create-fullstack-scaffold 0.5.7 → 0.6.1

package/template/src/server/middleware/__tests__/tenant-isolation.test.ts

@@ -58,23 +58,37 @@ describe('tenantIsolationMiddleware', () => {
     return app
   }
 
-  it('should return error when no tenant header or subdomain', async () => {
+  // P2 起中间件为"可选上下文"语义：无租户标识 → 放行且不设上下文
+  //（全局模式：dev token / 平台级 API / 无 tenant 模块 preset 不受影响）
+  it('should pass through without context when no tenant header or subdomain', async () => {
     const app = createApp()
     const res = await app.request('/api/test')
-    expect(res.status).toBe(404)
+    // /api/test 无路由 → 404 来自路由缺失而非中间件；断言响应不是
+    // tenant-not-found 错误体即可证明中间件放行
+    const body = (await res.json()) as { error?: string }
+    expect(String(body.error)).not.toContain('Tenant')
   })
 
-  it('should return error when tenant header is empty string', async () => {
+  it('should pass through without context when tenant header is empty string', async () => {
     const app = createApp()
     const res = await app.request('/api/test', {
       headers: { 'X-Tenant-Slug': '' },
     })
-    expect(res.status).toBe(404)
+    const body = (await res.json()) as { error?: string }
+    expect(String(body.error)).not.toContain('Tenant')
   })
 
   it('should pass with valid tenant from header', async () => {
     mockDbResult([
-      { id: 1, slug: 'test-tenant', name: 'Test', status: 'active', plan: 'free', maxUsers: 10, settings: null },
+      {
+        id: 1,
+        slug: 'test-tenant',
+        name: 'Test',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 10,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -98,7 +112,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should extract tenant from subdomain when no header', async () => {
     mockDbResult([
-      { id: 2, slug: 'acme', name: 'Acme', status: 'active', plan: 'pro', maxUsers: 100, settings: null },
+      {
+        id: 2,
+        slug: 'acme',
+        name: 'Acme',
+        status: 'active',
+        plan: 'pro',
+        maxUsers: 100,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -111,7 +133,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should prefer X-Tenant-Slug header over subdomain', async () => {
     mockDbResult([
-      { id: 3, slug: 'header-tenant', name: 'Header', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+      {
+        id: 3,
+        slug: 'header-tenant',
+        name: 'Header',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 5,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -124,7 +154,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should parse tenant settings JSON', async () => {
     mockDbResult([
-      { id: 4, slug: 'with-settings', name: 'Settings', status: 'active', plan: 'pro', maxUsers: 50, settings: '{"theme":"dark"}' },
+      {
+        id: 4,
+        slug: 'with-settings',
+        name: 'Settings',
+        status: 'active',
+        plan: 'pro',
+        maxUsers: 50,
+        settings: '{"theme":"dark"}',
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {
@@ -137,7 +175,15 @@ describe('tenantIsolationMiddleware', () => {
 
   it('should handle null settings gracefully', async () => {
     mockDbResult([
-      { id: 5, slug: 'no-settings', name: 'NoSettings', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+      {
+        id: 5,
+        slug: 'no-settings',
+        name: 'NoSettings',
+        status: 'active',
+        plan: 'free',
+        maxUsers: 5,
+        settings: null,
+      },
     ])
     const app = createApp()
     const res = await app.request('/api/test', {

package/template/src/server/middleware/auth.ts

@@ -131,27 +131,25 @@ function verifyToken(token: string, key: string): AuthUser | null {
     }
   }
 
-  if (key !== defaultSecretKey) {
-    try {
-      const decoded = jwt.verify(token, key) as {
-        userId: string
-        role: string
-        username: string
-        email: string
-      }
-      return {
-        id: decoded.userId,
-        username: decoded.username,
-        email: decoded.email,
-        role: decoded.role as UserRole,
-        permissions: getPermissionsByRole(decoded.role as UserRole),
-      }
-    } catch {
-      return null
+  // 真实 JWT 验证对默认/自定义 key 均启用——此前仅非默认 key 才走此分支，
+  // 导致 dev 未设 AUTH_SECRET_KEY 时所有注册账号的登录 token 恒 401
+  try {
+    const decoded = jwt.verify(token, key) as {
+      userId: string
+      role: string
+      username: string
+      email: string
+    }
+    return {
+      id: decoded.userId,
+      username: decoded.username,
+      email: decoded.email,
+      role: decoded.role as UserRole,
+      permissions: getPermissionsByRole(decoded.role as UserRole),
     }
+  } catch {
+    return null
   }
-
-  return null
 }
 
 export function authMiddleware(options: AuthMiddlewareOptions = {}): MiddlewareHandler {

package/template/src/server/middleware/tenant-isolation.ts

@@ -41,9 +41,11 @@ export function tenantIsolationMiddleware(): MiddlewareHandler {
     const hostname = c.req.header('host') || ''
     const tenantSlug = extractTenantSlug(hostname, c.req.header('X-Tenant-Slug'))
 
