create-windy 0.1.0

package/template/apps/server/src/system/feature-routes.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createServerRuntime } from "../runtime.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import { registerSystemRoutes } from "./routes.js";
+import { createSystemRepositories } from "./seed.js";
+
+describe("feature routes", () => {
+  test("只允许修改状态并让下一请求读取新运行态", async () => {
+    const snapshot = createFoundationSnapshot();
+    const repositories = createSystemRepositories(snapshot);
+    await repositories.features.syncManifest(snapshot.features);
+    const runtime = createServerRuntime(
+      { WINDY_DEV_ADMIN_TOKEN: "token_1" },
+      { featureResolver: repositories.features },
+    );
+    const app = new FakeRouteApp();
+    registerSystemRoutes(app, repositories, runtime, snapshot.features);
+    const context = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/features/system.rbac", {
+        headers: { authorization: "Bearer token_1" },
+      }),
+    );
+
+    const disabled = (await app.invoke("PUT", "/system/features/:id", {
+      guardContext: context,
+      params: { id: "system.rbac" },
+      query: {},
+      body: { enabled: false, label: "不能篡改的名称", module: "unknown" },
+    })) as { enabled: boolean; label: string; module: string };
+    const nextContext = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/users", {
+        headers: { authorization: "Bearer token_1" },
+      }),
+    );
+    const denied = (await app.invoke("GET", "/system/users", {
+      guardContext: nextContext,
+      params: {},
+      query: {},
+    })) as Response;
+
+    expect(disabled).toMatchObject({
+      enabled: false,
+      label: "RBAC 权限链路",
+      module: "system.identity",
+    });
+    expect(denied.status).toBe(403);
+    await expect(denied.json()).resolves.toMatchObject({
+      reason: "feature-disabled",
+    });
+    expect(app.handlers.has("POST /system/features")).toBe(false);
+    expect(app.handlers.has("POST /system/features/import")).toBe(false);
+    expect(app.handlers.has("DELETE /system/features/:id")).toBe(false);
+  });
+});

package/template/apps/server/src/system/identity-route-config.ts

@@ -0,0 +1,73 @@
+import type { FeatureFlagDefinition } from "@windy/shared";
+import type { AuthRepository } from "../auth/repository.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import { DataScopedResourceService } from "../data-access/scoped-resource.js";
+import type { ManagedRole, ManagedUser } from "./entities.js";
+import { resource } from "./resource-route-support.js";
+import type { ResourceRouteConfig } from "./route-types.js";
+import type { SystemRepositories } from "./seed.js";
+import { UserAccountPolicy } from "./user-account-policy.js";
+import { userDepartmentValidator } from "./user-department-validation.js";
+import { SerialMutationRunner } from "./mutation-runner.js";
+import { projectMaskedUser } from "./user-projection.js";
+
+export function identityRouteConfigs(
+  repositories: SystemRepositories,
+  features: FeatureFlagDefinition[],
+  authRepository?: Pick<AuthRepository, "revokeUserSessions">,
+): {
+  users: ResourceRouteConfig<ManagedUser>;
+  roles: ResourceRouteConfig<ManagedRole>;
+} {
+  const policy = new UserAccountPolicy(
+    repositories.users,
+    repositories.roles,
+    authRepository,
+  );
+  const mutationRunner = new SerialMutationRunner();
+  return {
+    users: {
+      ...resource(
+        "users",
+        "user",
+        repositories.users,
+        features,
+        ["username", "displayName"],
+        {
+          mode: "request",
+          access: new DataScopedResourceService(
+            repositories.users,
+            departmentDescendantResolver(repositories.departments),
+          ),
+        },
+      ),
+      projectResponse: projectMaskedUser,
+      validateInput: async (input, current) =>
