@yss123/cage-admin 0.1.0 → 0.3.0

package/dist/domain/constraints.js

@@ -1,15 +1,33 @@
+/**
+ * 组织授权命令的硬约束集合，供 Role 和 User 命令声明复用。
+ * 检查在内核命令流水线中执行，拒绝通过 violation 返回给调用方；约束不直接改角色或用户。
+ * 各函数只实现下方明确条件：不能把能力存在性、参数比较和范围宽度检查混称为任意授权策略证明。
+ */
 // 授权类命令的内置硬约束：代码里不存在「管理员跳过检查」的分支，超级管理员也一样要过这些约束。
 import { COMBINATOR_WIDTH, ok, violation } from '@yss123/cage-kernel';
+/**
+ * 计算操作者在目标聚合上的最大范围宽度，用于后续宽度比较。
+ * 优先聚合专用授权，其次通配授权，再回退 self；返回宽度序号，不枚举实际可见记录。
+ */
 function ownWidth(ctx, aggregate) {
     const grants = ctx.scopes[aggregate] ?? ctx.scopes['*'] ?? [{ combinator: 'self' }];
     return Math.max(...grants.map((g) => COMBINATOR_WIDTH[g.combinator] ?? 0));
 }
 /** 只能授出能力目录里存在的能力点 */
+/**
+ * 构造目录存在性约束。check 使用内核提供的实时目录核对 input.capability，
+ * 未知能力返回 CAGE-GRANT-003；该检查不负责判断操作者是否拥有这个能力。
+ */
 export const knownCapability = () => ({
     name: 'knownCapability',
     check: (_role, _ctx, input, meta) => meta.catalog().includes(input.capability) ? ok() : violation(`[CAGE-GRANT-003] 能力点 ${input.capability} 不在能力目录里`),
 });
 /** 防提权：不能授出自己没有的能力点；数值参数（额度）不能超过自己的 */
+/**
+ * 构造直接授权的防提权约束：操作者必须已有目标能力。
+ * 输入与操作者参数在同一键上都为 number 时，新值不能更大；其他参数类型不在这里比较。
+ * 检查只返回结果，实际替换角色能力列表由 grantCapability handler 完成。
+ */
 export const noEscalation = () => ({
     name: 'noEscalation',
     check: (_role, ctx, input) => {
@@ -25,6 +43,10 @@ export const noEscalation = () => ({
     },
 });
 /** 不能授出比自己更宽的数据范围 */
+/**
+ * 构造范围宽度约束，阻止设置比操作者更宽的组合子。
+ * combinator 为空表示删除已有范围，允许继续；deptSet 的具体部门集合不由本函数逐项比较。
+ */
 export const noWiderScope = () => ({
     name: 'noWiderScope',
     check: (_role, ctx, input) => {
@@ -35,6 +57,11 @@ export const noWiderScope = () => ({
     },
 });
 /** 分配角色也是授权：被分配角色里的每个能力点和范围，操作人自己都必须有 */
+/**
+ * 构造新增角色分配的防提权约束。对本次新增角色加载其能力与范围，逐项核对操作者。
+ * 已有角色跳过重复检查；不存在的角色留给 handler 返回 ROLE_NOT_FOUND。
+ * 这里核对能力标识与范围宽度，不比较每个能力的数值参数，也不实际修改用户角色。
+ */
 export const noEscalationViaRoles = () => ({
     name: 'noEscalationViaRoles',
     check: async (user, ctx, input, meta) => {

package/dist/domain/constraints.js.map

@@ -1 +1 @@
-{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../src/domain/constraints.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,OAAO,EAAE,gBAAgB,EAA8C,EAAE,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElH,SAAS,QAAQ,CAAC,GAAQ,EAAE,SAAiB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAoB,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,sBAAsB;AACtB,MAAM,CAAC,MAAM,eAAe,GAAG,GAAe,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,KAAK,CAAC,UAAU,UAAU,CAAC;CACnH,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,qBAAqB;AACrB,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtG,CAAC;CACF,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAe,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAmB,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI;gBAAE,SAAS,CAAC,8BAA8B;YACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;oBAAE,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtF,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"constraints.js","sourceRoot":"","sources":["../../src/domain/constraints.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,iDAAiD;AACjD,OAAO,EAAE,gBAAgB,EAA8C,EAAE,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElH;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAQ,EAAE,SAAiB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAoB,EAAE,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,sBAAsB;AACtB;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAe,EAAE,CAAC,CAAC;IAChD,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,wBAAwB,KAAK,CAAC,UAAU,UAAU,CAAC;CACnH,CAAC,CAAC;AAEH,uCAAuC;AACvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAI,IAAI,CAAC,CAAC,CAAY,EAAE,CAAC;gBACpF,OAAO,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,qBAAqB;AACrB;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAe,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC;QACpE,OAAO,IAAI,IAAI,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtG,CAAC;CACF,CAAC,CAAC;AAEH,yCAAyC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAe,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAmB,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI;gBAAE,SAAS,CAAC,8BAA8B;YACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;oBAAE,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1H,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtF,OAAO,SAAS,CAAC,uBAAuB,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/domain/index.d.ts

@@ -1 +1,6 @@
+/**
+ * 向应用 domain 暴露可注册的组织聚合与命令。
+ * 这里仅组合声明，不执行初始化、不连接数据库；实际写入仍由内核按能力、范围和状态检查。
+ * 密码计算辅助函数没有作为领域声明重导出，避免把实现工具误当成可执行业务能力。
+ */
 export { Dept, User, Role, createDept, updateDept, archiveDept, createUser, updateUser, assignRoles, disableUser, enableUser, setPassword, createRole, renameRole, grantCapability, revokeCapability, setScope, archiveRole, } from './org.js';

package/dist/domain/index.js

@@ -1,3 +1,8 @@
+/**
+ * 向应用 domain 暴露可注册的组织聚合与命令。
+ * 这里仅组合声明，不执行初始化、不连接数据库；实际写入仍由内核按能力、范围和状态检查。
+ * 密码计算辅助函数没有作为领域声明重导出，避免把实现工具误当成可执行业务能力。
+ */
 // @yss123/cage-admin/domain：框架自带的组织模型声明。业务 domain 的 index.ts 里写一行
 //   export * from '@yss123/cage-admin/domain';
 // 抽取器、内核、HTTP 层就都能看到部门、用户、角色。

package/dist/domain/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,+CAA+C;AAC/C,8BAA8B;AAC9B,OAAO,EACL,IAAI,EAAE,IAAI,EAAE,IAAI,EAChB,UAAU,EAAE,UAAU,EAAE,WAAW,EACnC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EACzE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,GACjF,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/domain/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,kEAAkE;AAClE,+CAA+C;AAC/C,8BAA8B;AAC9B,OAAO,EACL,IAAI,EAAE,IAAI,EAAE,IAAI,EAChB,UAAU,EAAE,UAAU,EAAE,WAAW,EACnC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EACzE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,GACjF,MAAM,UAAU,CAAC"}