create-windy 0.1.0

package/template/apps/server/src/workflow/routes.ts

@@ -0,0 +1,249 @@
+import { systemModuleManifest } from "@windy/modules";
+import type { ApiPermissionBinding, AuditActionType } from "@windy/shared";
+import { WorkflowInvariantError } from "@windy/shared";
+import { z } from "zod";
+import { evaluateRouteGuards } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import {
+  forbidden,
+  resourceEvent,
+  routeContext,
+} from "../system/route-helpers.js";
+import type { RouteApp } from "../system/route-types.js";
+import { parsePagination } from "../pagination.js";
+import {
+  WorkflowRepositoryConflict,
+  type WorkflowListQuery,
+} from "./repository.js";
+import { WorkflowService, WorkflowServiceError } from "./service.js";
+
+type ServerRuntime = ReturnType<typeof createServerRuntime>;
+const manifest = systemModuleManifest("system.workflow");
+const feature = manifest.features.find(({ key }) => key === "system.workflow");
+
+const idempotencyKey = z.string().trim().min(1).max(160);
+const createSchema = z
+  .object({
+    title: z.string().trim().min(1).max(160),
+    candidateRoles: z
+      .array(
+        z.object({
+          code: z.string().trim().min(1).max(64),
+          name: z.string().max(80).optional(),
+        }),
+      )
+      .min(1)
+      .max(20),
+    dueAt: z.iso.datetime(),
+    target: z.object({
+      type: z.string().trim().min(1).max(80),
+      id: z.string().trim().min(1).max(128),
+      route: z.string().trim().min(1).max(300),
+    }),
+    idempotencyKey,
+  })
+  .strict();
+const commandSchema = z
+  .object({
+    expectedVersion: z.number().int().positive(),
+    idempotencyKey,
+    reason: z.string().trim().min(1).max(500).optional(),
+    assigneeId: z.string().trim().min(1).max(64).optional(),
+  })
+  .strict();
+
+export function registerWorkflowRoutes(
+  app: RouteApp,
+  service: WorkflowService,
+  runtime: ServerRuntime,
+) {
+  app.get("/workflow/work-items", (raw) =>
+    guarded(raw, "GET", "/api/workflow/work-items", runtime, async () => {
+      const context = routeContext(raw);
+      const pagination = parsePagination(context.query);
+      if (pagination instanceof Response) return pagination;
+      const query: WorkflowListQuery = {
+        ...pagination,
+        status: context.query.status as WorkflowListQuery["status"],
+      };
+      return service.list(query, context.guardContext.actor);
+    }),
+  );
+  app.get("/workflow/work-items/:id", (raw) =>
+    guarded(raw, "GET", "/api/workflow/work-items/:id", runtime, async () => {
+      const context = routeContext(raw);
+      const item = await service.get(
+        context.params.id || "",
+        context.guardContext.actor,
+      );
+      return item || notFound();
+    }),
+  );
+  app.get("/workflow/work-items/:id/history", (raw) =>
+    guarded(
+      raw,
+      "GET",
+      "/api/workflow/work-items/:id/history",
+      runtime,
+      async () => {
+        const context = routeContext(raw);
+        const item = await service.get(
+          context.params.id || "",
+          context.guardContext.actor,
+        );
+        return item
+          ? service.history(item.id, context.guardContext.actor)
+          : notFound();
+      },
+    ),
+  );
+  app.post("/workflow/work-items", (raw) =>
+    guarded(raw, "POST", "/api/workflow/work-items", runtime, async () => {
+      const context = routeContext(raw);
+      const parsed = createSchema.safeParse(context.body);
+      if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
+      return runMutation(
+        runtime,
+        context,
+        "workflow.create",
+        undefined,
+        async () => ({
+          workItem: await service.create(
+            parsed.data,
+            context.guardContext.actor,
+          ),
+        }),
+      );
+    }),
+  );
+  commandRoute(app, service, runtime, "claim", "workflow.claim");
