create-windy 0.1.0

package/template/packages/modules/src/system-modules.test.ts

@@ -0,0 +1,344 @@
+import { describe, expect, test } from "bun:test";
+import { systemFoundationModule } from "./system-modules.js";
+
+describe("系统模块能力注册", () => {
+  test.each([
+    // @windy-module system.search begin
+    "system.search",
+    // @windy-module system.search end
+    // @windy-module system.settings begin
+    "system.settings",
+    "system.watermark",
+    // @windy-module system.settings end
+    "system.profile",
+    // @windy-module system.notification begin
+    "system.notification",
+    // @windy-module system.notification end
+    // @windy-module system.configuration begin
+    "system.config",
+    // @windy-module system.configuration end
+    // @windy-module system.workflow begin
+    "system.workflow",
+    // @windy-module system.workflow end
+  ])("%s 同时注册 Feature、权限和入口", (key) => {
+    const manifest = systemFoundationModule();
+    const menuKeys = flattenMenuKeys(manifest.menus);
+    const permissionKeys = manifest.permissions.map(
+      (permission) => permission.key,
+    );
+
+    expect(manifest.features.some((feature) => feature.key === key)).toBe(true);
+    expect(permissionKeys).toContain(`${key}.read`);
+    expect(permissionKeys).toContain(`${key}.manage`);
+    if (
+      key === "system.settings" ||
+      key === "system.profile" ||
+      key === "system.notification" ||
+      key === "system.config" ||
+      key === "system.workflow"
+    ) {
+      expect(menuKeys).toContain(key);
+    }
+  });
+
+  // @windy-module system.workflow begin
+  test("审批 API 使用独立读取、创建、处理和管理权限", () => {
+    const manifest = systemFoundationModule();
+    const permissions = manifest.permissions.map(({ key }) => key);
+    const bindings = manifest.apiPermissions.filter(({ path }) =>
+      path.startsWith("/api/workflow/work-items"),
+    );
+
+    expect(permissions).toEqual(
+      expect.arrayContaining([
+        "system.workflow.read",
+        "system.workflow.create",
+        "system.workflow.approve",
+        "system.workflow.manage",
+      ]),
+    );
+    expect(bindings).toHaveLength(9);
+    expect(
+      bindings.every(({ featureKey }) => featureKey === "system.workflow"),
+    ).toBe(true);
+  });
+  // @windy-module system.workflow end
+
+  // @windy-module system.data-governance begin
+  test("用户敏感字段策略绑定 read、reveal、export 与显式风险", () => {
+    const manifest = systemFoundationModule();
+    const policy = manifest.dataPolicies?.find(
+      ({ key }) => key === "system.user.fields",
+    );
+
+    expect(policy).toMatchObject({
+      resourceType: "system.user",
+      readPermissionKey: "system.user.read",
+      revealPermissionKey: "system.user.reveal",
+      exportPermissionKey: "system.user.export",
+      display: { read: "masked", reveal: "plaintext" },
+    });
+    expect(manifest.permissions).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          key: "system.user.reveal",
+          action: "reveal",
+          accessRisk: "sensitive-disclosure",
+        }),
+        expect.objectContaining({
+          key: "system.user.export",
+          action: "export",
+          accessRisk: "governed-export",
+        }),
+      ]),
+    );
+    expect(manifest.apiPermissions).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          method: "GET",
+          path: "/api/system/users/:id/plaintext",
+          permissionKey: "system.user.reveal",
+        }),
+        expect.objectContaining({
+          method: "POST",
+          path: "/api/system/users/plaintext/batch",
+          permissionKey: "system.user.reveal",
+        }),
+      ]),
+    );
+  });
+
+  test("用户敏感导出只绑定专用工作流，通用 Bulk 与 Storage API 无法旁路", () => {
+    const bindings = systemFoundationModule().apiPermissions;
+    const governed = bindings.filter(
+      ({ permissionKey }) => permissionKey === "system.user.export",
+    );
+
+    expect(governed).toEqual([
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/system/users/exports",
+      }),
+      expect.objectContaining({
+        method: "GET",
+        path: "/api/system/users/exports/:id",
+      }),
+      expect.objectContaining({
+        method: "POST",
