create-windy 0.1.0

package/template/apps/server/src/auth/repository.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+import { InMemoryAuthRepository } from "./repository.js";
+
+describe("auth repository active sessions", () => {
+  test("只返回活跃窗口内未过期且未撤销的有效用户会话", async () => {
+    const now = new Date("2026-07-14T10:00:00.000Z");
+    const repository = new InMemoryAuthRepository([
+      {
+        id: "user_1",
+        username: "admin",
+        displayName: "管理员",
+        status: "active",
+        credentialState: "active",
+        roleCodes: [],
+        permissionKeys: [],
+      },
+    ]);
+    await Promise.all([
+      repository.createSession({
+        id: "session_online",
+        userId: "user_1",
+        tokenHash: "hash_online",
+        status: "active",
+        issuedAt: new Date("2026-07-14T09:00:00.000Z"),
+        lastSeenAt: new Date("2026-07-14T09:55:00.000Z"),
+        expiresAt: new Date("2026-07-14T18:00:00.000Z"),
+        ip: "10.0.0.8",
+      }),
+      repository.createSession({
+        id: "session_stale",
+        userId: "user_1",
+        tokenHash: "hash_stale",
+        status: "active",
+        issuedAt: new Date("2026-07-14T08:00:00.000Z"),
+        lastSeenAt: new Date("2026-07-14T09:30:00.000Z"),
+        expiresAt: new Date("2026-07-14T18:00:00.000Z"),
+      }),
+      repository.createSession({
+        id: "session_revoked",
+        userId: "user_1",
+        tokenHash: "hash_revoked",
+        status: "revoked",
+        issuedAt: new Date("2026-07-14T09:50:00.000Z"),
+        expiresAt: new Date("2026-07-14T18:00:00.000Z"),
+        revokedAt: new Date("2026-07-14T09:58:00.000Z"),
+      }),
+    ]);
+
+    const sessions = await repository.listActiveSessions(
+      now,
+      new Date("2026-07-14T09:45:00.000Z"),
+    );
+
+    expect(sessions).toHaveLength(1);
+    expect(sessions[0]).toMatchObject({
+      sessionId: "session_online",
+      username: "admin",
+      ip: "10.0.0.8",
+    });
+  });
+});

package/template/apps/server/src/auth/repository.ts

@@ -0,0 +1,305 @@
+import type { RequestActor } from "../guards.js";
+import type { CredentialState, UserProfileUpdate } from "@windy/shared";
+import type { DataAccessRolePolicy } from "../data-access/context.js";
+import { buildActorScopeContexts } from "../data-access/context.js";
+
+export interface AuthUserRecord {
+  id: string;
+  username: string;
+  displayName: string;
+  email?: string;
+  phone?: string;
+  passwordHash?: string;
+  credentialState: CredentialState;
+  passwordChangedAt?: Date;
+  status: string;
+  roleCodes: string[];
+  permissionKeys: string[];
+  departmentId?: string;
+  dataAccessRoles?: DataAccessRolePolicy[];
+}
+
+export interface AuthSessionRecord {
+  id: string;
+  userId: string;
+  tokenHash: string;
+  status: string;
+  issuedAt: Date;
+  expiresAt: Date;
+  revokedAt?: Date;
+  lastSeenAt?: Date;
+  ip?: string;
+  userAgent?: string;
+}
+
+export interface ActiveAuthSession {
+  sessionId: string;
+  userId: string;
+  username: string;
+  displayName: string;
+  ip?: string;
+  issuedAt: Date;
+  lastSeenAt?: Date;
+  expiresAt: Date;
+}
+
+export interface PasswordCredentialUpdate {
+  passwordHash: string;
+  credentialState: CredentialState;
+  passwordChangedAt?: Date;
+}
+
+export interface AuthRepository {
+  findUserByUsername(username: string): Promise<AuthUserRecord | undefined>;
+  findUserByReference(reference: string): Promise<AuthUserRecord | undefined>;
+  createSession(session: AuthSessionRecord): Promise<void>;
+  findSessionById(id: string): Promise<AuthSessionRecord | undefined>;
+  findSessionByTokenHash(
+    tokenHash: string,
+  ): Promise<AuthSessionRecord | undefined>;
+  resolveSessionActor(
+    tokenHash: string,
+    now: Date,
+  ): Promise<RequestActor | undefined>;
+  listActiveSessions(
+    now: Date,
+    activeSince: Date,
+  ): Promise<ActiveAuthSession[]>;
+  listUserSessions(userId: string, now: Date): Promise<AuthSessionRecord[]>;
+  updateUserPassword(
+    userId: string,
+    update: PasswordCredentialUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<boolean>;
+  updateUserProfile(
+    userId: string,
+    input: UserProfileUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<AuthUserRecord | undefined>;
+  revokeSession(id: string, revokedAt: Date): Promise<boolean>;
+  revokeUserSessions(
+    userId: string,
+    revokedAt: Date,
