create-windy 0.1.0

package/template/apps/server/src/work-order/data-scope.integration.test.ts

@@ -0,0 +1,171 @@
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import type { WorkOrder } from "@windy/example-work-order";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { buildScopeContext } from "../data-access/context.js";
+import { DataAccessDeniedError } from "../data-access/scoped-resource.js";
+import type { RequestActor } from "../guards.js";
+import { createDrizzleSystemRepositories } from "../system/drizzle-system.js";
+import { createDrizzleWorkOrderRepository } from "./drizzle-repository.js";
+import { WorkOrderService } from "./service.js";
+
+const databaseUrl = process.env.DATA_SCOPE_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL Work Order data-scope enforcement", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = await connectAndMigrate(databaseUrl!);
+  });
+
+  beforeEach(async () => {
+    await pool.query("truncate table work_orders, departments cascade");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("搜索、分页和直接 ID 变更复用同一 SQL scope", async () => {
+    const database = drizzle(pool);
+    const repositories = createDrizzleSystemRepositories(database, {
+      users: [],
+      roles: [],
+      departments: [],
+      menus: [],
+      dictionaries: [],
+      features: [],
+      licenses: [],
+    });
+    await repositories.departments.create(department("dept_a"), setupActor);
+    await repositories.departments.create(
+      department("dept_a_child", "dept_a"),
+      setupActor,
+    );
+    await repositories.departments.create(department("dept_b"), setupActor);
+    const workOrders = createDrizzleWorkOrderRepository(database);
+    await workOrders.create(
+      ticket("ticket_self", "user_a", "dept_a"),
+      setupActor,
+    );
+    await workOrders.create(
+      ticket("ticket_child", "user_child", "dept_a_child"),
+      setupActor,
+    );
+    await workOrders.create(
+      ticket("ticket_other", "user_b", "dept_b"),
+      setupActor,
+    );
+    const service = new WorkOrderService(workOrders, repositories.departments);
+
+    const page = await service.list(
+      { page: 1, pageSize: 1, q: "网络" },
+      actor("department-and-children"),
+    );
+    expect(page).toMatchObject({ total: 2, page: 1, pageSize: 1 });
+    await expect(
+      service.get("ticket_other", actor("department")),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+    await expect(
+      service.update(
+        "ticket_other",
+        { workflowStatus: "resolved" },
+        actor("department"),
+      ),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+    await expect(
+      service.archive("ticket_other", actor("department")),
+    ).rejects.toBeInstanceOf(DataAccessDeniedError);
+    expect(await workOrders.get("ticket_other")).toMatchObject({
+      workflowStatus: "open",
+      status: "active",
+    });
+  });
+});
+
+async function connectAndMigrate(connectionString: string): Promise<Pool> {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 30; attempt += 1) {
+    const candidate = new Pool({ connectionString });
+    try {
+      await migrate(drizzle(candidate), {
+        migrationsFolder: resolve(
+          import.meta.dir,
+          "../../../../packages/database/drizzle",
+        ),
+        migrationsSchema: "public",
+        migrationsTable: "__data_scope_test_migrations",
+      });
+      return candidate;
+    } catch (error) {
+      lastError = error;
+      await candidate.end().catch(() => undefined);
+      await Bun.sleep(200);
+    }
+  }
+  throw lastError;
+}
+
+function actor(scope: "department" | "department-and-children"): RequestActor {
+  return {
+    id: "user_a",
+    type: "user",
+    name: "用户 A",
+    roleCodes: [scope],
+    permissionKeys: [],
+    scopeContext: buildScopeContext("user_a", "dept_a", [
+      {
+        id: `role_${scope}`,
+        code: scope,
+        dataScope: scope,
+        departmentIds: [],
+      },
+    ]),
+  };
+}
+
+const setupActor: RequestActor = {
+  id: "system",
+  type: "service",
+  name: "测试初始化",
+  roleCodes: ["system"],
+  permissionKeys: [],
+};
+
+function department(id: string, parentId?: string) {
+  return {
+    id,
+    parentId,
+    code: id,
+    name: id,
+    order: 10,
+    status: "active" as const,
+  };
+}
+
+function ticket(
+  id: string,
+  ownerId: string,
+  departmentId: string,
+): Partial<WorkOrder> {
+  return {
+    id,
+    title: `${id} 网络可检索`,
+    description: "网络故障",
+    priority: "medium",
+    workflowStatus: "open",
+    ownerId,
+    departmentId,
+    status: "active",
+  };
+}

package/template/apps/server/src/work-order/drizzle-repository.integration.test.ts

