create-windy 0.1.0

package/template/apps/server/src/system/seed.ts

@@ -0,0 +1,237 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { FoundationSnapshot } from "../foundation.js";
+import { ManifestFeatureRepository } from "../feature/manifest-feature-repository.js";
+import {
+  createDrizzleSystemRepositories,
+  type DrizzleSystemRepositorySeeds,
+} from "./drizzle-system.js";
+import { InMemoryEntityRepository } from "./repository.js";
+import type { EntityRepository } from "./repository.js";
+import {
+  InMemoryScopedEntityRepository,
+  type ScopedEntityRepository,
+} from "../data-access/scoped-repository.js";
+import type { RequestActor } from "../guards.js";
+import { ManifestMenuRegistry } from "./menu-registry.js";
+import { createBuiltInRoleSeeds } from "./built-in-roles.js";
+import type {
+  ManagedDepartment,
+  ManagedDictionary,
+  ManagedFeature,
+  // @windy-module system.license begin
+  ManagedLicense,
+  // @windy-module system.license end
+  ManagedMenu,
+  ManagedRole,
+  ManagedUser,
+} from "./entities.js";
+import { userDataScopeBinding } from "./user-data-scope.js";
+
+export interface SystemRepositories {
+  users: ScopedEntityRepository<ManagedUser>;
+  roles: EntityRepository<ManagedRole>;
+  departments: EntityRepository<ManagedDepartment>;
+  menus: EntityRepository<ManagedMenu>;
+  dictionaries: EntityRepository<ManagedDictionary>;
+  features: ManifestFeatureRepository;
+  // @windy-module system.license begin
+  licenses: EntityRepository<ManagedLicense>;
+  // @windy-module system.license end
+  menuRegistry: ManifestMenuRegistry;
+}
+
+export interface CreateSystemRepositoryOptions {
+  db?: NodePgDatabase;
+}
+
+export function createSystemRepositories(
+  snapshot: FoundationSnapshot,
+  options: CreateSystemRepositoryOptions = {},
+): SystemRepositories {
+  const seeds = createSystemRepositorySeeds(snapshot);
+  if (options.db) {
+    const repositories = createDrizzleSystemRepositories(options.db, seeds);
+    return {
+      ...repositories,
+      menuRegistry: new ManifestMenuRegistry(
+        repositories.menus,
+        snapshot.menus,
+      ),
+    };
+  }
+  const repositories = {
+    users: new InMemoryScopedEntityRepository<ManagedUser>(
+      seeds.users,
+      userDataScopeBinding,
+    ),
+    roles: new InMemoryEntityRepository<ManagedRole>(seeds.roles),
+    departments: new InMemoryEntityRepository<ManagedDepartment>(
+      seeds.departments,
+    ),
+    menus: new InMemoryEntityRepository<ManagedMenu>(seeds.menus),
+    dictionaries: new InMemoryEntityRepository<ManagedDictionary>(
+      seeds.dictionaries,
+    ),
+    features: new ManifestFeatureRepository(
+      new InMemoryEntityRepository<ManagedFeature>(seeds.features),
+    ),
+    // @windy-module system.license begin
+    licenses: new InMemoryEntityRepository<ManagedLicense>(seeds.licenses),
+    // @windy-module system.license end
+  };
+  return {
+    ...repositories,
+    menuRegistry: new ManifestMenuRegistry(repositories.menus, snapshot.menus),
+  };
+}
+
+export async function synchronizeBuiltInRoles(
+  repositories: Pick<SystemRepositories, "roles" | "users">,
+  snapshot: FoundationSnapshot,
+): Promise<void> {
+  for (const definition of createBuiltInRoleSeeds(snapshot)) {
+    const role = await repositories.roles.get(definition.id);
+    if (!role) continue;
+    const permissionKeys = unique([
+      ...role.permissionKeys,
+      ...definition.permissionKeys,
+    ]);
