create-fullstack-scaffold 0.5.7 → 0.6.0

package/template/src/server/module-todos/services/todo-service.ts

@@ -61,6 +61,8 @@ export async function seedTodosIfEmpty(): Promise<void> {
 export async function listTodos(options?: {
   page?: number
   limit?: number
+  /** 租户上下文存在时按租户隔离（saas 等含 tenant 模块的 preset） */
+  tenantId?: number
 }): Promise<{ todos: Todo[]; total: number; page: number; limit: number }> {
   const db = await getDb()
   const page = options?.page ?? 1
@@ -71,15 +73,20 @@ export async function listTodos(options?: {
   const rows = await db
     .select()
     .from(todos)
+    .where(options?.tenantId != null ? eq(todos.tenantId, options.tenantId) : undefined)
     .orderBy(desc(todos.createdAt))
     .limit(limit)
     .offset(offset)
   // db 为 LibSQL|D1 联合类型：select(config) 会重载坍缩，$count 两驱动同签名
-  const total = await db.$count(todos)
+  const total = await db.$count(
+    todos,
+    options?.tenantId != null ? eq(todos.tenantId, options.tenantId) : undefined
+  )
 
   return {
     todos: rows.map((row: TodoTable) => ({
       id: row.id,
+      tenantId: row.tenantId ?? null,
       title: row.title,
       description: row.description ?? undefined,
       status: row.status,
@@ -109,12 +116,13 @@ export async function getTodo(id: number): Promise<Todo | null> {
   }
 }
 
-export async function createTodo(input: CreateTodoInput): Promise<Todo> {
+export async function createTodo(input: CreateTodoInput, tenantId?: number): Promise<Todo> {
   const db = await getDb()
   const now = new Date()
   const result = await db
     .insert(todos)
     .values({
+      tenantId: tenantId ?? null,
       title: input.title,
       description: input.description ?? null,
       status: 'pending',
@@ -126,6 +134,7 @@ export async function createTodo(input: CreateTodoInput): Promise<Todo> {
   const row = result[0]
   return {
     id: row.id,
+    tenantId: row.tenantId ?? null,
     title: row.title,
     description: row.description ?? undefined,
     status: row.status,
@@ -158,6 +167,7 @@ export async function updateTodo(id: number, input: UpdateTodoInput): Promise<To
   const row = result[0]
   return {
     id: row.id,
+    tenantId: row.tenantId ?? null,
     title: row.title,
     description: row.description ?? undefined,
     status: row.status,

package/template/src/server/utils/__tests__/captcha.test.ts

@@ -6,10 +6,12 @@ function extractCodeFromSvg(image: string): string {
   const decoded = Buffer.from(image.split(',')[1], 'base64').toString()
   const matches = decoded.match(/>\s*([A-Z0-9])\s*<\/text>/g)
   if (!matches) throw new Error('Could not extract code from SVG')
-  return matches.map(m => {
-    const char = m.match(/>\s*([A-Z0-9])\s*</)
-    return char ? char[1] : ''
-  }).join('')
+  return matches
+    .map((m: string) => {
+      const char = m.match(/>\s*([A-Z0-9])\s*</)
+      return char ? char[1] : ''
+    })
+    .join('')
 }
 
 describe('captcha', () => {

package/template/src/server/utils/id-helpers.ts

@@ -3,3 +3,16 @@ export function parseModuleId(prefix: string, id: string): number {
   if (isNaN(num)) return -1
   return num
 }
+
+/** 租户域等文本主键：前缀 + 随机串（tenant_roles/tenant_members/invitations） */
+export function generateId(prefix: string): string {
+  return `${prefix}_${globalThis.crypto.randomUUID().replace(/-/g, '').slice(0, 20)}`
+}
+
+/** 一次性令牌（邀请链接等），48 hex 字符 */
+export function generateToken(): string {
+  return (
+    globalThis.crypto.randomUUID().replace(/-/g, '') +
+    globalThis.crypto.randomUUID().replace(/-/g, '').slice(0, 16)
+  )
+}

