create-windy 0.1.0

package/template/packages/modules/src/system-api-permissions.ts

@@ -0,0 +1,344 @@
+import type { ApiPermissionBinding } from "@windy/shared";
+import { binding, resourceBindings } from "./system-api-binding.js";
+// @windy-module system.data-governance begin
+import { dataGovernanceApiPermissionBindings } from "./system-api-data-governance.js";
+// @windy-module system.data-governance end
+
+export function systemApiPermissionBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "GET",
+      "/api/admin/bootstrap",
+      "system.admin.access",
+      "system.admin",
+    ),
+    binding("GET", "/api/foundation", "system.menu.read", "system.rbac", true),
+    // @windy-module system.search begin
+    binding(
+      "GET",
+      "/api/search/providers",
+      "system.search.read",
+      "system.search",
+    ),
+    binding("POST", "/api/search", "system.search.read", "system.search"),
+    // @windy-module system.search end
+    ...resourceBindings({
+      path: "users",
+      permissionResource: "user",
+      featureKey: "system.rbac",
+      backupExport: false,
+    }),
+    // @windy-module system.data-governance begin
+    ...dataGovernanceApiPermissionBindings(),
+    // @windy-module system.data-governance end
+    binding(
+      "POST",
+      "/api/auth/users/:id/password",
+      "system.user.manage",
+      "system.rbac",
+    ),
+    ...resourceBindings({
+      path: "roles",
+      permissionResource: "role",
+      featureKey: "system.rbac",
+    }),
+    ...resourceBindings({
+      path: "departments",
+      permissionResource: "department",
+      featureKey: "system.rbac",
+    }),
+    binding(
+      "POST",
+      "/api/system/departments/quick",
+      "system.department.create",
+      "system.rbac",
+    ),
+    binding("GET", "/api/system/menus", "system.menu.read", "system.rbac"),
+    binding(
+      "GET",
+      "/api/system/menus/export",
+      "system.menu.read",
+      "system.rbac",
+    ),
+    binding("GET", "/api/system/menus/:id", "system.menu.read", "system.rbac"),
+    binding(
+      "PUT",
+      "/api/system/menus/:id/placement",
+      "system.menu.manage",
+      "system.rbac",
+    ),
+    binding(
+      "PUT",
+      "/api/system/menus/placements",
+      "system.menu.manage",
+      "system.rbac",
+    ),
+    ...resourceBindings({
+      path: "dictionaries",
+      permissionResource: "dict",
+      featureKey: "system.rbac",
+    }),
+    // @windy-module system.license begin
+    ...resourceBindings({
+      path: "licenses",
+      permissionResource: "license",
+      featureKey: "system.license",
+    }),
+    // @windy-module system.license end
+    binding("GET", "/api/system/features", "system.feature.read"),
+    binding("GET", "/api/system/features/export", "system.feature.read"),
+    binding("GET", "/api/system/features/:id", "system.feature.read"),
+    binding("PUT", "/api/system/features/:id", "system.feature.manage"),
+    // @windy-module system.settings begin
+    binding(
+      "GET",
+      "/api/platform/branding",
+      "system.settings.read",
+      undefined,
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/system/settings/branding",
+      "system.settings.read",
+      "system.settings",
+    ),
+    binding(
+      "PUT",
+      "/api/system/settings/branding",
+      "system.settings.manage",
+      "system.settings",
+    ),
+    // @windy-module system.settings end
+    // @windy-module system.configuration begin
+    binding(
+      "GET",
+      "/api/system/configurations",
+      "system.config.read",
+      "system.config",
+    ),
+    binding(
+      "GET",
+      "/api/system/configurations/:moduleKey/versions",
+      "system.config.read",
+      "system.config",
+    ),
+    binding(
+      "POST",
+      "/api/system/configurations/:moduleKey/versions",
+      "system.config.manage",
+      "system.config",
+    ),
+    binding(
+      "POST",
+      "/api/system/configurations/:moduleKey/versions/:version/rollback",
+      "system.config.manage",