+    // 无租户标识 → 不设上下文继续（全局模式：dev token、平台级 API、
+    // 无 tenant 模块 preset 的既有行为都不受影响）
     if (!tenantSlug) {
-      log.warn({ hostname, path: c.req.path }, 'No tenant slug found')
-      throw NotFoundError.tenant()
+      await next()
+      return
     }
 
     const db = await getDb()

package/template/src/server/module-auth/module.ts

@@ -33,7 +33,8 @@ const authManifest: ModuleManifest = {
 
   dbSchemas: {
     files: ['developers'],
-    hasSeed: false,
+    hasSeed: true,
+    seed: { serviceFile: 'auth-service', functionName: 'seedDevelopersIfEmpty' },
   },
 
   cliModule: { dir: 'auth', registerFunction: 'registerAuthCommands' },

package/template/src/server/module-auth/services/auth-service.ts

@@ -6,6 +6,7 @@ import { developers, type DeveloperTable } from '@server/db/schema'
 import { ConflictError, AuthenticationError } from '@server/utils/app-error'
 import { generateUUID } from '@server/utils/uuid'
 import { toISOString } from '@server/utils/date'
+import { createModuleLoggerSync } from '@server/utils/logger'
 
 // eslint-disable-next-line local-rules/no-util-functions-in-service -- module-specific row-to-profile mapping
 function toProfile(row: DeveloperTable): DeveloperProfile {
@@ -98,3 +99,41 @@ export async function getDeveloperById(id: string): Promise<DeveloperProfile | n
 
   return toProfile(rows[0])
 }
+
+/**
+ * 认证种子（首启空库）：demo 开发者 + 平台超管。
+ * superadmin 必须是 super_admin 角色——requireSuperAdminMiddleware 只认这个值。
+ * 凭据 superadmin/admin123，首启日志打印一次，上线前必须改密。
+ */
+export async function seedDevelopersIfEmpty(): Promise<void> {
+  const db = await getDb()
+  const existing = await db.select().from(developers)
+  if (existing.length > 0) return
+
+  const log = createModuleLoggerSync('auth-service')
+  log.info({}, 'Seeding developers...')
+  const demoPasswordHash = hashSync('demo123', 10)
+  const adminPasswordHash = hashSync('admin123', 10)
+  await db.insert(developers).values([
+    {
+      id: generateUUID(),
+      username: 'demo',
+      email: 'demo@biomimic.app',
+      passwordHash: demoPasswordHash,
+      role: 'developer' as const,
+      apiKey: generateUUID(),
+    },
+    {
+      id: generateUUID(),
+      username: 'superadmin',
+      email: 'admin@biomimic.app',
+      passwordHash: adminPasswordHash,
+      role: 'super_admin' as const,
+      apiKey: generateUUID(),
+    },
+  ])
+  log.warn(
+    { account: 'superadmin', password: 'admin123', note: 'CHANGE IMMEDIATELY' },
+    'Platform super admin seeded (first boot only) — change the password before any real deployment'
+  )
+}