+        (await userDepartmentValidator(repositories.departments)(input)) ||
+        (await policy.validate(input, current)),
+      importable: false,
+      backupExport: false,
+      mutationRunner,
+      beforeUpdate: (current, input) => policy.protectUpdate(current, input),
+      beforeDelete: (current) => policy.protectDelete(current),
+      afterUpdate: (current, updated, actor) =>
+        policy.afterUpdate(current, updated, actor),
+      afterDelete: (deleted) => policy.afterDelete(deleted),
+    },
+    roles: {
+      ...resource(
+        "roles",
+        "role",
+        repositories.roles,
+        features,
+        ["code", "name"],
+        { mode: "platform" },
+      ),
+      beforeUpdate: (current, input) =>
+        policy.protectRoleUpdate(current, input),
+      beforeDelete: (current) => policy.protectRoleDelete(current),
+      importable: false,
+      mutationRunner,
+    },
+  };
+}

package/template/apps/server/src/system/interface-catalog.test.ts

@@ -0,0 +1,103 @@
+import { describe, expect, test } from "bun:test";
+import type { ModuleManifest } from "@windy/modules";
+import { systemFoundationModule } from "@windy/modules";
+import { featureKey } from "@windy/shared";
+import { collectSystemInterfacePermissions } from "./interface-catalog.js";
+
+describe("系统接口权限目录", () => {
+  test("只从注册 Manifest 汇总权限、Feature 与 License 版本", () => {
+    const interfaces = collectSystemInterfacePermissions([
+      systemFoundationModule(),
+    ]);
+    expect(
+      interfaces.find(
+        (item) => item.method === "POST" && item.path === "/api/system/users",
+      ),
+    ).toMatchObject({
+      permissionKey: "system.user.manage",
+      featureKey: "system.rbac",
+      guardOrder: ["license", "feature", "permission"],
+      source: "module-manifest",
+    });
+    // @windy-module system.scheduler begin
+    expect(
+      interfaces.find(
+        (item) =>
+          item.method === "POST" &&
+          item.path === "/api/system/scheduled-tasks/:id/trigger",
+      ),
+    ).toMatchObject({
+      permissionKey: "system.scheduler.manage",
+      featureKey: "system.scheduler",
+      allowedLicenseVersions: ["standard", "advanced"],
+      guardOrder: ["license", "license-version", "feature", "permission"],
+    });
+    expect(
+      interfaces.find(
+        (item) =>
+          item.method === "GET" &&
+          item.path === "/api/system/operations/scheduler",
+      ),
+    ).toMatchObject({
+      permissionKey: "system.scheduler.read",
+      featureKey: "system.scheduler",
+      allowedLicenseVersions: ["standard", "advanced"],
+      guardOrder: ["license", "license-version", "feature", "permission"],
+    });
+    // @windy-module system.scheduler end
+    expect(
+      interfaces.find(
+        (item) =>
+          item.method === "PUT" && item.path === "/api/system/features/:id",
+      ),
+    ).toMatchObject({
+      permissionKey: "system.feature.manage",
+      guardOrder: ["license", "permission"],
+    });
+    expect(
+      interfaces.find((item) => item.path === "/api/foundation"),
+    ).toMatchObject({ anonymous: true });
+    // @windy-module system.bulk-data begin
+    expect(
+      interfaces.find(
+        (item) =>
+          item.method === "POST" &&
+          item.path === "/api/system/bulk-data/dictionaries/import",
+      ),
+    ).toMatchObject({
+      featureKey: "system.bulk-data",
+      allowedLicenseVersions: ["advanced"],
+      guardOrder: ["license", "license-version", "feature", "permission"],
+    });
+    // @windy-module system.bulk-data end
+  });
+
+  test("重复绑定和未注册 Feature 会 fail closed", () => {
+    const module = systemFoundationModule();
+    const duplicate: ModuleManifest = {
+      ...module,
+      name: "duplicate",
+      apiPermissions: [module.apiPermissions[0]!],
+    };
+    expect(() =>