+      "system.config",
+    ),
+    // @windy-module system.configuration end
+    binding(
+      "GET",
+      "/api/system/profile",
+      "system.profile.read",
+      "system.profile",
+    ),
+    binding(
+      "PUT",
+      "/api/system/profile",
+      "system.profile.manage",
+      "system.profile",
+    ),
+    // @windy-module system.audit begin
+    binding(
+      "GET",
+      "/api/system/audit-logs",
+      "system.audit.read",
+      "system.audit",
+    ),
+    binding(
+      "GET",
+      "/api/system/audit-logs/export",
+      "system.audit.read",
+      "system.audit",
+    ),
+    // @windy-module system.audit end
+    // @windy-module system.storage begin
+    binding(
+      "POST",
+      "/api/system/storage/uploads",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "PUT",
+      "/api/system/storage/uploads/:id/parts/:partNumber",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "POST",
+      "/api/system/storage/uploads/:id/complete",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/storage/uploads/:id",
+      "system.storage.create",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/system/storage/files/:id",
+      "system.storage.read",
+      "system.storage",
+    ),
+    binding(
+      "GET",
+      "/api/platform/files/:id",
+      "system.settings.read",
+      "system.settings",
+      true,
+    ),
+    // @windy-module system.storage end
+    // @windy-module system.operations begin
+    binding("GET", "/api/system/operations", "system.ops.read", "system.ops"),
+    // @windy-module system.operations end
+    // @windy-module system.notification begin
+    binding(
+      "GET",
+      "/api/notifications",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/notifications/:id/read",
+      "system.notification.read",
+      "system.notification",
+    ),
+    binding(
+      "GET",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "POST",
+      "/api/system/notifications",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    binding(
+      "DELETE",
+      "/api/system/notifications/:id",
+      "system.notification.manage",
+      "system.notification",
+    ),
+    // @windy-module system.notification end
+    // @windy-module system.workflow begin
+    binding(
+      "GET",
+      "/api/workflow/work-items",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "GET",
+      "/api/workflow/work-items/:id/history",
+      "system.workflow.read",
+      "system.workflow",
+    ),
+    binding(
+      "POST",
+      "/api/workflow/work-items",
+      "system.workflow.create",
+      "system.workflow",
+    ),
+    ...["claim", "transfer", "approve", "reject", "cancel"].map((command) =>
+      binding(
+        "POST",
+        `/api/workflow/work-items/:id/${command}`,
+        "system.workflow.approve",
+        "system.workflow",
+      ),
+    ),
+    // @windy-module system.workflow end
+    // @windy-module system.scheduler begin
+    binding(
+      "GET",
+      "/api/system/scheduled-tasks",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/scheduled-task-runs",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "GET",
+      "/api/system/operations/scheduler",
+      "system.scheduler.read",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/trigger",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    binding(
+      "POST",
+      "/api/system/scheduled-tasks/:id/runs/:runId/recover",
+      "system.scheduler.manage",
+      "system.scheduler",
+    ),
+    // @windy-module system.scheduler end
+    // @windy-module system.bulk-data begin
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "GET",
+      "/api/system/bulk-data/jobs/:id/artifacts/:kind",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/import",
+      "system.dict.manage",
+      "system.bulk-data",
+    ),
+    binding(
+      "POST",
+      "/api/system/bulk-data/dictionaries/export",
+      "system.dict.read",
+      "system.bulk-data",
+    ),
+    // @windy-module system.bulk-data end
+  ];
+}