@@ -0,0 +1,78 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { resolve } from "node:path";
+import type { WorkOrder } from "@windy/example-work-order";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import type { RequestActor } from "../guards.js";
+import { createDrizzleWorkOrderRepository } from "./drizzle-repository.js";
+
+const databaseUrl = process.env.WORK_ORDER_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL work order repository", () => {
+  let pool: Pool;
+  const actor: RequestActor = {
+    id: "user_work_order_test",
+    type: "user",
+    name: "工单测试账号",
+    roleCodes: ["super-admin"],
+    permissionKeys: ["work-order.ticket.manage"],
+  };
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const db = drizzle(pool);
+    await migrate(db, {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__example01_test_migrations",
+    });
+    await pool.query("truncate table work_orders");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("创建和更新结果可由重建后的 Repository 读取", async () => {
+    const repository = createDrizzleWorkOrderRepository(drizzle(pool));
+    const created = await repository.create(input(), actor);
+    await repository.update(created.id, { workflowStatus: "resolved" }, actor);
+
+    const restarted = createDrizzleWorkOrderRepository(drizzle(pool));
+    expect(await restarted.get(created.id)).toMatchObject({
+      title: "验证重启持久化",
+      workflowStatus: "resolved",
+      ownerId: actor.id,
+      departmentId: "dept_platform",
+    });
+  });
+
+  test("软删除结果不会在重启后的默认查询中出现", async () => {
+    const repository = createDrizzleWorkOrderRepository(drizzle(pool));
+    const created = await repository.create(input(), actor);
+    await repository.softDelete(created.id, actor);
+
+    const restarted = createDrizzleWorkOrderRepository(drizzle(pool));
+    expect(await restarted.get(created.id)).toBeUndefined();
+    expect((await restarted.list()).items).not.toContainEqual(
+      expect.objectContaining({ id: created.id }),
+    );
+  });
+});
+
+function input(): Partial<WorkOrder> {
+  return {
+    title: "验证重启持久化",
+    description: "确认示例业务不是进程内演示数据。",
+    priority: "high",
+    workflowStatus: "open",
+    ownerId: "user_work_order_test",
+    departmentId: "dept_platform",
+    status: "active",
+  };
+}

package/template/apps/server/src/work-order/drizzle-repository.ts

@@ -0,0 +1,67 @@
+import { workOrders } from "@windy/database";
+import type { WorkOrder } from "@windy/example-work-order";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import {
+  DrizzleScopedEntityRepository,
+  type DrizzleScopedEntityRepositoryConfig,
+} from "../system/drizzle-scoped-repository.js";
+import { workOrderDataScopeBinding } from "./repository.js";
+
+export function createDrizzleWorkOrderRepository(db: NodePgDatabase) {
+  return new DrizzleScopedEntityRepository<WorkOrder>(db, workOrderConfig());
+}
+
+function workOrderConfig(): DrizzleScopedEntityRepositoryConfig<WorkOrder> {
+  return {
+    table: workOrders,
+    idColumn: "id",
+    dataScope: {
+      drizzle: {
+        ownerId: workOrders.ownerId,
+        tenant: { mode: "fixed", tenantId: "single-tenant" },
+        dimensions: { departmentId: workOrders.departmentId },
+      },
+      entity: workOrderDataScopeBinding,
+    },
+    toRow: (item) => ({
+      id: item.id,
+      title: item.title,
+      description: item.description,
+      priority: item.priority,
+      workflowStatus: item.workflowStatus,
+      ownerId: item.ownerId,
+      departmentId: item.departmentId,
+      status: item.status,
+      createdAt: date(item.createdAt),
+      createdBy: item.createdBy,
+      updatedAt: date(item.updatedAt),
+      updatedBy: item.updatedBy,
+      deletedAt: item.deletedAt ? date(item.deletedAt) : null,
+      deletedBy: item.deletedBy,
+    }),
+    toEntity: (row) => ({
+      id: String(row.id),
+      title: String(row.title),
+      description: String(row.description),
+      priority: String(row.priority) as WorkOrder["priority"],
+      workflowStatus: String(row.workflowStatus) as WorkOrder["workflowStatus"],
+      ownerId: String(row.ownerId),
+      departmentId: row.departmentId ? String(row.departmentId) : undefined,
+      status: String(row.status) as WorkOrder["status"],
+      createdAt: iso(row.createdAt),
+      createdBy: String(row.createdBy),
+      updatedAt: iso(row.updatedAt),
+      updatedBy: String(row.updatedBy),
+      deletedAt: row.deletedAt ? iso(row.deletedAt) : undefined,
+      deletedBy: row.deletedBy ? String(row.deletedBy) : undefined,
+    }),
+  };
+}
+
+function date(value: string): Date {
+  return new Date(value);
+}
+
+function iso(value: unknown): string {
+  return value instanceof Date ? value.toISOString() : String(value);
+}

