create-lumal-admin 0.0.5-beta → 0.0.6-beta

package/templates/modes/http/tests/http.test.ts.template

@@ -1,165 +1,218 @@
 // @vitest-environment node
-import type { AddressInfo } from 'node:net'
-import { createServer } from 'node:http'
-import { setTimeout as delay } from 'node:timers/promises'
-import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
-import { createHttpBackend } from '../src/services/data-source'
-import { createApplicationSession } from '../src/services/session-runtime'
+import type { AddressInfo } from 'node:net';
+import { createServer } from 'node:http';
+import { setTimeout as delay } from 'node:timers/promises';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest';
+import { createHttpBackend } from '../src/app/services/data-source';
+import { createApplicationSession } from '../src/app/services/session-runtime';
 
-const tokens = new Map<string, string>()
-const refreshTokens = new Map<string, string>()
-const expired = new Set<string>()
-const calls = new Map<string, number>()
-let failRefresh = false
-let failLogout = false
-let baseURL = ''
+const tokens = new Map<string, string>();
+const refreshTokens = new Map<string, string>();
+const expired = new Set<string>();
+const calls = new Map<string, number>();
+let failRefresh = false;
+let failLogout = false;
+let failAccess = false;
+let menuPayload: unknown;
+let baseURL = '';
 const server = createServer(async (request, response) => {
-  const path = new URL(request.url!, 'http://localhost').pathname
-  calls.set(path, (calls.get(path) ?? 0) + 1)
-  let body = ''
-  for await (const part of request)
-    body += String(part)
-  const input = body ? JSON.parse(body) as Record<string, string> : {}
-  const token = request.headers.authorization?.replace('Bearer ', '') ?? ''
+  const path = new URL(request.url!, 'http://localhost').pathname;
+  calls.set(path, (calls.get(path) ?? 0) + 1);
+  let body = '';
+  for await (const part of request) body += String(part);
+  const input = body ? (JSON.parse(body) as Record<string, string>) : {};
+  const token = request.headers.authorization?.replace('Bearer ', '') ?? '';
   function send(data: unknown, status = 200) {
-    response.writeHead(status, { 'content-type': 'application/json' })
-    response.end(JSON.stringify(data))
+    response.writeHead(status, { 'content-type': 'application/json' });
+    response.end(JSON.stringify(data));
   }
   function issue(username: string) {
-    const accessToken = crypto.randomUUID()
-    const refreshToken = crypto.randomUUID()
-    tokens.set(accessToken, username)
-    refreshTokens.set(refreshToken, username)
-    return { accessToken, refreshToken }
+    const accessToken = crypto.randomUUID();
+    const refreshToken = crypto.randomUUID();
+    tokens.set(accessToken, username);
+    refreshTokens.set(refreshToken, username);
+    return { accessToken, refreshToken };
   }
   if (path === '/auth/login') {
-    if (input.password !== 'valid')
-      return send({ message: '登录失败' }, 401)
-    return send(issue(input.username!))
+    if (input.password !== 'valid') return send({ message: '登录失败' }, 401);
+    return send(issue(input.username!));
   }
   if (path === '/auth/refresh') {
-    await delay(40)
-    const username = refreshTokens.get(input.refreshToken!)
