create-windy 0.1.0

package/template/apps/server/src/system/built-in-roles.ts

@@ -0,0 +1,116 @@
+import type { FoundationSnapshot } from "../foundation.js";
+import type { ManagedRole } from "./entities.js";
+
+type RoleSeed = Pick<
+  ManagedRole,
+  | "id"
+  | "code"
+  | "name"
+  | "dataScope"
+  | "permissionKeys"
+  | "menuKeys"
+  | "status"
+>;
+
+const ordinaryPermissions = [
+  "system.license.read",
+  "system.menu.read",
+  "system.notification.read",
+  "system.profile.manage",
+  "system.profile.read",
+  "system.search.read",
+];
+
+export function createBuiltInRoleSeeds(
+  snapshot: FoundationSnapshot,
+): RoleSeed[] {
+  const allPermissions = snapshot.permissions.map(({ key }) => key).sort();
+  const developerPermissions = snapshot.permissions
+    .filter(({ accessRisk }) => !accessRisk || accessRisk === "standard")
+    .map(({ key }) => key)
+    .sort();
+  const allMenus = collectNavigableMenuKeys(snapshot.menus);
+  const departmentManagerPermissions = [
+    ...ordinaryPermissions,
+    "system.department.read",
+    "system.user.read",
+  ].sort();
+  return [
+    role(
+      "role_super_admin",
+      "super-admin",
+      "超级管理员",
+      "all",
+      allPermissions,
+      allMenus,
+    ),
+    role(
+      "role_department_manager",
+      "department-manager",
+      "部门负责人",
+      "department-and-children",
+      departmentManagerPermissions,
+      menuKeysForPermissions(snapshot, departmentManagerPermissions),
+    ),
+    role(
+      "role_user",
+      "user",
+      "普通用户",
+      "self",
+      ordinaryPermissions,
+      menuKeysForPermissions(snapshot, ordinaryPermissions),
+    ),
+    role(
+      "role_developer",
+      "developer",
+      "开发运维",
+      "all",
+      developerPermissions,
+      allMenus,
+    ),
+  ];
+}
+
+function role(
+  id: string,
+  code: string,
+  name: string,
+  dataScope: RoleSeed["dataScope"],
+  permissionKeys: string[],
+  menuKeys: string[],
+): RoleSeed {
+  return {
+    id,
+    code,
+    name,
+    dataScope,
+    permissionKeys: [...new Set(permissionKeys)].sort(),
+    menuKeys: [...new Set(menuKeys)].sort(),
+    status: "active",
+  };
+}
+
+function menuKeysForPermissions(
+  snapshot: FoundationSnapshot,
+  permissions: string[],
+): string[] {
+  const allowed = new Set(permissions);
+  return snapshot.menus.flatMap((menu) => {
+    const children = (menu.children || []).filter(
+      (child) =>
+        child.type !== "button" &&
+        (!child.permissionKey || allowed.has(child.permissionKey)),
+    );
+    return children.length ? [menu.key, ...children.map(({ key }) => key)] : [];
+  });
+}
+
+function collectNavigableMenuKeys(
+  menus: FoundationSnapshot["menus"],
+): string[] {
+  return menus.flatMap((menu) =>
+    menu.type === "button"
+      ? []
+      : [menu.key, ...collectNavigableMenuKeys(menu.children || [])],
+  );
+}