+    excludedSessionId?: string,
+  ): Promise<number>;
+}
+
+export class InMemoryAuthRepository implements AuthRepository {
+  private readonly users = new Map<string, AuthUserRecord>();
+  private readonly sessions = new Map<string, AuthSessionRecord>();
+
+  constructor(users: AuthUserRecord[] = []) {
+    for (const user of users) {
+      this.users.set(user.id, structuredClone(user));
+    }
+  }
+
+  async findUserByUsername(
+    username: string,
+  ): Promise<AuthUserRecord | undefined> {
+    const user = [...this.users.values()].find(
+      (item) => item.username === username,
+    );
+    return user ? structuredClone(user) : undefined;
+  }
+
+  async findUserByReference(
+    reference: string,
+  ): Promise<AuthUserRecord | undefined> {
+    const user = [...this.users.values()].find(
+      (item) => item.id === reference || item.username === reference,
+    );
+    return user ? structuredClone(user) : undefined;
+  }
+
+  async createSession(session: AuthSessionRecord): Promise<void> {
+    this.sessions.set(session.id, structuredClone(session));
+  }
+
+  async findSessionById(id: string): Promise<AuthSessionRecord | undefined> {
+    const session = this.sessions.get(id);
+    return session ? structuredClone(session) : undefined;
+  }
+
+  async findSessionByTokenHash(
+    tokenHash: string,
+  ): Promise<AuthSessionRecord | undefined> {
+    const session = [...this.sessions.values()].find(
+      (item) => item.tokenHash === tokenHash,
+    );
+    return session ? structuredClone(session) : undefined;
+  }
+
+  async resolveSessionActor(
+    tokenHash: string,
+    now: Date,
+  ): Promise<RequestActor | undefined> {
+    const session = await this.findSessionByTokenHash(tokenHash);
+    if (!isUsableSession(session, now)) {
+      return undefined;
+    }
+    const user = this.users.get(session.userId);
+    if (!user || user.status !== "active") {
+      return undefined;
+    }
+    const current = this.sessions.get(session.id);
+    if (current) {
+      current.lastSeenAt = now;
+    }
+    return {
+      id: user.id,
+      type: "user",
+      name: user.displayName,
+      username: user.username,
+      displayName: user.displayName,
+      email: user.email,
+      phone: user.phone,
+      credentialState: user.credentialState,
+      passwordChangedAt: user.passwordChangedAt?.toISOString(),
+      roleCodes: [...user.roleCodes].sort(),
+      permissionKeys: [...user.permissionKeys].sort(),
+      ...buildActorScopeContexts(
+        user.id,
+        user.departmentId,
+        user.dataAccessRoles || [],
+      ),
+    };
+  }
+
+  async updateUserPassword(
+    userId: string,
+    update: PasswordCredentialUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<boolean> {
+    void updatedAt;
+    void updatedBy;
+    const user = this.users.get(userId);
+    if (!user) {
+      return false;
+    }
+    user.passwordHash = update.passwordHash;
+    user.credentialState = update.credentialState;
+    user.passwordChangedAt = update.passwordChangedAt;
+    return true;
+  }
+
+  async updateUserProfile(
+    userId: string,
+    input: UserProfileUpdate,
+    updatedAt: Date,
+    updatedBy: string,
+  ): Promise<AuthUserRecord | undefined> {
+    void updatedAt;
+    void updatedBy;
+    const user = this.users.get(userId);
+    if (!user) return undefined;
+    user.displayName = input.displayName;
+    user.email = input.email;
+    user.phone = input.phone;
+    return structuredClone(user);
+  }
+
+  async listActiveSessions(
+    now: Date,
+    activeSince: Date,
+  ): Promise<ActiveAuthSession[]> {
+    return [...this.sessions.values()]
+      .filter((session) => {
+        const activityAt = session.lastSeenAt || session.issuedAt;
+        return (
+          isUsableSession(session, now) &&
+          activityAt.getTime() >= activeSince.getTime()
+        );
+      })
+      .flatMap((session) => {
+        const user = this.users.get(session.userId);
+        return user?.status === "active"
+          ? [
+              {
+                sessionId: session.id,
+                userId: user.id,
+                username: user.username,
+                displayName: user.displayName,
+                ip: session.ip,
+                issuedAt: session.issuedAt,
+                lastSeenAt: session.lastSeenAt,
+                expiresAt: session.expiresAt,
+              },