package/template/src/shared/modules/index.ts

@@ -121,6 +121,24 @@ export {
   TenantListResponseSchema,
   TenantQuerySchema,
   TenantIdResponseSchema,
+  TenantRoleSchema,
+  CreateTenantRoleSchema,
+  UpdateTenantRoleSchema,
+  TenantMemberSchema,
+  UpdateMemberRoleSchema,
+  TenantInvitationSchema,
+  InviteMemberSchema,
+  PublicInvitationSchema,
+  StringIdResponseSchema,
+  TenantArrayResponseSchema,
+  TenantRoleArrayResponseSchema,
+  TenantMemberArrayResponseSchema,
+  TenantPermission,
+  TENANT_PERMISSION_VALUES,
+  TENANT_PERMISSION_LABELS,
+  TenantRoleCode,
+  TENANT_ROLE_TEMPLATES,
+  PLAN_ROLE_LIMITS,
   type Tenant,
   type TenantStatus,
   type TenantPlan,
@@ -132,6 +150,16 @@ export {
   type TenantListResponse,
   type TenantQuery,
   type TenantIdResponse,
+  type TenantRole,
+  type CreateTenantRoleInput,
+  type UpdateTenantRoleInput,
+  type TenantMember,
+  type UpdateMemberRoleInput,
+  type TenantInvitation,
+  type InviteMemberInput,
+  type PublicInvitation,
+  type StringIdResponse,
+  type TenantRoleTemplate,
 } from './tenant'
 export {
   OrderStatusSchema,
@@ -264,12 +292,7 @@ export {
   type ProfileActivity,
   type ProfileResponse,
 } from './community'
-export {
-  ResourceTypeSchema,
-  ActionTypeSchema,
-  AuditLogSchema,
-  type AuditLogType,
-} from './audit'
+export { ResourceTypeSchema, ActionTypeSchema, AuditLogSchema, type AuditLogType } from './audit'
 export {
   RoleSchema,
   CreateRoleSchema,

package/template/src/shared/modules/tenant/index.ts

@@ -22,3 +22,33 @@ export {
   type TenantQuery,
   type TenantIdResponse,
 } from './schemas'
+export {
+  TenantRoleSchema,
+  CreateTenantRoleSchema,
+  UpdateTenantRoleSchema,
+  TenantMemberSchema,
+  UpdateMemberRoleSchema,
+  TenantInvitationSchema,
+  InviteMemberSchema,
+  PublicInvitationSchema,
+  StringIdResponseSchema,
+  TenantArrayResponseSchema,
+  TenantRoleArrayResponseSchema,
+  TenantMemberArrayResponseSchema,
+  type TenantRole,
+  type CreateTenantRoleInput,
+  type UpdateTenantRoleInput,
+  type TenantMember,
+  type UpdateMemberRoleInput,
+  type TenantInvitation,
+  type InviteMemberInput,
+  type PublicInvitation,
+  type StringIdResponse,
+} from './schemas'
+export { TenantPermission, TENANT_PERMISSION_VALUES, TENANT_PERMISSION_LABELS } from './permissions'
+export {
+  TenantRoleCode,
+  TENANT_ROLE_TEMPLATES,
+  PLAN_ROLE_LIMITS,
+  type TenantRoleTemplate,
+} from './role-templates'