package/template/apps/server/src/system/department-routes.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import { registerSystemRoutes, type RouteApp } from "./routes.js";
+import { createSystemRepositories } from "./seed.js";
+
+class FakeRouteApp implements RouteApp {
+  private readonly handlers = new Map<string, (context: unknown) => unknown>();
+
+  get(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`GET ${path}`, handler);
+  }
+  post(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`POST ${path}`, handler);
+  }
+  put(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`PUT ${path}`, handler);
+  }
+  delete(path: string, handler: (context: unknown) => unknown): void {
+    this.handlers.set(`DELETE ${path}`, handler);
+  }
+  invoke(method: string, path: string, context: unknown): unknown {
+    const handler = this.handlers.get(`${method} ${path}`);
+    if (!handler) throw new Error(`未注册路由 ${method} ${path}`);
+    return handler(context);
+  }
+}
+
+describe("部门归属路由", () => {
+  test("用户表单快捷创建部门并拒绝绑定不存在的部门", async () => {
+    const snapshot = createFoundationSnapshot();
+    const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+    const app = new FakeRouteApp();
+    registerSystemRoutes(
+      app,
+      createSystemRepositories(snapshot),
+      runtime,
+      snapshot.features,
+    );
+    const guardContext = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/users", {
+        headers: { authorization: "Bearer token_1" },
+      }),
+    );
+    const context = { guardContext, params: {}, query: {} };
+
+    const department = (await app.invoke("POST", "/system/departments/quick", {
+      ...context,
+      body: { code: "sales", name: "销售部" },
+    })) as { id: string; code: string };
+    const user = (await app.invoke("POST", "/system/users", {
+      ...context,
+      body: {
+        username: "sales-user",
+        displayName: "销售用户",
+        roleIds: ["role_user"],
+        departmentId: department.id,
+      },
+    })) as { departmentId: string };
+    const invalid = (await app.invoke("POST", "/system/users", {
+      ...context,
+      body: {
+        username: "ghost-user",
+        displayName: "无部门用户",
+        roleIds: ["role_user"],
+        departmentId: "dept_missing",
+      },
+    })) as Response;
+
+    expect(department.code).toBe("sales");
+    expect(user.departmentId).toBe(department.id);
+    expect(invalid.status).toBe(400);
+    await expect(invalid.json()).resolves.toMatchObject({
+      error: "INVALID_RESOURCE",
+    });
+    expect(runtime.auditSink.list().map(({ action }) => action)).toContain(
+      "crud.create",
+    );
+  });
+});

package/template/apps/server/src/system/department-routes.ts

@@ -0,0 +1,90 @@
+import type { FeatureFlagDefinition } from "@windy/shared";
+import { recordMutationAudit } from "../audit/policy.js";
+import { evaluateRouteGuards } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { ManagedDepartment } from "./entities.js";
+import { forbidden, resourceEvent, routeContext } from "./route-helpers.js";
+import type { EntityRepository } from "./repository.js";
+import type { RouteApp } from "./route-types.js";
+
+type ServerRuntime = ReturnType<typeof createServerRuntime>;
+
+export function registerDepartmentQuickCreateRoute(
+  app: RouteApp,
+  departments: EntityRepository<ManagedDepartment>,
+  runtime: ServerRuntime,
+  feature?: FeatureFlagDefinition,
+): void {
+  app.post("/system/departments/quick", async (rawContext) => {
+    const { guardContext, body } = routeContext(rawContext);
+    const decision = await evaluateRouteGuards(runtime, guardContext, {
+      permission: {
+        method: "POST",
+        path: "/api/system/departments/quick",
+        permissionKey: "system.department.create",
+      },
+      feature,
+    });
+    if (!decision.allowed) return forbidden(decision.reason);
+    const parsed = parseDepartment(body);
+    if (parsed instanceof Response) return parsed;
+    const duplicate = (await departments.all()).find(
+      (department) => department.code === parsed.code,
+    );
+    if (duplicate) {
+      return Response.json(
+        { error: "DUPLICATE_DEPARTMENT_CODE", message: "部门编码已存在" },
+        { status: 409 },
+      );
+    }
+    if (parsed.parentId) {
+      const parent = await departments.get(parsed.parentId);
+      if (!parent || parent.status !== "active") {
+        return Response.json(
+          {
+            error: "INVALID_DEPARTMENT_PARENT",
+            message: "上级部门不存在或已停用",
+          },
+          { status: 400 },
+        );
+      }
+    }
+    const item = await departments.create(parsed, guardContext.actor);
+    await recordMutationAudit(
+      runtime,
+      "departments",
+      resourceEvent(guardContext, "crud.create", "departments", item.id, {
+        source: "user-form-shortcut",
+      }),
+    );
+    return item;
+  });
+}
+
+function parseDepartment(body: unknown): Partial<ManagedDepartment> | Response {
+  const value =
+    body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  const code = typeof value.code === "string" ? value.code.trim() : "";
+  const name = typeof value.name === "string" ? value.name.trim() : "";
+  if (!/^[a-zA-Z][a-zA-Z0-9_-]{1,79}$/.test(code) || !name) {
+    return Response.json(
+      {
+        error: "INVALID_DEPARTMENT",
+        message: "部门名称不能为空，编码需以字母开头且至少 2 位",
+      },
+      { status: 400 },
+    );
+  }
+  return {
+    code,
+    name,
+    parentId:
+      typeof value.parentId === "string" && value.parentId
+        ? value.parentId
+        : undefined,
+    order:
+      typeof value.order === "number" && Number.isFinite(value.order)
+        ? value.order
+        : 100,
+  };
+}

