create-windy 0.1.0

package/template/apps/server/src/auth/actor-resolver.ts

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import type { RequestActor } from "../guards.js";
+import type { RequestActorResolver } from "../runtime.js";
+import { readBearerToken } from "./bearer-token.js";
+import type { AuthRepository } from "./repository.js";
+import { buildActorScopeContexts } from "../data-access/context.js";
+
+export interface ActorResolverOptions {
+  developmentTokenUsers?: Record<string, string>;
+  allowDevelopmentUserTokens?: boolean;
+  userTokenPrefix?: string;
+  sessionCookieName?: string;
+  now?: () => Date;
+}
+
+export class RepositoryActorResolver implements RequestActorResolver {
+  private readonly developmentTokenUsers: Record<string, string>;
+  private readonly allowDevelopmentUserTokens: boolean;
+  private readonly userTokenPrefix: string;
+  private readonly sessionCookieName: string;
+  private readonly now: () => Date;
+
+  constructor(
+    private readonly repository: AuthRepository,
+    options: ActorResolverOptions = {},
+  ) {
+    this.developmentTokenUsers = options.developmentTokenUsers || {};
+    this.allowDevelopmentUserTokens =
+      options.allowDevelopmentUserTokens ?? false;
+    this.userTokenPrefix = options.userTokenPrefix || "user:";
+    this.sessionCookieName = options.sessionCookieName || "windy.sid";
+    this.now = options.now || (() => new Date());
+  }
+
+  async resolve(request: Request): Promise<RequestActor | undefined> {
+    const token = readRequestSessionToken(request, this.sessionCookieName);
+    if (!token) {
+      return undefined;
+    }
+    try {
+      const developmentUser = await this.resolveDevelopmentUser(token);
+      return (
+        developmentUser ||
+        (await this.repository.resolveSessionActor(
+          hashSessionToken(token),
+          this.now(),
+        ))
+      );
+    } catch {
+      return undefined;
+    }
+  }
+
+  private async resolveDevelopmentUser(
+    token: string,
+  ): Promise<RequestActor | undefined> {
+    const username = this.developmentTokenUsers[token];
+    const directUser =
+      this.allowDevelopmentUserTokens && token.startsWith(this.userTokenPrefix)
+        ? token.slice(this.userTokenPrefix.length)
+        : undefined;
+    const reference = username || directUser;
+    if (!reference) {
+      return undefined;
+    }
+    const user = await this.repository.findUserByReference(reference);
+    if (!user || user.status !== "active") {
+      return undefined;
+    }
+    return {
+      id: user.id,
+      type: "user",
+      name: user.displayName,
+      username: user.username,
+      displayName: user.displayName,
+      email: user.email,
+      phone: user.phone,
+      credentialState: user.credentialState,
+      passwordChangedAt: user.passwordChangedAt?.toISOString(),
+      roleCodes: [...user.roleCodes].sort(),
+      permissionKeys: [...user.permissionKeys].sort(),
+      ...buildActorScopeContexts(
+        user.id,
+        user.departmentId,
+        user.dataAccessRoles || [],
+      ),
+    };
+  }
+}
+
+export function hashSessionToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function readRequestSessionToken(
+  request: Request,
+  cookieName: string,
+): string | undefined {
+  return readBearerToken(request) || readCookie(request, cookieName);
+}
+
+function readCookie(request: Request, name: string): string | undefined {
+  const cookie = request.headers.get("cookie");
+  const match = cookie
+    ?.split(";")
+    .map((item) => item.trim())
+    .find((item) => item.startsWith(`${name}=`));
+  return match ? decodeURIComponent(match.slice(name.length + 1)) : undefined;
+}

