create-windy 0.1.0

package/template/apps/server/src/license/runtime-service.ts

@@ -0,0 +1,308 @@
+import { createHash } from "node:crypto";
+import { hostname } from "node:os";
+import {
+  createDeviceCode,
+  FileSystemAtomicLicenseStore,
+  LicenseInstaller,
+  MemoryLicenseStorage,
+  parseSignedLicense,
+  WindyLicenseClient,
+  type AtomicLicenseStore,
+  type LicenseInstallResult,
+  type LicensePublicKeyMap,
+  type LicenseStorage,
+} from "@windy/license-sdk";
+import type {
+  AuditEvent,
+  LicenseFailureReason,
+  SignedLicense,
+} from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { InMemoryAuditSink } from "../runtime.js";
+import type {
+  LicenseEntitlementResolver,
+  LicenseEntitlementState,
+} from "../runtime-license.js";
+import {
+  calculateLicenseExpiryReminder,
+  type LicenseExpiryReminder,
+} from "./reminder.js";
+
+export type PlatformLicenseStatus =
+  | "valid"
+  | "expired"
+  | "clock-rollback"
+  | "invalid"
+  | "missing";
+
+export interface PlatformLicenseSnapshot {
+  machineCode?: string;
+  productCode?: string;
+  status: PlatformLicenseStatus;
+  restricted: boolean;
+  failures?: string[];
+  expiresAt?: string;
+  reminder: LicenseExpiryReminder;
+  canViewDetails: boolean;
+  license?: SignedLicense;
+}
+
+export interface PlatformLicenseRuntimeOptions {
+  productCode: string;
+  machineCode: string;
+  publicKeys: LicensePublicKeyMap;
+  store: AtomicLicenseStore;
+  stateStorage?: LicenseStorage;
+  enforceRestrictions?: boolean;
+  now?: () => Date;
+}
+
+export interface LicenseInstallActorContext {
+  actor: RequestActor;
+  requestId: string;
+}
+
+export class PlatformLicenseRuntime implements LicenseEntitlementResolver {
+  private readonly stateStorage: LicenseStorage;
+  private readonly now: () => Date;
+  private auditSink?: InMemoryAuditSink;
+  private installQueue: Promise<void> = Promise.resolve();
+
+  constructor(
+    private readonly options: PlatformLicenseRuntimeOptions,
+    auditSink?: InMemoryAuditSink,
+  ) {
+    this.stateStorage = options.stateStorage || new MemoryLicenseStorage();
+    this.now = options.now || (() => new Date());
+    this.auditSink = auditSink;
+  }
+
+  setAuditSink(auditSink: InMemoryAuditSink): void {
+    this.auditSink = auditSink;
+  }
+
+  async resolve(): Promise<LicenseEntitlementState> {
+    const snapshot = await this.snapshot();
+    return {
+      versionKey:
+        snapshot.status === "valid"
+          ? snapshot.license?.claims.licenseVersion.key
+          : undefined,
+      entitlements: [],
+      status: snapshot.status,
+      restricted: snapshot.restricted,
+    };
+  }
+
+  async snapshot(): Promise<PlatformLicenseSnapshot> {
+    const now = this.now();
+    let rawLicense: string | undefined;
+    try {
+      rawLicense = await this.options.store.readCurrent();
+    } catch {
+      return this.baseSnapshot("invalid", ["storage-failure"], now);
+    }
+    if (!rawLicense) return this.baseSnapshot("missing", [], now);
+
+    const result = await this.client(() => now).recordOpen();
+    const expiresAt = result.license?.claims.expiresAt;
+    return {
+      ...this.baseSnapshot(
+        result.usage.status,
+        result.failures,
+        now,
+        expiresAt,
+      ),
+      license: result.license,
+    };
+  }
+
+  async snapshotForActor(
+    actor: RequestActor,
+  ): Promise<PlatformLicenseSnapshot> {
+    return this.presentSnapshot(await this.snapshot(), actor);
+  }
+
+  presentSnapshot(
+    snapshot: PlatformLicenseSnapshot,
+    actor: RequestActor,
+  ): PlatformLicenseSnapshot {
+    if (actor.permissionKeys.includes("system.license.manage")) return snapshot;
+    return {
+      status: snapshot.status,
+      restricted: snapshot.restricted,