package/template/src/shared/modules/tenant/permissions.ts

@@ -0,0 +1,54 @@
+/**
+ * 租户内权限点（与平台级 permission 模块区分：平台管全局，这里管租户内）。
+ * 角色的 permissions 字段存本枚举值数组的 JSON。
+ */
+export enum TenantPermission {
+  MEMBER_VIEW = 'tenant:member:view',
+  MEMBER_INVITE = 'tenant:member:invite',
+  MEMBER_REMOVE = 'tenant:member:remove',
+  MEMBER_ROLE_ASSIGN = 'tenant:member:role:assign',
+
+  ROLE_VIEW = 'tenant:role:view',
+  ROLE_CREATE = 'tenant:role:create',
+  ROLE_EDIT = 'tenant:role:edit',
+  ROLE_DELETE = 'tenant:role:delete',
+
+  SETTINGS_VIEW = 'tenant:settings:view',
+  SETTINGS_EDIT = 'tenant:settings:edit',
+
+  DATA_VIEW = 'tenant:data:view',
+  DATA_CREATE = 'tenant:data:create',
+  DATA_EDIT = 'tenant:data:edit',
+  DATA_DELETE = 'tenant:data:delete',
+  DATA_EXPORT = 'tenant:data:export',
+  DATA_IMPORT = 'tenant:data:import',
+
+  BILLING_VIEW = 'tenant:billing:view',
+  BILLING_MANAGE = 'tenant:billing:manage',
+
+  AUDIT_VIEW = 'tenant:audit:view',
+}
+
+export const TENANT_PERMISSION_VALUES = Object.values(TenantPermission)
+
+export const TENANT_PERMISSION_LABELS: Record<TenantPermission, string> = {
+  [TenantPermission.MEMBER_VIEW]: '查看成员',
+  [TenantPermission.MEMBER_INVITE]: '邀请成员',
+  [TenantPermission.MEMBER_REMOVE]: '移除成员',
+  [TenantPermission.MEMBER_ROLE_ASSIGN]: '分配角色',
+  [TenantPermission.ROLE_VIEW]: '查看角色',
+  [TenantPermission.ROLE_CREATE]: '创建角色',
+  [TenantPermission.ROLE_EDIT]: '编辑角色',
+  [TenantPermission.ROLE_DELETE]: '删除角色',
+  [TenantPermission.SETTINGS_VIEW]: '查看设置',
+  [TenantPermission.SETTINGS_EDIT]: '编辑设置',
+  [TenantPermission.DATA_VIEW]: '查看数据',
+  [TenantPermission.DATA_CREATE]: '创建数据',
+  [TenantPermission.DATA_EDIT]: '编辑数据',
+  [TenantPermission.DATA_DELETE]: '删除数据',
+  [TenantPermission.DATA_EXPORT]: '导出数据',
+  [TenantPermission.DATA_IMPORT]: '导入数据',
+  [TenantPermission.BILLING_VIEW]: '查看账单',
+  [TenantPermission.BILLING_MANAGE]: '管理账单',
+  [TenantPermission.AUDIT_VIEW]: '查看审计',
+}

package/template/src/shared/modules/tenant/role-templates.ts

@@ -0,0 +1,66 @@
+import { TenantPermission } from './permissions'
+
+export enum TenantRoleCode {
+  ADMIN = 'tenant_admin',
+  MEMBER = 'tenant_member',
+  GUEST = 'tenant_guest',
+}
+
+export interface TenantRoleTemplate {
+  code: TenantRoleCode
+  name: string
+  label: string
+  description: string
+  isSystem: boolean
+  permissions: TenantPermission[]
+}
+
+/** 开租户时事务内播种的三个系统角色 */
+export const TENANT_ROLE_TEMPLATES: TenantRoleTemplate[] = [
+  {
+    code: TenantRoleCode.ADMIN,
+    name: 'tenant_admin',
+    label: '租户管理员',
+    description: '拥有租户内所有权限，可管理成员、角色和设置',
+    isSystem: true,
+    permissions: Object.values(TenantPermission),
+  },
+  {
+    code: TenantRoleCode.MEMBER,
+    name: 'tenant_member',
+    label: '普通成员',
+    description: '可访问租户数据，无法管理成员和设置',
+    isSystem: true,
+    permissions: [
+      TenantPermission.MEMBER_VIEW,
+      TenantPermission.ROLE_VIEW,
+      TenantPermission.SETTINGS_VIEW,
+      TenantPermission.DATA_VIEW,
+      TenantPermission.DATA_CREATE,
+      TenantPermission.DATA_EDIT,
+      TenantPermission.DATA_DELETE,
+      TenantPermission.DATA_EXPORT,
+    ],
+  },
+  {
+    code: TenantRoleCode.GUEST,
+    name: 'tenant_guest',
+    label: '访客',
+    description: '只读权限，仅可查看数据',
+    isSystem: true,
+    permissions: [
+      TenantPermission.MEMBER_VIEW,
+      TenantPermission.ROLE_VIEW,
+      TenantPermission.SETTINGS_VIEW,
+      TenantPermission.DATA_VIEW,
+    ],
+  },
+]
+
+/** 套餐→自定义角色数上限（-1 不限），超限创建角色时真实拦截 */
+export const PLAN_ROLE_LIMITS: Record<string, number> = {
+  free: 3,
+  starter: 5,
+  pro: 10,
+  enterprise: -1,
+}