+        path: "/api/system/users/exports/:id/cancel",
+      }),
+      expect.objectContaining({
+        method: "GET",
+        path: "/api/system/users/exports/:id/download",
+      }),
+    ]);
+    expect(
+      bindings.some(({ path }) => path === "/api/system/users/export"),
+    ).toBe(false);
+    expect(
+      bindings
+        .filter(
+          ({ path }) => path.includes("/bulk") || path.includes("/storage"),
+        )
+        .some(({ permissionKey }) => permissionKey === "system.user.export"),
+    ).toBe(false);
+  });
+  // @windy-module system.data-governance end
+
+  // @windy-module system.settings begin
+  test("全局设置是独立页面且水印不注册重复入口", () => {
+    const manifest = systemFoundationModule();
+    const menus = flattenMenus(manifest.menus);
+    const settings = menus.find((menu) => menu.key === "system.settings");
+
+    expect(settings?.type).toBe("menu");
+    expect(settings?.path).toBe("/admin/settings");
+    expect(menus.some((menu) => menu.key === "system.watermark")).toBe(false);
+  });
+
+  test("共享设置路由只负责管理面准入，各入口保留独立能力 Guard", () => {
+    const manifest = systemFoundationModule();
+    const menus = flattenMenus(manifest.menus);
+
+    expect(
+      manifest.adminRoutes.find(({ path }) => path === "/admin/settings"),
+    ).toMatchObject({
+      permissionKey: "system.admin.access",
+      featureKey: "system.admin",
+      directAccess: "admin-admission",
+    });
+    expect(menus.find(({ key }) => key === "system.settings")).toMatchObject({
+      permissionKey: "system.settings.read",
+      featureKey: "system.settings",
+    });
+    // @windy-module system.storage begin
+    expect(menus.find(({ key }) => key === "system.storage")).toMatchObject({
+      permissionKey: "system.storage.read",
+      featureKey: "system.storage",
+    });
+    // @windy-module system.storage end
+  });
+  // @windy-module system.settings end
+
+  // @windy-module system.search begin
+  test("全局搜索目录和查询 API 使用独立入口权限", () => {
+    expect(systemFoundationModule().apiPermissions).toEqual(
+      expect.arrayContaining([
+        {
+          method: "GET",
+          path: "/api/search/providers",
+          permissionKey: "system.search.read",
+          featureKey: "system.search",
+          anonymous: undefined,
+        },
+        {
+          method: "POST",
+          path: "/api/search",
+          permissionKey: "system.search.read",
+          featureKey: "system.search",
+          anonymous: undefined,
+        },
+      ]),
+    );
+  });
+  // @windy-module system.search end
+
+  test("个人设置注册为头像菜单使用的非 Sidebar 入口", () => {
+    const menus = flattenMenus(systemFoundationModule().menus);
+    const profile = menus.find((menu) => menu.key === "system.profile");
+
+    expect(profile).toMatchObject({
+      type: "button",
+      path: "/admin/profile",
+      permissionKey: "system.profile.read",
+      featureKey: "system.profile",
+    });
+  });
+
+  test("Sidebar 分类由 Manifest 目录声明", () => {
+    const catalogs = systemFoundationModule().menus.map((menu) => menu.title);
+    expect(catalogs).toEqual(["组织与权限", "平台配置", "安全与合规", "运维"]);
+  });
+
+  test("部门快捷创建使用独立权限并绑定真实 API", () => {
+    const manifest = systemFoundationModule();
+    expect(
+      manifest.permissions.some(
+        ({ key }) => key === "system.department.create",
+      ),
+    ).toBe(true);
+    expect(manifest.apiPermissions).toContainEqual({
+      method: "POST",
+      path: "/api/system/departments/quick",
+      permissionKey: "system.department.create",
+      featureKey: "system.rbac",
+      anonymous: undefined,
+    });
+  });
+
+  test("所有权限都由 Manifest 提供稳定中文分组元数据", () => {
+    const permissions = systemFoundationModule().permissions;
+    expect(
+      permissions.every(
+        ({ moduleLabel, resourceLabel }) => moduleLabel && resourceLabel,
+      ),
+    ).toBe(true);
+    expect(
+      Object.fromEntries(
+        permissions.map(({ resource, resourceLabel }) => [
+          resource,
+          resourceLabel,
+        ]),
+      ),
+    ).toMatchObject({
+      // @windy-module system.license begin
+      license: "许可证管理",
+      // @windy-module system.license end
+      // @windy-module system.notification begin
+      notification: "通知管理",
