create-bubbles 0.1.26 → 0.1.27

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/accounts/accounts.service.ts

@@ -0,0 +1,154 @@
+import { Injectable } from '@nestjs/common'
+import { and, count, desc, eq, inArray } from 'drizzle-orm'
+import { roles, userRoles, users } from '@/database/schema'
+import { AccessService, type AccessActor } from '@/modules/access/access.service'
+import { MembersService } from '@/modules/members/members.service'
+import { SessionStoreService } from '@/modules/auth/session/session-store.service'
+import {
+  pageWindow,
+  requireFound,
+  scopeFilter,
+  searchSql,
+  type AccessDb,
+} from '@/modules/access/access.store'
+import type { AccountPageQuery, AccountRecord } from 'shared/types'
+import { toTimestampRecord } from 'shared/utils'
+
+@Injectable()
+export class AccountsService {
+  constructor(
+    private readonly access: AccessService,
+    private readonly members: MembersService,
+    private readonly sessions: SessionStoreService,
+  ) {}
+  /** 读取账号的公开资料和平台角色标识，并将时间字段转换为接口时间字符串。 */
+  async accountRecord(db: AccessDb, userId: string): Promise<AccountRecord> {
+    const [user] = await db
+      .select({
+        id: users.id,
+        name: users.name,
+        account: users.account,
+        status: users.status,
+        createdAt: users.createdAt,
+        updatedAt: users.updatedAt,
+      })
+      .from(users)
+      .where(eq(users.id, userId))
+    const found = requireFound(user)
+    return {
+      ...toTimestampRecord(found),
+      platformRoleIds: (await this.access.roleAssignments(db, { type: 'platform' }, userId)).map(
+        (r) => r.role.id,
+      ),
+    }
+  }
+  /** 在平台账号读取权限下，按状态、姓名或账号分页查询账号及其平台角色。 */
+  accounts(input: { actor: AccessActor; query: AccountPageQuery }) {
+    return this.access.read(
+      { actor: input.actor, scope: { type: 'platform' }, permission: 'platform.accounts.read' },
+      /** 分页读取账号并批量聚合平台角色，避免对每个账号重复查询角色。 */
+      async (tx) => {
+        const { page, pageSize, offset } = pageWindow(input.query)
+        const condition = and(
+          input.query.status ? eq(users.status, input.query.status) : undefined,
+          searchSql([users.name, users.account], input.query.query),
+        )
+        const [total] = await tx.select({ value: count() }).from(users).where(condition)
+        const rows = await tx
+          .select({
+            id: users.id,
+            name: users.name,
+            account: users.account,
+            status: users.status,
+            createdAt: users.createdAt,
+            updatedAt: users.updatedAt,
+          })
+          .from(users)
+          .where(condition)
+          .orderBy(desc(users.createdAt), desc(users.id))
+          .limit(pageSize)
+          .offset(offset)
+        const assignments = rows.length
+          ? await tx
+              .select({ userId: userRoles.userId, roleId: userRoles.roleId })
+              .from(userRoles)
+              .innerJoin(roles, eq(roles.id, userRoles.roleId))
+              .where(
+                and(
+                  scopeFilter({ type: 'platform' }),
+                  inArray(
+                    userRoles.userId,