package/template/src/shared/modules/tenant/schemas.ts

@@ -1,4 +1,5 @@
 import { z } from '@hono/zod-openapi'
+import { TENANT_PERMISSION_VALUES } from './permissions'
 
 export const TenantStatusSchema = z.enum(['active', 'suspended', 'trial'])
 export type TenantStatus = z.infer<typeof TenantStatusSchema>
@@ -36,7 +37,8 @@ export const CreateTenantSchema = z.object({
     .regex(/^[a-z0-9-]+$/),
   plan: TenantPlanSchema.default('free'),
   maxUsers: z.number().int().min(1).max(1000).default(5),
-  settings: TenantSettingsSchema,
+  // 可选：建租户时通常没有初始配置，service 层兜底空对象
+  settings: TenantSettingsSchema.nullish().default({}),
 })
 
 export type CreateTenantInput = z.infer<typeof CreateTenantSchema>
@@ -86,3 +88,113 @@ export const TenantQuerySchema = z.object({
 })
 
 export type TenantQuery = z.infer<typeof TenantQuerySchema>
+
+// ============ 租户角色 ============
+export const TenantRoleSchema = z.object({
+  id: z.string(),
+  tenantId: z.number().int().positive(),
+  code: z.string().min(1).max(100),
+  name: z.string().min(1).max(100),
+  label: z.string().min(1).max(100),
+  description: z.string().nullish(),
+  permissions: z.array(z.enum(TENANT_PERMISSION_VALUES as [string, ...string[]])),
+  isSystem: z.boolean(),
+  isActive: z.boolean(),
+  sortOrder: z.number().int(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+})
+
+export type TenantRole = z.infer<typeof TenantRoleSchema>
+
+export const CreateTenantRoleSchema = z.object({
+  code: z
+    .string()
+    .min(1)
+    .max(100)
+    .regex(/^[a-z0-9_-]+$/),
+  name: z.string().min(1).max(100),
+  label: z.string().min(1).max(100),
+  description: z.string().nullish(),
+  permissions: z.array(z.enum(TENANT_PERMISSION_VALUES as [string, ...string[]])).min(1),
+})
+
+export type CreateTenantRoleInput = z.infer<typeof CreateTenantRoleSchema>
+
+export const UpdateTenantRoleSchema = z.object({
+  label: z.string().min(1).max(100).nullish(),
+  description: z.string().nullish(),
+  permissions: z
+    .array(z.enum(TENANT_PERMISSION_VALUES as [string, ...string[]]))
+    .min(1)
+    .nullish(),
+})
+
+export type UpdateTenantRoleInput = z.infer<typeof UpdateTenantRoleSchema>
+
+// ============ 租户成员 ============
+export const TenantMemberSchema = z.object({
+  id: z.string(),
+  tenantId: z.number().int().positive(),
+  userId: z.string(),
+  roleId: z.string(),
+  /** 展示名：developers 表用户名，dev token 用户回退 userId */
+  username: z.string().nullish(),
+  role: TenantRoleSchema.nullish(),
+  status: z.enum(['active', 'pending', 'suspended', 'left']),
+  invitedBy: z.string().nullish(),
+  invitedAt: z.string().datetime().nullish(),
+  joinedAt: z.string().datetime(),
+  lastActiveAt: z.string().datetime().nullish(),
+})
+
+export type TenantMember = z.infer<typeof TenantMemberSchema>
+
+export const UpdateMemberRoleSchema = z.object({
+  roleId: z.string().min(1),
+})
+
+export type UpdateMemberRoleInput = z.infer<typeof UpdateMemberRoleSchema>
+
+// ============ 租户邀请 ============
+export const TenantInvitationSchema = z.object({
+  id: z.string(),
+  tenantId: z.number().int().positive(),
+  email: z.string().email(),
+  roleId: z.string(),
+  inviterId: z.string(),
+  token: z.string(),
+  status: z.enum(['pending', 'accepted', 'declined', 'expired', 'cancelled']),
+  expiresAt: z.string().datetime(),
+  acceptedAt: z.string().datetime().nullish(),
+  createdAt: z.string().datetime(),
+})
+
+export type TenantInvitation = z.infer<typeof TenantInvitationSchema>
+
+export const InviteMemberSchema = z.object({
+  email: z.string().email(),
+  roleId: z.string().min(1),
+})
+
+export type InviteMemberInput = z.infer<typeof InviteMemberSchema>
+
+/** 邀请详情（公开接口）：脱敏后返回，不含 inviterId */
+export const PublicInvitationSchema = z.object({
+  tenantName: z.string(),
+  tenantSlug: z.string(),
+  email: z.string().email(),
+  roleLabel: z.string(),
+  status: z.enum(['pending', 'accepted', 'declined', 'expired', 'cancelled']),
+  expiresAt: z.string().datetime(),
+})
+
+export type PublicInvitation = z.infer<typeof PublicInvitationSchema>
+
+// ============ 列表/ID 响应包装（路由 responses 不得内联 schema） ============
+export const StringIdResponseSchema = z.object({ id: z.string() })
+export type StringIdResponse = z.infer<typeof StringIdResponseSchema>
+
+export const TenantArrayResponseSchema = z.array(TenantSchema)
+export const TenantRoleArrayResponseSchema = z.array(TenantRoleSchema)
+export const TenantMemberArrayResponseSchema = z.array(TenantMemberSchema)