package/template/apps/server/src/system/drizzle-mapping.ts

@@ -0,0 +1,53 @@
+export function auditRow(item: {
+  createdAt: string;
+  createdBy: string;
+  updatedAt: string;
+  updatedBy: string;
+  deletedAt?: string;
+  deletedBy?: string;
+}) {
+  return {
+    createdAt: date(item.createdAt),
+    createdBy: item.createdBy,
+    updatedAt: date(item.updatedAt),
+    updatedBy: item.updatedBy,
+    deletedAt: item.deletedAt ? date(item.deletedAt) : undefined,
+    deletedBy: item.deletedBy,
+  };
+}
+
+export function auditEntity(row: Record<string, unknown>) {
+  return {
+    createdAt: iso(row.createdAt),
+    createdBy: String(row.createdBy),
+    updatedAt: iso(row.updatedAt),
+    updatedBy: String(row.updatedBy),
+    deletedAt: optionalIso(row.deletedAt),
+    deletedBy: row.deletedBy as string | undefined,
+  };
+}
+
+export function pick(source: object, keys: string[]) {
+  const record = source as Record<string, unknown>;
+  return Object.fromEntries(
+    keys
+      .map((key) => [key, record[key]])
+      .filter(([, value]) => value !== undefined),
+  );
+}
+
+export function array(value: unknown) {
+  return Array.isArray(value) ? value : [];
+}
+
+export function date(value: string) {
+  return new Date(value);
+}
+
+export function iso(value: unknown) {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+
+export function optionalIso(value: unknown) {
+  return value ? iso(value) : undefined;
+}