package/template/apps/server/src/work-order/foundation-modules.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import { featureKey } from "@windy/shared";
+import {
+  createFoundationSnapshot,
+  loadFoundationModules,
+} from "../foundation.js";
+import { createExampleModuleRuntime } from "../example-modules.js";
+import type { ManagedDepartment } from "../system/entities.js";
+import { InMemoryEntityRepository } from "../system/repository.js";
+
+describe("平台模块 composition root", () => {
+  test("默认安装平台能力模块与可删除的工单模块", () => {
+    const modules = loadFoundationModules();
+    const snapshot = createFoundationSnapshot();
+
+    expect(modules.map(({ name }) => name)).toEqual(
+      expect.arrayContaining([
+        "system",
+        "system.identity",
+        "system.workflow",
+        "system.storage",
+        "work-order",
+      ]),
+    );
+    expect(snapshot.features.map(({ key }) => key)).toContain(
+      featureKey("work-order.ticket"),
+    );
+    expect(snapshot.permissions.map(({ key }) => key)).toContain(
+      "work-order.ticket.manage",
+    );
+    expect(snapshot.menus.map(({ key }) => key)).not.toContain("work-order");
+    const workOrder = modules.find(({ name }) => name === "work-order");
+    expect(workOrder?.adminRoutes).toEqual([]);
+    expect(workOrder?.apiPermissions).toHaveLength(5);
+    expect(workOrder?.tasks.map(({ key }) => key)).toContain(
+      "work-order.ticket.snapshot",
+    );
+  });
+
+  test("业务 API 的 package 依赖图不经过 Windy Web 或 Vue", async () => {
+    const serverPackage = await packageJson(
+      new URL("../../package.json", import.meta.url),
+    );
+    const businessPackage = await packageJson(
+      new URL(
+        "../../../../packages/example-work-order/package.json",
+        import.meta.url,
+      ),
+    );
+    const webPackage = await packageJson(
+      new URL("../../../web/package.json", import.meta.url),
+    );
+
+    expect(serverPackage.dependencies).toMatchObject({
+      "@windy/example-work-order": "workspace:*",
+    });
+    expect(serverPackage.dependencies).not.toHaveProperty("@windy/web");
+    expect(serverPackage.dependencies).not.toHaveProperty("vue");
+    expect(businessPackage.dependencies).not.toHaveProperty("@windy/web");
+    expect(businessPackage.dependencies).not.toHaveProperty("vue");
+    expect(webPackage.dependencies).not.toHaveProperty(
+      "@windy/example-work-order",
+    );
+  });
+
+  test("示例模块运行时从同一 composition seam 提供搜索 Handler", () => {
+    const snapshot = createFoundationSnapshot();
+    const runtime = createExampleModuleRuntime({
+      features: snapshot.features,
+      departments: new InMemoryEntityRepository<ManagedDepartment>(),
+    });
+
+    expect(runtime?.providers.map(({ key }) => key)).toEqual([
+      "work-order.ticket.search",
+    ]);
+  });
+});
+
+interface PackageJson {
+  dependencies: Record<string, string>;
+}
+
+async function packageJson(url: URL): Promise<PackageJson> {
+  return (await Bun.file(url).json()) as PackageJson;
+}