package/template/src/shared/modules/todos/schemas.ts

@@ -4,6 +4,7 @@ export const TodoStatusSchema = z.enum(['pending', 'in_progress', 'completed'])
 
 export const TodoSchema = z.object({
   id: z.number().int().positive(),
+  tenantId: z.number().int().positive().nullish(),
   title: z.string().min(1, 'Title is required').max(200, 'Title too long'),
   description: z.string().max(1000, 'Description too long').nullish(),
   status: TodoStatusSchema,

package/template/src/shared/schemas/index.ts

@@ -225,6 +225,24 @@ export {
   TenantListResponseSchema,
   TenantQuerySchema,
   TenantIdResponseSchema,
+  TenantRoleSchema,
+  CreateTenantRoleSchema,
+  UpdateTenantRoleSchema,
+  TenantMemberSchema,
+  UpdateMemberRoleSchema,
+  TenantInvitationSchema,
+  InviteMemberSchema,
+  PublicInvitationSchema,
+  StringIdResponseSchema,
+  TenantArrayResponseSchema,
+  TenantRoleArrayResponseSchema,
+  TenantMemberArrayResponseSchema,
+  TenantPermission,
+  TENANT_PERMISSION_VALUES,
+  TENANT_PERMISSION_LABELS,
+  TenantRoleCode,
+  TENANT_ROLE_TEMPLATES,
+  PLAN_ROLE_LIMITS,
   type Tenant,
   type TenantStatus,
   type TenantPlan,
@@ -236,6 +254,16 @@ export {
   type TenantListResponse,
   type TenantQuery,
   type TenantIdResponse,
+  type TenantRole,
+  type CreateTenantRoleInput,
+  type UpdateTenantRoleInput,
+  type TenantMember,
+  type UpdateMemberRoleInput,
+  type TenantInvitation,
+  type InviteMemberInput,
+  type PublicInvitation,
+  type StringIdResponse,
+  type TenantRoleTemplate,
 } from '../modules/tenant'
 export {
   DisputeTypeSchema,

package/template/src/tenant/App.tsx

@@ -1,5 +1,5 @@
 import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom'
-import { ConfigProvider } from 'antd'
+import { ConfigProvider, App as AntApp } from 'antd'
 import { Layout } from './layouts/Layout'
 import { DashboardPage } from './pages/DashboardPage'
 import { UsersPage } from './pages/UsersPage'
@@ -7,6 +7,8 @@ import { SubscriptionPage } from './pages/SubscriptionPage'
 import { SettingsPage } from './pages/SettingsPage'
 import { TodosPage } from './pages/TodosPage'
 import { ContentPage } from './pages/ContentPage'
+import { LoginPage } from './pages/LoginPage'
+import { InviteAcceptPage } from './pages/InviteAcceptPage'
 import { TenantGuard } from './components/TenantGuard'
 