+      expiresAt: snapshot.expiresAt,
+      reminder: snapshot.reminder,
+      canViewDetails: false,
+    };
+  }
+
+  async install(
+    rawLicense: string,
+    context: LicenseInstallActorContext,
+  ): Promise<{
+    result: LicenseInstallResult;
+    snapshot: PlatformLicenseSnapshot;
+  }> {
+    if (context.actor.type !== "user") {
+      throw new Error("只有已认证用户可以安装 License");
+    }
+    const operation = this.installQueue.then(() =>
+      this.performInstall(rawLicense, context),
+    );
+    this.installQueue = operation.then(
+      () => undefined,
+      () => undefined,
+    );
+    return operation;
+  }
+
+  private async performInstall(
+    rawLicense: string,
+    context: LicenseInstallActorContext,
+  ): Promise<{
+    result: LicenseInstallResult;
+    snapshot: PlatformLicenseSnapshot;
+  }> {
+    const digest = createHash("sha256").update(rawLicense).digest("hex");
+    const untrustedCandidate = parseSignedLicense(rawLicense);
+    const result = await new LicenseInstaller({
+      store: this.options.store,
+      productCode: this.options.productCode,
+      machineCode: this.options.machineCode,
+      publicKeys: this.options.publicKeys,
+      now: this.now(),
+      trustedInvalidCurrentRecoveryAuthority: () => true,
+    }).install(rawLicense);
+
+    await this.auditSink?.recordCriticalEvent(
+      installAuditEvent(context, digest, untrustedCandidate, result),
+    );
+    return { result, snapshot: await this.snapshot() };
+  }
+
+  private client(now: () => Date = this.now): WindyLicenseClient {
+    return new WindyLicenseClient({
+      licenseSource: this.options.store,
+      stateStorage: this.stateStorage,
+      productCode: this.options.productCode,
+      machineCode: this.options.machineCode,
+      publicKeys: this.options.publicKeys,
+      now,
+    });
+  }
+
+  private baseSnapshot(
+    status: PlatformLicenseStatus,
+    failures: readonly (LicenseFailureReason | string)[],
+    now: Date,
+    expiresAt?: string,
+  ): PlatformLicenseSnapshot {
+    return {
+      machineCode: this.options.machineCode,
+      productCode: this.options.productCode,
+      status,
+      restricted:
+        Boolean(this.options.enforceRestrictions) && status !== "valid",
+      failures: [...failures],
+      expiresAt,
+      reminder: calculateLicenseExpiryReminder(expiresAt, now, status),
+      canViewDetails: true,
+    };
+  }
+}
+
+export function createPlatformLicenseRuntimeOptions(
+  env: Record<string, string | undefined>,
+): PlatformLicenseRuntimeOptions {
+  const productCode = env.WINDY_PRODUCT_CODE || "windy-platform";
+  const machineCode =
+    env.WINDY_SERVER_MACHINE_CODE ||
+    env.LICENSE_MACHINE_CODE ||
+    createDeviceCode({
+      hostname: hostname(),
+      platform: process.platform,
+      arch: process.arch,
+      tenant: env.WINDY_LICENSE_DEVICE_TENANT,
+    });
+  return {
+    productCode,
+    machineCode,
+    publicKeys: readPublicKeys(env),
+    store: new FileSystemAtomicLicenseStore(
+      env.WINDY_LICENSE_FILE || "./data/license/current.license.json",
+    ),
+    enforceRestrictions:
+      env.LICENSE_ENABLED !== "false" &&
+      (env.NODE_ENV === "production" ||
+        env.WINDY_LICENSE_RESTRICTION_MODE === "1"),
+  };
+}
+
+export function hasConfiguredLicenseKeys(
+  options: PlatformLicenseRuntimeOptions,
+): boolean {
+  return Object.keys(options.publicKeys).length > 0;
+}
+
+function readPublicKeys(
+  env: Record<string, string | undefined>,
+): LicensePublicKeyMap {
+  if (env.WINDY_LICENSE_PUBLIC_KEYS) {
+    try {
+      const value = JSON.parse(env.WINDY_LICENSE_PUBLIC_KEYS) as unknown;
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        return Object.fromEntries(
+          Object.entries(value)