+      collectSystemInterfacePermissions([module, duplicate]),
+    ).toThrow("接口权限绑定重复");
+
+    const missingFeature: ModuleManifest = {
+      ...module,
+      name: "missing-feature",
+      features: [],
+      apiPermissions: [
+        {
+          method: "GET",
+          path: "/api/missing",
+          permissionKey: "missing.read",
+          featureKey: featureKey("missing.feature"),
+        },
+      ],
+    };
+    expect(() => collectSystemInterfacePermissions([missingFeature])).toThrow(
+      "未注册 Feature",
+    );
+  });
+});

package/template/apps/server/src/system/interface-catalog.ts

@@ -0,0 +1,82 @@
+import type { ModuleManifest } from "@windy/modules";
+import type {
+  EntitlementKey,
+  HttpMethod,
+  LicenseVersionKey,
+} from "@windy/shared";
+
+type GuardStep =
+  | "license"
+  | "license-version"
+  | "entitlement"
+  | "feature"
+  | "permission";
+
+export interface SystemInterfacePermissionDetail {
+  module: string;
+  method: HttpMethod;
+  path: string;
+  permissionKey: string;
+  anonymous: boolean;
+  featureKey?: string;
+  allowedLicenseVersions?: readonly LicenseVersionKey[];
+  entitlementKey?: EntitlementKey;
+  guardOrder: readonly GuardStep[];
+  source: "module-manifest";
+}
+
+export function collectSystemInterfacePermissions(
+  modules: ModuleManifest[],
+): SystemInterfacePermissionDetail[] {
+  const features = new Map<string, ModuleManifest["features"][number]>(
+    modules.flatMap((module) =>
+      module.features.map((feature) => [feature.key, feature] as const),
+    ),
+  );
+  const registered = new Set<string>();
+  const details = modules.flatMap((module) =>
+    module.apiPermissions.map((binding) => {
+      const identity = `${binding.method} ${binding.path}`;
+      if (registered.has(identity)) {
+        throw new Error(`接口权限绑定重复：${identity}`);
+      }
+      registered.add(identity);
+      const feature = binding.featureKey
+        ? features.get(binding.featureKey)
+        : undefined;
+      if (binding.featureKey && !feature) {
+        throw new Error(
+          `接口 ${identity} 引用了未注册 Feature：${binding.featureKey}`,
+        );
+      }
+      return {
+        module: module.name,
+        method: binding.method,
+        path: binding.path,
+        permissionKey: binding.permissionKey,
+        anonymous: binding.anonymous === true,
+        featureKey: feature?.key,
+        allowedLicenseVersions: feature?.allowedLicenseVersions,
+        entitlementKey: feature?.requiredEntitlement,
+        guardOrder: resolveGuardOrder(feature),
+        source: "module-manifest" as const,
+      };
+    }),
+  );
+  return details.sort((left, right) =>
+    `${left.path}:${left.method}`.localeCompare(
+      `${right.path}:${right.method}`,
+    ),
+  );
+}
+
+function resolveGuardOrder(
+  feature: ModuleManifest["features"][number] | undefined,
+): GuardStep[] {
+  const order: GuardStep[] = ["license"];
+  if (feature?.allowedLicenseVersions?.length) order.push("license-version");
+  if (feature?.requiredEntitlement) order.push("entitlement");
+  if (feature) order.push("feature");
+  order.push("permission");
+  return order;
+}

package/template/apps/server/src/system/menu-registry.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createSystemRepositories } from "./seed.js";
+
+const actor = {
+  id: "user_admin",
+  type: "user" as const,
+  name: "管理员",
+  roleCodes: ["super-admin"],
+  permissionKeys: ["system.menu.manage"],
+};
+
+describe("ManifestMenuRegistry", () => {
+  test("仅保留 Manifest 导航菜单并清理旧水印和按钮行", async () => {
+    const snapshot = createFoundationSnapshot();
+    const repositories = createSystemRepositories(snapshot);
+    await repositories.menus.create(
+      {
+        id: "system.watermark",
+        key: "system.watermark",
+        title: "水印设置",
+        type: "menu",
+        order: 99,
+        visible: true,