package/template/src/server/module-tenant/__tests__/tenant-routes.test.ts

@@ -140,3 +140,100 @@ describe('Tenant Routes', () => {
     })
   })
 })
+
+describe('membership & invitation routes (P1)', () => {
+  const authHeaders = { Authorization: 'Bearer test-super-admin-1' }
+
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  it('GET /api/tenants/mine 返回当前用户租户', async () => {
+    const client = createTestClient(undefined, { headers: authHeaders })
+    const res = await client.api.tenants.mine.$get()
+    expect(res.status).toBe(200)
+    const data = await res.json()
+    if (data.success) {
+      expect(Array.isArray(data.data)).toBe(true)
+      expect(data.data.length).toBeGreaterThanOrEqual(1) // demo 种子 owner
+    }
+  })
+
+  it('非成员访问租户成员列表 403', async () => {
+    const client = createTestClient(undefined, {
+      headers: { Authorization: 'Bearer test-user-2' },
+    })
+    const res = await client.api.tenants[':tenantId'].members.$get({ param: { tenantId: '1' } })
+    expect(res.status).toBe(403)
+  })
+
+  it('owner 邀请→公开查详情→接受→列表可见→移除', async () => {
+    const owner = createTestClient(undefined, { headers: authHeaders })
+
+    // demo 租户（id=1，seed owner=test-super-admin-1）
+    const rolesRes = await owner.api.tenants[':tenantId'].roles.$get({ param: { tenantId: '1' } })
+    expect(rolesRes.status).toBe(200)
+    const rolesData = await rolesRes.json()
+    if (!rolesData.success) throw new Error('roles failed')
+    const guestRole = rolesData.data.find(r => r.code === 'tenant_guest')!
+
+    const inviteRes = await owner.api.tenants[':tenantId'].members.invite.$post({
+      param: { tenantId: '1' },
+      json: { email: 'route-newbie@example.com', roleId: guestRole.id },
+    })
+    expect(inviteRes.status).toBe(201)
+    const inviteData = await inviteRes.json()
+    if (!inviteData.success) throw new Error('invite failed')
+    const token = inviteData.data.token
+
+    // 公开接口（无认证）可查脱敏详情
+    const pub = createTestClient(undefined)
+    const pubRes = await pub.api.tenants.invitations[':token'].$get({ param: { token } })
+    expect(pubRes.status).toBe(200)
+    const pubData = await pubRes.json()
+    if (pubData.success) {
+      expect(pubData.data.tenantSlug).toBe('demo')
+      expect(pubData.data.roleLabel).toBe('访客')
+      expect(pubData.data).not.toHaveProperty('inviterId')
+    }
+
+    // 被邀人接受
+    const newbie = createTestClient(undefined, {
+      headers: { Authorization: 'Bearer test-user-2' },
+    })
+    const acceptRes = await newbie.api.tenants.invitations[':token'].accept.$post({
+      param: { token },
+    })
+    expect(acceptRes.status).toBe(200)
+
+    // owner 视角成员列表可见新人
+    const membersRes = await owner.api.tenants[':tenantId'].members.$get({
+      param: { tenantId: '1' },
+    })
+    const membersData = await membersRes.json()
+    if (membersData.success) {
+      const newbieRow = membersData.data.find((m: { userId: string }) => m.userId === 'test-user-2')
+      expect(newbieRow).toBeDefined()
+      expect(newbieRow!.role?.code).toBe('tenant_guest')
+    }
+
+    // 移除后新人 403
+    if (membersData.success) {
+      const newbieRow = membersData.data.find(
+        (m: { userId: string }) => m.userId === 'test-user-2'
+      )!
+      const delRes = await owner.api.tenants[':tenantId'].members[':memberId'].$delete({
+        param: { tenantId: '1', memberId: newbieRow.id },
+      })
+      expect(delRes.status).toBe(200)
+      const denied = await newbie.api.tenants[':tenantId'].members.$get({
+        param: { tenantId: '1' },
+      })
+      expect(denied.status).toBe(403)
+    }
+  })
+})

package/template/src/server/module-tenant/__tests__/tenant-service.test.ts

@@ -7,7 +7,19 @@ import {
   createTenant,
   updateTenant,
   deleteTenant,
+  getTenantRoles,
+  createTenantRole,
+  getTenantMembers,
+  getUserTenants,
+  getUserTenantPermissions,
+  hasTenantPermission,
+  requireTenantMembership,
+  inviteMember,
+  getInvitationByToken,
+  acceptInvitation,
+  removeMember,
 } from '../services/tenant-service'
+import { TenantPermission } from '@shared/schemas'
 import type { CreateTenantInput } from '@shared/schemas'
 
 describe('Tenant Service', () => {
@@ -84,7 +96,7 @@ describe('Tenant Service', () => {
         maxUsers: 5,
         settings: null,
       }
-      const result = await createTenant(input)
+      const result = await createTenant(input, 'test-super-admin-1')
       expect(result.name).toBe('New Corp')
       expect(result.slug).toBe('new-corp')
       expect(result.status).toBe('trial')
@@ -93,13 +105,16 @@ describe('Tenant Service', () => {
 
     it('should reject duplicate slug', async () => {
       await expect(
-        createTenant({
-          name: 'Duplicate',
-          slug: 'demo',
-          plan: 'free',
-          maxUsers: 5,
-          settings: null,
-        })
+        createTenant(
+          {
+            name: 'Duplicate',
+            slug: 'demo',
+            plan: 'free',
+            maxUsers: 5,
+            settings: null,
+          },
+          'test-super-admin-1'
+        )
       ).rejects.toThrow(/already exists/)
     })
   })
@@ -112,13 +127,16 @@ describe('Tenant Service', () => {
 