package/template/apps/server/src/system/drizzle-repository.ts

@@ -0,0 +1,298 @@
+import { randomUUIDv7 } from "bun";
+import {
+  and,
+  asc,
+  desc,
+  eq,
+  ilike,
+  inArray,
+  isNull,
+  or,
+  sql,
+  type SQL,
+} from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { PageResult, SortRule } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { ManagedEntity } from "./entities.js";
+import type {
+  EntityBulkUpdate,
+  EntityImportResult,
+  EntityListQuery,
+  EntityRepository,
+} from "./repository.js";
+
+type DbTable = unknown;
+
+export interface DrizzleEntityRepositoryConfig<T extends ManagedEntity> {
+  table: DbTable;
+  idColumn: string;
+  seedItems?: T[];
+  toRow(entity: T): Record<string, unknown>;
+  toEntity(row: Record<string, unknown>): T;
+}
+
+export class DrizzleEntityRepository<
+  T extends ManagedEntity,
+> implements EntityRepository<T> {
+  private seedPromise: Promise<void> | undefined;
+
+  constructor(
+    protected readonly db: NodePgDatabase,
+    protected readonly config: DrizzleEntityRepositoryConfig<T>,
+  ) {}
+
+  async list(
+    query: EntityListQuery = {},
+    searchFields: Array<keyof T> = [],
+  ): Promise<PageResult<T>> {
+    await this.ensureSeeded();
+    const page = Math.max(1, query.page || 1);
+    const pageSize = Math.min(100, Math.max(1, query.pageSize || 20));
+    const where = this.buildWhere(query, searchFields);
+    const rows = await this.selectRows(
+      where,
+      query.sort,
+      pageSize,
+      (page - 1) * pageSize,
+    );
+    const [{ count = 0 } = { count: 0 }] = await this.countRows(where);
+    return {
+      items: rows.map((row) => this.config.toEntity(row)),
+      total: count,
+      page,
+      pageSize,
+    };
+  }
+
+  async all(
+    query: EntityListQuery = {},
+    searchFields: Array<keyof T> = [],
+  ): Promise<T[]> {
+    await this.ensureSeeded();
+    const rows = await this.selectRows(
+      this.buildWhere(query, searchFields),
+      query.sort,
+    );
+    return rows.map((row) => this.config.toEntity(row));
+  }
+
+  async get(id: string): Promise<T | undefined> {
+    await this.ensureSeeded();
+    const deletedAt = this.column("deletedAt");
+    const where = deletedAt
+      ? and(eq(this.idColumn(), id), isNull(deletedAt))
+      : eq(this.idColumn(), id);
+    const [row] = await this.selectRows(where, undefined, 1);
+    return row ? this.config.toEntity(row) : undefined;
+  }
+
+  async create(input: Partial<T>, actor: RequestActor): Promise<T> {
+    await this.ensureSeeded();
+    const now = new Date().toISOString();
+    const entity = {
+      ...input,
+      id: input.id || randomUUIDv7(),
+      status: input.status || "active",
+      createdAt: now,
+      createdBy: actor.id,
+      updatedAt: now,
+      updatedBy: actor.id,
+    } as T;
+    await this.db.insert(this.table()).values(this.config.toRow(entity));
+    return entity;
+  }
+
+  async update(
+    id: string,
+    input: Partial<T>,
+    actor: RequestActor,
+  ): Promise<T | undefined> {
+    const current = await this.get(id);
+    if (!current) {
+      return undefined;
+    }
+    const entity = {
+      ...current,
+      ...input,
+      id,
+      updatedAt: new Date().toISOString(),
+      updatedBy: actor.id,
+    } as T;
+    await this.db
+      .update(this.table())
+      .set(this.config.toRow(entity))
+      .where(eq(this.idColumn(), id));
+    return entity;
+  }
+
+  async updateMany(
+    updates: Array<EntityBulkUpdate<T>>,
+    actor: RequestActor,
+  ): Promise<T[]> {
+    if (updates.length === 0) return [];
+    await this.ensureSeeded();
+    const ids = updates.map(({ id }) => id);
+    const rows = await this.db
+      .select()
+      .from(this.table())
+      .where(inArray(this.idColumn(), ids));
+    const current = new Map(
+      rows.map((row) => {
+        const entity = this.config.toEntity(row as Record<string, unknown>);
+        return [entity.id, entity];
+      }),
+    );
+    if (current.size !== new Set(ids).size) {
+      throw new Error("批量更新包含不存在的记录");
+    }
+    const now = new Date().toISOString();
+    const entities = updates.map(({ id, input }) => ({