+        path: "/system/watermark",
+      },
+      actor,
+    );
+
+    await repositories.menuRegistry.synchronize(actor);
+
+    const items = await repositories.menuRegistry.all();
+    expect(items.some((item) => item.key === "system.watermark")).toBe(false);
+    expect(items.some((item) => item.key === "system.profile")).toBe(false);
+    // @windy-module system.settings begin
+    expect(items.find((item) => item.key === "system.settings")?.path).toBe(
+      "/admin/settings",
+    );
+    // @windy-module system.settings end
+  });
+
+  test("支持调整父目录和同级顺序并拒绝循环父级", async () => {
+    const repositories = createSystemRepositories(createFoundationSnapshot());
+    await repositories.menuRegistry.synchronize(actor);
+
+    const moved = await repositories.menuRegistry.updatePlacement(
+      "system.user",
+      { parentKey: "system.configuration" },
+      actor,
+    );
+    const raised = await repositories.menuRegistry.updatePlacement(
+      "system.user",
+      { direction: "up" },
+      actor,
+    );
+
+    expect(moved?.parentKey).toBe("system.configuration");
+    expect(raised?.order).toBeLessThan(moved?.order || 0);
+    await expect(
+      repositories.menuRegistry.updatePlacement(
+        "system.configuration",
+        { parentKey: "system.configuration" },
+        actor,
+      ),
+    ).rejects.toThrow("循环层级");
+  });
+
+  test("完整批量草稿一次保存并在校验失败时不写入任何修改", async () => {
+    const repositories = createSystemRepositories(createFoundationSnapshot());
+    await repositories.menuRegistry.synchronize(actor);
+    const before = await repositories.menuRegistry.all();
+    const byParent = new Map<string, typeof before>();
+    for (const menu of before) {
+      const key = menu.parentKey || "";
+      byParent.set(key, [...(byParent.get(key) || []), menu]);
+    }
+    const placements = before.flatMap((menu) => {
+      const siblings = [
+        ...(byParent.get(menu.parentKey || "") || []),
+      ].reverse();
+      return [
+        {
+          id: menu.id,
+          parentKey: menu.parentKey,
+          order: (siblings.findIndex(({ id }) => id === menu.id) + 1) * 10,
+          visible: menu.visible,
+        },
+      ];
+    });
+    const target = placements.find((placement) =>
+      placements.some(
+        (candidate) =>
+          candidate.id !== placement.id &&
+          candidate.parentKey === placement.parentKey,
+      ),
+    );
+    if (!target) throw new Error("测试菜单缺少同级项");
+    target.visible = false;
+
+    await repositories.menuRegistry.updatePlacements(placements, actor);
+
+    expect((await repositories.menuRegistry.get(target.id))?.visible).toBe(
+      false,
+    );
+    const saved = await repositories.menuRegistry.all();
+    const invalid = saved.map((menu) => ({
+      id: menu.id,
+      parentKey: menu.parentKey,
+      order: menu.order,
+      visible: menu.id === target.id ? true : menu.visible,
+    }));
+    const changed = invalid.find(({ id }) => id === target.id)!;
+    const sibling = invalid.find(
+      (item) => item.id !== changed.id && item.parentKey === changed.parentKey,
+    )!;
+    changed.order = sibling.order;
+
+    await expect(
+      repositories.menuRegistry.updatePlacements(invalid, actor),
+    ).rejects.toThrow("顺序不能重复");
+    expect((await repositories.menuRegistry.get(target.id))?.visible).toBe(
+      false,
+    );
+  });
+});

package/template/apps/server/src/system/menu-registry.ts

@@ -0,0 +1,259 @@
+import type { MenuNode, PageResult } from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { ManagedMenu } from "./entities.js";
+import type { EntityListQuery, EntityRepository } from "./repository.js";
+
+export interface MenuPlacementInput {
+  parentKey?: string | null;
+  direction?: "up" | "down";
+  visible?: boolean;
+}
+
+export interface MenuPlacementDraft {
+  id: string;
+  parentKey?: string;
+  order: number;