package/template/apps/server/src/work-order/repository.ts

@@ -0,0 +1,46 @@
+import type { WorkOrder } from "@windy/example-work-order";
+import {
+  InMemoryScopedEntityRepository,
+  type EntityDataScopeBinding,
+} from "../data-access/scoped-repository.js";
+
+const seededAt = "2026-07-15T00:00:00.000Z";
+
+export function createWorkOrderRepository() {
+  return new InMemoryScopedEntityRepository<WorkOrder>(
+    [
+      workOrder("ticket_example_1", "办公网络偶发中断", "high"),
+      workOrder("ticket_example_2", "会议室投屏使用咨询", "medium"),
+    ],
+    workOrderDataScopeBinding,
+  );
+}
+
+export const workOrderDataScopeBinding: EntityDataScopeBinding<WorkOrder> = {
+  fixedTenantId: "single-tenant",
+  ownership: (workOrder) => ({
+    ownerId: workOrder.ownerId,
+    dimensions: { departmentId: workOrder.departmentId },
+  }),
+};
+
+function workOrder(
+  id: string,
+  title: string,
+  priority: WorkOrder["priority"],
+): WorkOrder {
+  return {
+    id,
+    title,
+    description: "这是一条可随示例模块整体移除的演示工单。",
+    priority,
+    workflowStatus: "open",
+    ownerId: "user_dev_admin",
+    departmentId: "dept_platform",
+    status: "active",
+    createdAt: seededAt,
+    createdBy: "system",
+    updatedAt: seededAt,
+    updatedBy: "system",
+  };
+}