+                    rows.map((r) => r.id),
+                  ),
+                ),
+              )
+          : []
+        return {
+          page,
+          pageSize,
+          total: total!.value,
+          items: rows.map((row) => ({
+            ...toTimestampRecord(row),
+            platformRoleIds: assignments.filter((a) => a.userId === row.id).map((a) => a.roleId),
+          })),
+        }
+      },
+    )
+  }
+  /**
+   * 在用户行锁与权限写锁保护下修改账号状态或平台角色，并验证最后一位管理员仍然有效。
+   *
+   * 成功校验并写入审计后，停用账号还会撤销其全部会话；数据库异常交由事务回滚。
+   * @returns 更新后的账号资料及平台角色。
+   */
+  accountChange(input: {
+    actor: AccessActor
+    userId: string
+    body: { status: 'active' | 'disabled' } | { roleIds: string[] }
+  }) {
+    return this.access.write(
+      {
+        actor: input.actor,
+        scope: { type: 'platform' },
+        permission: 'status' in input.body ? 'platform.accounts.status' : 'platform.accounts.roles',
+      },
+      /** 锁定目标用户行后更新账号或角色，管理员保护和审计通过后才撤销停用账号的会话。 */
+      async (tx, access) => {
+        const [user] = await tx.select().from(users).where(eq(users.id, input.userId)).for('update')
+        requireFound(user)
+        if ('status' in input.body) {
+          const options = { userId: input.userId, platformOnly: !!access.administrator }
+          const previous = (await this.access.effectiveAdministratorScopes(tx, options)).effective
+          await tx
+            .update(users)
+            .set({ status: input.body.status, updatedAt: new Date() })
+            .where(eq(users.id, input.userId))
+          await this.access.assertAdministrators(tx, { ...options, previous })
+        } else {
+          await this.members.validateRoleAssignment(tx, {
+            access,
+            userId: input.userId,
+            roleIds: input.body.roleIds,
+          })
+          await this.access.assertAdministrators(tx, { platformOnly: true })
+        }
+        await this.access.audit(tx, {
+          actor: input.actor,
+          access,
+          action: 'status' in input.body ? 'account.status' : 'account.roles',
+          objectType: 'account',
+          objectId: input.userId,
+          summary:
+            'status' in input.body
+              ? { fromStatus: user!.status, toStatus: input.body.status }
+              : { roleIds: input.body.roleIds },
+        })
+        const result = await this.accountRecord(tx, input.userId)
+        // 保持用户行排他锁；业务校验与审计成功后再撤销会话，避免拒绝操作产生注销副作用。
+        if ('status' in input.body && input.body.status === 'disabled')
+          await this.sessions.revokeAllForUser(input.userId)
+        return result
+      },
+    )
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/accounts/accounts.validation.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod'
+import { pageSchema, roleIdsSchema } from '@/modules/access/access.validation'
+
+export const listSchema = pageSchema.extend({
+  status: z.enum(['active', 'disabled', 'locked']).optional(),
+})
+export const accountStatusSchema = z.strictObject({ status: z.enum(['active', 'disabled']) })
+export const platformRolesSchema = z.strictObject({ roleIds: roleIdsSchema })