-    return !failRefresh && username ? send(issue(username)) : send({ message: '刷新失败' }, 401)
+    await delay(40);
+    const username = refreshTokens.get(input.refreshToken!);
+    return !failRefresh && username ? send(issue(username)) : send({ message: '刷新失败' }, 401);
   }
-  const username = tokens.get(token)
-  if (!username || expired.has(token))
-    return send({ message: '已过期' }, 401)
-  if (path === '/session/me')
-    return send({ id: username, name: username, username })
+  const username = tokens.get(token);
+  if (!username || expired.has(token)) return send({ message: '已过期' }, 401);
+  if (path === '/session/me') return send({ id: username, name: username, username });
   if (path === '/session/access')
-    return send({ roles: [username], permissions: [`${username}:read`] })
+    return failAccess
+      ? send({ message: '权限读取失败' }, 503)
+      : send({ roles: [username], permissions: [`${username}:read`] });
   if (path === '/menus')
-    return send([{ path: '/deep', name: 'Deep', component: 'dashboard/index', meta: { title: username } }])
+    return send(
+      menuPayload ?? [{ path: '/deep', name: 'Deep', component: 'dashboard/index', meta: { title: username } }],
+    );
   if (path === '/auth/logout') {
-    tokens.delete(token)
-    return send({}, failLogout ? 503 : 200)
+    tokens.delete(token);
+    return send({}, failLogout ? 503 : 200);
   }
-  if (path.startsWith('/system/'))
-    return send({ items: [{ id: '1', owner: username }], total: 1 })
-  send({}, 404)
-})
+  if (path.startsWith('/system/')) return send({ items: [{ id: '1', owner: username }], total: 1 });
+  send({}, 404);
+});
 beforeAll(async () => {
-  await new Promise<void>(done => server.listen(0, '127.0.0.1', done))
-  baseURL = `http://127.0.0.1:${(server.address() as AddressInfo).port}`
-})
+  await new Promise<void>((done) => server.listen(0, '127.0.0.1', done));
+  baseURL = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
+});
 beforeEach(() => {
-  calls.clear()
-  tokens.clear()
-  refreshTokens.clear()
-  expired.clear()
-  failRefresh = false
-  failLogout = false
-})
+  calls.clear();
+  tokens.clear();
+  refreshTokens.clear();
+  expired.clear();
+  failRefresh = false;
+  failLogout = false;
+  failAccess = false;
+  menuPayload = undefined;
+});
 afterAll(async () => {
-  server.closeAllConnections()
-  await new Promise<void>((done, reject) => server.close(error => error ? reject(error) : done()))
-})
+  server.closeAllConnections();
+  await new Promise<void>((done, reject) => server.close((error) => (error ? reject(error) : done())));
+});
 function memoryStorage(): Storage {
-  const values = new Map<string, string>()
+  const values = new Map<string, string>();
   return {
-    getItem: key => values.get(key) ?? null,
-    setItem: (key, value) => { values.set(key, value) },
-    removeItem: (key) => { values.delete(key) },
+    getItem: (key) => values.get(key) ?? null,
+    setItem: (key, value) => {
+      values.set(key, value);
+    },
+    removeItem: (key) => {
+      values.delete(key);
+    },
     clear: () => values.clear(),
-    key: index => [...values.keys()][index] ?? null,
-    get length() { return values.size },
-  }
+    key: (index) => [...values.keys()][index] ?? null,
+    get length() {
+      return values.size;
+    },
+  };
 }
 function application(url = baseURL) {
-  const storage = memoryStorage()
-  return createApplicationSession(context => createHttpBackend(context, url), storage, storage)
+  const storage = memoryStorage();
+  return createApplicationSession((context) => createHttpBackend(context, url), storage, storage);
 }
 describe('真实 HTTP 应用服务', () => {
+  it('权限重读失败清理旧授权，保留凭据以供显式重试且并发刷新单飞', async () => {
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    const token = app.session.getToken();
+    failAccess = true;
+    const failed = app.refreshAccess();
+    expect(app.refreshAccess()).toBe(failed);
+    await expect(failed).rejects.toThrow('权限读取失败');
+    expect(app.permissionStore.permissions).toEqual([]);
+    expect(app.menus.value).toEqual([]);
+    expect(app.ready.value).toBe(false);
+    expect(app.session.getToken()).toBe(token);
+    failAccess = false;
+    await app.refreshAccess();
+    expect(app.ready.value).toBe(true);
+    expect(app.permissionStore.permissions).toEqual(['alice:read']);
+  });
+  it.each([
+    { component: 'constructor' },
+    { component: '__proto__' },
+    { component: 'not-registered' },
+    { meta: { externalLink: 'javascript:alert(1)' } },
+    { meta: { externalLink: '//evil.invalid' } },
+    { meta: { authority: [7] } },
+  ])('真实 HTTP 下发的恶意子菜单拒绝初始化 %j', async (invalid) => {
+    menuPayload = [
+      {
+        path: '/remote',
+        name: 'Remote',
+        children: [{ path: '/remote/page', name: 'RemotePage', component: 'dashboard/index', ...invalid }],
+      },
+    ];
+    const app = application();
+    await expect(app.login({ username: 'alice', password: 'valid' })).rejects.toThrow();
+    expect(app.ready.value).toBe(false);
+    expect(app.menus.value).toEqual([]);
+    expect(app.isAuthenticated()).toBe(false);
+  });