+            .filter(
+              (entry): entry is [string, string] =>
+                Boolean(entry[0]) && typeof entry[1] === "string",
+            )
+            .map(([key, pem]) => [key, normalizePem(pem)]),
+        );
+      }
+    } catch {
+      return {};
+    }
+  }
+  const keyId = env.LICENSE_PUBLIC_KEY_ID;
+  const publicKey = env.LICENSE_PUBLIC_KEY;
+  return keyId && publicKey ? { [keyId]: normalizePem(publicKey) } : {};
+}
+
+function normalizePem(value: string): string {
+  return value.replace(/\\n/g, "\n");
+}
+
+function installAuditEvent(
+  context: LicenseInstallActorContext,
+  digest: string,
+  candidate: SignedLicense | undefined,
+  result: LicenseInstallResult,
+): AuditEvent {
+  const success = result.status !== "rejected";
+  return {
+    id: crypto.randomUUID(),
+    action: "license.update",
+    outcome: success ? "success" : "failure",
+    actor: {
+      id: context.actor.id,
+      type: "user",
+      name: context.actor.name,
+      roleCodes: context.actor.roleCodes,
+    },
+    target: {
+      type: "runtime-license",
+      id: result.license?.claims.licenseId || candidate?.claims.licenseId,
+    },
+    requestId: context.requestId,
+    message: success ? "License 安装完成" : "License 安装失败",
+    metadata: {
+      digest,
+      installStatus: result.status,
+      reasons: result.failures,
+      publicKeyId: candidate?.publicKeyId,
+    },
+    occurredAt: new Date().toISOString(),
+  };
+}

package/template/apps/server/src/module-composition.test.ts

@@ -0,0 +1,70 @@
+import { describe, expect, test } from "bun:test";
+import type { ModuleManifest } from "@windy/modules";
+import { Elysia } from "elysia";
+import { validateServerModuleComposition } from "./module-composition.js";
+
+describe("Server Module Composition", () => {
+  test("以 Elysia 实际注册路由作为 API Handler 事实源", () => {
+    const app = new Elysia({ prefix: "/api" }).post(
+      "/auth/users/:id/password",
+      () => null,
+    );
+    const input = {
+      modules: [fixture()],
+      routes: app.routes,
+      tasks: [],
+      tools: new Map(),
+      providers: [],
+    };
+
+    expect(() => validateServerModuleComposition(input)).not.toThrow();
+    expect(() =>
+      validateServerModuleComposition({
+        ...input,
+        routes: [
+          ...app.routes,
+          { method: "POST", path: "/api/auth/users/:id/password" },
+        ],
+      }),
+    ).toThrow(
+      "API Route Handler Key 重复：POST /api/auth/users/:id/password",
+    );
+  });
+});
+
+function fixture(): ModuleManifest {
+  return {
+    name: "system",
+    version: "0.1.0",
+    label: "系统",
+    description: "系统模块",
+    dependencies: [],
+    menus: [],
+    adminRoutes: [],
+    permissions: [
+      {
+        key: "system.auth.manage",
+        label: "管理账号",
+        module: "system",
+        moduleLabel: "系统",
+        resource: "auth",
+        resourceLabel: "账号",
+        action: "manage",
+      },
+    ],
+    apiPermissions: [
+      {
+        method: "POST",
+        path: "/api/auth/users/:id/password",
+        permissionKey: "system.auth.manage",
+      },
+    ],
+    features: [],
+    migrations: [],
+    schemaExports: [],
+    tasks: [],
+    tools: [],
+    providers: [],
+    auditActions: [],
+  };
+}

package/template/apps/server/src/module-composition.ts

@@ -0,0 +1,28 @@
+import {
+  apiRouteKey,
+  validateModuleComposition,
+  type ModuleManifest,
+} from "@windy/modules";
+interface RegisteredHttpRoute {
+  method: string;
+  path: string;
+}
+
+export interface ServerCompositionInput {
+  modules: readonly ModuleManifest[];
+  routes: readonly RegisteredHttpRoute[];
+  tasks?: readonly { key: string }[];
+  tools?: ReadonlyMap<string, unknown>;
