create-windy 0.1.0

package/template/apps/server/src/data-governance/export/postgres-api-actors.ts

@@ -0,0 +1,140 @@
+import { buildScopeContext } from "../../data-access/context.js";
+import type { RequestActor } from "../../guards.js";
+import type { RequestActorResolver } from "../../runtime.js";
+import type { createSystemRepositories } from "../../system/seed.js";
+
+export const ownerCanaries = [
+  "owner-canary@example.invalid",
+  "13800138071",
+] as const;
+export const outsideCanaries = [
+  "outside-canary@example.invalid",
+  "13900139072",
+] as const;
+
+export function governanceActors() {
+  const self = (id: string) =>
+    buildScopeContext(id, "dept_platform", [
+      { id: `role_${id}`, code: "self", dataScope: "self", departmentIds: [] },
+    ]);
+  const all = buildScopeContext("bootstrap", "dept_platform", [
+    { id: "role_all", code: "all", dataScope: "all", departmentIds: [] },
+  ]);
+  const sensitivePermissions = [
+    "system.user.read",
+    "system.user.reveal",
+    "system.user.export",
+  ];
+  return {
+    bootstrap: actor("bootstrap", ["system"], ["system.user.manage"], all),
+    owner: actor(
+      "user_scope_owner",
+      ["auditor"],
+      sensitivePermissions,
+      self("user_scope_owner"),
+    ),
+    ownerChanged: actor(
+      "user_scope_owner",
+      ["auditor"],
+      sensitivePermissions,
+      self("scope_changed_actor"),
+    ),
+    outside: actor(
+      "user_scope_outside",
+      ["auditor"],
+      sensitivePermissions,
+      self("user_scope_outside"),
+    ),
+    reviewer: actor(
+      "user_reviewer",
+      ["super-admin"],
+      ["system.workflow.manage", "system.user.export"],
+      all,
+    ),
+    denied: actor(
+      "user_denied",
+      ["viewer"],
+      ["system.user.read"],
+      self("user_denied"),
+    ),
+  };
+}
+
+export function bearerActorResolver(
+  actors: ReturnType<typeof governanceActors>,
+): RequestActorResolver {
+  return {
+    resolve(request) {
+      const token = request.headers
+        .get("authorization")
+        ?.replace("Bearer ", "");
+      return token && token in actors
+        ? (actors as unknown as Record<string, RequestActor>)[token]
+        : undefined;
+    },
+  };
+}
+
+export async function seedGovernanceUsers(
+  system: ReturnType<typeof createSystemRepositories>,
+  bootstrap: RequestActor,
+) {
+  for (const id of ["user_scope_owner", "user_scope_outside"]) {
+    await system.roles.create(
+      {
+        id: `role_${id}`,
+        code: `auditor-${id}`,
+        name: `治理审计角色 ${id}`,
+        status: "active",
+        dataScope: "self",
+        permissionKeys: [
+          "system.user.read",
+          "system.user.reveal",
+          "system.user.export",
+        ],
+        menuKeys: [],
+      },
+      bootstrap,
+    );
+  }
+  await system.users.create(
+    {
+      id: "user_scope_owner",
+      username: "scope-owner",
+      displayName: "范围内用户",
+      email: ownerCanaries[0],
+      phone: ownerCanaries[1],
+      roleIds: ["role_user_scope_owner"],
+      departmentId: "dept_platform",
+    },
+    bootstrap,
+  );
+  await system.users.create(
+    {
+      id: "user_scope_outside",
+      username: "scope-outside",
+      displayName: "范围外用户",
+      email: outsideCanaries[0],
+      phone: outsideCanaries[1],
+      roleIds: ["role_user_scope_outside"],
+      departmentId: "dept_platform",
+    },
+    bootstrap,
+  );
+}
+
+function actor(
+  id: string,
+  roleCodes: string[],
+  permissionKeys: string[],
+  scopeContext: NonNullable<RequestActor["scopeContext"]>,
+): RequestActor {
+  return {
+    id,
+    type: "user",
+    name: id,
+    roleCodes,
+    permissionKeys,
+    scopeContext,
+  };
+}

package/template/apps/server/src/data-governance/export/postgres-api-assertions.ts