+      // @windy-module system.notification end
+      profile: "个人设置",
+      // @windy-module system.settings begin
+      settings: "全局设置",
+      // @windy-module system.settings end
+      // @windy-module system.configuration begin
+      config: "配置版本",
+      // @windy-module system.configuration end
+    });
+  });
+
+  // @windy-module system.configuration begin
+  test("配置版本的读取、变更和回滚 API 统一引用 Manifest 权限与 Feature", () => {
+    const bindings = systemFoundationModule().apiPermissions.filter(
+      ({ path }) => path.startsWith("/api/system/configurations"),
+    );
+
+    expect(bindings).toEqual([
+      {
+        method: "GET",
+        path: "/api/system/configurations",
+        permissionKey: "system.config.read",
+        featureKey: "system.config",
+        anonymous: undefined,
+      },
+      {
+        method: "GET",
+        path: "/api/system/configurations/:moduleKey/versions",
+        permissionKey: "system.config.read",
+        featureKey: "system.config",
+        anonymous: undefined,
+      },
+      {
+        method: "POST",
+        path: "/api/system/configurations/:moduleKey/versions",
+        permissionKey: "system.config.manage",
+        featureKey: "system.config",
+        anonymous: undefined,
+      },
+      {
+        method: "POST",
+        path: "/api/system/configurations/:moduleKey/versions/:version/rollback",
+        permissionKey: "system.config.manage",
+        featureKey: "system.config",
+        anonymous: undefined,
+      },
+    ]);
+  });
+  // @windy-module system.configuration end
+
+  test("管理面准入使用独立 Feature 与 access 权限", () => {
+    const manifest = systemFoundationModule();
+
+    expect(manifest.features).toContainEqual(
+      expect.objectContaining({ key: "system.admin", enabled: true }),
+    );
+    expect(manifest.permissions).toContainEqual(
+      expect.objectContaining({
+        key: "system.admin.access",
+        action: "access",
+      }),
+    );
+    expect(manifest.apiPermissions).toContainEqual({
+      method: "GET",
+      path: "/api/admin/bootstrap",
+      permissionKey: "system.admin.access",
+      featureKey: "system.admin",
+      anonymous: undefined,
+    });
+  });
+});
+
+function flattenMenuKeys(
+  menus: ReturnType<typeof systemFoundationModule>["menus"],
+): string[] {
+  return menus.flatMap((menu) => [
+    menu.key,
+    ...flattenMenuKeys(menu.children || []),
+  ]);
+}
+
+function flattenMenus(
+  menus: ReturnType<typeof systemFoundationModule>["menus"],
+): ReturnType<typeof systemFoundationModule>["menus"] {
+  return menus.flatMap((menu) => [menu, ...flattenMenus(menu.children || [])]);
+}

package/template/packages/modules/src/system-modules.ts

@@ -0,0 +1,335 @@
+import type { ModuleManifest } from "./manifest.js";
+// @windy-module system.agent begin
+import { systemAgentTools } from "./system-agent-tools.js";
+// @windy-module system.agent end
+import { systemAdminRoutes } from "./system-admin-routes.js";
+import { systemApiPermissionBindings } from "./system-api-permissions.js";
+import { systemAuditActions } from "./system-audit-actions.js";
+// @windy-module system.data-governance begin
+import { systemDataPolicies } from "./system-data-governance.js";
+// @windy-module system.data-governance end
+import { systemFeatures } from "./system-features.js";
+import { systemPermissions } from "./system-permissions.js";
+
+export function systemFoundationModule(): ModuleManifest {
+  return {
+    name: "system",
+    version: "0.1.0",
+    label: "系统基础设施",
+    description: "用户、角色、菜单、功能开关与平台治理基础能力。",
+    menus: [
+      {
+        key: "system.identity",
+        title: "组织与权限",
+        type: "catalog",
+        order: 10,
+        visible: true,
+        icon: "users",
+        children: [
+          {
+            key: "system.profile",
+            title: "个人设置",
+            type: "button",
+            order: 5,
+            visible: true,
+            path: "/admin/profile",
+            icon: "user-round-cog",
+            permissionKey: "system.profile.read",
+            featureKey: "system.profile",
+          },
+          {
+            key: "system.user",
+            title: "用户管理",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/users",