+  providers?: readonly string[];
+}
+
+export function validateServerModuleComposition(
+  input: ServerCompositionInput,
+): void {
+  validateModuleComposition(input.modules, {
+    apiRoutes: input.routes.map(apiRouteKey),
+    tasks: (input.tasks || []).map(({ key }) => key),
+    tools: [...(input.tools?.keys() || [])],
+    providers: input.providers || [],
+  });
+}

package/template/apps/server/src/notification/drizzle-repository.ts

@@ -0,0 +1,233 @@
+import { notificationReads, platformNotifications } from "@windy/database";
+import type {
+  NotificationInboxItem,
+  PageResult,
+  PlatformNotification,
+  PublishNotificationInput,
+} from "@windy/shared";
+import { and, desc, eq, ilike, isNull, or, sql, type SQL } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestActor } from "../guards.js";
+import type { NotificationRepository } from "./repository.js";
+
+export class DrizzleNotificationRepository implements NotificationRepository {
+  constructor(private readonly db: NodePgDatabase) {}
+
+  async listInbox(
+    actor: Pick<RequestActor, "id" | "roleCodes">,
+    page: number,
+    pageSize: number,
+  ) {
+    const where = and(
+      eq(platformNotifications.status, "published"),
+      audienceWhere(actor),
+    );
+    const rows = await this.db
+      .select({
+        notification: platformNotifications,
+        readAt: notificationReads.readAt,
+      })
+      .from(platformNotifications)
+      .leftJoin(
+        notificationReads,
+        and(
+          eq(notificationReads.notificationId, platformNotifications.id),
+          eq(notificationReads.userId, actor.id),
+        ),
+      )
+      .where(where)
+      .orderBy(desc(platformNotifications.publishedAt))
+      .limit(pageSize)
+      .offset((page - 1) * pageSize);
+    const [{ count = 0 } = { count: 0 }] = await this.db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(platformNotifications)
+      .where(where);
+    return {
+      items: rows.map(({ notification, readAt }) => ({
+        ...toNotification(notification),
+        read: Boolean(readAt),
+        readAt: readAt?.toISOString(),
+      })),
+      total: count,
+      page,
+      pageSize,
+    } satisfies PageResult<NotificationInboxItem>;
+  }
+
+  async listManaged(page: number, pageSize: number, query?: string) {
+    const where = searchWhere(query);
+    let rowsQuery = this.db
+      .select()
+      .from(platformNotifications)
+      .orderBy(desc(platformNotifications.publishedAt))
+      .limit(pageSize)
+      .offset((page - 1) * pageSize)
+      .$dynamic();
+    let countQuery = this.db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(platformNotifications)
+      .$dynamic();
+    if (where) {
+      rowsQuery = rowsQuery.where(where);
+      countQuery = countQuery.where(where);
+    }
+    const [rows, [{ count = 0 } = { count: 0 }]] = await Promise.all([
+      rowsQuery,
+      countQuery,
+    ]);
+    return {
+      items: rows.map(toNotification),
+      total: count,
+      page,
+      pageSize,
+    } satisfies PageResult<PlatformNotification>;
+  }
+
+  async publish(input: PublishNotificationInput, actor: RequestActor) {
+    const now = new Date();
+    const [row] = await this.db
+      .insert(platformNotifications)
+      .values({
+        id: Bun.randomUUIDv7(),
+        ...input,
+        status: "published",
+        publishedAt: now,
+        createdAt: now,
+        createdBy: actor.id,
+        updatedAt: now,
+        updatedBy: actor.id,
+      })
+      .onConflictDoNothing()
+      .returning();
+    if (!row && input.sourceKey) {
+      const [existing] = await this.db
+        .select()
+        .from(platformNotifications)
+        .where(eq(platformNotifications.sourceKey, input.sourceKey))