   it('配置缺失明确失败，不产生演示会话', async () => {
-    const app = application('')
-    await expect(app.login({ username: 'alice', password: 'valid' })).rejects.toThrow('VITE_API_BASE_URL')
-    expect(app.isAuthenticated()).toBe(false)
-    expect(calls.size).toBe(0)
-  })
+    const app = application('');
+    await expect(app.login({ username: 'alice', password: 'valid' })).rejects.toThrow('VITE_API_BASE_URL');
+    expect(app.isAuthenticated()).toBe(false);
+    expect(calls.size).toBe(0);
+  });
   it('登录失败、成功、用户权限菜单与真实 CRUD 请求', async () => {
-    const app = application()
-    await expect(app.login({ username: 'alice', password: 'wrong' })).rejects.toThrow()
-    expect(app.currentUser.value).toBeNull()
-    await app.login({ username: 'alice', password: 'valid' })
-    expect(app.ready.value).toBe(true)
-    expect(app.currentUser.value?.username).toBe('alice')
-    expect(app.permissionStore.permissions).toEqual(['alice:read'])
-    expect(app.permissionStore.roles).toEqual(['alice'])
-    expect(app.menus.value[0]?.path).toBe('/deep')
-    expect(await app.service.list('users', { page: 1, pageSize: 10, query: {} })).toEqual({ items: [{ id: '1', owner: 'alice' }], total: 1 })
-    await Promise.all([app.initialize(), app.initialize()])
-    expect(calls.get('/session/me')).toBe(1)
-  })
+    const app = application();
+    await expect(app.login({ username: 'alice', password: 'wrong' })).rejects.toThrow('登录失败');
+    expect(app.currentUser.value).toBeNull();
+    await app.login({ username: 'alice', password: 'valid' });
+    expect(app.ready.value).toBe(true);
+    expect(app.currentUser.value?.username).toBe('alice');
+    expect(app.permissionStore.permissions).toEqual(['alice:read']);
+    expect(app.permissionStore.roles).toEqual(['alice']);
+    expect(app.menus.value[0]?.path).toBe('/deep');
+    expect(await app.service.list('users', { page: 1, pageSize: 10, query: {} })).toEqual({
+      items: [{ id: '1', owner: 'alice' }],
+      total: 1,
+    });
+    await Promise.all([app.initialize(), app.initialize()]);
+    expect(calls.get('/session/me')).toBe(1);
+  });
   it('401 并发请求只刷新一次，重放使用新凭据', async () => {
-    const app = application()
-    await app.login({ username: 'alice', password: 'valid' })
-    expired.add(app.session.getToken()!)
-    const signal = new AbortController().signal
-    const [user, access, menus] = await Promise.all([app.service.getUser(signal), app.service.getAccess(signal), app.service.getMenus(signal)])
-    expect(user.username).toBe('alice')
-    expect(access.permissions).toEqual(['alice:read'])
-    expect(menus[0]?.path).toBe('/deep')
-    expect(calls.get('/auth/refresh')).toBe(1)
-    expect(calls.get('/session/me')).toBe(3)
-  })
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    expired.add(app.session.getToken()!);
+    const signal = new AbortController().signal;
+    const [user, access, menus] = await Promise.all([
+      app.service.getUser(signal),
+      app.service.getAccess(signal),
+      app.service.getMenus(signal),
+    ]);
+    expect(user.username).toBe('alice');
+    expect(access.permissions).toEqual(['alice:read']);
+    expect(menus[0]?.path).toBe('/deep');
+    expect(calls.get('/auth/refresh')).toBe(1);
+    expect(calls.get('/session/me')).toBe(3);
+  });
   it('刷新失败清理凭据、权限、菜单、标签和动态状态回调', async () => {
-    const app = application()
-    await app.login({ username: 'alice', password: 'valid' })
-    let resets = 0
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    let resets = 0;
     app.onReset(() => {
-      resets += 1
-    })
-    expired.add(app.session.getToken()!)
-    failRefresh = true
-    await expect(app.service.getUser(new AbortController().signal)).rejects.toThrow()
-    expect(app.isAuthenticated()).toBe(false)
-    expect(app.currentUser.value).toBeNull()
-    expect(app.menus.value).toEqual([])
-    expect(app.permissionStore.permissions).toEqual([])
-    expect(resets).toBe(1)
-  })
+      resets += 1;
+    });
+    expired.add(app.session.getToken()!);
+    failRefresh = true;
+    await expect(app.service.getUser(new AbortController().signal)).rejects.toThrow();
+    expect(app.isAuthenticated()).toBe(false);
+    expect(app.currentUser.value).toBeNull();
+    expect(app.menus.value).toEqual([]);
+    expect(app.permissionStore.permissions).toEqual([]);
+    expect(resets).toBe(1);
+  });
   it('退出接口失败不保留本地身份', async () => {
-    const app = application()
-    await app.login({ username: 'alice', password: 'valid' })
-    failLogout = true
-    await expect(app.logout()).rejects.toThrow()
-    expect(app.isAuthenticated()).toBe(false)
-    expect(app.permissionStore.roles).toEqual([])
-    expect(calls.get('/auth/logout')).toBe(1)
-  })
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    failLogout = true;
+    await expect(app.logout()).rejects.toThrow();
+    expect(app.isAuthenticated()).toBe(false);
+    expect(app.permissionStore.roles).toEqual([]);
+    expect(calls.get('/auth/logout')).toBe(1);
+  });
   it('刷新在途时切换账号，旧响应不能污染新用户', async () => {
-    const app = application()
-    await app.login({ username: 'alice', password: 'valid' })
-    expired.add(app.session.getToken()!)
