create-fullstack-scaffold 0.1.0

package/template/src/server/module-permission/routes/role-routes.ts

@@ -0,0 +1,263 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import { z } from '@hono/zod-openapi'
+import { authMiddleware } from '@server/middleware/auth'
+import { Role } from '@shared/modules/permission'
+import { roleService } from '../services/role-service'
+import { permissionService } from '../services/permission-service-impl'
+import { successResponse, errorResponse, success } from '@server/utils/route-helpers'
+import {
+  RoleSchema,
+  CreateRoleSchema,
+  UpdateRoleSchema,
+  UpdateRolePermissionsSchema,
+  SuccessSchema,
+} from '@shared/modules/role/schemas'
+import { validatePermissionDependencies } from '@shared/modules/permission/permission-dependencies'
+
+const RoleWithPermissionsSchema = RoleSchema.extend({
+  permissions: z.array(z.string()),
+})
+
+const getRolesRoute = createRoute({
+  method: 'get',
+  path: '/roles',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  responses: {
+    200: successResponse(RoleSchema.array(), 'Get all roles'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+  },
+})
+
+const getRoleRoute = createRoute({
+  method: 'get',
+  path: '/roles/:id',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  request: {
+    params: z.object({
+      id: z.string(),
+    }),
+  },
+  responses: {
+    200: successResponse(RoleWithPermissionsSchema, 'Get role by ID'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Role not found'),
+  },
+})
+
+const createRoleRoute = createRoute({
+  method: 'post',
+  path: '/roles',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  request: {
+    body: {
+      content: {
+        'application/json': {
+          schema: CreateRoleSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    200: successResponse(RoleSchema, 'Role created'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    400: errorResponse('Invalid request'),
+  },
+})
+
+const updateRoleRoute = createRoute({
+  method: 'put',
+  path: '/roles/:id',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  request: {
+    params: z.object({
+      id: z.string(),
+    }),
+    body: {
+      content: {
+        'application/json': {
+          schema: UpdateRoleSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    200: successResponse(RoleSchema, 'Role updated'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Role not found'),
+  },
+})
+
+const deleteRoleRoute = createRoute({
+  method: 'delete',
+  path: '/roles/:id',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  request: {
+    params: z.object({
+      id: z.string(),
+    }),
+  },
+  responses: {
+    200: successResponse(SuccessSchema, 'Role deleted'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    400: errorResponse('Cannot delete system role'),
+  },
+})
+
+const updateRolePermissionsRoute = createRoute({
+  method: 'put',
+  path: '/roles/:id/permissions',
+  tags: ['roles'],
+  security: [{ Bearer: [] }],
+  middleware: [authMiddleware({ requiredRole: Role.SUPER_ADMIN })],
+  request: {
+    params: z.object({
+      id: z.string(),
+    }),
+    body: {
+      content: {
+        'application/json': {
+          schema: UpdateRolePermissionsSchema,
+        },
+      },
+    },
+  },
+  responses: {
+    200: successResponse(SuccessSchema, 'Role permissions updated'),
+    400: errorResponse('Permission dependency validation failed'),
+    401: errorResponse('Unauthorized'),
+    403: errorResponse('Forbidden'),
+    404: errorResponse('Role not found'),
+  },
+})
+
+export const roleRoutes = new OpenAPIHono()
+  .openapi(getRolesRoute, async c => {
+    const roles = await roleService.getAll()
+    return c.json(success(roles), 200)
+  })
+  .openapi(getRoleRoute, async c => {
+    const { id } = c.req.valid('param')
+    const role = await roleService.getById(id)
+
+    if (!role) {
+      return c.json({ success: false as const, error: 'Role not found' }, 404)
+    }
+
+    const permissions = await permissionService.getRolePermissions(id)
+
+    return c.json(
+      success({
+        ...role,
+        permissions: permissions.map(p => p.code),
+      }),
+      200
+    )
+  })
+  .openapi(createRoleRoute, async c => {
+    const data = c.req.valid('json')
+    const role = await roleService.create({
+      id: `role_${Date.now()}`,
+      ...data,
+      sortOrder: data.sortOrder ?? 0,
+    })
+
+    return c.json(success(role), 200)
+  })
+  .openapi(updateRoleRoute, async c => {
+    const { id } = c.req.valid('param')