+        .limit(1);
+      if (existing) return toNotification(existing);
+    }
+    if (!row) throw new Error("通知发布未返回记录");
+    return toNotification(row);
+  }
+
+  async markRead(
+    notificationId: string,
+    actor: Pick<RequestActor, "id" | "roleCodes">,
+  ) {
+    const [notification] = await this.db
+      .select({ id: platformNotifications.id })
+      .from(platformNotifications)
+      .where(
+        and(
+          eq(platformNotifications.id, notificationId),
+          eq(platformNotifications.status, "published"),
+          audienceWhere(actor),
+        ),
+      )
+      .limit(1);
+    if (!notification) return undefined;
+    const readAt = new Date();
+    const inserted = await this.db
+      .insert(notificationReads)
+      .values({ notificationId, userId: actor.id, readAt })
+      .onConflictDoNothing()
+      .returning({ readAt: notificationReads.readAt });
+    if (inserted[0]) {
+      return {
+        success: true,
+        alreadyRead: false,
+        readAt: inserted[0].readAt.toISOString(),
+      } as const;
+    }
+    const [existing] = await this.db
+      .select({ readAt: notificationReads.readAt })
+      .from(notificationReads)
+      .where(
+        and(
+          eq(notificationReads.notificationId, notificationId),
+          eq(notificationReads.userId, actor.id),
+        ),
+      )
+      .limit(1);
+    return existing
+      ? ({
+          success: true,
+          alreadyRead: true,
+          readAt: existing.readAt.toISOString(),
+        } as const)
+      : undefined;
+  }
+
+  async archive(notificationId: string, actor: RequestActor) {
+    const now = new Date();
+    const [row] = await this.db
+      .update(platformNotifications)
+      .set({
+        status: "archived",
+        archivedAt: now,
+        archivedBy: actor.id,
+        updatedAt: now,
+        updatedBy: actor.id,
+      })
+      .where(
+        and(
+          eq(platformNotifications.id, notificationId),
+          eq(platformNotifications.status, "published"),
+        ),
+      )
+      .returning();
+    return row ? toNotification(row) : undefined;
+  }
+}
+
+function toNotification(
+  row: typeof platformNotifications.$inferSelect,
+): PlatformNotification {
+  return {
+    id: row.id,
+    title: row.title,
+    summary: row.summary,
+    content: row.content,
+    category: row.category,
+    status: row.status as PlatformNotification["status"],
+    publishedAt: row.publishedAt.toISOString(),
+    createdAt: row.createdAt.toISOString(),
+    createdBy: row.createdBy,
+    updatedAt: row.updatedAt.toISOString(),
+    updatedBy: row.updatedBy,
+    archivedAt: row.archivedAt?.toISOString(),
+    archivedBy: row.archivedBy || undefined,
+    target: row.target || undefined,
+    recipientUserId: row.recipientUserId || undefined,
+    recipientRoleCodes: row.recipientRoleCodes,
+    sourceKey: row.sourceKey || undefined,
+  };
+}
+
+function audienceWhere(actor: Pick<RequestActor, "id" | "roleCodes">): SQL {
+  const roleClauses = actor.roleCodes.map(
+    (role) =>
+      sql`${platformNotifications.recipientRoleCodes} @> ${JSON.stringify([role])}::jsonb`,
+  );
+  return or(
+    and(
+      isNull(platformNotifications.recipientUserId),
+      sql`jsonb_array_length(${platformNotifications.recipientRoleCodes}) = 0`,
+    ),
+    eq(platformNotifications.recipientUserId, actor.id),
+    ...roleClauses,
+  )!;
+}
+
+function searchWhere(query?: string): SQL | undefined {
+  const keyword = query?.trim();
+  return keyword
+    ? or(
+        ilike(platformNotifications.title, `%${keyword}%`),
+        ilike(platformNotifications.summary, `%${keyword}%`),
+        ilike(platformNotifications.category, `%${keyword}%`),
+      )
+    : undefined;
+}