package/template/apps/server/src/auth/authentication-provider.test.ts

@@ -0,0 +1,180 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import type { AuditEvent } from "@windy/shared";
+import {
+  AuthenticationProviderRegistry,
+  LocalArgon2AuthenticationAdapter,
+  type AuthenticationProvider,
+} from "./authentication-provider.js";
+import { argon2PasswordHasher } from "./password.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { AuthService } from "./service.js";
+
+let passwordHash = "";
+
+beforeAll(async () => {
+  passwordHash = await argon2PasswordHasher.hash("test-only-password");
+});
+
+describe("Authentication Provider", () => {
+  test("本地 Adapter 只通过 Repository 与 Argon2 验证启用账号", async () => {
+    const adapter = new LocalArgon2AuthenticationAdapter(
+      new InMemoryAuthRepository([
+        user(),
+        {
+          ...user(),
+          id: "user_disabled",
+          username: "disabled",
+          status: "disabled",
+        },
+      ]),
+      argon2PasswordHasher,
+    );
+
+    expect(
+      await adapter.authenticate({
+        method: "password",
+        username: " admin ",
+        password: "test-only-password",
+      }),
+    ).toMatchObject({
+      status: "authenticated",
+      subject: "user_admin",
+      user: { id: "user_admin" },
+    });
+    expect(
+      await adapter.authenticate({
+        method: "password",
+        username: "admin",
+        password: "wrong-password",
+      }),
+    ).toMatchObject({ status: "rejected", reason: "invalid-credentials" });
+    expect(
+      await adapter.authenticate({
+        method: "password",
+        username: "disabled",
+        password: "test-only-password",
+      }),
+    ).toMatchObject({ status: "rejected", reason: "inactive-user" });
+  });
+
+  test("Registry 拒绝重复 Key 和缺失默认 Provider", () => {
+    const local = provider("local", "local", ["password"]);
+
+    expect(
+      () => new AuthenticationProviderRegistry([local, local], "local"),
+    ).toThrow("重复注册");
+    expect(
+      () => new AuthenticationProviderRegistry([local], "missing"),
+    ).toThrow("默认 Authentication Provider 未注册");
+  });
+
+  test("OIDC、LDAP 和 MFA 通过同一端口组合，不预置客户集成", async () => {
+    const oidc = provider("customer-oidc", "oidc", [
+      "authorization-code",
+      "mfa",
+    ]);
+    const ldap = provider("customer-ldap", "ldap", ["password"]);
+    const registry = new AuthenticationProviderRegistry(
+      [ldap, oidc],
+      "customer-ldap",
+    );
+
+    expect(registry.defaultProvider()).toBe(ldap);
+    expect(registry.descriptors()).toEqual([
+      {
+        key: "customer-ldap",
+        kind: "ldap",
+        capabilities: ["password"],
+      },
+      {
+        key: "customer-oidc",
+        kind: "oidc",
+        capabilities: ["authorization-code", "mfa"],
+      },
+    ]);
+    expect(
+      await registry.get("customer-oidc").authenticate({
+        method: "authorization-code",
+        code: "opaque-code",
+        redirectUri: "https://example.test/callback",
+      }),
+    ).toMatchObject({
+      status: "challenge-required",
+      challenge: { id: "challenge_1", type: "mfa" },
+    });
+  });
+
+  test("AuthService 只依赖 Registry 默认 Provider，不绑定本地密码实现", async () => {
+    const externalUser = { ...user(), passwordHash: undefined };
+    const repository = new InMemoryAuthRepository([externalUser]);
+    const events: AuditEvent[] = [];
+    let providerUser = externalUser;
+    const ldap: AuthenticationProvider = {
+      key: "customer-ldap",
+      kind: "ldap",
+      capabilities: ["password"],
+      authenticate: async () => ({
+        status: "authenticated",
+        user: providerUser,
+        subject: "directory/admin",
+      }),
+    };
+    const service = new AuthService(repository, {
+      authenticationProviders: new AuthenticationProviderRegistry(
+        [ldap],
+        ldap.key,
+      ),
+      auditWriter: { write: (event) => void events.push(event) },
+    });
+
+    const result = await service.login("admin", "provider-owned-secret");
+
+    expect(result).toMatchObject({ ok: true, user: { id: "user_admin" } });
+    expect(repository.storedSessions()).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      action: "auth.login",
+      metadata: { provider: "customer-ldap" },
+    });
+
+    providerUser = { ...externalUser, status: "disabled" };
+    expect(await service.login("admin", "provider-owned-secret")).toEqual({
+      ok: false,
+      code: "INVALID_CREDENTIALS",
+    });
+    expect(repository.storedSessions()).toHaveLength(1);
+    expect(events[1]).toMatchObject({
+      outcome: "failure",
+      metadata: { provider: "customer-ldap", reason: "inactive-user" },
+    });
+  });
+});
+
+function provider(
+  key: string,
+  kind: AuthenticationProvider["kind"],
+  capabilities: AuthenticationProvider["capabilities"],
+): AuthenticationProvider {
+  return {
+    key,
+    kind,
+    capabilities,
+    authenticate: async () => ({
+      status: "challenge-required",
+      user: user(),
+      challenge: { id: "challenge_1", type: "mfa" },
+    }),
+  };
+}
+
+function user(): AuthUserRecord {
+  return {
+    id: "user_admin",
+    username: "admin",
+    displayName: "平台管理员",
+    passwordHash,
+    credentialState: "active",
+    status: "active",
+    roleCodes: ["developer"],
+    permissionKeys: [],
+  };
+}

