create-windy 0.1.0

package/template/apps/server/src/data-access/scoped-repository.integration.test.ts

@@ -0,0 +1,203 @@
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import type { DataScope } from "@windy/shared";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import type { RequestActor } from "../guards.js";
+import { createDrizzleSystemRepositories } from "../system/drizzle-system.js";
+import type { ManagedDepartment, ManagedUser } from "../system/entities.js";
+import { buildScopeContext, type ScopeGrant } from "./context.js";
+import { departmentDescendantResolver } from "./department-tree.js";
+import {
+  DataAccessDeniedError,
+  DataScopedResourceService,
+} from "./scoped-resource.js";
+
+const databaseUrl = process.env.DATA_SCOPE_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL data-scope repository enforcement", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = await connectAndMigrate(databaseUrl!);
+  });
+
+  beforeEach(async () => {
+    await pool.query("truncate table users, departments cascade");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("User 的搜索、分页总数和多角色并集均在 scoped Repository 返回", async () => {
+    const repositories = createRepositories(pool);
+    await seedDepartments(repositories.departments);
+    await seedUsers(repositories.users);
+    const access = new DataScopedResourceService(
+      repositories.users,
+      departmentDescendantResolver(repositories.departments),
+    );
+
+    const departmentPage = await access.list(
+      { page: 1, pageSize: 1, q: "可检索" },
+      ["displayName"],
+      actor("department-and-children"),
+    );
+    expect(departmentPage).toMatchObject({ total: 2, page: 1, pageSize: 1 });
+    expect(departmentPage.items[0]?.id).toBe("user_a_child");
+
+    const union = await access.all(
+      { q: "可检索" },
+      ["displayName"],
+      actor("self", [
+        { scope: "custom", dimension: "departmentId", values: ["dept_b"] },
+      ]),
+    );
+    expect(union.map(({ id }) => id).sort()).toEqual(["user_a", "user_b"]);
+  });
+
+  test("User 直接 ID 越权的读取、更新和删除一致拒绝且不改变 PostgreSQL", async () => {
+    const repositories = createRepositories(pool);
+    await seedDepartments(repositories.departments);
+    await seedUsers(repositories.users);
+    const access = new DataScopedResourceService(
+      repositories.users,
+      departmentDescendantResolver(repositories.departments),
+    );
+    const current = actor("department");
+
+    await expect(access.get("user_b", current)).rejects.toBeInstanceOf(
+      DataAccessDeniedError,
+    );
+    await expect(
+      access.update("user_b", { displayName: "越权更新" }, current),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+    await expect(access.softDelete("user_b", current)).rejects.toBeInstanceOf(
+      DataAccessDeniedError,
+    );
+    expect(await repositories.users.get("user_b")).toMatchObject({
+      displayName: "B 可检索",
+      status: "active",
+      deletedAt: undefined,
+    });
+  });
+});
+
+async function connectAndMigrate(connectionString: string): Promise<Pool> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 30; attempt += 1) {
+    const candidate = new Pool({ connectionString });
+    try {
+      await migrate(drizzle(candidate), {
+        migrationsFolder: resolve(
+          import.meta.dir,
+          "../../../../packages/database/drizzle",
+        ),
+        migrationsSchema: "public",
+        migrationsTable: "__data_scope_test_migrations",
+      });
+      return candidate;
+    } catch (error) {
+      lastError = error;
+      await candidate.end().catch(() => undefined);
+      await Bun.sleep(200);
+    }
+  }
+  throw lastError;
+}
+
+function createRepositories(pool: Pool) {
+  return createDrizzleSystemRepositories(drizzle(pool), {
+    users: [],
+    roles: [],
+    departments: [],
+    menus: [],
+    dictionaries: [],
+    features: [],
+    // @windy-module system.license begin
+    licenses: [],
+    // @windy-module system.license end
+  });
+}
+
+async function seedDepartments(
+  repository: ReturnType<typeof createRepositories>["departments"],
+) {
+  await repository.create(department("dept_a"), setupActor);
+  await repository.create(department("dept_a_child", "dept_a"), setupActor);
+  await repository.create(department("dept_b"), setupActor);
+}
+
+async function seedUsers(
+  repository: ReturnType<typeof createRepositories>["users"],
+) {
+  await repository.create(user("user_a", "A 可检索", "dept_a"), setupActor);
+  await repository.create(