@@ -0,0 +1,76 @@
+import { expect } from "bun:test";
+import type { Pool } from "pg";
+import {
+  apiRequest,
+  outsideCanaries,
+  ownerCanaries,
+} from "./postgres-api-fixture.js";
+
+const allCanaries = [...ownerCanaries, ...outsideCanaries];
+
+export async function createExport(
+  app: Parameters<typeof apiRequest>[0],
+  token: string,
+  idempotencyKey: string,
+) {
+  const response = await apiRequest(
+    app,
+    token,
+    "POST",
+    "/system/users/exports",
+    {
+      idempotencyKey,
+      reason: "安全审计复核用户字段导出",
+      query: { includeDeleted: false },
+    },
+  );
+  expect(response.status).toBe(202);
+  return json(response) as Promise<{
+    id: string;
+    approvalId?: string;
+    status: string;
+  }>;
+}
+
+export async function readDatabaseSurfaces(pool: Pool) {
+  const tables = [
+    "audit_logs",
+    "governed_export_requests",
+    "durable_jobs",
+    "durable_job_progress",
+    "durable_job_failures",
+    "durable_job_artifacts",
+  ];
+  return Promise.all(
+    tables.map(async (table) => {
+      const result = await pool.query<{ value: string }>(
+        `select coalesce(jsonb_agg(to_jsonb(t)), '[]'::jsonb)::text as value from ${table} t`,
+      );
+      return result.rows[0]?.value || "[]";
+    }),
+  );
+}
+
+export async function deniedBody(
+  response: Response | Promise<Response>,
+  status: number,
+) {
+  const resolved = await response;
+  const body = await resolved.text();
+  expect(resolved.status).toBe(status);
+  assertNoCanaries(body);
+  return body;
+}
+
+export async function json(response: Response | Promise<Response>) {
+  return (await response).json() as Promise<Record<string, unknown>>;
+}
+
+export function assertNoCanaries(value: string) {
+  for (const canary of allCanaries) expect(value).not.toContain(canary);
+}
+
+export function required(value: string | undefined): string {
+  if (!value) throw new Error("缺少必需 ID");
+  return value;
+}