     it('should update tenant fields', async () => {
       // Create a tenant to update
-      const created = await createTenant({
-        name: 'Update Test',
-        slug: 'update-test',
-        plan: 'free',
-        maxUsers: 5,
-        settings: null,
-      })
+      const created = await createTenant(
+        {
+          name: 'Update Test',
+          slug: 'update-test',
+          plan: 'free',
+          maxUsers: 5,
+          settings: null,
+        },
+        'test-super-admin-1'
+      )
 
       const result = await updateTenant(created.id, { name: 'Updated Name' })
       expect(result).not.toBeNull()
@@ -133,13 +151,16 @@ describe('Tenant Service', () => {
     })
 
     it('should delete and return true', async () => {
-      const created = await createTenant({
-        name: 'Delete Test',
-        slug: 'delete-test',
-        plan: 'free',
-        maxUsers: 5,
-        settings: null,
-      })
+      const created = await createTenant(
+        {
+          name: 'Delete Test',
+          slug: 'delete-test',
+          plan: 'free',
+          maxUsers: 5,
+          settings: null,
+        },
+        'test-super-admin-1'
+      )
 
       const result = await deleteTenant(created.id)
       expect(result).toBe(true)
@@ -150,3 +171,161 @@ describe('Tenant Service', () => {
     })
   })
 })
+
+describe('provisioning & membership (P1)', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  it('createTenant 事务播种 3 个系统角色 + owner 为租户管理员', async () => {
+    const tenant = await createTenant(
+      { name: '开通验证', slug: 'prov-check', plan: 'pro', maxUsers: 20, settings: {} },
+      'test-super-admin-1'
+    )
+    const roles = await getTenantRoles(tenant.id)
+    expect(roles.length).toBe(3)
+    expect(roles.map(r => r.code).sort()).toEqual(['tenant_admin', 'tenant_guest', 'tenant_member'])
+    expect(roles.every(r => r.isSystem)).toBe(true)
+
+    const members = await getTenantMembers(tenant.id)
+    expect(members.length).toBe(1)
+    expect(members[0].userId).toBe('test-super-admin-1')
+    expect(members[0].role?.code).toBe('tenant_admin')
+    expect(members[0].status).toBe('active')
+  })
+
+  it('owner 拥有全部租户权限，陌生人无任何权限', async () => {
+    const tenant = await createTenant(
+      { name: '权限验证', slug: 'perm-check', plan: 'free', maxUsers: 5, settings: {} },
+      'test-super-admin-1'
+    )
+    const ownerPerms = await getUserTenantPermissions('test-super-admin-1', tenant.id)
+    expect(ownerPerms.length).toBeGreaterThan(10)
+    expect(
+      await hasTenantPermission('test-super-admin-1', tenant.id, TenantPermission.MEMBER_INVITE)
+    ).toBe(true)
+    expect(await hasTenantPermission('test-user-2', tenant.id, TenantPermission.DATA_VIEW)).toBe(
+      false
+    )
+    await expect(requireTenantMembership('test-user-2', tenant.id)).rejects.toThrow()
+  })
+
+  it('邀请→接受→成员可见→移除后失权 全链路', async () => {
+    const tenant = await createTenant(
+      { name: '邀请验证', slug: 'invite-check', plan: 'free', maxUsers: 5, settings: {} },
+      'test-super-admin-1'
+    )
+    const guestRole = (await getTenantRoles(tenant.id)).find(r => r.code === 'tenant_guest')!
+
+    const invitation = await inviteMember(
+      tenant.id,
+      'newbie@example.com',
+      guestRole.id,
+      'test-super-admin-1'
+    )
+    expect(invitation.status).toBe('pending')
+    expect(invitation.token.length).toBeGreaterThanOrEqual(32)
+
+    // 公开详情可查（带租户名/角色名）
+    const detail = await getInvitationByToken(invitation.token)
+    expect(detail?.tenantName).toBe('邀请验证')
+    expect(detail?.roleLabel).toBe('访客')
+
+    // 陌生用户接受邀请后成为 guest
+    const member = await acceptInvitation(invitation.token, 'test-user-2')