+            ]
+          : [];
+      })
+      .sort(
+        (left, right) =>
+          (right.lastSeenAt || right.issuedAt).getTime() -
+          (left.lastSeenAt || left.issuedAt).getTime(),
+      );
+  }
+
+  async listUserSessions(
+    userId: string,
+    now: Date,
+  ): Promise<AuthSessionRecord[]> {
+    return [...this.sessions.values()]
+      .filter(
+        (session) => session.userId === userId && isUsableSession(session, now),
+      )
+      .sort(
+        (left, right) =>
+          (right.lastSeenAt || right.issuedAt).getTime() -
+          (left.lastSeenAt || left.issuedAt).getTime(),
+      )
+      .map((session) => structuredClone(session));
+  }
+
+  async revokeSession(id: string, revokedAt: Date): Promise<boolean> {
+    const session = this.sessions.get(id);
+    if (!session || session.status !== "active" || session.revokedAt) {
+      return false;
+    }
+    session.status = "revoked";
+    session.revokedAt = revokedAt;
+    return true;
+  }
+
+  async revokeUserSessions(
+    userId: string,
+    revokedAt: Date,
+    excludedSessionId?: string,
+  ): Promise<number> {
+    let revoked = 0;
+    for (const session of this.sessions.values()) {
+      if (
+        session.userId === userId &&
+        session.id !== excludedSessionId &&
+        session.status === "active" &&
+        !session.revokedAt
+      ) {
+        session.status = "revoked";
+        session.revokedAt = revokedAt;
+        revoked += 1;
+      }
+    }
+    return revoked;
+  }
+
+  storedSessions(): AuthSessionRecord[] {
+    return [...this.sessions.values()].map((session) =>
+      structuredClone(session),
+    );
+  }
+}
+
+function isUsableSession(
+  session: AuthSessionRecord | undefined,
+  now: Date,
+): session is AuthSessionRecord {
+  return Boolean(
+    session &&
+    session.status === "active" &&
+    !session.revokedAt &&
+    session.expiresAt.getTime() > now.getTime(),
+  );
+}

package/template/apps/server/src/auth/routes.test.ts

@@ -0,0 +1,350 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import type { AuditEvent } from "@windy/shared";
+import { Elysia } from "elysia";
+import { createServerRuntime } from "../runtime.js";
+import { RepositoryActorResolver } from "./actor-resolver.js";
+import { argon2PasswordHasher } from "./password.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
+import { AuthService } from "./service.js";
+
+let passwordHash = "";
+
+beforeAll(async () => {
+  passwordHash = await argon2PasswordHasher.hash("test-only-password");
+});
+
+describe("platform auth API", () => {
+  test("会话探测只返回当前 Actor，不暴露 Token", async () => {
+    const fixture = authFixture([activeUser()]);
+    const anonymous = await fixture.app.handle(
+      new Request("http://localhost/api/auth/session"),
+    );
+    expect(anonymous.status).toBe(401);
+    expect(anonymous.headers.get("cache-control")).toBe("no-store");
+
+    const current = await login(fixture.app, "admin");
+    const session = await fixture.app.handle(
+      apiRequest("/api/auth/session", current.token),
+    );
+    const body = (await session.json()) as Record<string, unknown>;
+
+    expect(session.status).toBe(200);
+    expect(session.headers.get("cache-control")).toBe("no-store");
+    expect(body).toMatchObject({
+      actor: {
+        id: "user_admin",
+        name: "平台管理员",
+        username: "admin",
+        displayName: "平台管理员",
+        phone: "13800138000",
+        roleCodes: ["developer"],
+        permissionKeys: ["system.audit.read", "system.user.manage"],
+      },
+    });
+    expect(JSON.stringify(body)).not.toContain(current.token);
+  });
+
+  test("Admin 登录只签发 Cookie，独立 API 登录才返回 Bearer Token", async () => {
+    const fixture = authFixture([activeUser()]);
+    const browserLogin = await fixture.app.handle(
+      jsonRequest("/api/auth/login", {
+        username: "admin",
+        password: "test-only-password",
+      }),
+    );
+    const browserBody = (await browserLogin.json()) as Record<string, unknown>;
+    const browserCookie = browserLogin.headers.get("set-cookie") || "";
+    const browserToken = readCookieValue(browserCookie, "windy.sid");
+
+    expect(browserLogin.status).toBe(200);
+    expect(browserBody).not.toHaveProperty("token");
+    expect(browserBody).not.toHaveProperty("tokenType");
+    expect(browserCookie).toContain("HttpOnly");
+    expect(browserCookie).toContain("SameSite=Strict");