+    user("user_a_child", "A 子级可检索", "dept_a_child"),
+    setupActor,
+  );
+  await repository.create(user("user_b", "B 可检索", "dept_b"), setupActor);
+}
+
+function actor(
+  scope: DataScope,
+  grants: Array<Extract<ScopeGrant, { scope: "custom" }>> = [],
+): RequestActor {
+  return {
+    id: "user_a",
+    type: "user",
+    name: "用户 A",
+    roleCodes: [scope],
+    permissionKeys: [],
+    scopeContext: buildScopeContext(
+      "user_a",
+      "dept_a",
+      [
+        {
+          id: `role_${scope}`,
+          code: scope,
+          dataScope: scope,
+          departmentIds: [],
+        },
+      ],
+      grants,
+    ),
+  };
+}
+
+const setupActor: RequestActor = {
+  id: "system",
+  type: "service",
+  name: "测试初始化",
+  roleCodes: ["system"],
+  permissionKeys: [],
+};
+
+function department(id: string, parentId?: string): Partial<ManagedDepartment> {
+  return { id, parentId, code: id, name: id, order: 10, status: "active" };
+}
+
+function user(
+  id: string,
+  displayName: string,
+  departmentId: string,
+): Partial<ManagedUser> {
+  return {
+    id,
+    username: id,
+    displayName,
+    departmentId,
+    roleIds: [],
+    status: "active",
+  };
+}

package/template/apps/server/src/data-access/scoped-repository.ts

@@ -0,0 +1,268 @@
+import type { PageResult } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { ManagedEntity } from "../system/entities.js";
+import {
+  InMemoryEntityRepository,
+  type EntityImportResult,
+  type EntityListQuery,
+  type EntityRepository,
+  type MaybePromise,
+} from "../system/repository.js";
+import { DataScopeBindingError } from "./drizzle-predicate.js";
+import { DataAccessDeniedError } from "./errors.js";
+import type { DataScopeQuerySpecification } from "./query-specification.js";
+
+export interface EntityScopeOwnership {
+  readonly ownerId?: string;
+  readonly tenantId?: string;
+  readonly dimensions?: Readonly<Record<string, string | undefined>>;
+}
+
+export interface EntityDataScopeBinding<T extends ManagedEntity> {
+  readonly fixedTenantId?: string;
+  ownership(entity: Partial<T>): EntityScopeOwnership;
+}
+
+export interface ScopedEntityRepository<
+  T extends ManagedEntity,
+> extends EntityRepository<T> {
+  listScoped(
+    query: EntityListQuery,
+    searchFields: Array<keyof T>,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<PageResult<T>>;
+  allScoped(
+    query: EntityListQuery,
+    searchFields: Array<keyof T>,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T[]>;
+  getScoped(
+    id: string,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T | undefined>;
+  getManyScopedSnapshot(
+    ids: readonly string[],
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T[] | undefined>;
+  createScoped(
+    input: Partial<T>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T>;
+  updateScoped(
+    id: string,
+    input: Partial<T>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T | undefined>;
+  softDeleteScoped(
+    id: string,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): MaybePromise<T | undefined>;
+  importManyScoped(
+    inputs: Array<Partial<T>>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+    mode?: "create" | "upsert",
+  ): MaybePromise<EntityImportResult<T>>;
+}
+
+export class InMemoryScopedEntityRepository<
+  T extends ManagedEntity,
+> implements ScopedEntityRepository<T> {
+  private readonly repository: InMemoryEntityRepository<T>;
+
+  constructor(
+    initialItems: T[],
+    private readonly binding: EntityDataScopeBinding<T>,
+  ) {
+    this.repository = new InMemoryEntityRepository(initialItems);
+  }
+
+  list(...args: Parameters<EntityRepository<T>["list"]>) {
+    return this.repository.list(...args);
+  }
+
+  all(...args: Parameters<EntityRepository<T>["all"]>) {
+    return this.repository.all(...args);
+  }
+
+  get(...args: Parameters<EntityRepository<T>["get"]>) {
+    return this.repository.get(...args);
+  }
+
+  create(...args: Parameters<EntityRepository<T>["create"]>) {
+    return this.repository.create(...args);
+  }
+
+  update(...args: Parameters<EntityRepository<T>["update"]>) {
+    return this.repository.update(...args);
+  }
+
+  updateMany(...args: Parameters<EntityRepository<T>["updateMany"]>) {
+    return this.repository.updateMany(...args);
+  }
+
+  softDelete(...args: Parameters<EntityRepository<T>["softDelete"]>) {
+    return this.repository.softDelete(...args);
+  }
+
+  importMany(...args: Parameters<EntityRepository<T>["importMany"]>) {
+    return this.repository.importMany(...args);
+  }
+