+  commandRoute(app, service, runtime, "transfer", "workflow.transfer");
+  commandRoute(app, service, runtime, "approve", "workflow.decide");
+  commandRoute(app, service, runtime, "reject", "workflow.decide");
+  commandRoute(app, service, runtime, "cancel", "workflow.cancel");
+}
+
+function commandRoute(
+  app: RouteApp,
+  service: WorkflowService,
+  runtime: ServerRuntime,
+  command: "claim" | "transfer" | "approve" | "reject" | "cancel",
+  action: AuditActionType,
+) {
+  const path = `/workflow/work-items/:id/${command}`;
+  app.post(path, (raw) =>
+    guarded(raw, "POST", `/api${path}`, runtime, async () => {
+      const context = routeContext(raw);
+      const parsed = commandSchema.safeParse(context.body);
+      if (!parsed.success) return invalid(parsed.error.issues[0]?.message);
+      const id = context.params.id || "";
+      return runMutation(runtime, context, action, id, () =>
+        service[command](id, parsed.data, context.guardContext.actor),
+      );
+    }),
+  );
+}
+
+async function runMutation(
+  runtime: ServerRuntime,
+  context: ReturnType<typeof routeContext>,
+  action: AuditActionType,
+  id: string | undefined,
+  mutate: () => Promise<{
+    workItem: { id: string };
+    fact?: Record<string, unknown>;
+  }>,
+) {
+  try {
+    await runtime.auditSink.recordCriticalEvent(
+      resourceEvent(context.guardContext, action, "workflow-work-item", id, {
+        phase: "intent",
+      }),
+    );
+    const result = await mutate();
+    runtime.auditSink.recordEvent(
+      resourceEvent(
+        context.guardContext,
+        action,
+        "workflow-work-item",
+        result.workItem.id,
+        result.fact
+          ? {
+              phase: "completed",
+              command: result.fact.command,
+              beforeStatus: result.fact.beforeStatus,
+              afterStatus: result.fact.afterStatus,
+              decision: (
+                result.fact.decision as { outcome?: string } | undefined
+              )?.outcome,
+              target: result.fact.target,
+            }
+          : { phase: "completed" },
+      ),
+    );
+    return result;
+  } catch (error) {
+    return workflowError(error);
+  }
+}
+
+async function guarded(
+  raw: unknown,
+  method: string,
+  path: string,
+  runtime: ServerRuntime,
+  handler: () => unknown,
+) {
+  const permission = binding(method, path);
+  const decision = await evaluateRouteGuards(
+    runtime,
+    routeContext(raw).guardContext,
+    {
+      permission,
+      feature,
+    },
+  );
+  return decision.allowed ? handler() : forbidden(decision.reason);
+}
+
+function binding(method: string, path: string): ApiPermissionBinding {
+  const result = manifest.apiPermissions.find(
+    (item) => item.method === method && item.path === path,
+  );
+  if (!result) throw new Error(`审批任务缺少 API 绑定：${method} ${path}`);
+  return result;
+}
+
+function workflowError(error: unknown) {
+  if (error instanceof WorkflowRepositoryConflict) {
+    if (error.code === "WORK_ITEM_NOT_FOUND") return notFound();
+    return Response.json({ error: error.code }, { status: 409 });
+  }
+  if (error instanceof WorkflowServiceError) {
+    return Response.json({ error: error.code }, { status: 400 });
+  }
+  if (error instanceof WorkflowInvariantError) {
+    const forbiddenCodes = [
+      "ROLE_NOT_CANDIDATE",
+      "ASSIGNEE_MISMATCH",
+      "MANAGE_REQUIRED",
+      "SERVICE_REQUIRED",
+    ];
+    return Response.json(
+      { error: error.code, message: error.message },
+      { status: forbiddenCodes.includes(error.code) ? 403 : 409 },
+    );
+  }
+  throw error;
+}
+
+function invalid(message = "审批请求无效") {
+  return Response.json(
+    { error: "INVALID_WORKFLOW_INPUT", message },
+    { status: 400 },
+  );
+}
+
+function notFound() {
+  return Response.json({ error: "WORK_ITEM_NOT_FOUND" }, { status: 404 });
+}

