create-fullstack-scaffold 0.1.0

package/template/src/server/module-permission/__tests__/role-routes.test.ts

@@ -0,0 +1,215 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import { createTestClient } from '@server/test-utils/test-client'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+
+describe('Role Routes', () => {
+  const authHeaders = { Authorization: 'Bearer test-super-admin-1' }
+
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  describe('GET /api/roles', () => {
+    it('should get all roles', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles.$get({ headers: authHeaders })
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(Array.isArray(data.data)).toBe(true)
+        expect(data.data.length).toBeGreaterThan(0)
+      }
+    })
+
+    it('should return roles with correct structure', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles.$get({ headers: authHeaders })
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      if (data.success && data.data.length > 0) {
+        const firstRole = data.data[0]
+        expect(firstRole).toHaveProperty('id')
+        expect(firstRole).toHaveProperty('code')
+        expect(firstRole).toHaveProperty('name')
+        expect(firstRole).toHaveProperty('label')
+        expect(firstRole).toHaveProperty('isSystem')
+      }
+    })
+  })
+
+  describe('GET /api/roles/:id', () => {
+    it('should get role by id', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$get(
+        {
+          param: { id: 'role_super_admin' },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data.id).toBe('role_super_admin')
+        expect(data.data.code).toBe('super_admin')
+      }
+    })
+
+    it('should return 404 for non-existent role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$get(
+        {
+          param: { id: 'non-existent-role' },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(404)
+    })
+  })
+
+  describe('POST /api/roles', () => {
+    it('should create a new role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles.$post(
+        {
+          json: {
+            code: 'test_role',
+            name: 'Test Role',
+            label: 'Test Role',
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data.code).toBe('test_role')
+        expect(data.data.name).toBe('Test Role')
+      }
+    })
+  })
+
+  describe('PUT /api/roles/:id', () => {
+    it('should update role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$put(
+        {
+          param: { id: 'role_user' },
+          json: {
+            name: 'Updated User',
+            label: 'Updated User',
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      expect(data.success).toBe(true)
+      if (data.success) {
+        expect(data.data.name).toBe('Updated User')
+      }
+    })
+
+    it('should return 404 for non-existent role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$put(
+        {
+          param: { id: 'non-existent-role' },
+          json: {
+            name: 'Updated Name',
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(404)
+    })
+  })
+
+  describe('DELETE /api/roles/:id', () => {
+    it('should not delete system role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$delete(
+        {
+          param: { id: 'role_super_admin' },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 404 for non-existent role', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].$delete(
+        {
+          param: { id: 'non-existent-role' },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(400)
+    })
+  })
+
+  describe('PUT /api/roles/:id/permissions', () => {
+    it('should update role permissions', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].permissions.$put(
+        {
+          param: { id: 'role_user' },
+          json: {
+            permissionIds: ['perm_user_view', 'perm_content_view'],
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(200)
+
+      const data = await res.json()
+      expect(data.success).toBe(true)
+    })
+
+    it('should not modify super admin permissions', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].permissions.$put(
+        {
+          param: { id: 'role_super_admin' },
+          json: {
+            permissionIds: ['perm_user_view'],
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(403)
+
+      const data = await res.json()
+      expect(data.success).toBe(false)
+      if (!data.success) {
+        expect(data.error).toBe('Cannot modify super admin permissions')
+      }
+    })
+
+    it('should return 404 for non-existent role when updating permissions', async () => {
+      const client = createTestClient(undefined, { headers: authHeaders })
+      const res = await client.api.roles[':id'].permissions.$put(
+        {
+          param: { id: 'non-existent-role' },
+          json: {
+            permissionIds: ['perm_user_view'],
+          },
+        },
+        { headers: authHeaders }
+      )
+      expect(res.status).toBe(404)
+    })
+  })
+})