+  listScoped(
+    query: EntityListQuery,
+    searchFields: Array<keyof T>,
+    scope: DataScopeQuerySpecification,
+  ): PageResult<T> {
+    const page = Math.max(1, query.page || 1);
+    const pageSize = Math.min(100, Math.max(1, query.pageSize || 20));
+    const items = this.allScoped(query, searchFields, scope);
+    const start = (page - 1) * pageSize;
+    return {
+      items: items.slice(start, start + pageSize),
+      total: items.length,
+      page,
+      pageSize,
+    };
+  }
+
+  allScoped(
+    query: EntityListQuery,
+    searchFields: Array<keyof T>,
+    scope: DataScopeQuerySpecification,
+  ): T[] {
+    return this.repository
+      .all(query, searchFields)
+      .filter((item) => isEntityInDataScope(item, scope, this.binding));
+  }
+
+  getScoped(id: string, scope: DataScopeQuerySpecification): T | undefined {
+    const item = this.repository.get(id);
+    if (!item) return undefined;
+    assertEntityInDataScope(item, scope, this.binding);
+    return item;
+  }
+
+  getManyScopedSnapshot(
+    ids: readonly string[],
+    scope: DataScopeQuerySpecification,
+  ): T[] | undefined {
+    const items = ids.map((id) => this.repository.get(id));
+    if (items.some((item) => !item)) return undefined;
+    const complete = items as T[];
+    if (
+      complete.some((item) => !isEntityInDataScope(item, scope, this.binding))
+    ) {
+      return undefined;
+    }
+    return complete;
+  }
+
+  createScoped(
+    input: Partial<T>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): T {
+    assertEntityInDataScope(input, scope, this.binding);
+    return this.repository.create(input, actor);
+  }
+
+  updateScoped(
+    id: string,
+    input: Partial<T>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): T | undefined {
+    const current = this.getScoped(id, scope);
+    if (!current) return undefined;
+    assertEntityInDataScope({ ...current, ...input, id }, scope, this.binding);
+    return this.repository.update(id, input, actor);
+  }
+
+  softDeleteScoped(
+    id: string,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+  ): T | undefined {
+    return this.updateScoped(
+      id,
+      {
+        status: "archived",
+        deletedAt: new Date().toISOString(),
+        deletedBy: actor.id,
+      } as Partial<T>,
+      actor,
+      scope,
+    );
+  }
+
+  importManyScoped(
+    inputs: Array<Partial<T>>,
+    actor: RequestActor,
+    scope: DataScopeQuerySpecification,
+    mode: "create" | "upsert" = "create",
+  ): EntityImportResult<T> {
+    const result: EntityImportResult<T> = {
+      created: 0,
+      updated: 0,
+      skipped: 0,
+      items: [],
+    };
+    for (const input of inputs) {
+      const current = input.id ? this.getScoped(input.id, scope) : undefined;
+      if (current && mode !== "upsert") {
+        result.skipped += 1;
+        continue;
+      }
+      const item = current
+        ? this.updateScoped(current.id, input, actor, scope)
+        : this.createScoped(input, actor, scope);
+      if (!item) continue;
+      if (current) result.updated += 1;
+      else result.created += 1;
+      result.items.push(item);
+    }
+    return result;
+  }
+}
+
+export function assertEntityInDataScope<T extends ManagedEntity>(
+  entity: Partial<T>,
+  scope: DataScopeQuerySpecification,
+  binding: EntityDataScopeBinding<T>,
+): void {
+  if (!isEntityInDataScope(entity, scope, binding)) {
+    throw new DataAccessDeniedError();
+  }
+}
+
+export function isEntityInDataScope<T extends ManagedEntity>(
+  entity: Partial<T>,
+  scope: DataScopeQuerySpecification,
+  binding: EntityDataScopeBinding<T>,
+): boolean {
+  const ownership = binding.ownership(entity);
+  return scope.branches.some((branch) => {
+    if (branch.kind === "all") return true;
+    if (branch.kind === "tenant") {
+      return (ownership.tenantId || binding.fixedTenantId) === branch.tenantId;
+    }
+    if (branch.kind === "owner") {
+      if (ownership.ownerId === undefined) missing("ownerId");
+      return ownership.ownerId === branch.ownerId;
+    }
+    if (!(branch.dimension in (ownership.dimensions || {}))) {
+      missing(branch.dimension);
+    }
+    return branch.values.includes(
+      ownership.dimensions?.[branch.dimension] || "",
+    );
+  });
+}
+
+function missing(dimension: string): never {
+  throw new DataScopeBindingError(`entity scope binding missing ${dimension}`);
+}

package/template/apps/server/src/data-access/scoped-resource.test.ts

@@ -0,0 +1,158 @@
+import { describe, expect, test } from "bun:test";