+  visible: boolean;
+}
+
+export class MenuPlacementError extends Error {}
+
+export class ManifestMenuRegistry {
+  private readonly definitions: Map<string, ManagedMenu>;
+
+  constructor(
+    private readonly repository: EntityRepository<ManagedMenu>,
+    manifestMenus: MenuNode[],
+  ) {
+    this.definitions = new Map(
+      flattenManifestMenus(manifestMenus).map((menu) => [menu.key, menu]),
+    );
+  }
+
+  async synchronize(actor: RequestActor): Promise<void> {
+    const stored = await this.repository.all({ includeDeleted: false });
+    const storedByKey = new Map(stored.map((menu) => [menu.key, menu]));
+    for (const menu of stored) {
+      if (!this.definitions.has(menu.key)) {
+        await this.repository.softDelete(menu.id, actor);
+      }
+    }
+    for (const definition of this.definitions.values()) {
+      const existing = storedByKey.get(definition.key);
+      if (!existing) {
+        await this.repository.create(definition, actor);
+        continue;
+      }
+      const parentKey = this.validParentKey(
+        existing.key,
+        existing.parentKey,
+        storedByKey,
+      )
+        ? existing.parentKey
+        : definition.parentKey;
+      await this.repository.update(
+        existing.id,
+        {
+          ...definition,
+          id: existing.id,
+          parentKey,
+          order: existing.order,
+          visible: existing.visible,
+        },
+        actor,
+      );
+    }
+  }
+
+  async list(query: EntityListQuery): Promise<PageResult<ManagedMenu>> {
+    return await this.repository.list(query, ["key", "title", "path"]);
+  }
+
+  async get(id: string): Promise<ManagedMenu | undefined> {
+    const menu = await this.repository.get(id);
+    return menu && this.definitions.has(menu.key) ? menu : undefined;
+  }
+
+  async all(): Promise<ManagedMenu[]> {
+    const menus = await this.repository.all({
+      sort: [
+        { field: "parentKey", order: "asc" },
+        { field: "order", order: "asc" },
+      ],
+    });
+    return menus.filter((menu) => this.definitions.has(menu.key));
+  }
+
+  async tree(): Promise<MenuNode[]> {
+    const menus = await this.all();
+    const byParent = groupByParent(menus);
+    const build = (parentKey?: string): MenuNode[] =>
+      (byParent.get(parentKey || "") || []).sort(compareMenu).map((menu) => ({
+        key: menu.key,
+        title: menu.title,
+        type: menu.type,
+        order: menu.order,
+        visible: menu.visible,
+        path: menu.path,
+        component: menu.component,
+        icon: menu.icon,
+        permissionKey: menu.permissionKey,
+        featureKey: menu.featureKey,
+        children: menu.type === "catalog" ? build(menu.key) : undefined,
+      }));
+    return build();
+  }
+
+  async updatePlacement(
+    id: string,
+    input: MenuPlacementInput,
+    actor: RequestActor,
+  ): Promise<ManagedMenu | undefined> {
+    const current = await this.get(id);
+    if (!current) return undefined;
+    const menus = await this.all();
+    const byKey = new Map(menus.map((menu) => [menu.key, menu]));
+    const parentKey =
+      input.parentKey === null
+        ? undefined
+        : input.parentKey === undefined
+          ? current.parentKey
+          : input.parentKey;
+    if (!this.validParentKey(current.key, parentKey, byKey)) {
+      throw new MenuPlacementError("上级目录不存在、不是目录或会形成循环层级");
+    }
+    const siblings = menus
+      .filter((menu) => menu.id !== current.id && menu.parentKey === parentKey)
+      .sort(compareMenu);
+    const oldIndex = menus
+      .filter((menu) => menu.parentKey === current.parentKey)
+      .sort(compareMenu)
+      .findIndex((menu) => menu.id === current.id);
+    let targetIndex =
+      parentKey === current.parentKey ? oldIndex : siblings.length;
+    if (input.direction === "up") targetIndex = Math.max(0, targetIndex - 1);