+    const data = c.req.valid('json')
+
+    const filteredData = Object.fromEntries(
+      Object.entries(data).filter(([_, v]) => v !== null && v !== undefined)
+    )
+
+    const role = await roleService.update(id, filteredData)
+
+    if (!role) {
+      return c.json({ success: false as const, error: 'Role not found' }, 404)
+    }
+
+    return c.json(success(role), 200)
+  })
+  .openapi(deleteRoleRoute, async c => {
+    const { id } = c.req.valid('param')
+
+    const deleted = await roleService.delete(id)
+
+    if (!deleted) {
+      return c.json(
+        { success: false as const, error: 'Cannot delete system role or role not found' },
+        400
+      )
+    }
+
+    return c.json(success({}), 200)
+  })
+  .openapi(updateRolePermissionsRoute, async c => {
+    const { id } = c.req.valid('param')
+    const { permissionIds } = c.req.valid('json')
+
+    const role = await roleService.getById(id)
+    if (!role) {
+      return c.json({ success: false as const, error: 'Role not found' }, 404)
+    }
+
+    if (role.code === 'super_admin') {
+      return c.json(
+        { success: false as const, error: 'Cannot modify super admin permissions' },
+        403
+      )
+    }
+
+    const validation = validatePermissionDependencies(permissionIds)
+    if (!validation.valid) {
+      return c.json(
+        {
+          success: false as const,
+          error: '权限依赖校验失败',
+          details: validation.errors.map(msg => ({ message: msg })),
+        },
+        400
+      )
+    }
+
+    const permissionObjects = await Promise.all(
+      permissionIds.map(code => permissionService.getByCode(code))
+    )
+    const validPermissionIds = permissionObjects
+      .filter((p): p is NonNullable<typeof p> => p !== undefined)
+      .map(p => p.id)
+
+    const currentPermissions = await permissionService.getRolePermissions(id)
+    const currentPermissionIds = currentPermissions.map(p => p.id)
+
+    for (const permissionId of currentPermissionIds) {
+      if (!validPermissionIds.includes(permissionId)) {
+        await permissionService.revokePermissionFromRole(id, permissionId)
+      }
+    }
+
+    for (const permissionId of validPermissionIds) {
+      if (!currentPermissionIds.includes(permissionId)) {
+        await permissionService.assignPermissionToRole(id, permissionId)
+      }
+    }
+
+    return c.json(success({}), 200)
+  })

package/template/src/server/module-permission/services/audit-log-service.ts

@@ -0,0 +1,108 @@
+import type { NewPermissionAuditLog } from '@server/db/schema/permission-audit-logs'
+import { getDb } from '@server/db'
+import { permissionAuditLogs } from '@server/db/schema'
+import { eq, and, gte, lte, desc } from 'drizzle-orm'
+import { transformAuditLog } from '@server/utils/date'
+import { type ResourceType, type ActionType } from '@shared/constants'
+
+export class AuditLogService {
+  async create(data: NewPermissionAuditLog): Promise<ReturnType<typeof transformAuditLog>> {
+    const db = await getDb()
+    const rows = await db
+      .insert(permissionAuditLogs)
+      .values({
+        ...data,
+        createdAt: new Date(),
+      })
+      .returning()
+    return transformAuditLog(rows[0])
+  }
+
+  async getAll(limit = 50, offset = 0): Promise<ReturnType<typeof transformAuditLog>[]> {
+    const db = await getDb()
+    const rows = await db
+      .select()
+      .from(permissionAuditLogs)
+      .orderBy(desc(permissionAuditLogs.createdAt))
+      .limit(limit)
+      .offset(offset)
+    return rows.map(transformAuditLog)
+  }
+
+  async getByUserId(userId: string, limit = 50): Promise<ReturnType<typeof transformAuditLog>[]> {
+    const db = await getDb()
+    const rows = await db
+      .select()
+      .from(permissionAuditLogs)
+      .where(eq(permissionAuditLogs.userId, userId))
+      .orderBy(desc(permissionAuditLogs.createdAt))
+      .limit(limit)
+    return rows.map(transformAuditLog)
+  }
+
+  async getByResource(
+    resourceType: ResourceType,
+    resourceId?: string
+  ): Promise<ReturnType<typeof transformAuditLog>[]> {
+    const db = await getDb()
+    const conditions = [eq(permissionAuditLogs.resourceType, resourceType)]
+    if (resourceId) {
+      conditions.push(eq(permissionAuditLogs.resourceId, resourceId))
+    }
+    const rows = await db
+      .select()
+      .from(permissionAuditLogs)
+      .where(and(...conditions))
+      .orderBy(desc(permissionAuditLogs.createdAt))
+    return rows.map(transformAuditLog)
+  }
+
+  async search(query: {
+    userId?: string
+    action?: ActionType