package/template/packages/modules/src/system-audit-actions.ts

@@ -0,0 +1,70 @@
+import type { ModuleManifest } from "./manifest.js";
+
+export const systemAuditActions: ModuleManifest["auditActions"] = [
+  "auth.login",
+  "auth.password.update",
+  "auth.session.revoke",
+  "user.profile.update",
+  "crud.create",
+  "crud.update",
+  "crud.delete",
+  // @windy-module system.configuration begin
+  "config.update",
+  "config.rollback",
+  // @windy-module system.configuration end
+  // @windy-module system.license begin
+  "license.verify",
+  // @windy-module system.license end
+  "feature.update",
+  "menu.structure.update",
+  // @windy-module system.notification begin
+  "notification.publish",
+  "notification.read",
+  "notification.archive",
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
+  "workflow.create",
+  "workflow.claim",
+  "workflow.transfer",
+  "workflow.decide",
+  "workflow.cancel",
+  "workflow.timeout",
+  // @windy-module system.workflow end
+  // @windy-module system.scheduler begin
+  "task.trigger",
+  "task.read",
+  "task.execute",
+  "task.recover",
+  // @windy-module system.scheduler end
+  // @windy-module system.search begin
+  "data.search",
+  // @windy-module system.search end
+  // @windy-module system.data-governance begin
+  "data.plaintext.read",
+  "data.plaintext.batch-read",
+  "data.governed-export.request",
+  "data.governed-export.generate",
+  "data.governed-export.download",
+  "data.governed-export.cancel",
+  // @windy-module system.data-governance end
+  // @windy-module system.search begin
+  "search.query",
+  "search.result.access",
+  // @windy-module system.search end
+  // @windy-module system.bulk-data begin
+  "data.bulk-import.create",
+  "data.bulk-export.create",
+  "data.bulk-artifact.download",
+  // @windy-module system.bulk-data end
+  // @windy-module system.storage begin
+  "file.upload.create",
+  "file.upload.complete",
+  "file.upload.abort",
+  "file.download",
+  // @windy-module system.storage end
+  // @windy-module system.agent begin
+  "agent.tool.execute",
+  // @windy-module system.agent end
+  "security.denied",
+  "system.error",
+];

package/template/packages/modules/src/system-data-governance.ts

@@ -0,0 +1,30 @@
+import { featureKey, type DataGovernancePolicyDefinition } from "@windy/shared";
+
+export const systemDataPolicies: DataGovernancePolicyDefinition[] = [
+  {
+    key: "system.user.fields",
+    resourceType: "system.user",
+    version: "1",
+    featureKey: featureKey("system.rbac"),
+    readPermissionKey: "system.user.read",
+    revealPermissionKey: "system.user.reveal",
+    exportPermissionKey: "system.user.export",
+    display: {
+      read: "masked",
+      reveal: "plaintext",
+      unauthorized: "hidden",
+    },
+    fields: [
+      {
+        fieldKey: "email",
+        classification: "personal",
+        mask: { kind: "partial", prefix: 2, suffix: 4 },
+      },
+      {
+        fieldKey: "phone",
+        classification: "sensitive",
+        mask: { kind: "partial", prefix: 3, suffix: 4 },
+      },
+    ],
+  },
+];

