archiveRole, } from './org.js';

package/dist/domain/index.js

@@ -0,0 +1,5 @@
+// @yss123/cage-admin/domain：框架自带的组织模型声明。业务 domain 的 index.ts 里写一行
+//   export * from '@yss123/cage-admin/domain';
+// 抽取器、内核、HTTP 层就都能看到部门、用户、角色。
+export { Dept, User, Role, createDept, updateDept, archiveDept, createUser, updateUser, assignRoles, disableUser, enableUser, setPassword, createRole, renameRole, grantCapability, revokeCapability, setScope, archiveRole, } from './org.js';
+//# sourceMappingURL=index.js.map

package/dist/domain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,+CAA+C;AAC/C,8BAA8B;AAC9B,OAAO,EACL,IAAI,EAAE,IAAI,EAAE,IAAI,EAChB,UAAU,EAAE,UAAU,EAAE,WAAW,EACnC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EACzE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,GACjF,MAAM,UAAU,CAAC"}