package/template/apps/server/src/data-governance/export/postgres-api-fixture.ts

@@ -0,0 +1,265 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { LocalFileBlobStore, type BlobStore } from "@windy/storage";
+import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import type { Pool } from "pg";
+import { createFoundationSnapshot } from "../../foundation.js";
+import { createPlatformHttpApp } from "../../http-app.js";
+import { DurableArtifactService } from "../../jobs/artifact-service.js";
+import { DrizzleDurableExecutionRepository } from "../../jobs/drizzle-execution-repository.js";
+import { DrizzleDurableJobRepository } from "../../jobs/drizzle-repository.js";
+import { DurableHandlerRegistry } from "../../jobs/handler-registry.js";
+import { DurableJobService } from "../../jobs/service.js";
+import { DurableJobWorker } from "../../jobs/worker.js";
+import { createPlatformObservability } from "../../observability/bootstrap.js";
+import { createServerRuntime, type AuditEventWriter } from "../../runtime.js";
+import { identityRouteConfigs } from "../../system/identity-route-config.js";
+import { registerSystemRoutes } from "../../system/routes.js";
+import { createSystemRepositories } from "../../system/seed.js";
+import { DrizzleWorkflowRepository } from "../../workflow/drizzle-repository.js";
+import { WorkflowService } from "../../workflow/service.js";
+import { WorkflowGovernedExportApproval } from "./approval-port.js";
+import { SystemGovernedExportAuthorization } from "./authorization-port.js";
+import { DrizzleGovernedExportRepository } from "./drizzle-repository.js";
+import { GovernedExportJobRuntime } from "./job-runtime.js";
+import { registerGovernedUserExportRoutes } from "./routes.js";
+import { GovernedExportService } from "./service.js";
+import {
+  GovernedUserExportSource,
+  type GovernedExportSource,
+} from "./source.js";
+import type { RequestActor } from "../../guards.js";
+import {
+  bearerActorResolver,
+  governanceActors,
+  seedGovernanceUsers,
+} from "./postgres-api-actors.js";
+
+export { outsideCanaries, ownerCanaries } from "./postgres-api-actors.js";
+
+export interface GovernanceClock {
+  current: Date;
+}
+
+export async function createPostgresApiFixture(
+  pool: Pool,
+  auditWriter: AuditEventWriter,
+) {
+  const db = drizzle(pool);
+  await migrate(db, {
+    migrationsFolder: resolve(
+      import.meta.dir,
+      "../../../../../packages/database/drizzle",
+    ),
+    migrationsSchema: "public",
+    migrationsTable: "__governance_api_test_migrations",
+  });
+  await truncateDomainTables(pool);
+  const storageRoot = await mkdtemp(join(tmpdir(), "windy-governance-"));
+  const counting = countingBlobStore(
+    new LocalFileBlobStore({ root: storageRoot }),
+  );
+  const clock: GovernanceClock = {
+    current: new Date("2026-07-16T06:00:00.000Z"),
+  };
+  const actors = governanceActors();
+  const actorResolver = bearerActorResolver(actors);
+  const logs: Array<Record<string, unknown>> = [];
+  const runtime = createServerRuntime({}, { actorResolver, auditWriter });
+  const stack = createGovernanceStack({
+    db,
+    runtime,
+    blobStore: counting.blobStore,
+    clock,
+    logs,
+  });
+  await seedGovernanceUsers(stack.system, actors.bootstrap);
+  return {
+    ...stack,
+    actorResolver,
+    actors,
+    blobStore: counting.blobStore,
+    clock,
+    db,
+    logs,
+    openCount: counting.openCount,
+    pool,
+    runtime,
+    storageRoot,
+    async close() {
+      await rm(storageRoot, { recursive: true, force: true });
+    },
+  };
+}
+
+export function createGovernanceStack(input: {
+  db: NodePgDatabase;
+  runtime: ReturnType<typeof createServerRuntime>;
+  blobStore: BlobStore;
+  clock: GovernanceClock;
+  logs?: Array<Record<string, unknown>>;
+  sources?: GovernedExportSource[];
+}) {
+  const foundation = createFoundationSnapshot();
+  const system = createSystemRepositories(foundation, { db: input.db });
+  const workflow = new WorkflowService(
+    new DrizzleWorkflowRepository(input.db),
+    {
+      async resolve() {
+        return undefined;
+      },
+    },
+    () => input.clock.current,
+  );
+  const approvals = new WorkflowGovernedExportApproval(workflow, [
+    { code: "super-admin", name: "超级管理员" },
+  ]);
+  const requests = new DrizzleGovernedExportRepository(input.db);
+  const facts = new DrizzleDurableJobRepository(input.db);
+  const jobs = new DurableJobService(facts, () => input.clock.current);
+  const registry = new DurableHandlerRegistry();
+  const worker = new DurableJobWorker(
+    new DrizzleDurableExecutionRepository(input.db),
+    registry,
+    { now: () => input.clock.current },
+  );
+  const sources = input.sources || [
+    new GovernedUserExportSource(
+      identityRouteConfigs(system, foundation.features).users,
+    ),
+  ];
+  const exports = new GovernedExportJobRuntime(
+    requests,
+    jobs,
+    worker,
+    registry,
+    input.blobStore,
+    input.runtime.auditSink,
+    sources,
+    (request) => approvals.isApproved(request),
+    new SystemGovernedExportAuthorization(system),
+    () => input.clock.current,
+  );
+  const service = new GovernedExportService(
+    requests,
+    exports,
+    jobs,
+    new DurableArtifactService(
+      facts,
+      input.blobStore,
+      () => input.clock.current,
+    ),
+    approvals,
+    input.runtime.auditSink,
+    { approvalRequired: true, retentionSeconds: 86_400 },
+    () => input.clock.current,
+  );
+  const app = platformApp(input.runtime, input.logs || []);
+  registerSystemRoutes(app, system, input.runtime, foundation.features);
+  registerGovernedUserExportRoutes(
+    app,
+    service,
+    input.runtime,
+    foundation.features,
+  );
+  return {
+    app,
+    approvals,
+    exports,
+    facts,
+    jobs,
+    requests,
+    service,
+    system,
+    workflow,
+  };
+}
+
+export async function approveExport(
+  workflow: WorkflowService,
+  approvalId: string,
+  reviewer: RequestActor,
+) {
+  const pending = await workflow.get(approvalId, reviewer);
+  if (!pending) throw new Error("审批任务不存在");
+  const claimed = await workflow.claim(
+    pending.id,
+    { expectedVersion: pending.version, idempotencyKey: `claim:${pending.id}` },
+    reviewer,
+  );
+  await workflow.approve(
+    pending.id,
+    {
+      expectedVersion: claimed.workItem.version,
+      idempotencyKey: `approve:${pending.id}`,
+      reason: "已核验导出范围与用途",
+    },
+    reviewer,
+  );
+}
+
+export function apiRequest(
+  app: { handle(request: Request): Response | Promise<Response> },
+  token: string,
+  method: string,
+  path: string,
+  body?: unknown,
+) {
+  return app.handle(
+    new Request(`http://localhost/api${path}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...(body === undefined ? {} : { "content-type": "application/json" }),
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    }),
+  );
+}
+
+function platformApp(
+  runtime: ReturnType<typeof createServerRuntime>,
+  logs: Array<Record<string, unknown>>,
+) {
+  const observability = createPlatformObservability({
+    databaseRequired: false,
+    auditStatus: () => runtime.auditSink.status(),
+    logger: {
+      info(fields) {
+        logs.push(structuredClone(fields));
+      },
+    },
+  });
+  return createPlatformHttpApp(runtime, observability);
+}
+
+function countingBlobStore(delegate: BlobStore) {
+  let opened = 0;
+  const blobStore: BlobStore = {
+    put: (input) => delegate.put(input),
+    inspect: (ref) => delegate.inspect(ref),
+    open: (ref) => {
+      opened += 1;
+      return delegate.open(ref);
+    },
+    delete: (ref) => delegate.delete(ref),
+  };
+  return { blobStore, openCount: () => opened };
+}
+
+async function truncateDomainTables(pool: Pool) {
+  const result = await pool.query<{ tablename: string }>(`
+    select tablename from pg_tables
+    where schemaname = 'public'
+      and left(tablename, 2) <> '__'
+      and tablename <> 'windy_migration_history'`);
+  if (!result.rows.length) return;
+  const names = result.rows.map(
+    ({ tablename }) => `"${tablename.replaceAll('"', '""')}"`,
+  );
+  await pool.query(
+    `truncate table ${names.join(", ")} restart identity cascade`,
+  );
+}