+    const menuKeys = unique([...role.menuKeys, ...definition.menuKeys]);
+    if (
+      permissionKeys.length !== role.permissionKeys.length ||
+      menuKeys.length !== role.menuKeys.length
+    ) {
+      await repositories.roles.update(
+        role.id,
+        { permissionKeys, menuKeys },
+        systemBootstrapActor,
+      );
+    }
+  }
+  const admin = await repositories.users.get("user_dev_admin");
+  if (!admin) return;
+  const roleIds = unique([...admin.roleIds, "role_super_admin"]);
+  if (roleIds.length !== admin.roleIds.length || !admin.departmentId) {
+    await repositories.users.update(
+      admin.id,
+      { roleIds, departmentId: admin.departmentId || "dept_platform" },
+      systemBootstrapActor,
+    );
+  }
+}
+
+const systemBootstrapActor: RequestActor = {
+  id: "system_bootstrap",
+  type: "service",
+  name: "平台初始化",
+  roleCodes: ["system"],
+  permissionKeys: ["system.role.manage"],
+};
+
+function createSystemRepositorySeeds(
+  snapshot: FoundationSnapshot,
+): DrizzleSystemRepositorySeeds {
+  const now = new Date().toISOString();
+  const audit = {
+    createdAt: now,
+    createdBy: "system",
+    updatedAt: now,
+    updatedBy: "system",
+  };
+
+  return {
+    users: [
+      {
+        id: "user_dev_admin",
+        username: "admin",
+        displayName: "开发管理员",
+        status: "active" as const,
+        roleIds: ["role_super_admin"],
+        departmentId: "dept_platform",
+        ...audit,
+      },
+    ],
+    roles: createBuiltInRoleSeeds(snapshot).map((role) => ({
+      ...role,
+      ...audit,
+    })),
+    departments: [
+      {
+        id: "dept_platform",
+        name: "平台运营",
+        code: "platform",
+        order: 10,
+        status: "active" as const,
+        ...audit,
+      },
+    ],
+    menus: flattenMenus(snapshot.menus, audit),
+    dictionaries: [
+      {
+        id: "dict_lifecycle_status",
+        code: "lifecycle_status",
+        name: "生命周期状态",
+        status: "active" as const,
+        items: [
+          {
+            label: "启用",
+            value: "active",
+            status: "active" as const,
+            order: 10,
+          },
+          {
+            label: "停用",
+            value: "disabled",
+            status: "active" as const,
+            order: 20,
+          },
+          {
+            label: "归档",
+            value: "archived",
+            status: "active" as const,
+            order: 30,
+          },
+        ],
+        ...audit,
+      },
+    ],
+    features: snapshot.features.map((feature) => ({
+      ...feature,
+      id: feature.key,
+      status: feature.enabled ? ("active" as const) : ("disabled" as const),
+      ...audit,
+    })),
+    // @windy-module system.license begin
+    licenses: [],
+    // @windy-module system.license end
+  };
+}
+
+function unique(values: string[]): string[] {
+  return [...new Set(values)].sort();
+}
+
+function flattenMenus(
+  menus: FoundationSnapshot["menus"],
+  audit: Pick<
+    ManagedMenu,
+    "createdAt" | "createdBy" | "updatedAt" | "updatedBy"
+  >,
+  parentKey?: string,
+): ManagedMenu[] {
+  return menus.flatMap((menu) =>
+    menu.type === "button"
+      ? []
+      : [
+          {
+            ...menu,
+            children: undefined,
+            id: menu.key,
+            status: "active" as const,
+            parentKey,
+            ...audit,
+          },
+          ...flattenMenus(menu.children || [], audit, menu.key),
+        ],
+  );
+}