+    expect(browserToken).toBeString();
+
+    const apiLogin = await fixture.app.handle(
+      jsonRequest("/api/auth/api/login", {
+        username: "admin",
+        password: "test-only-password",
+      }),
+    );
+    const apiBody = (await apiLogin.json()) as {
+      token: string;
+      sessionId: string;
+      expiresAt: string;
+    };
+
+    expect(apiLogin.status).toBe(200);
+    expect(apiBody.token).toBeString();
+    expect(apiLogin.headers.get("set-cookie")).toBeNull();
+    expect(
+      fixture.repository
+        .storedSessions()
+        .every(({ tokenHash }) => tokenHash.length === 64),
+    ).toBe(true);
+    expect(JSON.stringify(fixture.events)).not.toContain(apiBody.token);
+    expect(JSON.stringify(fixture.events)).not.toContain(browserToken);
+
+    const bearerContext = await fixture.runtime.createGuardContext(
+      apiRequest("/api/foundation", apiBody.token),
+    );
+    expect(bearerContext.actor).toMatchObject({
+      id: "user_admin",
+      permissionKeys: ["system.audit.read", "system.user.manage"],
+    });
+    const cookieContext = await fixture.runtime.createGuardContext(
+      new Request("http://localhost/api/foundation", {
+        headers: { cookie: `windy.sid=${browserToken}` },
+      }),
+    );
+    expect(cookieContext.actor.id).toBe("user_admin");
+
+    const logout = await fixture.app.handle(
+      apiRequest("/api/auth/logout", apiBody.token, "POST"),
+    );
+    expect(logout.status).toBe(200);
+    expect(logout.headers.get("set-cookie")).toContain("Max-Age=0");
+    const afterLogout = await fixture.runtime.createGuardContext(
+      apiRequest("/api/foundation", apiBody.token),
+    );
+    expect(afterLogout.actor.type).toBe("anonymous");
+    expect(
+      fixture.events.map(({ action, outcome }) => [action, outcome]),
+    ).toEqual([
+      ["auth.login", "success"],
+      ["auth.login", "success"],
+      ["auth.logout", "success"],
+    ]);
+  });
+
+  test("密码错误和停用用户统一拒绝，审计不包含密码或 Token", async () => {
+    const fixture = authFixture([
+      activeUser(),
+      {
+        ...activeUser(),
+        id: "user_disabled",
+        username: "disabled",
+        status: "disabled",
+      },
+    ]);
+    const wrongPassword = "This-is-the-wrong-password";
+    const wrong = await fixture.app.handle(
+      jsonRequest("/api/auth/login", {
+        username: "admin",
+        password: wrongPassword,
+      }),
+    );
+    const disabled = await fixture.app.handle(
+      jsonRequest("/api/auth/login", {
+        username: "disabled",
+        password: "test-only-password",
+      }),
+    );
+
+    expect(wrong.status).toBe(401);
+    expect(disabled.status).toBe(401);
+    expect(await wrong.json()).toMatchObject({ error: "INVALID_CREDENTIALS" });
+    expect(await disabled.json()).toMatchObject({
+      error: "INVALID_CREDENTIALS",
+    });
+    const serializedAudit = JSON.stringify(fixture.events);
+    expect(serializedAudit).not.toContain(wrongPassword);
+    expect(serializedAudit).not.toContain("test-only-password");
+    expect(fixture.events).toHaveLength(2);
+    expect(fixture.events.every(({ action }) => action === "auth.login")).toBe(
+      true,
+    );
+  });
+
+  test("管理员可吊销其他用户会话，被吊销会话不能再通过 Guard", async () => {
+    const fixture = authFixture([
+      activeUser(),
+      {
+        ...activeUser(),
+        id: "user_operator",
+        username: "operator",
+        displayName: "操作员",
+        permissionKeys: [],
+      },
+    ]);
+    const operator = await login(fixture.app, "operator");
+    const admin = await login(fixture.app, "admin");
+
+    const revoke = await fixture.app.handle(
+      apiRequest(
+        `/api/auth/sessions/${operator.sessionId}/revoke`,
+        admin.token,
+        "POST",
+      ),
+    );
+
+    expect(revoke.status).toBe(200);
+    const context = await fixture.runtime.createGuardContext(
+      apiRequest("/api/foundation", operator.token),
+    );
+    expect(context.actor.type).toBe("anonymous");
+    expect(fixture.events.at(-1)).toMatchObject({
+      action: "auth.session.revoke",
+      outcome: "success",
+      actor: { id: "user_admin" },
+      target: { id: operator.sessionId },
+    });
+  });
+
+  test("普通用户不能吊销其他人的会话", async () => {
+    const fixture = authFixture([
+      activeUser(),
+      {
+        ...activeUser(),
+        id: "user_operator",
+        username: "operator",