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/accounts/password-reset/password-reset.service.ts

@@ -0,0 +1,81 @@
+import { AppException } from '@/common/exceptions/app.exception'
+import { users } from '@/database/schema'
+import { ACCESS_ERRORS } from '@/modules/access/access.errors'
+import { AccessService, type AccessActor } from '@/modules/access/access.service'
+import { PasswordService } from '@/modules/auth/password.service'
+import { AUTH_ERRORS } from '@/modules/auth/auth.errors'
+import { SessionStoreService } from '@/modules/auth/session/session-store.service'
+import { Injectable } from '@nestjs/common'
+import { eq } from 'drizzle-orm'
+import type { ResetAccountPasswordRequest, ResetAccountPasswordResult } from 'shared/types'
+
+interface ResetPasswordInput {
+  actor: AccessActor
+  userId: string
+  body: ResetAccountPasswordRequest
+  onTargetResolved?: (targetUserId: string) => void
+}
+
+@Injectable()
+export class AccountPasswordResetService {
+  constructor(
+    private readonly access: AccessService,
+    private readonly passwords: PasswordService,
+    private readonly sessions: SessionStoreService,
+  ) {}
+
+  /**
+   * 在平台写事务中复核内置管理员、排除本人，更新目标摘要并撤销目标全部会话。
+   * 撤销失败时密码与成功审计均回滚，目标状态和成员关系保持原样。
+   */
+  async resetPassword(input: ResetPasswordInput): Promise<ResetAccountPasswordResult> {
+    try {
+      return await this.access.write(
+        {
+          actor: input.actor,
+          scope: { type: 'platform' },
+          permission: 'platform.accounts.reset-password',
+          adminOnly: true,
+        },
+        async (tx, access) => {
+          if (access.administrator !== 'platform' || input.userId === input.actor.userId) {
+            throw new AppException(ACCESS_ERRORS.FORBIDDEN)
+          }
+
+          const [user] = await tx
+            .select({ id: users.id })
+            .from(users)
+            .where(eq(users.id, input.userId))
+            .for('update')
+          if (!user) throw new AppException(ACCESS_ERRORS.NOT_FOUND)
+          input.onTargetResolved?.(user.id)
+
+          let passwordHash: string
+          try {
+            passwordHash = await this.passwords.hash(input.body.newPassword)
+          } catch {
+            throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE)
+          }
+          await tx
+            .update(users)
+            .set({ passwordHash, updatedAt: new Date() })
+            .where(eq(users.id, input.userId))
+          await this.access.audit(tx, {
+            actor: input.actor,
+            access,
+            action: 'account.password.reset',
+            objectType: 'account',
+            objectId: input.userId,
+            summary: { result: 'success' },
+          })
+          await this.sessions.revokeAllForUser(input.userId)
+          return { passwordReset: true }
+        },
+      )
+    } catch (cause: unknown) {
+      if (cause instanceof AppException) throw cause
+      // 事务开启、SQL 写入、审计写入或提交失败均属于本操作必需的认证存储故障。
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE)
+    }
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/accounts/password-reset/reset-password.validation.ts

@@ -0,0 +1,13 @@
+import type { ResetAccountPasswordRequest } from 'shared/types'
+import { z } from 'zod'
+
+/** 平台重置密码的服务端校验，不修改密码输入原值。 */
+export const resetAccountPasswordSchema = z
+  .object({
+    newPassword: z.string().min(8).max(16),
+    confirmPassword: z.string(),
+  })
+  .refine((input) => input.newPassword === input.confirmPassword, {
+    path: ['confirmPassword'],
+    message: '两次密码不一致',
+  }) satisfies z.ZodType<ResetAccountPasswordRequest>

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/administrators/administrators.service.ts