+import type { DataScope } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { ManagedDepartment, ManagedUser } from "../system/entities.js";
+import { InMemoryEntityRepository } from "../system/repository.js";
+import { InMemoryScopedEntityRepository } from "./scoped-repository.js";
+import { userDataScopeBinding } from "../system/user-data-scope.js";
+import { buildScopeContext, type ScopeGrant } from "./context.js";
+import { departmentDescendantResolver } from "./department-tree.js";
+import {
+  DataAccessDeniedError,
+  DataScopedResourceService,
+} from "./scoped-resource.js";
+
+const systemActor: RequestActor = {
+  id: "system",
+  type: "service",
+  name: "测试初始化",
+  roleCodes: ["system"],
+  permissionKeys: [],
+};
+
+describe("data scoped resource service", () => {
+  test.each([
+    ["all", ["user_a", "user_a_child", "user_b"]],
+    ["tenant", ["user_a", "user_a_child", "user_b"]],
+    ["department", ["user_a"]],
+    ["department-and-children", ["user_a", "user_a_child"]],
+    ["self", ["user_a"]],
+    ["custom", ["user_b"]],
+  ] as Array<[DataScope, string[]]>)(
+    "%s 范围约束用户列表",
+    async (scope, expected) => {
+      const { service } = fixture();
+      const result = await service.all({}, [], actor(scope));
+      expect(result.map((item) => item.id).sort()).toEqual(expected.sort());
+    },
+  );
+
+  test("多角色按并集计算，并让搜索、分页和导出复用相同结果", async () => {
+    const { service } = fixture();
+    const current = actor("self", [
+      { scope: "custom", dimension: "departmentId", values: ["dept_b"] },
+    ]);
+    const listed = await service.list(
+      { page: 1, pageSize: 1, q: "用户" },
+      ["displayName"],
+      current,
+    );
+    const exported = await service.all({ q: "用户" }, ["displayName"], current);
+
+    expect(listed).toMatchObject({ total: 2, page: 1, pageSize: 1 });
+    expect(exported.map((item) => item.id).sort()).toEqual([
+      "user_a",
+      "user_b",
+    ]);
+  });
+
+  test("跨部门直接 ID 的读取、修改和删除均拒绝", async () => {
+    const { service } = fixture();
+    const current = actor("department");
+
+    await expect(service.get("user_b", current)).rejects.toBeInstanceOf(
+      DataAccessDeniedError,
+    );
+    await expect(
+      service.update("user_b", { displayName: "越权" }, current),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+    await expect(service.softDelete("user_b", current)).rejects.toBeInstanceOf(
+      DataAccessDeniedError,
+    );
+  });
+
+  test("不能把可管理用户移动到无权部门", async () => {
+    const { service } = fixture();
+    await expect(
+      service.update("user_a", { departmentId: "dept_b" }, actor("department")),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+  });
+});
+
+function fixture() {
+  const departments = new InMemoryEntityRepository<ManagedDepartment>([
+    department("dept_a"),
+    department("dept_a_child", "dept_a"),
+    department("dept_b"),
+  ]);
+  const users = new InMemoryScopedEntityRepository<ManagedUser>(
+    [
+      user("user_a", "dept_a"),
+      user("user_a_child", "dept_a_child"),
+      user("user_b", "dept_b"),
+    ],
+    userDataScopeBinding,
+  );
+  return {
+    service: new DataScopedResourceService(
+      users,
+      departmentDescendantResolver(departments),
+    ),
+  };
+}
+
+function actor(
+  scope: DataScope,
+  extraGrants: Array<Extract<ScopeGrant, { scope: "custom" }>> = [],
+): RequestActor {
+  const role = {
+    id: `role_${scope}`,
+    code: scope,
+    dataScope: scope,
+    departmentIds: scope === "custom" ? ["dept_b"] : [],
+  };
+  const scopeContext = buildScopeContext(
+    "user_a",
+    "dept_a",
+    [role],
+    extraGrants,
+  );
+  return {
+    id: "user_a",
+    type: "user",
+    name: "用户 A",
+    roleCodes: [scope],
+    permissionKeys: ["system.user.read", "system.user.manage"],
+    scopeContext,
+  };
+}
+
+function user(id: string, departmentId: string): ManagedUser {
+  return {
+    id,
+    username: id,
+    displayName: `${id} 用户`,
+    roleIds: [],
+    departmentId,
+    status: "active",
+    createdAt: "2026-07-15T00:00:00.000Z",
+    createdBy: systemActor.id,
+    updatedAt: "2026-07-15T00:00:00.000Z",
+    updatedBy: systemActor.id,
+  };
+}
+
+function department(id: string, parentId?: string): ManagedDepartment {
+  return {
+    id,
+    parentId,
+    code: id,
+    name: id,
+    order: 10,
+    status: "active",
+    createdAt: "2026-07-15T00:00:00.000Z",
+    createdBy: systemActor.id,
+    updatedAt: "2026-07-15T00:00:00.000Z",
+    updatedBy: systemActor.id,
+  };
+}