+            icon: "users",
+            permissionKey: "system.user.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.role",
+            title: "角色权限",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/roles",
+            icon: "shield-check",
+            permissionKey: "system.role.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.department",
+            title: "部门组织",
+            type: "menu",
+            order: 25,
+            visible: true,
+            path: "/admin/system/departments",
+            icon: "building-2",
+            permissionKey: "system.department.read",
+            featureKey: "system.rbac",
+          },
+        ],
+      },
+      {
+        key: "system.configuration",
+        title: "平台配置",
+        type: "catalog",
+        order: 20,
+        visible: true,
+        icon: "settings",
+        children: [
+          // @windy-module system.settings begin
+          {
+            key: "system.settings",
+            title: "全局设置",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/settings",
+            icon: "settings",
+            permissionKey: "system.settings.read",
+            featureKey: "system.settings",
+          },
+          // @windy-module system.settings end
+          // @windy-module system.storage begin
+          {
+            key: "system.storage",
+            title: "文件存储",
+            type: "button",
+            order: 15,
+            visible: true,
+            path: "/admin/settings",
+            icon: "file-up",
+            permissionKey: "system.storage.read",
+            featureKey: "system.storage",
+          },
+          // @windy-module system.storage end
+          {
+            key: "system.menu",
+            title: "菜单管理",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/menus",
+            icon: "panel-left",
+            permissionKey: "system.menu.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.dictionary",
+            title: "字典管理",
+            type: "menu",
+            order: 30,
+            visible: true,
+            path: "/admin/system/dictionaries",
+            icon: "book-open",
+            permissionKey: "system.dict.read",
+            featureKey: "system.rbac",
+          },
+          {
+            key: "system.feature",
+            title: "功能开关",
+            type: "menu",
+            order: 40,
+            visible: true,
+            path: "/admin/system/features",
+            icon: "flag",
+            permissionKey: "system.feature.read",
+          },
+          // @windy-module system.notification begin
+          {
+            key: "system.notification",
+            title: "通知管理",
+            type: "menu",
+            order: 50,
+            visible: true,
+            path: "/admin/system/notifications",
+            icon: "bell",
+            permissionKey: "system.notification.manage",
+            featureKey: "system.notification",
+          },
+          // @windy-module system.notification end
+          // @windy-module system.configuration begin
+          {
+            key: "system.config",
+            title: "配置版本",
+            type: "menu",
+            order: 60,
+            visible: true,
+            path: "/admin/system/configurations",
+            icon: "settings",
+            permissionKey: "system.config.read",
+            featureKey: "system.config",
+          },
+          // @windy-module system.configuration end
+        ],
+      },
+      {
+        key: "system.compliance",
+        title: "安全与合规",
+        type: "catalog",
+        order: 30,
+        visible: true,
+        icon: "shield-check",
+        children: [
+          // @windy-module system.license begin
+          {
+            key: "system.license",
+            title: "License",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/license",
+            icon: "key-round",
+            permissionKey: "system.license.read",
+            featureKey: "system.license",
+          },
+          // @windy-module system.license end
+          // @windy-module system.audit begin
+          {
+            key: "system.audit",
+            title: "审计日志",
+            type: "menu",