package/template/apps/server/src/work-order/routes.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, test } from "bun:test";
+import type { WorkOrder } from "@windy/example-work-order";
+import { licenseVersionKey } from "@windy/shared";
+import { InMemoryEntityRepository } from "../system/repository.js";
+import { InMemoryScopedEntityRepository } from "../data-access/scoped-repository.js";
+import { buildScopeContext } from "../data-access/context.js";
+import type { ManagedDepartment } from "../system/entities.js";
+import { FakeRouteApp } from "../system/route-test-app.js";
+import { createServerRuntime } from "../runtime.js";
+import type { RequestActor } from "../guards.js";
+import { registerWorkOrderRoutes } from "./routes.js";
+import { WorkOrderService } from "./service.js";
+import { workOrderDataScopeBinding } from "./repository.js";
+
+describe("示例工单 routes", () => {
+  test("查询复用用户级数据范围并拒绝按 ID 越权", async () => {
+    const fixture = await createFixture({ actor: selfActor() });
+    const listed = (await fixture.invoke("GET", "/work-orders")) as {
+      items: WorkOrder[];
+    };
+    expect(listed.items.map(({ id }) => id)).toEqual(["ticket_self"]);
+
+    const denied = (await fixture.invoke("GET", "/work-orders/:id", {
+      id: "ticket_other",
+    })) as Response;
+    expect(denied.status).toBe(403);
+    await expect(denied.json()).resolves.toMatchObject({
+      reason: "data-scope-denied",
+    });
+  });
+
+  test("Feature、RBAC 与 License 任一拒绝时不执行查询", async () => {
+    const featureDenied = await createFixture({ featureEnabled: false });
+    expect(await reason(featureDenied.invoke("GET", "/work-orders"))).toBe(
+      "feature-disabled",
+    );
+
+    const rbacDenied = await createFixture({ permissionKeys: [] });
+    expect(await reason(rbacDenied.invoke("GET", "/work-orders"))).toBe(
+      "missing-permission",
+    );
+
+    const licenseDenied = await createFixture({ licenseVersion: "basic" });
+    expect(await reason(licenseDenied.invoke("GET", "/work-orders"))).toBe(
+      "license-version-not-allowed",
+    );
+  });
+
+  test("创建工单写入归属字段和审计事件", async () => {
+    const fixture = await createFixture({ actor: selfActor() });
+    const created = (await fixture.invoke(
+      "POST",
+      "/work-orders",
+      {},
+      {
+        title: "打印机无法连接",
+        description: "三楼打印机显示离线。",
+        priority: "medium",
+      },
+    )) as WorkOrder;
+
+    expect(created).toMatchObject({
+      ownerId: "user_self",
+      departmentId: "dept_a",
+      workflowStatus: "open",
+    });
+    expect(fixture.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "crud.create",
+        target: expect.objectContaining({ id: created.id, type: "work-order" }),
+      }),
+    );
+  });
+});
+
+interface FixtureOptions {
+  actor?: RequestActor;
+  featureEnabled?: boolean;
+  permissionKeys?: string[];
+  licenseVersion?: string;
+}
+
+async function createFixture(options: FixtureOptions = {}) {
+  const actor = options.actor || allActor(options.permissionKeys);
+  const runtime = createServerRuntime(
+    {},
+    {
+      actorResolver: { resolve: () => actor },
+      licenseResolver: {
+        resolve: () => ({
+          versionKey: licenseVersionKey(options.licenseVersion || "standard"),
+        }),
+      },
+      featureResolver: {
+        resolve: () => ({
+          key: "work-order.ticket",
+          enabled: options.featureEnabled ?? true,
+          visible: "visible",
+        }),
+      },
+    },
+  );
+  const app = new FakeRouteApp();
+  const workOrders = new InMemoryScopedEntityRepository<WorkOrder>(
+    [
+      ticket("ticket_self", "user_self", "dept_a"),
+      ticket("ticket_other", "user_other", "dept_b"),
+    ],
+    workOrderDataScopeBinding,
+  );
+  const departments = new InMemoryEntityRepository<ManagedDepartment>([
+    department("dept_a"),
+    department("dept_b"),
+  ]);
+  registerWorkOrderRoutes(
+    app,
+    new WorkOrderService(workOrders, departments),
+    runtime,
+  );
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/work-orders"),
+  );
+  return {
+    runtime,
+    invoke(method: string, path: string, params = {}, body?: unknown) {
+      return app.invoke(method, path, {
+        guardContext,
+        params,
+        query: {},
+        body,
+      });
+    },
+  };
+}
+
+function selfActor(): RequestActor {
+  return {
+    ...allActor(),
+    id: "user_self",
+    scopeContext: buildScopeContext("user_self", "dept_a", [
+      {
+        id: "role_user",
+        code: "user",
+        dataScope: "self",
+        departmentIds: [],
+      },
+    ]),
+  };
+}
+
+function allActor(
+  permissionKeys = [
+    "work-order.ticket.read",
+    "work-order.ticket.create",
+    "work-order.ticket.manage",
+  ],
+): RequestActor {
+  return {
+    id: "user_admin",
+    type: "user",
+    name: "测试管理员",
+    roleCodes: ["developer"],
+    permissionKeys,
+    scopeContext: buildScopeContext("user_admin", undefined, [
+      {
+        id: "role_developer",
+        code: "developer",
+        dataScope: "all",
+        departmentIds: [],
+      },
+    ]),
+  };
+}
+
+function ticket(id: string, ownerId: string, departmentId: string): WorkOrder {
+  return {
+    id,
+    title: id,
+    description: "测试工单",
+    priority: "medium",
+    workflowStatus: "open",
+    ownerId,
+    departmentId,
+    status: "active",
+    createdAt: "2026-07-15T00:00:00.000Z",
+    createdBy: "system",
+    updatedAt: "2026-07-15T00:00:00.000Z",
+    updatedBy: "system",
+  };
+}
+
+function department(id: string): ManagedDepartment {
+  return {
+    id,
+    name: id,
+    code: id,
+    order: 1,
+    status: "active",
+    createdAt: "2026-07-15T00:00:00.000Z",
+    createdBy: "system",
+    updatedAt: "2026-07-15T00:00:00.000Z",
+    updatedBy: "system",
+  };
+}
+
+async function reason(result: unknown) {
+  const response = (await result) as Response;
+  return ((await response.json()) as { reason: string }).reason;
+}