package/template/apps/server/src/workflow/service.ts

@@ -0,0 +1,196 @@
+import type {
+  Assignee,
+  CandidateRole,
+  TargetRef,
+  WorkflowActor,
+  WorkItem,
+  WorkItemTransition,
+} from "@windy/shared";
+import type { RequestActor } from "../guards.js";
+import type { WorkflowListQuery, WorkflowRepository } from "./repository.js";
+
+export interface WorkflowAssigneeDirectory {
+  resolve(userId: string): Promise<Assignee | undefined>;
+}
+
+export interface WorkflowEffects {
+  created(item: WorkItem): Promise<void>;
+  transitioned(result: WorkItemTransition): Promise<void>;
+}
+
+export interface CreateApprovalInput {
+  title: string;
+  candidateRoles: CandidateRole[];
+  dueAt: string;
+  target: TargetRef;
+  idempotencyKey: string;
+}
+
+export interface ApprovalCommandInput {
+  expectedVersion: number;
+  idempotencyKey: string;
+  reason?: string;
+  assigneeId?: string;
+}
+
+export class WorkflowService {
+  constructor(
+    private readonly repository: WorkflowRepository,
+    private readonly assignees: WorkflowAssigneeDirectory,
+    private readonly now: () => Date = () => new Date(),
+    private readonly effects: WorkflowEffects = noEffects,
+  ) {}
+
+  list(query: WorkflowListQuery, actor: RequestActor) {
+    return this.repository.list(query, workflowActor(actor));
+  }
+
+  get(id: string, actor: RequestActor) {
+    return this.repository.get(id, workflowActor(actor));
+  }
+
+  history(id: string, actor: RequestActor) {
+    return this.repository.history(id, workflowActor(actor));
+  }
+
+  async openItemsForTimeoutScheduling() {
+    const actor = timeoutActor();
+    const items: WorkItem[] = [];
+    for (const status of ["pending", "claimed"] as const) {
+      let page = 1;
+      while (true) {
+        const result = await this.repository.list(
+          { page, pageSize: 100, status },
+          actor,
+        );
+        items.push(...result.items);
+        if (page * result.pageSize >= result.total) break;
+        page += 1;
+      }
+    }
+    return items;
+  }
+
+  async create(input: CreateApprovalInput, actor: RequestActor) {
+    const createdAt = this.now().toISOString();
+    const item = await this.repository.create(
+      {
+        id: Bun.randomUUIDv7(),
+        title: input.title,
+        requesterId: actor.id,
+        candidateRoles: input.candidateRoles,
+        dueAt: input.dueAt,
+        target: input.target,
+        createdAt,
+      },
+      input.idempotencyKey,
+      workflowActor(actor),
+    );
+    await this.effects.created(item);
+    return item;
+  }
+
+  claim(id: string, input: ApprovalCommandInput, actor: RequestActor) {
+    return this.execute(id, input, actor, { type: "claim" });
+  }
+
+  async transfer(id: string, input: ApprovalCommandInput, actor: RequestActor) {
+    const assignee = input.assigneeId
+      ? await this.assignees.resolve(input.assigneeId)
+      : undefined;
+    if (!assignee) throw new WorkflowServiceError("ASSIGNEE_NOT_FOUND");
+    return this.execute(id, input, actor, {
+      type: "transfer",
+      assignee,
+      reason: { text: input.reason || "" },
+    });
+  }
+
+  approve(id: string, input: ApprovalCommandInput, actor: RequestActor) {
+    return this.execute(id, input, actor, {
+      type: "approve",
+      reason: { text: input.reason || "" },
+    });
+  }
+
+  reject(id: string, input: ApprovalCommandInput, actor: RequestActor) {
+    return this.execute(id, input, actor, {
+      type: "reject",
+      reason: { text: input.reason || "" },
+    });
+  }
+
+  cancel(id: string, input: ApprovalCommandInput, actor: RequestActor) {
+    return this.execute(id, input, actor, {
+      type: "cancel",
+      reason: { text: input.reason || "" },
+    });
+  }
+
+  async timeoutCurrent(id: string, at = this.now()) {
+    const actor = timeoutActor();
+    const item = await this.repository.get(id, actor);
+    if (!item || !["pending", "claimed"].includes(item.status))
+      return undefined;
+    const result = await this.repository.execute(
+      id,
+      { type: "timeout", actor, at: at.toISOString() },
+      item.version,
+      `timeout:${id}`,
+    );
+    await this.effects.transitioned(result);
+    return result;
+  }
+
+  private async execute(
+    id: string,
+    input: ApprovalCommandInput,
+    actor: RequestActor,
+    command: Record<string, unknown> & { type: string },
+  ) {
+    const result = await this.repository.execute(
+      id,
+      {
+        ...command,
+        actor: workflowActor(actor),
+        at: this.now().toISOString(),
+      } as Parameters<WorkflowRepository["execute"]>[1],
+      input.expectedVersion,
+      input.idempotencyKey,
+    );
+    await this.effects.transitioned(result);
+    return result;
+  }
+}
+
+const noEffects: WorkflowEffects = {
+  async created() {},
+  async transitioned() {},
+};
+
+function timeoutActor(): WorkflowActor {
+  return {
+    id: "system_workflow_timeout",
+    name: "审批超时服务",
+    type: "service",
+    roleCodes: [],
+    canManage: true,
+  };
+}
+
+export class WorkflowServiceError extends Error {
+  constructor(readonly code: "ASSIGNEE_NOT_FOUND") {
+    super(code);
+    this.name = "WorkflowServiceError";
+  }
+}
+
+function workflowActor(actor: RequestActor): WorkflowActor {
+  return {
+    id: actor.id,
+    name: actor.displayName || actor.name,
+    type: actor.type === "service" ? "service" : "user",
+    roleCodes: actor.roleCodes,
+    canManage: actor.permissionKeys.includes("system.workflow.manage"),
+  };
+}