+    resourceType?: ResourceType
+    startDate?: Date
+    endDate?: Date
+  }): Promise<ReturnType<typeof transformAuditLog>[]> {
+    const db = await getDb()
+    const conditions = []
+
+    if (query.userId) {
+      conditions.push(eq(permissionAuditLogs.userId, query.userId))
+    }
+    if (query.action) {
+      conditions.push(eq(permissionAuditLogs.action, query.action))
+    }
+    if (query.resourceType) {
+      conditions.push(eq(permissionAuditLogs.resourceType, query.resourceType))
+    }
+    if (query.startDate) {
+      conditions.push(gte(permissionAuditLogs.createdAt, query.startDate))
+    }
+    if (query.endDate) {
+      conditions.push(lte(permissionAuditLogs.createdAt, query.endDate))
+    }
+
+    const rows = await db
+      .select()
+      .from(permissionAuditLogs)
+      .where(conditions.length > 0 ? and(...conditions) : undefined)
+      .orderBy(desc(permissionAuditLogs.createdAt))
+    return rows.map(transformAuditLog)
+  }
+
+  async deleteOlderThan(days: number): Promise<number> {
+    const db = await getDb()
+    const cutoff = new Date()
+    cutoff.setDate(cutoff.getDate() - days)
+
+    const rows = await db
+      .delete(permissionAuditLogs)
+      .where(lte(permissionAuditLogs.createdAt, cutoff))
+      .returning()
+
+    return rows.length
+  }
+}
+
+export const auditLogService = new AuditLogService()

package/template/src/server/module-permission/services/permission-service-impl.ts

@@ -0,0 +1,233 @@
+import { eq, and } from 'drizzle-orm'
+import type { Permission, NewPermission } from '@server/db/schema/permissions'
+import type { RoleInfo, PermissionInfo, MenuItem } from '@shared/modules/permission'
+import { Permission as PermissionEnum, Role } from '@shared/modules/permission'
+import { getDb } from '@server/db'
+import { permissions, rolePermissions, roles } from '@server/db/schema'
+import { roleService } from './role-service'
+import { logger } from '@server/utils/logger'
+import { MENU_CONFIG, PAGE_PERMISSIONS, type PagePermissionConfig } from './permission-service'
+
+const log = logger.api()
+
+export class PermissionService {
+  async getAll(): Promise<Permission[]> {
+    const db = await getDb()
+    const rows = await db.select().from(permissions).where(eq(permissions.isActive, true))
+    return rows
+  }
+
+  async getAllRoles(): Promise<RoleInfo[]> {
+    const db = await getDb()
+    const roleRows = await db.select().from(roles).where(eq(roles.isActive, true))
+
+    const result: RoleInfo[] = []
+    for (const role of roleRows) {
+      const rolePerms = await this.getRolePermissions(role.id)
+      result.push({
+        role: role.code as Role,
+        label: role.label,
+        permissions: rolePerms.map(p => p.code as PermissionEnum),
+      })
+    }
+
+    return result
+  }
+
+  async getAllPermissions(): Promise<PermissionInfo[]> {
+    const db = await getDb()
+    const rows = await db.select().from(permissions).where(eq(permissions.isActive, true))
+
+    return rows.map(p => ({
+      permission: p.code as PermissionEnum,
+      label: p.label,
+      category: p.category,
+    }))
+  }
+
+  async getById(id: string): Promise<Permission | undefined> {
+    const db = await getDb()
+    const rows = await db.select().from(permissions).where(eq(permissions.id, id))
+    return rows[0]
+  }
+
+  async getByCode(code: string): Promise<Permission | undefined> {
+    const db = await getDb()
+    const rows = await db.select().from(permissions).where(eq(permissions.code, code))
+    return rows[0]
+  }
+
+  async getByCategory(category: string): Promise<Permission[]> {
+    const db = await getDb()
+    const rows = await db
+      .select()
+      .from(permissions)
+      .where(and(eq(permissions.category, category), eq(permissions.isActive, true)))
+    return rows
+  }
+
+  async create(data: NewPermission): Promise<Permission> {
+    const db = await getDb()
+    const rows = await db.insert(permissions).values(data).returning()
+    return rows[0]
+  }
+
+  async update(id: string, data: Partial<NewPermission>): Promise<Permission | undefined> {
+    const db = await getDb()
+    const rows = await db.update(permissions).set(data).where(eq(permissions.id, id)).returning()
+    return rows[0]
+  }
+
+  async delete(id: string): Promise<boolean> {
+    const db = await getDb()
+    const rows = await db
+      .update(permissions)
+      .set({ isActive: false })
+      .where(eq(permissions.id, id))
+      .returning()
+    return rows.length > 0
+  }
+
