create-windy 0.1.0

package/template/apps/server/src/license/runtime-audit-reliability.test.ts

@@ -0,0 +1,96 @@
+import { generateKeyPairSync, sign } from "node:crypto";
+import { describe, expect, test } from "bun:test";
+import {
+  createLicenseSigningPayload,
+  MemoryAtomicLicenseStore,
+} from "@windy/license-sdk";
+import {
+  licenseVersionKey,
+  type LicenseV1Claims,
+  type SignedLicenseV1,
+} from "@windy/shared";
+import { MemoryAuditRecoveryQueue } from "../audit/recovery-queue.js";
+import { ReliableAuditWriter } from "../audit/reliable-writer.js";
+import { InMemoryAuditSink } from "../runtime.js";
+import { PlatformLicenseRuntime } from "./runtime-service.js";
+
+describe("License 上传审计可靠性", () => {
+  test("损坏文件恢复遇到 PostgreSQL 故障时进入关键恢复队列", async () => {
+    const signed = signedLicense();
+    const queue = new MemoryAuditRecoveryQueue();
+    const auditWriter = new ReliableAuditWriter(
+      { write: async () => Promise.reject(new Error("postgres unavailable")) },
+      queue,
+      { maxAttempts: 2, delay: async () => undefined },
+    );
+    const runtime = new PlatformLicenseRuntime(
+      {
+        productCode: "windy-platform",
+        machineCode: "machine_1",
+        publicKeys: { [signed.license.publicKeyId]: signed.publicKeyPem },
+        store: new MemoryAtomicLicenseStore("{corrupted-current"),
+        enforceRestrictions: true,
+        now: () => new Date("2026-08-01T00:00:00.000Z"),
+      },
+      new InMemoryAuditSink(auditWriter),
+    );
+
+    const result = await runtime.install(JSON.stringify(signed.license), {
+      actor: {
+        id: "user_1",
+        type: "user",
+        name: "普通用户",
+        roleCodes: ["member"],
+        permissionKeys: [],
+      },
+      requestId: "request_1",
+    });
+
+    expect(result.result.status).toBe("installed");
+    expect(queue.events).toHaveLength(1);
+    expect(queue.events[0]).toMatchObject({
+      action: "license.update",
+      outcome: "success",
+    });
+    expect(auditWriter.status()).toMatchObject({
+      state: "degraded",
+      queued: 1,
+    });
+  });
+});
+
+function signedLicense() {
+  const claims: LicenseV1Claims = {
+    licenseId: "license_queued",
+    productCode: "windy-platform",
+    customer: { id: "customer_1", code: "C-1", name: "客户一" },
+    project: { id: "project_1", code: "P-1", name: "项目一" },
+    contract: { id: "contract_1", contractNumber: "HT-1", version: "1" },
+    machineCode: "machine_1",
+    issuedAt: "2026-07-10T00:00:00.000Z",
+    expiresAt: "2030-07-10T00:00:00.000Z",
+    licenseVersion: {
+      key: licenseVersionKey("advanced"),
+      name: "高级付费版",
+    },
+  };
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const unsigned = {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: "key_license_queued",
+    claims,
+  } as const;
+  const license: SignedLicenseV1 = {
+    ...unsigned,
+    signature: sign(
+      null,
+      Buffer.from(createLicenseSigningPayload(unsigned)),
+      privateKey,
+    ).toString("base64"),
+  };
+  return {
+    license,
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+  };
+}

package/template/apps/server/src/license/runtime-reminder.test.ts

@@ -0,0 +1,147 @@
+import { generateKeyPairSync, sign } from "node:crypto";
+import { describe, expect, test } from "bun:test";
+import {
+  createLicenseSigningPayload,
+  MemoryAtomicLicenseStore,
+} from "@windy/license-sdk";
+import {
+  licenseVersionKey,
+  type LicenseV1Claims,
+  type SignedLicenseV1,
+} from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import { PlatformLicenseRuntime } from "./runtime-service.js";
+
+const NOW = new Date("2026-08-01T00:00:00.000Z");
+
+describe("License 运行时提醒视图", () => {
+  test("到期后沿用 LIC-08 限制状态且不再返回到期前提醒", async () => {
+    const expired = signedLicense({
+      licenseId: "license_expired",