package/template/apps/server/src/workflow/timeout-runtime.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, test } from "bun:test";
+import type { RequestActor } from "../guards.js";
+import { DurableHandlerRegistry } from "../jobs/handler-registry.js";
+import { InMemoryDurableExecutionRepository } from "../jobs/in-memory-execution.js";
+import { DurableJobService } from "../jobs/service.js";
+import { DurableJobWorker } from "../jobs/worker.js";
+import { InMemoryWorkflowRepository } from "./repository.js";
+import { WorkflowService } from "./service.js";
+import { WorkflowTimeoutRuntime } from "./timeout-runtime.js";
+
+describe("审批 durable 超时", () => {
+  test("任务在截止时间持久化可用，重建 worker 后继续终结审批", async () => {
+    const createdAt = new Date("2026-07-16T00:00:00.000Z");
+    const dueAt = new Date("2026-07-16T00:10:00.000Z");
+    const workflowRepository = new InMemoryWorkflowRepository();
+    const workflow = new WorkflowService(
+      workflowRepository,
+      {
+        async resolve() {
+          return undefined;
+        },
+      },
+      () => createdAt,
+    );
+    const item = await workflow.create(
+      {
+        title: "重启恢复审批",
+        candidateRoles: [{ code: "reviewer" }],
+        dueAt: dueAt.toISOString(),
+        target: {
+          type: "purchase",
+          id: "P-RESTART",
+          route: "/purchases/P-RESTART",
+        },
+        idempotencyKey: "create-restart",
+      },
+      requester,
+    );
+    const durableFacts = new InMemoryDurableExecutionRepository();
+    const firstRegistry = new DurableHandlerRegistry();
+    const first = new WorkflowTimeoutRuntime(
+      new DurableJobService(durableFacts, () => createdAt),
+      new DurableJobWorker(durableFacts, firstRegistry, {
+        now: () => createdAt,
+      }),
+      firstRegistry,
+      workflow,
+      () => createdAt,
+    );
+    await first.schedule(item);
+
+    const restartedRegistry = new DurableHandlerRegistry();
+    const restarted = new WorkflowTimeoutRuntime(
+      new DurableJobService(durableFacts, () => dueAt),
+      new DurableJobWorker(durableFacts, restartedRegistry, {
+        now: () => dueAt,
+      }),
+      restartedRegistry,
+      new WorkflowService(
+        workflowRepository,
+        {
+          async resolve() {
+            return undefined;
+          },
+        },
+        () => dueAt,
+      ),
+      () => dueAt,
+    );
+    const result = await restarted.runNext();
+    const persisted = await workflowRepository.get(item.id, manager);
+
+    expect(result).toMatchObject({ claimed: true, status: "succeeded" });
+    expect(persisted?.status).toBe("timed-out");
+    expect(persisted?.version).toBe(2);
+    expect(await restarted.runNext()).toMatchObject({
+      claimed: false,
+      status: "idle",
+    });
+  });
+});
+
+const requester: RequestActor = {
+  id: "requester",
+  name: "申请人",
+  type: "user",
+  roleCodes: ["requester"],
+  permissionKeys: ["system.workflow.create"],
+};
+const manager = {
+  id: "manager",
+  name: "管理员",
+  type: "user" as const,
+  roleCodes: [],
+  canManage: true,
+};