+  async getRolePermissions(roleId: string): Promise<Permission[]> {
+    const db = await getDb()
+    const rows = await db
+      .select()
+      .from(rolePermissions)
+      .innerJoin(permissions, eq(rolePermissions.permissionId, permissions.id))
+      .where(eq(rolePermissions.roleId, roleId))
+    return rows.map(row => row.permissions)
+  }
+
+  async getUserPermissions(_userId: string, roleCode?: string): Promise<Permission[]> {
+    if (!roleCode) {
+      return []
+    }
+
+    const role = await roleService.getByCode(roleCode)
+    if (!role) {
+      return []
+    }
+
+    // 超级管理员拥有所有权限
+    if (roleCode === 'super_admin') {
+      const db = await getDb()
+      const allPermissions = await db
+        .select()
+        .from(permissions)
+        .where(eq(permissions.isActive, true))
+      return allPermissions
+    }
+
+    return this.getRolePermissions(role.id)
+  }
+
+  async hasPermission(
+    _userId: string,
+    permissionCode: string,
+    roleCode?: string
+  ): Promise<boolean> {
+    if (roleCode === 'super_admin') {
+      return true
+    }
+
+    if (roleCode) {
+      const role = await roleService.getByCode(roleCode)
+      if (role) {
+        const rolePerms = await this.getRolePermissions(role.id)
+        return rolePerms.some(p => p.code === permissionCode)
+      }
+    }
+
+    const userRoles = await roleService.getUserRoles(_userId)
+    for (const role of userRoles) {
+      if (role.code === 'super_admin') {
+        return true
+      }
+      const rolePermissions = await this.getRolePermissions(role.id)
+      if (rolePermissions.some(p => p.code === permissionCode)) {
+        return true
+      }
+    }
+    return false
+  }
+
+  async assignPermissionToRole(roleId: string, permissionId: string): Promise<void> {
+    const db = await getDb()
+    const existing = await db
+      .select()
+      .from(rolePermissions)
+      .where(
+        and(eq(rolePermissions.roleId, roleId), eq(rolePermissions.permissionId, permissionId))
+      )
+
+    if (existing.length === 0) {
+      log.info({ roleId, permissionId }, 'Assigning permission to role')
+      await db.insert(rolePermissions).values({
+        roleId,
+        permissionId,
+        createdAt: new Date(),
+      })
+    } else {
+      log.debug({ roleId, permissionId }, 'Permission already assigned to role')
+    }
+  }
+
+  async revokePermissionFromRole(roleId: string, permissionId: string): Promise<void> {
+    const db = await getDb()
+    log.info({ roleId, permissionId }, 'Revoking permission from role')
+    await db
+      .delete(rolePermissions)
+      .where(
+        and(eq(rolePermissions.roleId, roleId), eq(rolePermissions.permissionId, permissionId))
+      )
+  }
+
+  async getUserMenuConfig(userId: string, roleCode?: string): Promise<MenuItem[]> {
+    const userPermissions = await this.getUserPermissions(userId, roleCode)
+    const permissionCodes = new Set(userPermissions.map(p => p.code))
+
+    const hasAnyPermission = (perms: PermissionEnum[]): boolean => {
+      if (!perms || perms.length === 0) return true
+      return perms.some(p => permissionCodes.has(p))
+    }
+
+    const filterMenuItems = (items: MenuItem[]): MenuItem[] => {
+      return items
+        .filter(item => hasAnyPermission(item.permissions))
+        .map(item => {
+          if (item.children && item.children.length > 0) {
+            const visibleChildren = item.children.filter(child =>
+              hasAnyPermission(child.permissions)
+            )
+            if (visibleChildren.length === 0) {
+              return null
+            }
+            return { ...item, children: visibleChildren }
+          }
+          return item
+        })
+        .filter((item): item is MenuItem => item !== null)
+    }
+
+    return filterMenuItems(MENU_CONFIG)
+  }
+
+  async getUserPagePermissions(userId: string, roleCode?: string): Promise<PagePermissionConfig[]> {
+    const userPermissions = await this.getUserPermissions(userId, roleCode)
+    const permissionCodes = new Set(userPermissions.map(p => p.code))
+
+    const hasAllPermissions = (perms: PermissionEnum[]): boolean => {
+      if (!perms || perms.length === 0) return true
+      return perms.every(p => permissionCodes.has(p))
+    }
+
+    return PAGE_PERMISSIONS.filter(page => hasAllPermissions(page.requiredPermissions)).map(
+      page => ({
+        ...page,
+        actions: page.actions.filter(action => hasAllPermissions(action.permissions)),
+      })
+    )
+  }
+}
+
+export const permissionService = new PermissionService()