+    expect(member?.status).toBe('active')
+    expect(await hasTenantPermission('test-user-2', tenant.id, TenantPermission.DATA_VIEW)).toBe(
+      true
+    )
+    expect(
+      await hasTenantPermission('test-user-2', tenant.id, TenantPermission.MEMBER_INVITE)
+    ).toBe(false)
+
+    // 二次接受同一 token 失效
+    const again = await acceptInvitation(invitation.token, 'test-user-3')
+    expect(again).toBeNull()
+
+    // 移除后立即失权
+    await removeMember(tenant.id, member!.id)
+    expect(await hasTenantPermission('test-user-2', tenant.id, TenantPermission.DATA_VIEW)).toBe(
+      false
+    )
+    await expect(requireTenantMembership('test-user-2', tenant.id)).rejects.toThrow()
+  })
+
+  it('套餐角色数配额：free 上限 3，创建第 4 个被拦截', async () => {
+    const tenant = await createTenant(
+      { name: '配额验证', slug: 'quota-check', plan: 'free', maxUsers: 5, settings: {} },
+      'test-super-admin-1'
+    )
+    // 3 个系统角色已占满 free 上限
+    await expect(
+      createTenantRole(tenant.id, {
+        code: 'custom-a',
+        name: 'custom-a',
+        label: '自定义A',
+        description: null,
+        permissions: [TenantPermission.DATA_VIEW],
+      })
+    ).rejects.toThrow(/上限/)
+
+    // 升级 pro 后可继续创建
+    await updateTenant(tenant.id, { plan: 'pro' })
+    const role = await createTenantRole(tenant.id, {
+      code: 'custom-a',
+      name: 'custom-a',
+      label: '自定义A',
+      description: null,
+      permissions: [TenantPermission.DATA_VIEW],
+    })
+    expect(role.isSystem).toBe(false)
+  })
+
+  it('P4：套餐成员配额——满员后邀请被拦截，升级后放行', async () => {
+    // maxUsers=1 的租户：owner 已占 1 席
+    const tiny = await createTenant(
+      { name: '配额租户', slug: 'quota-member', plan: 'free', maxUsers: 1, settings: {} },
+      'test-super-admin-1'
+    )
+    const guestRole = (await getTenantRoles(tiny.id)).find(r => r.code === 'tenant_guest')!
+
+    await expect(
+      inviteMember(tiny.id, 'full@quota.io', guestRole.id, 'test-super-admin-1')
+    ).rejects.toThrow(/上限/)
+
+    // 升级 maxUsers=2 后放行；接受时也过配额
+    await updateTenant(tiny.id, { maxUsers: 2 })
+    const inv = await inviteMember(tiny.id, 'full@quota.io', guestRole.id, 'test-super-admin-1')
+    const member = await acceptInvitation(inv.token, 'test-user-4')
+    expect(member?.status).toBe('active')
+
+    // 满员（2/2）后再邀新邮箱 → 拦截
+    await expect(
+      inviteMember(tiny.id, 'overflow@quota.io', guestRole.id, 'test-super-admin-1')
+    ).rejects.toThrow(/上限/)
+  })
+
+  it('P4：接受时二次校验——邀请有效期内满员则接受被拦截', async () => {
+    const t = await createTenant(
+      { name: '二次校验', slug: 'quota-accept', plan: 'free', maxUsers: 2, settings: {} },
+      'test-super-admin-1'
+    )
+    const guestRole = (await getTenantRoles(t.id)).find(r => r.code === 'tenant_guest')!
+    const inv = await inviteMember(t.id, 'late@quota.io', guestRole.id, 'test-super-admin-1')
+
+    // 邀请发出后把 maxUsers 降到 1（owner 已满员）
+    await updateTenant(t.id, { maxUsers: 1 })
+    await expect(acceptInvitation(inv.token, 'test-user-5')).rejects.toThrow(/上限/)
+  })
+
+  it('getUserTenants 只返回本人 active 成员的租户', async () => {
+    const mine = await getUserTenants('test-super-admin-1')
+    expect(mine.length).toBeGreaterThanOrEqual(2) // demo 种子 + 本组新建
+    expect(mine.every(t => t.slug)).toBe(true)
+    expect((await getUserTenants('test-user-2')).length).toBe(0)
+  })
+})

package/template/src/server/module-tenant/module.ts

@@ -22,7 +22,7 @@ const tenantManifest: ModuleManifest = {
   clientPages: [],
 
   dbSchemas: {
-    files: ['tenants'],
+    files: ['tenants', 'tenant-roles', 'tenant-members', 'tenant-invitations'],
     hasSeed: true,
     seed: { serviceFile: 'tenant-service', functionName: 'seedTenantsIfEmpty' },
   },