package/template/apps/server/src/workflow/timeout-runtime.ts

@@ -0,0 +1,66 @@
+import type { WorkItem } from "@windy/shared";
+import type { DurableHandlerRegistry } from "../jobs/handler-registry.js";
+import type { DurableJobService } from "../jobs/service.js";
+import type { DurableJobWorker } from "../jobs/worker.js";
+import type { WorkflowTimeoutScheduler } from "./effects.js";
+import type { WorkflowService } from "./service.js";
+
+const HANDLER_KEY = "system.workflow.timeout";
+const QUEUE = "system.workflow.timeout";
+
+export class WorkflowTimeoutRuntime implements WorkflowTimeoutScheduler {
+  constructor(
+    private readonly jobs: DurableJobService,
+    private readonly worker: DurableJobWorker,
+    registry: DurableHandlerRegistry,
+    private readonly workflow: WorkflowService,
+    private readonly now: () => Date = () => new Date(),
+  ) {
+    registry.register({
+      key: HANDLER_KEY,
+      payload: { parse: parsePayload },
+      execute: async ({ workItemId }) => {
+        await this.workflow.timeoutCurrent(workItemId, this.now());
+      },
+    });
+  }
+
+  async schedule(item: WorkItem) {
+    await this.jobs.submit({
+      handlerKey: HANDLER_KEY,
+      queue: QUEUE,
+      idempotencyKey: item.id,
+      payload: { workItemId: item.id },
+      requestedBy: "system_workflow_timeout",
+      availableAt: new Date(item.dueAt),
+      maxAttempts: 5,
+      timeoutSeconds: 30,
+    });
+  }
+
+  async reconcile() {
+    const items = await this.workflow.openItemsForTimeoutScheduling();
+    await Promise.all(items.map((item) => this.schedule(item)));
+    return items.length;
+  }
+
+  async runNext() {
+    await this.reconcile();
+    const result = await this.worker.runNext(
+      QUEUE,
+      `server-${process.pid}-workflow-timeout`,
+    );
+    return { claimed: result.status !== "idle", ...result };
+  }
+}
+
+function parsePayload(input: unknown) {
+  const value =
+    input && typeof input === "object"
+      ? (input as Record<string, unknown>)
+      : {};
+  if (typeof value.workItemId !== "string" || !value.workItemId.trim()) {
+    throw new Error("审批超时任务缺少 workItemId");
+  }
+  return { workItemId: value.workItemId };
+}

package/template/apps/server/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "lib": ["esnext", "dom"],
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noImplicitAny": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "outDir": "dist",
+    "types": ["bun"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/template/apps/web/Dockerfile

@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1
+
+FROM oven/bun:1.3.14-alpine AS deps
+WORKDIR /app
+
+COPY package.json bun.lock ./
+COPY apps/license/package.json apps/license/package.json
+COPY apps/server/package.json apps/server/package.json
+COPY apps/signing-service/package.json apps/signing-service/package.json
+COPY apps/web/package.json apps/web/package.json
+COPY packages/config/package.json packages/config/package.json
+COPY packages/create-windy/package.json packages/create-windy/package.json
+COPY packages/crud-generator/package.json packages/crud-generator/package.json
+COPY packages/database/package.json packages/database/package.json
+COPY packages/example-work-order/package.json packages/example-work-order/package.json
+COPY packages/license-sdk/package.json packages/license-sdk/package.json
+COPY packages/modules/package.json packages/modules/package.json
+COPY packages/shared/package.json packages/shared/package.json
+COPY packages/storage/package.json packages/storage/package.json
+RUN bun install --frozen-lockfile
+
+FROM deps AS build
+COPY apps/web apps/web
+COPY packages/example-work-order packages/example-work-order
+COPY packages/license-sdk packages/license-sdk
+COPY packages/modules packages/modules
+COPY packages/shared packages/shared
+RUN bun run --cwd apps/web build
+
+FROM deps AS runner
+COPY apps/web/package.json apps/web/package.json
+COPY apps/web/server.ts apps/web/server.ts
+COPY apps/web/runtime-server.ts apps/web/runtime-server.ts
+COPY packages/shared packages/shared
+COPY --from=build /app/apps/web/dist apps/web/dist
+ENV NODE_ENV=production
+ENV PORT=9746
+EXPOSE 9746
+USER bun
+HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=4 CMD ["bun", "-e", "const r=await fetch('http://127.0.0.1:9746/-/ready');process.exit(r.ok?0:1)"]
+CMD ["bun", "run", "--cwd", "apps/web", "start"]

package/template/apps/web/components.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://shadcn-vue.com/schema.json",
+  "style": "reka-nova",
+  "font": "inter",
+  "typescript": true,
+  "tailwind": {
+    "config": "",
+    "css": "src/style.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": ""
+  },
+  "iconLibrary": "lucide",
+  "rtl": false,
+  "pointer": false,
+  "aliases": {
+    "components": "@/components",
+    "utils": "@/lib/utils",
+    "ui": "@/components/ui",
+    "lib": "@/lib",
+    "composables": "@/composables"
+  },
+  "registries": {}
+}