+      ...current.get(id)!,
+      ...input,
+      id,
+      updatedAt: now,
+      updatedBy: actor.id,
+    })) as T[];
+    await this.db.transaction(async (transaction) => {
+      for (const entity of entities) {
+        await transaction
+          .update(this.table())
+          .set(this.config.toRow(entity))
+          .where(eq(this.idColumn(), entity.id));
+      }
+    });
+    return entities;
+  }
+
+  async softDelete(id: string, actor: RequestActor): Promise<T | undefined> {
+    return this.update(
+      id,
+      {
+        status: "archived",
+        deletedAt: new Date().toISOString(),
+        deletedBy: actor.id,
+      } as Partial<T>,
+      actor,
+    );
+  }
+
+  async importMany(
+    inputs: Array<Partial<T>>,
+    actor: RequestActor,
+    mode: "create" | "upsert" = "create",
+  ): Promise<EntityImportResult<T>> {
+    const result: EntityImportResult<T> = {
+      created: 0,
+      updated: 0,
+      skipped: 0,
+      items: [],
+    };
+    for (const input of inputs) {
+      const existing = input.id ? await this.get(input.id) : undefined;
+      if (existing) {
+        if (mode === "upsert") {
+          const updated = await this.update(input.id as string, input, actor);
+          if (updated) {
+            result.updated += 1;
+            result.items.push(updated);
+          }
+        } else {
+          result.skipped += 1;
+        }
+      } else {
+        const created = await this.create(input, actor);
+        result.created += 1;
+        result.items.push(created);
+      }
+    }
+    return result;
+  }
+
+  protected ensureSeeded(): Promise<void> {
+    if (!this.seedPromise) {
+      this.seedPromise = this.seed();
+    }
+    return this.seedPromise;
+  }
+
+  private async seed(): Promise<void> {
+    const items = this.config.seedItems || [];
+    if (items.length === 0) {
+      return;
+    }
+    await this.db
+      .insert(this.table())
+      .values(items.map((item) => this.config.toRow(item)))
+      .onConflictDoNothing();
+  }
+
+  protected buildWhere(
+    query: EntityListQuery,
+    searchFields: Array<keyof T>,
+  ): SQL | undefined {
+    const clauses: SQL[] = [];
+    const deletedAt = this.column("deletedAt");
+    if (!query.includeDeleted && deletedAt) clauses.push(isNull(deletedAt));
+    const status = this.column("status");
+    if (query.status && status) clauses.push(eq(status, query.status));
+    const keyword = query.q?.trim();
+    const search = keyword
+      ? searchFields.map((field) => this.column(String(field))).filter(Boolean)
+      : [];
+    if (keyword && search.length) {
+      clauses.push(
+        or(...search.map((column) => ilike(column, `%${keyword}%`))) as SQL,
+      );
+    }
+    return clauses.length ? and(...clauses) : undefined;
+  }
+
+  protected selectRows(
+    where: SQL | undefined,
+    sort?: SortRule[],
+    limit?: number,
+    offset?: number,
+  ) {
+    const orderBy = this.orderBy(sort);
+    let query = this.db.select().from(this.table()).$dynamic();
+    if (where) query = query.where(where);
+    if (orderBy.length) query = query.orderBy(...orderBy);
+    if (limit) query = query.limit(limit);
+    if (offset) query = query.offset(offset);
+    return query as Promise<Array<Record<string, unknown>>>;
+  }
+
+  protected countRows(
+    where: SQL | undefined,
+  ): Promise<Array<{ count: number }>> {
+    let query = this.db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(this.table())
+      .$dynamic();
+    if (where) query = query.where(where);
+    return query;
+  }
+
+  private orderBy(sort: SortRule[] | undefined): SQL[] {
+    const rules = sort?.length
+      ? sort
+      : [{ field: "updatedAt", order: "desc" as const }];
+    return rules.map((rule) => {
+      const column = this.column(rule.field) || this.idColumn();
+      return rule.order === "asc" ? asc(column) : desc(column);
+    });
+  }
+
+  protected idColumn() {
+    return this.column(this.config.idColumn);
+  }
+
+  protected column(name: string) {
+    return this.table()[name] as never;
+  }
+
+  protected table() {
+    return this.config.table as never;
+  }
+}