-    const old = app.service.getUser(new AbortController().signal).catch(error => error)
-    while (!calls.get('/auth/refresh'))
-      await delay(1)
-    await app.login({ username: 'bob', password: 'valid' })
-    await old
-    await delay(50)
-    expect(app.currentUser.value?.username).toBe('bob')
-    expect(app.permissionStore.permissions).toEqual(['bob:read'])
-    expect(app.ready.value).toBe(true)
-  })
-})
+    const app = application();
+    await app.login({ username: 'alice', password: 'valid' });
+    expired.add(app.session.getToken()!);
+    const old = app.service.getUser(new AbortController().signal).catch((error) => error);
+    while (!calls.get('/auth/refresh')) await delay(1);
+    await app.login({ username: 'bob', password: 'valid' });
+    await old;
+    await delay(50);
+    expect(app.currentUser.value?.username).toBe('bob');
+    expect(app.permissionStore.permissions).toEqual(['bob:read']);
+    expect(app.ready.value).toBe(true);
+  });
+});

package/templates/modes/local/src/app/services/data-source.ts

@@ -0,0 +1,113 @@
+import type {
+  AccessSnapshot,
+  ApplicationService,
+  BusinessRequest,
+  CurrentUser,
+  DataRow,
+  HttpMethod,
+  ServiceContext,
+} from './contracts';
+import type { LocalModule } from './local-contracts';
+import { object, stringArray } from '../menu-policy';
+import { permissionCodes, viewComponents } from '../router/views';
+import { buildStoredMenus } from '../stored-menus';
+import { createLocalDatabase } from './local-database';
+
+export const demoAccount = import.meta.env.DEV ? { username: 'admin', password: 'lumal123' } : null;
+const localModules = import.meta.glob<LocalModule>(['../../modules/*/local.ts', '../../modules/business/*/local.ts']);
+
+export function createBackend(context: ServiceContext): ApplicationService {
+  const db = createLocalDatabase();
+  let ownedToken = '';
+  let handlers: Promise<ReturnType<LocalModule['createLocalHandler']>[]> | undefined;
+  function assertDemo(): void {
+    if (import.meta.env.PROD && import.meta.env.VITE_ENABLE_LOCAL_DEMO !== 'true')
+      throw new Error('生产环境已禁用本地演示，请使用 HTTP 模式或显式启用演示');
+    context.getSignal().throwIfAborted();
+  }
+  function account(): DataRow {
+    assertDemo();
+    const token = context.getSession()?.accessToken ?? '';
+    const raw = sessionStorage.getItem(`demo:${token}`);
+    if (!raw) throw new Error('本地演示会话已失效');
+    const identity = object(JSON.parse(raw));
+    const user = db.read('users').find((row) => row.id === identity.id);
+    if (!user || user.status !== 'enabled') throw new Error('本地账号已停用或删除，请重新登录');
+    ownedToken = token;
+    return user;
+  }
+  function user(): CurrentUser {
+    const current = account();
+    return { id: String(current.id), username: String(current.username), name: String(current.nickname) };
+  }
+  function access(): AccessSnapshot {
+    const current = account();
+    const assigned = stringArray(current.roles);
+    const roles = db.read('roles').filter((row) => assigned.includes(String(row.code)) && row.status === 'enabled');
+    return {
+      roles: roles.map((row) => String(row.code)),
+      permissions: [...new Set(roles.flatMap((row) => stringArray(row.permissions)))].filter((code) =>
+        permissionCodes.includes(code),
+      ),
+    };
+  }
+  function assertPermission(code: string): void {
+    if (!access().permissions.includes(code)) throw new Error(`无操作权限：${code}`);
+  }
+  async function businessRequest<T>(method: HttpMethod, path: string, input: BusinessRequest = {}): Promise<T> {
+    user();
+    const signal = context.getSignal();
+    handlers ??= Promise.all(
+      Object.values(localModules).map(async (load) =>
+        (await load()).createLocalHandler({ db, user, assertPermission }),
+      ),
+    );
+    const handler = (await handlers).find((item) => item.handles(path));