package/template/apps/server/src/system/user-account-policy.test.ts

@@ -0,0 +1,158 @@
+import { describe, expect, test } from "bun:test";
+import { InMemoryAuthRepository } from "../auth/repository.js";
+import type { RequestActor } from "../guards.js";
+import type { ManagedRole, ManagedUser } from "./entities.js";
+import { InMemoryEntityRepository } from "./repository.js";
+import { UserAccountPolicy } from "./user-account-policy.js";
+import { SerialMutationRunner } from "./mutation-runner.js";
+
+const actor: RequestActor = {
+  id: "admin",
+  type: "user",
+  name: "管理员",
+  roleCodes: ["super-admin"],
+  permissionKeys: ["system.user.manage"],
+};
+
+describe("user account policy", () => {
+  test("新增账号必须选择部门和至少一个启用角色", async () => {
+    const { policy } = fixture([admin("admin_1")]);
+    await expect(policy.validate({ roleIds: [] })).resolves.toBe(
+      "新增账号必须选择所属部门",
+    );
+    await expect(
+      policy.validate({ departmentId: "dept_a", roleIds: [] }),
+    ).resolves.toBe("账号必须至少选择一个角色");
+    await expect(
+      policy.validate({ departmentId: "dept_a", roleIds: ["role_disabled"] }),
+    ).resolves.toContain("角色不存在或已停用");
+  });
+
+  test("禁止停用、删除或移除最后一个超级管理员角色", async () => {
+    const only = admin("admin_1");
+    const { policy } = fixture([only]);
+
+    await expect(
+      policy.protectUpdate(only, { status: "disabled" }),
+    ).resolves.toContain("至少一个");
+    await expect(
+      policy.protectUpdate(only, { roleIds: ["role_user"] }),
+    ).resolves.toContain("至少一个");
+    await expect(policy.protectDelete(only)).resolves.toContain("至少一个");
+  });
+
+  test("存在另一个超级管理员时允许停用，并吊销全部活跃会话", async () => {
+    const target = admin("admin_1");
+    const auth = new InMemoryAuthRepository();
+    await auth.createSession({
+      id: "session_1",
+      userId: target.id,
+      tokenHash: "hash_1",
+      status: "active",
+      issuedAt: new Date("2026-07-15T00:00:00.000Z"),
+      expiresAt: new Date("2026-07-16T00:00:00.000Z"),
+    });
+    await auth.createSession({
+      id: "session_2",
+      userId: target.id,
+      tokenHash: "hash_2",
+      status: "active",
+      issuedAt: new Date("2026-07-15T00:00:00.000Z"),
+      expiresAt: new Date("2026-07-16T00:00:00.000Z"),
+    });
+    const { policy } = fixture([target, admin("admin_2")], auth);
+
+    await expect(
+      policy.protectUpdate(target, { status: "disabled" }),
+    ).resolves.toBeUndefined();
+    await policy.afterUpdate(target, { ...target, status: "disabled" }, actor);
+    expect(
+      auth.storedSessions().every((session) => session.status === "revoked"),
+    ).toBe(true);
+  });
+
+  test("内置超级管理员角色不能失去恢复能力", async () => {
+    const { policy, roles } = fixture([admin("admin_1")]);
+    const role = await roles.get("role_super_admin");
+    expect(role).toBeDefined();
+    await expect(
+      policy.protectRoleUpdate(role!, { dataScope: "self" }),
+    ).resolves.toContain("全量数据权限");
+    expect(policy.protectRoleDelete(role!)).toContain("不可删除");
+  });
+
+  test("并发停用两个超级管理员时仍保留一个可恢复账号", async () => {
+    const { policy, users } = fixture([admin("admin_1"), admin("admin_2")]);
+    const runner = new SerialMutationRunner();
+    const disable = (id: string) =>
+      runner.run(async () => {
+        const current = await users.get(id);
+        if (!current) throw new Error("missing fixture user");
+        const conflict = await policy.protectUpdate(current, {
+          status: "disabled",
+        });
+        if (conflict) return conflict;
+        await users.update(id, { status: "disabled" }, actor);
+        return undefined;
+      });
+
+    const results = await Promise.all([disable("admin_1"), disable("admin_2")]);
+    expect(results.filter(Boolean)).toHaveLength(1);
+    const active = await users.all({ status: "active" });
+    expect(active).toHaveLength(1);
+  });
+});
+
+function fixture(users: ManagedUser[], auth = new InMemoryAuthRepository()) {
+  const roles = new InMemoryEntityRepository<ManagedRole>([
+    role("role_super_admin", "super-admin", "active"),
+    role("role_user", "user", "active"),
+    role("role_disabled", "disabled", "disabled"),
+  ]);
+  const userRepository = new InMemoryEntityRepository(users);
+  return {
+    roles,
+    users: userRepository,
+    policy: new UserAccountPolicy(userRepository, roles, auth),
+  };
+}
+
+function admin(id: string): ManagedUser {
+  return user(id, ["role_super_admin"]);
+}
+
+function user(id: string, roleIds: string[]): ManagedUser {
+  return {
+    id,
+    username: id,
+    displayName: id,
+    departmentId: "dept_a",
+    roleIds,
+    status: "active",
+    ...auditFields,
+  };
+}
+
+function role(
+  id: string,
+  code: string,
+  status: ManagedRole["status"],
+): ManagedRole {
+  return {
+    id,
+    code,
+    name: code,
+    status,
+    dataScope: "all",
+    permissionKeys: ["system.user.manage"],
+    menuKeys: [],
+    ...auditFields,
+  };
+}
+
+const auditFields = {
+  createdAt: "2026-07-15T00:00:00.000Z",
+  createdBy: "system",
+  updatedAt: "2026-07-15T00:00:00.000Z",
+  updatedBy: "system",
+};