@@ -0,0 +1,116 @@
+import { Injectable } from '@nestjs/common'
+import { and, eq, inArray, sql } from 'drizzle-orm'
+import { roles, userRoles, users } from '@/database/schema'
+import { AppException } from '@/common/exceptions/app.exception'
+import { AccessService } from '@/modules/access/access.service'
+import { AccessSeedService } from '@/modules/access/seed/access-seed.service'
+import { ACCESS_ERRORS } from '@/modules/access/access.errors'
+import {
+  requireFound,
+  scopeFilter,
+  type AccessDb,
+  type AccessTx,
+} from '@/modules/access/access.store'
+import { MembersService } from '@/modules/members/members.service'
+import type { AccessScope, AdministratorSummary, SetAdministratorRequest } from 'shared/types'
+
+@Injectable()
+export class AdministratorsService {
+  constructor(
+    private readonly access: AccessService,
+    private readonly members: MembersService,
+    private readonly seed: AccessSeedService,
+  ) {}
+
+  /**
+   * 列出公司或项目直接分配的管理员，附带账号状态、成员状态和当前身份是否有效。
+   *
+   * 没有对应成员关系的角色分配会被忽略，继承的公司管理员不在项目直接分配列表中。
+   */
+  async administrators(db: AccessDb, scope: AccessScope): Promise<AdministratorSummary[]> {
+    const assignments = await db
+      .select({
+        user: { id: users.id, name: users.name, account: users.account, status: users.status },
+      })
+      .from(roles)
+      .innerJoin(userRoles, eq(userRoles.roleId, roles.id))
+      .innerJoin(users, eq(users.id, userRoles.userId))
+      .where(and(scopeFilter(scope), eq(roles.builtin, 'administrator')))
+    const result: AdministratorSummary[] = []
+    for (const { user } of assignments) {
+      const table = this.members.table(scope)
+      const [member] = await db
+        .select()
+        .from(table)
+        .where(and(this.members.filter(scope), eq(table.userId, user.id)))
+      if (!member) continue
+      result.push({
+        id: user.id,
+        name: user.name,
+        account: user.account,
+        accountStatus: user.status,
+        memberStatus: member.status,
+        effective: await this.access.isAdministrator(db, scope, user.id),
+      })
+    }
+    return result
+  }
+
+  /** 在现有事务中补齐内置角色和有效成员关系，并幂等授予指定用户管理员角色。 */
+  async initialize(tx: AccessTx, scope: AccessScope, userId: string) {
+    const builtins = await this.seed.ensureRoles(tx, scope)
+    await this.members.ensureMember(tx, scope, userId)
+    await tx
+      .insert(userRoles)
+      .values({
+        userId,
+        roleId: builtins.find((role) => role.builtin === 'administrator')!.id,
+      })
+      .onConflictDoNothing()
+  }
+
+  /**
+   * 验证新管理员 userId 并保证成员关系有效，授予管理员角色后按需撤销旧管理员角色。
+   *
+   * 新旧成员版本都会递增；调用方负责作用域鉴权、审计记录及事务提交。
+   * @returns 新管理员对应的用户记录。
+   */
+  async assign(tx: AccessTx, input: { scope: AccessScope; body: SetAdministratorRequest }) {
+    const { scope, body } = input
+    const user = await this.members.userForAdministrator(tx, {
+      userId: body.administratorUserId,
+      companyId: scope.type === 'project' ? scope.companyId : undefined,
+    })
+    const builtins = await this.seed.ensureRoles(tx, scope)
+    const role = builtins.find((item) => item.builtin === 'administrator')!
+    if (body.replaceUserId) {
+      if (user.id === body.replaceUserId)
+        throw new AppException(ACCESS_ERRORS.INVALID_MEMBER_RELATION)
+      const [old] = await tx
+        .select()
+        .from(userRoles)
+        .where(and(eq(userRoles.roleId, role.id), eq(userRoles.userId, body.replaceUserId)))
+      requireFound(old)
+    }
+    await this.members.ensureMember(tx, scope, user.id)
+    await tx.insert(userRoles).values({ userId: user.id, roleId: role.id }).onConflictDoNothing()
+    if (body.replaceUserId)
+      await tx
+        .delete(userRoles)
+        .where(and(eq(userRoles.userId, body.replaceUserId), eq(userRoles.roleId, role.id)))
+    const memberTable = this.members.table(scope)
+    await tx
+      .update(memberTable)
+      .set({ version: sql`${memberTable.version} + 1`, updatedAt: new Date() })
+      .where(
+        and(
+          this.members.filter(scope),
+          inArray(memberTable.userId, [
+            user.id,
+            ...(body.replaceUserId ? [body.replaceUserId] : []),
+          ]),
+        ),
+      )
+    return user
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/administrators/administrators.validation.ts

@@ -0,0 +1 @@
+export { setAdministratorSchema as administratorSchema } from 'shared/utils'

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/invitations/company-member-invitations.controller.ts