package/template/packages/modules/src/system-features.ts

@@ -0,0 +1,143 @@
+import { featureKey, licenseVersionKey } from "@windy/shared";
+import type { ModuleManifest } from "./manifest.js";
+
+const standardAndAdvanced = ["standard", "advanced"].map(licenseVersionKey);
+const advancedOnly = [licenseVersionKey("advanced")];
+
+export const systemFeatures: ModuleManifest["features"] = [
+  feature(
+    "system.admin",
+    "Windy 管理面",
+    "平台管理员、运维与授权审计人员使用的控制面准入能力。",
+  ),
+  feature(
+    "system.rbac",
+    "RBAC 权限链路",
+    "用户、角色、权限点与数据范围的统一访问控制链路。",
+  ),
+  feature(
+    "system.profile",
+    "个人设置",
+    "当前账号维护姓名、邮箱和手机等个人资料。",
+  ),
+  // @windy-module system.settings begin
+  feature("system.settings", "全局设置", "平台软件名、Logo 等全局品牌配置。"),
+  // @windy-module system.settings end
+  // @windy-module system.configuration begin
+  feature(
+    "system.config",
+    "配置版本",
+    "受控管理模块配置的版本、应用状态、差异与回滚。",
+  ),
+  // @windy-module system.configuration end
+  // @windy-module system.search begin
+  feature(
+    "system.search",
+    "平台功能搜索",
+    "搜索当前账号有权访问的平台菜单和功能入口。",
+  ),
+  // @windy-module system.search end
+  // @windy-module system.settings begin
+  feature(
+    "system.watermark",
+    "页面水印",
+    "带身份信息的页面水印与用户显示偏好。",
+  ),
+  // @windy-module system.settings end
+  // @windy-module system.license begin
+  feature(
+    "system.license",
+    "License 验证",
+    "客户 License 安装、验签、到期限制与运行状态检查。",
+  ),
+  // @windy-module system.license end
+  // @windy-module system.audit begin
+  feature(
+    "system.audit",
+    "审计日志",
+    "记录关键配置、权限拒绝与业务操作，支持安全追溯。",
+  ),
+  // @windy-module system.audit end
+  // @windy-module system.storage begin
+  feature(
+    "system.storage",
+    "文件与对象存储",
+    "受控文件上传、续传、下载、过期和底层对象生命周期。",
+  ),
+  // @windy-module system.storage end
+  // @windy-module system.agent begin
+  feature(
+    "system.agent",
+    "Agent Tool",
+    "让受控 Agent 在权限、Feature 与审计保护下调用平台工具。",
+  ),
+  // @windy-module system.agent end
+  // @windy-module system.operations begin
+  feature(
+    "system.ops",
+    "运维总览",
+    "集中查看服务、数据库、缓存与调度任务的运行状态。",
+  ),
+  // @windy-module system.operations end
+  // @windy-module system.notification begin
+  feature(
+    "system.notification",
+    "站内通知",
+    "站内通知发布、管理、阅读和已读状态闭环。",
+  ),
+  // @windy-module system.notification end
+  // @windy-module system.workflow begin
+  feature(
+    "system.workflow",
+    "最小审批",
+    "候选角色领取、转交、决定、取消和到期终结的通用审批能力。",
+  ),
+  // @windy-module system.workflow end
+  // @windy-module system.scheduler begin
+  {
+    ...feature(
+      "system.scheduler",
+      "定时任务执行器",
+      "平台定时任务调度、重试、手动执行和历史追踪。",
+    ),
+    allowedLicenseVersions: standardAndAdvanced,
+  },
+  // @windy-module system.scheduler end
+  // @windy-module system.bulk-data begin
+  {
+    ...feature(
+      "system.bulk-data",
+      "批量数据任务",
+      "受控的大批量导入、导出、失败明细和结果留存。",
+    ),
+    allowedLicenseVersions: advancedOnly,
+  },
+  // @windy-module system.bulk-data end
+  {
+    ...feature(
+      "system.ruoyi-compat",
+      "RuoYi-Vue 兼容层",
+      "可选适配旧 RuoYi-Vue 数据与接口，不影响平台标准模型。",
+    ),
+    visible: "hidden",
+    enabled: false,
+    stage: "internal",
+    allowedLicenseVersions: advancedOnly,
+  },
+];
+
+function feature(
+  key: string,
+  label: string,
+  description?: string,
+): ModuleManifest["features"][number] {
+  return {
+    key: featureKey(key),
+    label,
+    module: "system",
+    description,
+    visible: "visible",
+    enabled: true,
+    stage: "stable",
+  };
+}

package/template/packages/modules/src/system-governed-export-bindings.ts

@@ -0,0 +1,31 @@
+import type { ApiPermissionBinding } from "@windy/shared";
+import { binding } from "./system-api-binding.js";
+
+export function governedUserExportBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "POST",
+      "/api/system/users/exports",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "GET",
+      "/api/system/users/exports/:id",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "POST",
+      "/api/system/users/exports/:id/cancel",
+      "system.user.export",
+      "system.rbac",
+    ),
+    binding(
+      "GET",
+      "/api/system/users/exports/:id/download",
+      "system.user.export",
+      "system.rbac",
+    ),
+  ];
+}