+            order: 20,
+            visible: true,
+            path: "/admin/system/audit",
+            icon: "clipboard-list",
+            permissionKey: "system.audit.read",
+            featureKey: "system.audit",
+          },
+          // @windy-module system.audit end
+        ],
+      },
+      {
+        key: "system.operations",
+        title: "运维",
+        type: "catalog",
+        order: 40,
+        visible: true,
+        icon: "activity",
+        children: [
+          // @windy-module system.operations begin
+          {
+            key: "system.ops",
+            title: "运维总览",
+            type: "menu",
+            order: 10,
+            visible: true,
+            path: "/admin/system/operations",
+            icon: "activity",
+            permissionKey: "system.ops.read",
+            featureKey: "system.ops",
+          },
+          // @windy-module system.operations end
+          // @windy-module system.workflow begin
+          {
+            key: "system.workflow",
+            title: "审批任务",
+            type: "button",
+            order: 20,
+            visible: false,
+            permissionKey: "system.workflow.read",
+            featureKey: "system.workflow",
+          },
+          // @windy-module system.workflow end
+        ],
+      },
+    ],
+    adminRoutes: systemAdminRoutes,
+    permissions: systemPermissions,
+    apiPermissions: systemApiPermissionBindings(),
+    features: systemFeatures,
+    migrations: [],
+    schemaExports: [
+      {
+        key: "system.database.schema",
+        exportName: "systemSchema",
+        migrationIds: ["0000..0028"],
+      },
+    ],
+    tasks: [
+      // @windy-module system.scheduler begin
+      {
+        key: "system.scheduler.health-snapshot",
+        label: "调度器健康快照",
+        description: "周期验证调度、Guard、执行历史和重试链路可用。",
+        permissionKey: "system.scheduler.manage",
+        featureKey: "system.scheduler",
+        intervalSeconds: 300,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.scheduler end
+      // @windy-module system.bulk-data begin
+      {
+        key: "system.bulk-data.dispatch",
+        label: "批量数据任务派发",
+        description: "领取一个已排队或到期重试的批量导入导出任务。",
+        permissionKey: "system.bulk-data.manage",
+        featureKey: "system.bulk-data",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      {
+        key: "system.bulk-data.cleanup",
+        label: "批量数据文件清理",
+        description: "清理超过留存期限的源文件、结果和失败明细。",
+        permissionKey: "system.bulk-data.manage",
+        featureKey: "system.bulk-data",
+        intervalSeconds: 3_600,
+        maxAttempts: 3,
+        retryDelaySeconds: 60,
+      },
+      // @windy-module system.bulk-data end
+      // @windy-module system.storage begin
+      {
+        key: "system.storage.cleanup",
+        label: "文件存储清理",
+        description: "清理过期上传、文件、临时分片和超过宽限期的孤儿对象。",
+        permissionKey: "system.storage.manage",
+        featureKey: "system.storage",
+        intervalSeconds: 3_600,
+        maxAttempts: 3,
+        retryDelaySeconds: 60,
+      },
+      // @windy-module system.storage end
+      // @windy-module system.workflow begin
+      {
+        key: "system.workflow.timeout-dispatch",
+        label: "审批超时派发",
+        description: "补偿登记并执行一个到期审批任务，进程重启后继续处理。",
+        permissionKey: "system.workflow.manage",
+        featureKey: "system.workflow",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.workflow end
+      // @windy-module system.data-governance begin
+      {
+        key: "system.governed-export.dispatch",
+        label: "受治理导出派发",
+        description: "领取并执行一个已批准的敏感数据导出任务。",
+        permissionKey: "system.user.export",
+        featureKey: "system.rbac",
+        intervalSeconds: 5,
+        maxAttempts: 3,
+        retryDelaySeconds: 30,
+      },
+      // @windy-module system.data-governance end
+    ],
+    tools: [
+      // @windy-module system.agent begin
+      ...systemAgentTools,
+      // @windy-module system.agent end
+    ],
+    providers: [],
+    // @windy-module system.data-governance begin
+    dataPolicies: systemDataPolicies,
+    // @windy-module system.data-governance end
+    auditActions: systemAuditActions,
+  };
+}