+      expiresAt: "2026-07-31T23:59:59.999Z",
+    });
+    const runtime = new PlatformLicenseRuntime({
+      productCode: "windy-platform",
+      machineCode: "machine_1",
+      publicKeys: { [expired.license.publicKeyId]: expired.publicKeyPem },
+      store: new MemoryAtomicLicenseStore(JSON.stringify(expired.license)),
+      enforceRestrictions: true,
+      now: () => NOW,
+    });
+
+    expect(await runtime.snapshotForActor(actor())).toMatchObject({
+      status: "expired",
+      restricted: true,
+      reminder: { level: "none" },
+      canViewDetails: false,
+    });
+  });
+
+  test("按维护权限脱敏，并在替换后立即按新期限重算", async () => {
+    const current = signedLicense({
+      licenseId: "license_notice",
+      expiresAt: "2026-09-15T00:00:00.000Z",
+    });
+    const replacement = signedLicense({
+      licenseId: "license_critical",
+      issuedAt: "2026-07-20T00:00:00.000Z",
+      expiresAt: "2026-08-06T00:00:00.000Z",
+    });
+    const runtime = new PlatformLicenseRuntime({
+      productCode: "windy-platform",
+      machineCode: "machine_1",
+      publicKeys: {
+        [current.license.publicKeyId]: current.publicKeyPem,
+        [replacement.license.publicKeyId]: replacement.publicKeyPem,
+      },
+      store: new MemoryAtomicLicenseStore(JSON.stringify(current.license)),
+      enforceRestrictions: true,
+      now: () => NOW,
+    });
+
+    const member = await runtime.snapshotForActor(actor());
+    expect(member).toMatchObject({
+      status: "valid",
+      expiresAt: "2026-09-15T00:00:00.000Z",
+      reminder: { level: "notice", daysRemaining: 45 },
+      canViewDetails: false,
+    });
+    expect(JSON.stringify(member)).not.toContain("machine_1");
+    expect(JSON.stringify(member)).not.toContain("客户一");
+
+    const maintainer = await runtime.snapshotForActor(
+      actor(["system.license.manage"]),
+    );
+    expect(maintainer).toMatchObject({
+      machineCode: "machine_1",
+      productCode: "windy-platform",
+      canViewDetails: true,
+      license: { claims: { licenseId: "license_notice" } },
+    });
+
+    const installed = await runtime.install(
+      JSON.stringify(replacement.license),
+      {
+        actor: actor(),
+        requestId: "request_replace",
+      },
+    );
+    const replacementView = runtime.presentSnapshot(
+      installed.snapshot,
+      actor(),
+    );
+    expect(replacementView).toMatchObject({
+      expiresAt: "2026-08-06T00:00:00.000Z",
+      reminder: { level: "critical", daysRemaining: 5 },
+      canViewDetails: false,
+    });
+    expect(JSON.stringify(replacementView)).not.toContain("machine_1");
+  });
+});
+
+function actor(permissionKeys: string[] = []): RequestActor {
+  return {
+    id: "user_1",
+    type: "user",
+    name: "平台用户",
+    roleCodes: ["member"],
+    permissionKeys,
+  };
+}
+
+function signedLicense(overrides: Partial<LicenseV1Claims>) {
+  const claims: LicenseV1Claims = {
+    licenseId: "license_valid",
+    productCode: "windy-platform",
+    customer: { id: "customer_1", code: "C-1", name: "客户一" },
+    project: { id: "project_1", code: "P-1", name: "项目一" },
+    contract: { id: "contract_1", contractNumber: "HT-1", version: "1" },
+    machineCode: "machine_1",
+    issuedAt: "2026-07-10T00:00:00.000Z",
+    expiresAt: "2030-07-10T00:00:00.000Z",
+    licenseVersion: {
+      key: licenseVersionKey("advanced"),
+      name: "高级付费版",
+    },
+    ...overrides,
+  };
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const unsigned = {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: `key_${claims.licenseId}`,
+    claims,
+  } as const;
+  const license: SignedLicenseV1 = {
+    ...unsigned,
+    signature: sign(
+      null,
+      Buffer.from(createLicenseSigningPayload(unsigned)),
+      privateKey,
+    ).toString("base64"),
+  };