@@ -0,0 +1,69 @@
+import { Body, Controller, Get, HttpCode, HttpStatus, Post, Query, Req } from '@nestjs/common'
+import type { FastifyRequest } from 'fastify'
+import { AccessPolicy } from '@/common/decorators/access-policy.decorator'
+import { actor, ids } from '@/modules/access/access-http'
+import { parse } from '@/modules/access/access.validation'
+import { MemberInvitationsService } from './member-invitations.service'
+import {
+  companyMemberInvitationQuerySchema,
+  createCompanyMemberInvitationSchema,
+  resendCompanyMemberInvitationSchema,
+  revokeCompanyMemberInvitationSchema,
+} from './member-invitations.validation'
+
+@Controller('companies/:companyId/member-invitations')
+export class CompanyMemberInvitationsController {
+  constructor(private readonly invitations: MemberInvitationsService) {}
+
+  /** 分页查询当前企业邀请，过期状态按查询时刻派生且不会返回任何 token 信息。 */
+  @Get()
+  @AccessPolicy({ scope: 'company', permission: 'company.members.add' })
+  list(@Req() request: FastifyRequest, @Query() query: unknown) {
+    const { companyId } = ids(request)
+    return this.invitations.list({
+      actor: actor(request),
+      scope: { type: 'company', companyId: companyId! },
+      query: parse(companyMemberInvitationQuerySchema, query),
+    })
+  }
+
+  /** 创建 7 天有效的一次性邀请，原始 token 只在本次响应返回。 */
+  @Post()
+  @AccessPolicy({ scope: 'company', permission: 'company.members.add' })
+  create(@Req() request: FastifyRequest, @Body() body: unknown) {
+    const { companyId } = ids(request)
+    return this.invitations.create({
+      actor: actor(request),
+      scope: { type: 'company', companyId: companyId! },
+      body: parse(createCompanyMemberInvitationSchema, body),
+    })
+  }
+
+  /** 撤销邀请并使其 token 永久不可接受。 */
+  @Post(':invitationId/revoke')
+  @HttpCode(HttpStatus.OK)
+  @AccessPolicy({ scope: 'company', permission: 'company.members.add' })
+  revoke(@Req() request: FastifyRequest, @Body() body: unknown) {
+    const { companyId, invitationId } = ids(request)
+    return this.invitations.revoke({
+      actor: actor(request),
+      scope: { type: 'company', companyId: companyId! },
+      invitationId: invitationId!,
+      body: parse(revokeCompanyMemberInvitationSchema, body),
+    })
+  }
+
+  /** 轮换邀请 token 并从重发时刻重新计算 7 天有效期。 */
+  @Post(':invitationId/resend')
+  @HttpCode(HttpStatus.OK)
+  @AccessPolicy({ scope: 'company', permission: 'company.members.add' })
+  resend(@Req() request: FastifyRequest, @Body() body: unknown) {
+    const { companyId, invitationId } = ids(request)
+    return this.invitations.resend({
+      actor: actor(request),
+      scope: { type: 'company', companyId: companyId! },
+      invitationId: invitationId!,
+      body: parse(resendCompanyMemberInvitationSchema, body),
+    })
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/members/invitations/member-invitation-acceptance.controller.ts

@@ -0,0 +1,23 @@
+import { Body, Controller, HttpCode, HttpStatus, Post, Req } from '@nestjs/common'
+import type { FastifyRequest } from 'fastify'
+import { Authenticated } from '@/common/decorators/access-policy.decorator'
+import { actor } from '@/modules/access/access-http'
+import { parse } from '@/modules/access/access.validation'
+import { MemberInvitationsService } from './member-invitations.service'
+import { acceptCompanyMemberInvitationSchema } from './member-invitations.validation'
+
+@Controller('company-member-invitations')
+export class MemberInvitationAcceptanceController {
+  constructor(private readonly invitations: MemberInvitationsService) {}
+
+  /** 由当前登录账号接受一次性邀请，并在成功后建立企业成员及默认角色。 */
+  @Post('accept')
+  @HttpCode(HttpStatus.OK)
+  @Authenticated()
+  accept(@Req() request: FastifyRequest, @Body() body: unknown) {
+    return this.invitations.accept({
+      actor: actor(request),
+      body: parse(acceptCompanyMemberInvitationSchema, body),
+    })
+  }
+}