+        displayName: "操作员",
+        permissionKeys: [],
+      },
+    ]);
+    const admin = await login(fixture.app, "admin");
+    const operator = await login(fixture.app, "operator");
+    const denied = await fixture.app.handle(
+      apiRequest(
+        `/api/auth/sessions/${admin.sessionId}/revoke`,
+        operator.token,
+        "POST",
+      ),
+    );
+
+    expect(denied.status).toBe(403);
+    const adminContext = await fixture.runtime.createGuardContext(
+      apiRequest("/api/foundation", admin.token),
+    );
+    expect(adminContext.actor.id).toBe("user_admin");
+    expect(fixture.events.at(-1)).toMatchObject({
+      action: "auth.session.revoke",
+      outcome: "denied",
+    });
+  });
+
+  test("管理员重置密码时只持久化 Argon2id hash", async () => {
+    const fixture = authFixture([
+      activeUser(),
+      {
+        ...activeUser(),
+        id: "user_operator",
+        username: "operator",
+        displayName: "操作员",
+        permissionKeys: [],
+      },
+    ]);
+    const admin = await login(fixture.app, "admin");
+    const oldOperatorSession = await login(fixture.app, "operator");
+    const newPassword = "Operator-Secure-2026";
+    const updated = await fixture.app.handle(
+      new Request("http://localhost/api/auth/users/user_operator/password", {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${admin.token}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ password: newPassword }),
+      }),
+    );
+
+    expect(updated.status).toBe(200);
+    const oldContext = await fixture.runtime.createGuardContext(
+      apiRequest("/api/foundation", oldOperatorSession.token),
+    );
+    expect(oldContext.actor.type).toBe("anonymous");
+    const operator =
+      await fixture.repository.findUserByReference("user_operator");
+    expect(operator?.passwordHash).toStartWith("$argon2id$");
+    expect(operator?.passwordHash).not.toContain(newPassword);
+    expect(operator?.credentialState).toBe("must-change-password");
+    expect(operator?.passwordChangedAt).toBeUndefined();
+    const loggedIn = await fixture.app.handle(
+      jsonRequest("/api/auth/login", {
+        username: "operator",
+        password: newPassword,
+      }),
+    );
+    expect(loggedIn.status).toBe(200);
+    expect(JSON.stringify(fixture.events)).not.toContain(newPassword);
+    expect(fixture.events).toContainEqual(
+      expect.objectContaining({
+        action: "auth.password.update",
+        outcome: "success",
+      }),
+    );
+  });
+});
+
+function authFixture(users: AuthUserRecord[]) {
+  const repository = new InMemoryAuthRepository(users);
+  const resolver = new RepositoryActorResolver(repository, {
+    sessionCookieName: "windy.sid",
+  });
+  const events: AuditEvent[] = [];
+  const runtime = createServerRuntime({}, { actorResolver: resolver });
+  const service = new AuthService(repository, {
+    auditWriter: {
+      write(event) {
+        events.push(event);
+      },
+    },
+  });
+  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
+    guardContext: await runtime.createGuardContext(request),
+  }));
+  registerAuthSessionRoute(app);
+  registerAuthRoutes(app, service, { secureCookie: false });
+  return { app, events, repository, runtime };
+}
+
+function activeUser(): AuthUserRecord {
+  return {
+    id: "user_admin",
+    username: "admin",
+    displayName: "平台管理员",
+    email: "admin@windy.local",
+    phone: "13800138000",
+    passwordHash,
+    credentialState: "active",
+    status: "active",
+    roleCodes: ["developer"],
+    permissionKeys: ["system.user.manage", "system.audit.read"],
+  };
+}
+
+async function login(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+) {
+  const response = await app.handle(
+    jsonRequest("/api/auth/api/login", {
+      username,
+      password: "test-only-password",
+    }),
+  );
+  expect(response.status).toBe(200);
+  return (await response.json()) as { token: string; sessionId: string };
+}
+
+function readCookieValue(header: string, name: string): string {
+  const value = header.split(";")[0]?.slice(`${name}=`.length);
+  return value ? decodeURIComponent(value) : "";
+}
+
+function jsonRequest(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+function apiRequest(path: string, token: string, method = "GET"): Request {
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: { authorization: `Bearer ${token}` },
+  });
+}