+  return {
+    license,
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+  };
+}

package/template/apps/server/src/license/runtime-service-test-http.ts

@@ -0,0 +1,28 @@
+export async function requestStatus(
+  app: { handle(request: Request): Promise<Response> | Response },
+  method: string,
+  path: string,
+  authenticated = false,
+  body?: unknown,
+): Promise<number> {
+  const current = createRuntimeRequest(path, authenticated, body);
+  if (current.method !== method) {
+    return (await app.handle(new Request(current, { method }))).status;
+  }
+  return (await app.handle(current)).status;
+}
+
+export function createRuntimeRequest(
+  path: string,
+  authenticated = false,
+  body?: unknown,
+): Request {
+  return new Request(`http://localhost${path}`, {
+    method: body === undefined ? "GET" : "POST",
+    headers: {
+      ...(authenticated ? { authorization: "Bearer user-token" } : {}),
+      ...(body === undefined ? {} : { "content-type": "application/json" }),
+    },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  });
+}

package/template/apps/server/src/license/runtime-service.test.ts

@@ -0,0 +1,334 @@
+import { generateKeyPairSync, sign } from "node:crypto";
+import { describe, expect, test } from "bun:test";
+import { Elysia } from "elysia";
+import {
+  createLicenseSigningPayload,
+  MemoryAtomicLicenseStore,
+} from "@windy/license-sdk";
+import {
+  featureKey,
+  licenseVersionKey,
+  type LicenseV1Claims,
+  type SignedLicenseV1,
+} from "@windy/shared";
+import { evaluateAccessGuards } from "../access-guards.js";
+import {
+  createSystemToolHandlers,
+  registerAgentRoutes,
+} from "../agent/routes.js";
+import { runGuardedBackgroundTask } from "../background/task-guard.js";
+import {
+  createFoundationSnapshot,
+  loadFoundationModules,
+} from "../foundation.js";
+import {
+  evaluateRestrictedHttpRequest,
+  licenseRestrictedResponse,
+} from "./restriction.js";
+import { registerPlatformLicenseRoutes } from "./routes.js";
+import { createServerRuntime } from "../runtime.js";
+import { registerSystemRoutes } from "../system/routes.js";
+import { createSystemRepositories } from "../system/seed.js";
+import { PlatformLicenseRuntime } from "./runtime-service.js";
+import {
+  createRuntimeRequest as request,
+  requestStatus as status,
+} from "./runtime-service-test-http.js";
+import { buildScopeContext } from "../data-access/context.js";
+
+const NOW = new Date("2026-08-01T00:00:00.000Z");
+
+describe("客户业务平台 License 运行闭环", () => {
+  test("到期限流、认证上传、失败审计和安装后动态恢复", async () => {
+    const expired = signedLicense({
+      licenseId: "license_expired",
+      issuedAt: "2025-07-01T00:00:00.000Z",
+      expiresAt: "2026-07-01T00:00:00.000Z",
+    });
+    const next = signedLicense({
+      licenseId: "license_next",
+      issuedAt: "2026-07-20T00:00:00.000Z",
+      expiresAt: "2030-07-20T00:00:00.000Z",
+    });
+    const fixture = createFixture(
+      new MemoryAtomicLicenseStore(JSON.stringify(expired.license)),
+      {
+        [expired.license.publicKeyId]: expired.publicKeyPem,
+        [next.license.publicKeyId]: next.publicKeyPem,
+      },
+    );
+
+    expect(await status(fixture.app, "GET", "/api/health")).toBe(200);
+    expect(await status(fixture.app, "GET", "/api/system/users", true)).toBe(
+      403,
+    );
+    expect(
+      await status(
+        fixture.app,
+        "POST",
+        "/api/agent/tools/system.users.list/execute",
+        true,
+      ),
+    ).toBe(403);
+    expect(
+      await status(fixture.app, "GET", "/api/system/users/export", true),
+    ).toBe(403);
+    expect(await status(fixture.app, "GET", "/api/license/runtime", true)).toBe(
+      200,
+    );
+    expect(
+      await status(fixture.app, "POST", "/api/license/runtime/install", false, {
+        license: JSON.stringify(next.license),