package/template/apps/server/src/auth/authentication-provider.ts

@@ -0,0 +1,117 @@
+import type { PasswordHasher } from "./password.js";
+import type { AuthRepository, AuthUserRecord } from "./repository.js";
+
+export type AuthenticationProviderKind = "local" | "oidc" | "ldap";
+export type AuthenticationCapability =
+  | "password"
+  | "authorization-code"
+  | "mfa";
+
+export type AuthenticationRequest =
+  | { method: "password"; username: string; password: string }
+  | {
+      method: "authorization-code";
+      code: string;
+      redirectUri: string;
+    }
+  | { method: "mfa-challenge"; challengeId: string; response: string };
+
+export type AuthenticationResult =
+  | { status: "authenticated"; user: AuthUserRecord; subject: string }
+  | {
+      status: "challenge-required";
+      user: AuthUserRecord;
+      challenge: { id: string; type: "mfa"; expiresAt?: Date };
+    }
+  | {
+      status: "rejected";
+      reason: "invalid-credentials" | "inactive-user" | "unsupported-method";
+      user?: AuthUserRecord;
+    };
+
+export interface AuthenticationProvider {
+  readonly key: string;
+  readonly kind: AuthenticationProviderKind;
+  readonly capabilities: readonly AuthenticationCapability[];
+  authenticate(request: AuthenticationRequest): Promise<AuthenticationResult>;
+}
+
+export class LocalArgon2AuthenticationAdapter implements AuthenticationProvider {
+  readonly key = "local";
+  readonly kind = "local";
+  readonly capabilities = ["password"] as const;
+
+  constructor(
+    private readonly repository: AuthRepository,
+    private readonly passwordHasher: PasswordHasher,
+  ) {}
+
+  async authenticate(
+    request: AuthenticationRequest,
+  ): Promise<AuthenticationResult> {
+    if (request.method !== "password") {
+      return { status: "rejected", reason: "unsupported-method" };
+    }
+    const username = request.username.trim();
+    const user = username
+      ? await this.repository.findUserByUsername(username)
+      : undefined;
+    const valid = Boolean(
+      user?.passwordHash &&
+      (await this.passwordHasher.verify(user.passwordHash, request.password)),
+    );
+    if (!user || !valid) {
+      return { status: "rejected", reason: "invalid-credentials", user };
+    }
+    if (user.status !== "active") {
+      return { status: "rejected", reason: "inactive-user", user };
+    }
+    return { status: "authenticated", user, subject: user.id };
+  }
+}
+
+export class AuthenticationProviderRegistry {
+  private readonly providers = new Map<string, AuthenticationProvider>();
+
+  constructor(
+    providers: readonly AuthenticationProvider[],
+    readonly defaultProviderKey: string,
+  ) {
+    for (const provider of providers) {
+      if (!provider.key.trim()) {
+        throw new Error("Authentication Provider Key 不能为空");
+      }
+      if (this.providers.has(provider.key)) {
+        throw new Error(`Authentication Provider 重复注册：${provider.key}`);
+      }
+      this.providers.set(provider.key, provider);
+    }
+    if (!this.providers.has(defaultProviderKey)) {
+      throw new Error(
+        `默认 Authentication Provider 未注册：${defaultProviderKey}`,
+      );
+    }
+  }
+
+  get(key: string): AuthenticationProvider {
+    const provider = this.providers.get(key);
+    if (!provider) {
+      throw new Error(`Authentication Provider 未注册：${key}`);
+    }
+    return provider;
+  }
+
+  defaultProvider(): AuthenticationProvider {
+    return this.get(this.defaultProviderKey);
+  }
+
+  descriptors() {
+    return [...this.providers.values()]
+      .map(({ key, kind, capabilities }) => ({
+        key,
+        kind,
+        capabilities: [...capabilities],
+      }))
+      .sort((left, right) => left.key.localeCompare(right.key));
+  }
+}