 export const App: React.FC = () => {
@@ -18,28 +20,33 @@ export const App: React.FC = () => {
         },
       }}
     >
-      <BrowserRouter basename="/tenant">
-        <Routes>
-          <Route
-            path="/*"
-            element={
-              <TenantGuard>
-                <Layout>
-                  <Routes>
-                    <Route path="/" element={<Navigate to="/dashboard" replace />} />
-                    <Route path="/dashboard" element={<DashboardPage />} />
-                    <Route path="/users" element={<UsersPage />} />
-                    <Route path="/subscription" element={<SubscriptionPage />} />
-                    <Route path="/settings" element={<SettingsPage />} />
-                    <Route path="/todos" element={<TodosPage />} />
-                    <Route path="/content" element={<ContentPage />} />
-                  </Routes>
-                </Layout>
-              </TenantGuard>
-            }
-          />
-        </Routes>
-      </BrowserRouter>
+      <AntApp>
+        <BrowserRouter basename="/tenant">
+          <Routes>
+            {/* 公开路由：登录 + 邀请落地（TenantGuard 的 /login 回跳自此可达） */}
+            <Route path="/login" element={<LoginPage />} />
+            <Route path="/invite/:token" element={<InviteAcceptPage />} />
+            <Route
+              path="/*"
+              element={
+                <TenantGuard>
+                  <Layout>
+                    <Routes>
+                      <Route path="/" element={<Navigate to="/dashboard" replace />} />
+                      <Route path="/dashboard" element={<DashboardPage />} />
+                      <Route path="/users" element={<UsersPage />} />
+                      <Route path="/subscription" element={<SubscriptionPage />} />
+                      <Route path="/settings" element={<SettingsPage />} />
+                      <Route path="/todos" element={<TodosPage />} />
+                      <Route path="/content" element={<ContentPage />} />
+                    </Routes>
+                  </Layout>
+                </TenantGuard>
+              }
+            />
+          </Routes>
+        </BrowserRouter>
+      </AntApp>
     </ConfigProvider>
   )
 }

package/template/src/tenant/components/TenantGuard.tsx

@@ -9,14 +9,24 @@ interface TenantGuardProps {
 
 export const TenantGuard: React.FC<TenantGuardProps> = ({ children }) => {
   const location = useLocation()
-  const { isAuthenticated, currentTenant, loading, fetchCurrentTenant } = useTenantStore()
+  const { isAuthenticated, currentTenant, loading, fetchCurrentTenant, restoreFromToken } =
+    useTenantStore()
 
   useEffect(() => {
+    // 已有租户上下文即短路——fetch 会 set 新对象，若把它放进依赖/重复
+    // 触发会形成无限请求循环（250ms 内百次请求打满限流被弹回登录）
+    if (currentTenant) return
+    if (!isAuthenticated) return
+
     const tenantSlug = extractTenantSlug()
     if (tenantSlug) {
       fetchCurrentTenant(tenantSlug)
+      return
     }
-  }, [fetchCurrentTenant])
+    // 无 slug（如邀请接受后直跳）：token 在则从 mine 恢复租户上下文
+    restoreFromToken()
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isAuthenticated, currentTenant])
 
   if (loading) {
     return (

package/template/src/tenant/layouts/Header.tsx

@@ -5,6 +5,7 @@ import {
   UserOutlined,
   LogoutOutlined,
 } from '@ant-design/icons'
+import { useTenantStore } from '../stores/tenantStore'
 
 interface HeaderProps {
   collapsed: boolean
@@ -12,9 +13,12 @@ interface HeaderProps {
 }
 
 export const Header: React.FC<HeaderProps> = ({ collapsed, onToggle }) => {
+  const logout = useTenantStore(state => state.logout)
+
   const handleLogout = () => {
-    localStorage.removeItem('tenant-token')
-    window.location.href = '/login'
+    logout()
+    // basename=/tenant 下的路由跳转
+    window.location.href = '/tenant/login'
   }
 
   const userMenuItems = [