package/template/src/server/module-permission/module.ts

@@ -0,0 +1,68 @@
+import type { ModuleManifest } from '@shared/core/module-manifest'
+
+const permissionManifest: ModuleManifest = {
+  name: 'permission',
+  description: 'Role-based access control, permission management, and audit logging',
+  category: 'system',
+  dependsOn: [],
+
+  routes: {
+    admin: [
+      {
+        importPath: './routes/permission-routes',
+        exportName: 'permissionRoutes',
+      },
+      {
+        importPath: './routes/role-routes',
+        exportName: 'roleRoutes',
+      },
+      {
+        importPath: './routes/audit-log-routes',
+        exportName: 'auditLogRoutes',
+      },
+    ],
+  },
+
+  sharedSchemas: {
+    path: 'permission',
+    additionalPaths: ['role', 'audit'],
+  },
+
+  adminPages: [
+    {
+      name: 'PermissionsPage',
+      route: '/system/permissions',
+      requiredPermission: 'SYSTEM_MANAGE_PERMISSIONS',
+    },
+    { name: 'RolesPage', route: '/system/roles', requiredPermission: 'ROLE_MANAGE' },
+    { name: 'SystemLogsPage', route: '/system/logs' },
+  ],
+
+  dbSchemas: {
+    files: [
+      'permissions',
+      'roles',
+      'role-permissions',
+      'user-roles',
+      'permission-audit-logs',
+      'permission-route-mappings',
+      'api-endpoints',
+    ],
+    hasSeed: false,
+  },
+
+  providesMiddleware: [
+    {
+      name: 'permission',
+      importPath: './middleware/permission',
+      appliesTo: 'all-api',
+    },
+    {
+      name: 'audit-log',
+      importPath: './middleware/audit-log',
+      appliesTo: 'all-api',
+    },
+  ],
+}
+
+export default permissionManifest

package/template/src/server/module-permission/routes/audit-log-routes.ts

@@ -0,0 +1,76 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import { z } from '@hono/zod-openapi'
+import { authMiddleware } from '@server/middleware/auth'
+import { auditLogService } from '../services/audit-log-service'
+import { successResponse, errorResponse, success } from '@server/utils/route-helpers'
+import { AuditLogSchema, ResourceTypeSchema, ActionTypeSchema } from '@shared/modules/audit'
+
+const getAuditLogsRoute = createRoute({
+  method: 'get',
+  path: '/audit-logs',
+  tags: ['audit-logs'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware()],
+  request: {
+    query: z.object({
+      limit: z.string().optional(),
+      offset: z.string().optional(),
+      userId: z.string().optional(),
+      action: ActionTypeSchema.optional(),
+      resourceType: ResourceTypeSchema.optional(),
+    }),
+  },
+  responses: {
+    200: successResponse(AuditLogSchema.array(), 'Get audit logs'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+const getAuditLogRoute = createRoute({
+  method: 'get',
+  path: '/audit-logs/:id',
+  tags: ['audit-logs'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware()],
+  request: {
+    params: z.object({
+      id: z.string(),
+    }),
+  },
+  responses: {
+    200: successResponse(AuditLogSchema, 'Get audit log by ID'),
+    404: errorResponse('Audit log not found'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+export const auditLogRoutes = new OpenAPIHono()
+  .openapi(getAuditLogsRoute, async c => {
+    const query = c.req.valid('query')
+    const limit = query.limit ? parseInt(query.limit) : 50
+    const offset = query.offset ? parseInt(query.offset) : 0
+
+    if (query.userId || query.action || query.resourceType) {
+      const logs = await auditLogService.search({
+        userId: query.userId,
+        action: query.action,
+        resourceType: query.resourceType,
+      })
+      return c.json(success(logs.slice(offset, offset + limit)), 200)
+    }
+
+    const logs = await auditLogService.getAll(limit, offset)
+    return c.json(success(logs), 200)
+  })
+  .openapi(getAuditLogRoute, async c => {
+    const { id } = c.req.valid('param')
+    const logs = await auditLogService.getAll(1000, 0)
+    const log = logs.find(l => l.id === id)
+
+    if (!log) {
+      return c.json({ success: false as const, error: 'Audit log not found' }, 404)
+    }
+
+    return c.json(success(log), 200)
+  })