package/template/apps/server/src/system/user-account-policy.ts

@@ -0,0 +1,103 @@
+import type { RequestActor } from "../guards.js";
+import type { AuthRepository } from "../auth/repository.js";
+import type { ManagedRole, ManagedUser } from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+
+export class UserAccountPolicy {
+  constructor(
+    private readonly users: EntityRepository<ManagedUser>,
+    private readonly roles: EntityRepository<ManagedRole>,
+    private readonly auth?: Pick<AuthRepository, "revokeUserSessions">,
+  ) {}
+
+  async validate(
+    input: Partial<ManagedUser>,
+    current?: ManagedUser,
+  ): Promise<string | undefined> {
+    const departmentId = input.departmentId ?? current?.departmentId;
+    const roleIds = input.roleIds ?? current?.roleIds;
+    if (!current && !departmentId) return "新增账号必须选择所属部门";
+    if (!Array.isArray(roleIds) || roleIds.length === 0) {
+      return "账号必须至少选择一个角色";
+    }
+    for (const roleId of roleIds) {
+      const role = await this.roles.get(roleId);
+      if (!role || role.status !== "active") {
+        return `角色不存在或已停用：${roleId}`;
+      }
+    }
+    return undefined;
+  }
+
+  async protectUpdate(
+    current: ManagedUser,
+    input: Partial<ManagedUser>,
+  ): Promise<string | undefined> {
+    if (!(await this.isRecoverableAdmin(current))) return undefined;
+    const next = { ...current, ...input };
+    if (await this.isRecoverableAdmin(next)) return undefined;
+    return (await this.recoverableAdminCount()) <= 1
+      ? "必须保留至少一个启用的超级管理员账号"
+      : undefined;
+  }
+
+  async protectDelete(current: ManagedUser): Promise<string | undefined> {
+    return (await this.isRecoverableAdmin(current)) &&
+      (await this.recoverableAdminCount()) <= 1
+      ? "必须保留至少一个启用的超级管理员账号"
+      : undefined;
+  }
+
+  async afterUpdate(
+    current: ManagedUser,
+    updated: ManagedUser,
+    actor: RequestActor,
+  ): Promise<void> {
+    void actor;
+    if (current.status === "active" && updated.status !== "active") {
+      await this.auth?.revokeUserSessions(updated.id, new Date());
+    }
+  }
+
+  async afterDelete(deleted: ManagedUser): Promise<void> {
+    await this.auth?.revokeUserSessions(deleted.id, new Date());
+  }
+
+  async protectRoleUpdate(
+    current: ManagedRole,
+    input: Partial<ManagedRole>,
+  ): Promise<string | undefined> {
+    if (current.code !== "super-admin") return undefined;
+    const next = { ...current, ...input };
+    return next.code !== "super-admin" ||
+      next.status !== "active" ||
+      next.dataScope !== "all" ||
+      !next.permissionKeys.includes("system.user.manage")
+      ? "内置超级管理员角色必须保持启用、全量数据权限和用户管理能力"
+      : undefined;
+  }
+
+  protectRoleDelete(current: ManagedRole): string | undefined {
+    return current.code === "super-admin"
+      ? "内置超级管理员角色不可删除"
+      : undefined;
+  }
+
+  private async recoverableAdminCount(): Promise<number> {
+    const users = await this.users.all({ status: "active" });
+    const checks = await Promise.all(
+      users.map((user) => this.isRecoverableAdmin(user)),
+    );
+    return checks.filter(Boolean).length;
+  }
+
+  private async isRecoverableAdmin(user: ManagedUser): Promise<boolean> {
+    if (user.status !== "active") return false;
+    const roles = await Promise.all(
+      user.roleIds.map((id) => this.roles.get(id)),
+    );
+    return roles.some(
+      (role) => role?.status === "active" && role.code === "super-admin",
+    );
+  }
+}