+      }),
+    ).toBe(401);
+
+    const beforeContext = await fixture.runtime.createGuardContext(
+      request("/api/background", true),
+    );
+    const deniedTask = await runGuardedBackgroundTask(
+      fixture.runtime,
+      beforeContext,
+      {
+        taskKey: "report.refresh",
+        permission: { permissionKey: "system.user.read" },
+      },
+      () => "不应执行",
+    );
+    expect(deniedTask).toMatchObject({
+      ok: false,
+      reason: "license-restricted",
+    });
+
+    expect(
+      await status(fixture.app, "POST", "/api/license/runtime/install", true, {
+        license: "{broken",
+      }),
+    ).toBe(400);
+    expect(
+      await status(fixture.app, "POST", "/api/license/runtime/install", true, {
+        license: JSON.stringify(next.license),
+      }),
+    ).toBe(200);
+
+    expect(await status(fixture.app, "GET", "/api/system/users", true)).toBe(
+      200,
+    );
+    const afterContext = await fixture.runtime.createGuardContext(
+      request("/api/background", true),
+    );
+    const commercial = await evaluateAccessGuards(
+      fixture.runtime,
+      afterContext,
+      {
+        permission: { permissionKey: "system.audit.read" },
+        feature: {
+          key: featureKey("system.audit"),
+          label: "审计",
+          module: "system",
+          enabled: true,
+          visible: "visible",
+          stage: "stable",
+          allowedLicenseVersions: [licenseVersionKey("advanced")],
+        },
+      },
+    );
+    expect(commercial.decision.reason).toBe("allowed");
+    expect(
+      fixture.runtime.auditSink
+        .list()
+        .filter((event) => event.action === "license.update")
+        .map((event) => event.outcome),
+    ).toEqual(["failure", "success"]);
+  });
+
+  test("损坏 current 只能经已认证上传入口恢复并留下摘要审计", async () => {
+    const next = signedLicense({ licenseId: "license_recovery" });
+    const store = new MemoryAtomicLicenseStore("{corrupted-current");
+    const fixture = createFixture(store, {
+      [next.license.publicKeyId]: next.publicKeyPem,
+    });
+
+    expect(
+      await status(fixture.app, "POST", "/api/license/runtime/install", false, {
+        license: JSON.stringify(next.license),
+      }),
+    ).toBe(401);
+    expect(await store.readCurrent()).toBe("{corrupted-current");
+
+    expect(
+      await status(fixture.app, "POST", "/api/license/runtime/install", true, {
+        license: JSON.stringify(next.license),
+      }),
+    ).toBe(200);
+    expect(JSON.parse((await store.readCurrent())!).claims.licenseId).toBe(
+      "license_recovery",
+    );
+    expect(fixture.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "license.update",
+        outcome: "success",
+        actor: expect.objectContaining({ id: "user_1" }),
+        metadata: expect.objectContaining({
+          digest: expect.stringMatching(/^[a-f0-9]{64}$/),
+        }),
+      }),
+    );
+  });
+
+  test("并发上传按服务端顺序执行，旧签发文件不能在竞态中覆盖新文件", async () => {
+    const currentLicense = signedLicense({
+      licenseId: "license_current",
+      issuedAt: "2026-07-01T00:00:00.000Z",
+    });
+    const newer = signedLicense({
+      licenseId: "license_newer",
+      issuedAt: "2026-07-20T00:00:00.000Z",
+    });
+    const older = signedLicense({
+      licenseId: "license_older",
+      issuedAt: "2026-07-15T00:00:00.000Z",
+    });
+    let current = JSON.stringify(currentLicense.license);
+    const store = {
+      readCurrent: () => current,
+      async replaceCurrentAtomically(value: string) {
+        if (JSON.parse(value).claims.licenseId === "license_older") {
+          await Bun.sleep(10);
+        }
+        current = value;
+      },
+    };
+    const fixture = createFixture(store, {
+      [currentLicense.license.publicKeyId]: currentLicense.publicKeyPem,