package/template/src/server/module-permission/routes/permission-routes.ts

@@ -0,0 +1,184 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import { authMiddleware } from '@server/middleware/auth'
+import { getAuthUser } from '@server/utils/auth'
+import { permissionService } from '../services/permission-service-impl'
+import { successResponse, errorResponse, success } from '@server/utils/route-helpers'
+import {
+  RoleInfoSchema,
+  PermissionInfoSchema,
+  UserPermissionsSchema,
+  MenuConfigSchema,
+  PagePermissionsSchema,
+  PermissionCategoriesSchema,
+  RoleLabelsSchema,
+  PermissionLabelsSchema,
+  Permission,
+  PermissionInitSchema,
+} from '@shared/modules/permission'
+import * as permissionServiceOld from '../services/permission-service'
+
+const getRolesRoute = createRoute({
+  method: 'get',
+  path: '/permissions/roles',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(RoleInfoSchema.array(), 'Get all roles'),
+  },
+})
+
+const getPermissionsRoute = createRoute({
+  method: 'get',
+  path: '/permissions',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(PermissionInfoSchema.array(), 'Get all permissions'),
+  },
+})
+
+const getUserPermissionsRoute = createRoute({
+  method: 'get',
+  path: '/permissions/me',
+  tags: ['permissions'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware()],
+  responses: {
+    200: successResponse(UserPermissionsSchema, 'Get current user permissions'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+const getMenuConfigRoute = createRoute({
+  method: 'get',
+  path: '/permissions/menu-config',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(MenuConfigSchema, 'Get menu configuration'),
+  },
+})
+
+const getPagePermissionsRoute = createRoute({
+  method: 'get',
+  path: '/permissions/page-permissions',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(PagePermissionsSchema, 'Get page permissions configuration'),
+  },
+})
+
+const getPermissionCategoriesRoute = createRoute({
+  method: 'get',
+  path: '/permissions/categories',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(PermissionCategoriesSchema, 'Get permission categories'),
+  },
+})
+
+const getRoleLabelsRoute = createRoute({
+  method: 'get',
+  path: '/permissions/role-labels',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(RoleLabelsSchema, 'Get role labels'),
+  },
+})
+
+const getPermissionLabelsRoute = createRoute({
+  method: 'get',
+  path: '/permissions/permission-labels',
+  tags: ['permissions'],
+  responses: {
+    200: successResponse(PermissionLabelsSchema, 'Get permission labels'),
+  },
+})
+
+const getMyMenuRoute = createRoute({
+  method: 'get',
+  path: '/permissions/my-menu',
+  tags: ['permissions'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware()],
+  responses: {
+    200: successResponse(MenuConfigSchema, 'Get user menu configuration'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+const getPermissionInitRoute = createRoute({
+  method: 'get',
+  path: '/permissions/init',
+  tags: ['permissions'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware()],
+  responses: {
+    200: successResponse(PermissionInitSchema, 'Get permission initialization data'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+export const permissionRoutes = new OpenAPIHono()
+  .openapi(getRolesRoute, async c => {
+    const roles = await permissionService.getAllRoles()
+    return c.json(success(roles), 200)
+  })
+  .openapi(getPermissionsRoute, async c => {
+    const permissions = await permissionService.getAllPermissions()
+    return c.json(success(permissions), 200)
+  })
+  .openapi(getUserPermissionsRoute, async c => {
+    const user = getAuthUser(c)
+    const userPermissions = await permissionService.getUserPermissions(user.id, user.role)
+    const permissionCodes = userPermissions.map(p => p.code) as Permission[]
+    return c.json(
+      success({
+        userId: user.id,
+        role: user.role,
+        permissions: permissionCodes,
+      }),
+      200
+    )
+  })
+  .openapi(getMenuConfigRoute, async c => {
+    const menuConfig = permissionServiceOld.getMenuConfig()
+    return c.json(success(menuConfig), 200)
+  })
+  .openapi(getPagePermissionsRoute, async c => {
+    const pagePermissions = permissionServiceOld.getPagePermissions()
+    return c.json(success(pagePermissions), 200)
+  })
+  .openapi(getPermissionCategoriesRoute, async c => {
+    const categories = permissionServiceOld.getPermissionCategories()
+    return c.json(success(categories), 200)
+  })
+  .openapi(getRoleLabelsRoute, async c => {
+    const labels = permissionServiceOld.getRoleLabels()
+    return c.json(success(labels), 200)
+  })
+  .openapi(getPermissionLabelsRoute, async c => {
+    const labels = permissionServiceOld.getPermissionLabels()
+    return c.json(success(labels), 200)
+  })
+  .openapi(getMyMenuRoute, async c => {
+    const user = getAuthUser(c)
+    const menuConfig = await permissionService.getUserMenuConfig(user.id, user.role)
+    return c.json(success(menuConfig), 200)
+  })
+  .openapi(getPermissionInitRoute, async c => {
+    const user = getAuthUser(c)
+    const [userPermissions, menuConfig, pagePermissions] = await Promise.all([
+      permissionService.getUserPermissions(user.id, user.role),
+      permissionService.getUserMenuConfig(user.id, user.role),
+      permissionService.getUserPagePermissions(user.id, user.role),
+    ])
+    const permissionCodes = userPermissions.map(p => p.code) as Permission[]
+    return c.json(
+      success({
+        permissions: permissionCodes,
+        menuConfig,
+        pagePermissions,
+        role: user.role,
+      }),
+      200
+    )
+  })