package/template/apps/server/src/system/user-data-scope.ts

@@ -0,0 +1,10 @@
+import type { EntityDataScopeBinding } from "../data-access/scoped-repository.js";
+import type { ManagedUser } from "./entities.js";
+
+export const userDataScopeBinding: EntityDataScopeBinding<ManagedUser> = {
+  fixedTenantId: "single-tenant",
+  ownership: (user) => ({
+    ownerId: user.id,
+    dimensions: { departmentId: user.departmentId },
+  }),
+};

package/template/apps/server/src/system/user-department-validation.ts

@@ -0,0 +1,17 @@
+import type { ManagedDepartment, ManagedUser } from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+
+export function userDepartmentValidator(
+  departments: EntityRepository<ManagedDepartment>,
+) {
+  return async (input: Partial<ManagedUser>): Promise<string | undefined> => {
+    if (input.departmentId === undefined) return undefined;
+    if (typeof input.departmentId !== "string" || !input.departmentId) {
+      return "部门 ID 必须是非空字符串";
+    }
+    const department = await departments.get(input.departmentId);
+    return department?.status === "active"
+      ? undefined
+      : "所选部门不存在或已停用";
+  };
+}

package/template/apps/server/src/system/user-projection.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from "bun:test";
+import type { ManagedUser } from "./entities.js";
+import { projectMaskedUser } from "./user-projection.js";
+
+describe("用户敏感字段读取模型", () => {
+  test("普通读取只序列化掩码结果，不携带完整手机号或邮箱", () => {
+    const projected = projectMaskedUser(user());
+    const serialized = JSON.stringify(projected);
+
+    expect(projected.phone).toEqual({
+      kind: "masked",
+      classification: "sensitive",
+      display: "138****8000",
+    });
+    expect(projected.email).toEqual({
+      kind: "masked",
+      classification: "personal",
+      display: "se************.com",
+    });
+    expect(serialized).not.toContain("13800138000");
+    expect(serialized).not.toContain("secret@example.com");
+  });
+});
+
+function user(): ManagedUser {
+  return {
+    id: "user_sensitive",
+    username: "sensitive",
+    displayName: "敏感用户",
+    email: "secret@example.com",
+    phone: "13800138000",
+    status: "active",
+    roleIds: ["role_user"],
+    departmentId: "dept_platform",
+    createdAt: "2026-07-16T00:00:00.000Z",
+    createdBy: "system",
+    updatedAt: "2026-07-16T00:00:00.000Z",
+    updatedBy: "system",
+  };
+}

package/template/apps/server/src/system/user-projection.ts

@@ -0,0 +1,35 @@
+import { maskGovernedValue, type GovernedFieldPolicy } from "@windy/shared";
+import type { ManagedUser } from "./entities.js";
+
+export const userMaskFields: readonly GovernedFieldPolicy[] = [
+  {
+    fieldKey: "email",
+    classification: "personal",
+    mask: { kind: "partial", prefix: 2, suffix: 4 },
+  },
+  {
+    fieldKey: "phone",
+    classification: "sensitive",
+    mask: { kind: "partial", prefix: 3, suffix: 4 },
+  },
+];
+
+export function projectMaskedUser(user: ManagedUser): Record<string, unknown> {
+  const fields = new Map(
+    userMaskFields.map((field) => [field.fieldKey, field]),
+  );
+  return {
+    ...user,
+    email: maskGovernedValue(user.email, requiredField(fields, "email")),
+    phone: maskGovernedValue(user.phone, requiredField(fields, "phone")),
+  };
+}
+
+function requiredField(
+  fields: ReadonlyMap<string, GovernedFieldPolicy>,
+  key: string,
+): GovernedFieldPolicy {
+  const field = fields.get(key);
+  if (!field) throw new Error(`用户脱敏策略缺少字段：${key}`);
+  return field;
+}