+    if (input.direction === "down") {
+      targetIndex = Math.min(siblings.length, targetIndex + 1);
+    }
+    siblings.splice(Math.max(0, targetIndex), 0, current);
+    let updated: ManagedMenu | undefined;
+    for (const [index, sibling] of siblings.entries()) {
+      const patch = {
+        parentKey,
+        order: (index + 1) * 10,
+        ...(sibling.id === current.id && input.visible !== undefined
+          ? { visible: input.visible }
+          : {}),
+      };
+      const result = await this.repository.update(sibling.id, patch, actor);
+      if (sibling.id === current.id) updated = result;
+    }
+    return updated;
+  }
+
+  async updatePlacements(
+    placements: MenuPlacementDraft[],
+    actor: RequestActor,
+  ): Promise<ManagedMenu[]> {
+    const menus = await this.all();
+    const currentById = new Map(menus.map((menu) => [menu.id, menu]));
+    const ids = placements.map(({ id }) => id);
+    if (
+      placements.length !== menus.length ||
+      new Set(ids).size !== ids.length ||
+      ids.some((id) => !currentById.has(id))
+    ) {
+      throw new MenuPlacementError("菜单结构已经变化，请刷新后重新调整");
+    }
+    const planned = placements.map((placement) => ({
+      ...currentById.get(placement.id)!,
+      parentKey: placement.parentKey,
+      order: placement.order,
+      visible: placement.visible,
+    }));
+    const plannedByKey = new Map(planned.map((menu) => [menu.key, menu]));
+    const siblingOrders = new Set<string>();
+    for (const menu of planned) {
+      if (!Number.isSafeInteger(menu.order) || menu.order < 0) {
+        throw new MenuPlacementError("菜单顺序必须是非负整数");
+      }
+      if (!this.validParentKey(menu.key, menu.parentKey, plannedByKey)) {
+        throw new MenuPlacementError(
+          "上级目录不存在、不是目录或会形成循环层级",
+        );
+      }
+      const orderKey = `${menu.parentKey || "__root__"}:${menu.order}`;
+      if (siblingOrders.has(orderKey)) {
+        throw new MenuPlacementError("同一目录下的菜单顺序不能重复");
+      }
+      siblingOrders.add(orderKey);
+    }
+    return await this.repository.updateMany(
+      planned.map((menu) => ({
+        id: menu.id,
+        input: {
+          parentKey: menu.parentKey,
+          order: menu.order,
+          visible: menu.visible,
+        },
+      })),
+      actor,
+    );
+  }
+
+  private validParentKey(
+    menuKey: string,
+    parentKey: string | undefined,
+    menus: Map<string, ManagedMenu>,
+  ): boolean {
+    if (!parentKey) return true;
+    const parent = menus.get(parentKey) || this.definitions.get(parentKey);
+    if (!parent || parent.type !== "catalog" || parent.key === menuKey) {
+      return false;
+    }
+    let ancestor = parent.parentKey;
+    while (ancestor) {
+      if (ancestor === menuKey) return false;
+      ancestor = menus.get(ancestor)?.parentKey;
+    }
+    return true;
+  }
+}
+
+function flattenManifestMenus(
+  menus: MenuNode[],
+  parentKey?: string,
+): ManagedMenu[] {
+  const now = new Date().toISOString();
+  return menus.flatMap((menu) =>
+    menu.type === "button"
+      ? []
+      : [
+          {
+            ...menu,
+            children: undefined,
+            id: menu.key,
+            parentKey,
+            status: "active",
+            createdAt: now,
+            createdBy: "system",
+            updatedAt: now,
+            updatedBy: "system",
+          },
+          ...flattenManifestMenus(menu.children || [], menu.key),
+        ],
+  );
+}
+
+function groupByParent(menus: ManagedMenu[]): Map<string, ManagedMenu[]> {
+  const groups = new Map<string, ManagedMenu[]>();
+  for (const menu of menus) {
+    const key = menu.parentKey || "";
+    groups.set(key, [...(groups.get(key) || []), menu]);
+  }
+  return groups;
+}
+
+function compareMenu(left: ManagedMenu, right: ManagedMenu): number {
+  return left.order - right.order || left.key.localeCompare(right.key);
+}