+      [newer.license.publicKeyId]: newer.publicKeyPem,
+      [older.license.publicKeyId]: older.publicKeyPem,
+    });
+
+    const actor = actorFrom(request("/api/license/runtime/install", true))!;
+    const results = await Promise.all([
+      fixture.licenseRuntime.install(JSON.stringify(newer.license), {
+        actor,
+        requestId: "request_newer",
+      }),
+      fixture.licenseRuntime.install(JSON.stringify(older.license), {
+        actor,
+        requestId: "request_older",
+      }),
+    ]);
+    expect(results.map(({ result }) => result.status)).toEqual([
+      "installed",
+      "rejected",
+    ]);
+    expect(JSON.parse(current).claims.licenseId).toBe("license_newer");
+  });
+});
+
+function createFixture(
+  store: ConstructorParameters<typeof PlatformLicenseRuntime>[0]["store"],
+  publicKeys: Record<string, string>,
+) {
+  const licenseRuntime = new PlatformLicenseRuntime({
+    productCode: "windy-platform",
+    machineCode: "machine_1",
+    publicKeys,
+    store,
+    enforceRestrictions: true,
+    now: () => NOW,
+  });
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: { resolve: (current) => actorFrom(current) },
+      licenseResolver: licenseRuntime,
+      featureResolver: {
+        resolve: (key) => ({ key, enabled: true, visible: "visible" }),
+      },
+    },
+  );
+  licenseRuntime.setAuditSink(runtime.auditSink);
+  const app = new Elysia({ prefix: "/api" })
+    .derive(async ({ request: current }) => ({
+      guardContext: await runtime.createGuardContext(current),
+    }))
+    .onBeforeHandle(({ request: current, guardContext }) => {
+      const decision = evaluateRestrictedHttpRequest(guardContext, current);
+      if (!decision.allowed) {
+        runtime.recordDecisions([decision]);
+        return licenseRestrictedResponse(guardContext);
+      }
+    })
+    .get("/health", () => ({ status: "ok" }));
+  registerPlatformLicenseRoutes(app, licenseRuntime);
+  registerSystemRoutes(app, repositories, runtime, snapshot.features);
+  registerAgentRoutes(
+    app,
+    loadFoundationModules(),
+    createSystemToolHandlers(repositories, runtime),
+    runtime,
+  );
+  return { app, runtime, licenseRuntime };
+}
+
+function actorFrom(current: Request) {
+  if (current.headers.get("authorization") !== "Bearer user-token") {
+    return undefined;
+  }
+  return {
+    id: "user_1",
+    type: "user" as const,
+    name: "普通用户",
+    roleCodes: ["member"],
+    permissionKeys: [
+      "system.user.read",
+      "system.audit.read",
+      "system.menu.read",
+    ],
+    scopeContext: buildScopeContext("user_1", undefined, [
+      {
+        id: "role_member",
+        code: "member",
+        dataScope: "self",
+        departmentIds: [],
+      },
+    ]),
+  };
+}
+
+function signedLicense(overrides: Partial<LicenseV1Claims> = {}) {
+  const claims: LicenseV1Claims = {
+    licenseId: "license_valid",
+    productCode: "windy-platform",
+    customer: { id: "customer_1", code: "C-1", name: "客户一" },
+    project: { id: "project_1", code: "P-1", name: "项目一" },
+    contract: { id: "contract_1", contractNumber: "HT-1", version: "1" },
+    machineCode: "machine_1",
+    issuedAt: "2026-07-10T00:00:00.000Z",
+    expiresAt: "2030-07-10T00:00:00.000Z",
+    licenseVersion: {
+      key: licenseVersionKey("advanced"),
+      name: "高级付费版",
+    },
+    ...overrides,
+  };
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const unsigned = {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: `key_${claims.licenseId}`,
+    claims,
+  } as const;
+  const license: SignedLicenseV1 = {
+    ...unsigned,
+    signature: sign(
+      null,
+      Buffer.from(createLicenseSigningPayload(unsigned)),
+      privateKey,
+    ).toString("base64"),
+  };
+  return {
+    license,
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+  };
+}