+    signal.throwIfAborted();
+    if (handler) return (await handler.request(method, path, input)) as T;
+    throw new Error(`本地数据源不支持此业务接口：${method} ${path}`);
+  }
+  return {
+    request: businessRequest,
+    async login(input, signal) {
+      assertDemo();
+      signal.throwIfAborted();
+      const found = db.read('users').find((row) => row.username === input.username);
+      if (!found || found.status !== 'enabled' || input.password !== found.password)
+        throw new Error('账号或密码不正确');
+      ownedToken = crypto.randomUUID();
+      sessionStorage.setItem(`demo:${ownedToken}`, JSON.stringify({ id: found.id }));
+      return { accessToken: ownedToken };
+    },
+    getUser: async (signal) => {
+      signal.throwIfAborted();
+      return user();
+    },
+    getAccess: async (signal) => {
+      signal.throwIfAborted();
+      return access();
+    },
+    getMenus: async (signal) => {
+      signal.throwIfAborted();
+      user();
+      return buildStoredMenus(db.read('menus'), viewComponents);
+    },
+    logout: async (token) => {
+      sessionStorage.removeItem(`demo:${token}`);
+    },
+    clearCache() {
+      if (ownedToken) sessionStorage.removeItem(`demo:${ownedToken}`);
+      ownedToken = '';
+      handlers = undefined;
+    },
+    list: (resource, input) =>
+      businessRequest('GET', `/system/${resource}`, {
+        query: { page: input.page, pageSize: input.pageSize, ...input.query } as BusinessRequest['query'],
+      }),
+    save: (resource, model, id) =>
+      businessRequest(id ? 'PUT' : 'POST', `/system/${resource}${id ? `/${encodeURIComponent(id)}` : ''}`, {
+        body: model,
+      }),
+    remove: (resource, id) => businessRequest('DELETE', `/system/${resource}/${encodeURIComponent(id)}`),
+  };
+}

package/templates/modes/local/src/app/services/local-database.ts

@@ -0,0 +1,67 @@
+import type { DataRow } from './contracts';
+import type { LocalDatabase } from './local-contracts';
+import { localMenus, permissionCodes } from '../router/views';
+import { seedMenuRows } from '../stored-menus';
+
+// 仅开发用途。存储和校验不能替代生产后端的认证、授权与密码散列。
+export function createLocalDatabase(): LocalDatabase {
+  const initial: Record<string, DataRow[]> = {
+    users: [
+      {
+        id: 'admin',
+        username: 'admin',
+        nickname: '管理员',
+        organizationId: 'root',
+        roles: ['admin'],
+        status: 'enabled',
+        phone: '',
+        createdAt: '',
+        password: 'lumal123',
+      },
+      {
+        id: 'guest',
+        username: 'guest',
+        nickname: '访客',
+        organizationId: 'root',
+        roles: ['guest'],
+        status: 'enabled',
+        phone: '',
+        createdAt: '',
+        password: 'lumal123',
+      },
+    ],
+    roles: [
+      {
+        id: 'admin',
+        code: 'admin',
+        name: '管理员',
+        description: '内置管理员',
+        builtIn: true,
+        status: 'enabled',
+        permissions: permissionCodes,
+      },
+      {
+        id: 'guest',
+        code: 'guest',
+        name: '访客',
+        description: '默认访客',
+        builtIn: true,
+        status: 'enabled',
+        permissions: [],
+      },
+    ],
+    menus: seedMenuRows(localMenus),
+  };
+  return {
+    read<T extends DataRow>(resource: string, fallback?: () => T[]): T[] {
+      const raw = localStorage.getItem(`demo:system:${resource}`);
+      const value: unknown = raw ? JSON.parse(raw) : structuredClone(initial[resource] ?? fallback?.() ?? []);
+      if (!Array.isArray(value) || value.some((row) => !row || typeof row !== 'object' || Array.isArray(row)))
+        throw new Error(`本地演示数据损坏：${resource}`);
+      return value as T[];
+    },
+    write(resource, rows) {
+      localStorage.setItem(`demo:system:${resource}`, JSON.stringify(rows));
+    },
+  };
+}