package/template/apps/server/src/auth/authorization-snapshot.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildAuthorizationSnapshot,
+  selectAuthorizationRoleIds,
+} from "./authorization-snapshot.js";
+
+describe("authorization snapshot", () => {
+  test("canonical 角色数组存在时覆盖兼容关系并稳定去重", () => {
+    expect(
+      selectAuthorizationRoleIds(
+        ["role_json", "role_shared", "role_json", 1],
+        ["role_relation", "role_shared", ""],
+      ),
+    ).toEqual(["role_json", "role_shared"]);
+    expect(selectAuthorizationRoleIds([], ["role_relation"])).toEqual([]);
+  });
+
+  test("canonical 角色数组缺失时回退兼容关系", () => {
+    expect(
+      selectAuthorizationRoleIds(undefined, [
+        "role_relation",
+        "role_relation",
+        "",
+      ]),
+    ).toEqual(["role_relation"]);
+  });
+
+  test("权限按角色执行 canonical 覆盖和缺失回退", () => {
+    const snapshot = buildAuthorizationSnapshot(
+      [
+        role("role_json", ["permission.json"]),
+        role("role_empty", []),
+        role("role_relation", null),
+      ],
+      [
+        { roleId: "role_json", permissionKey: "permission.stale-json" },
+        { roleId: "role_empty", permissionKey: "permission.stale-empty" },
+        { roleId: "role_relation", permissionKey: "permission.relation" },
+      ],
+    );
+
+    expect(snapshot.permissionKeys).toEqual([
+      "permission.json",
+      "permission.relation",
+    ]);
+  });
+
+  test("角色、权限和 data access 只来自同一组启用角色", () => {
+    const snapshot = buildAuthorizationSnapshot(
+      [
+        {
+          id: "role_relation",
+          code: "relation",
+          status: "active",
+          dataScope: "custom",
+          departmentIds: ["dept_b", "dept_a", "dept_a"],
+          permissionKeys: null,
+        },
+        {
+          id: "role_json",
+          code: "json",
+          status: "active",
+          dataScope: "self",
+          departmentIds: [],
+          permissionKeys: ["system.user.read", "system.user.manage"],
+        },
+        {
+          id: "role_disabled",
+          code: "disabled",
+          status: "disabled",
+          dataScope: "all",
+          departmentIds: [],
+          permissionKeys: ["system.audit.read"],
+        },
+      ],
+      [
+        { roleId: "role_relation", permissionKey: "system.role.read" },
+        { roleId: "role_json", permissionKey: "system.role.manage" },
+        { roleId: "role_disabled", permissionKey: "system.audit.manage" },
+      ],
+    );
+
+    expect(snapshot).toEqual({
+      roleCodes: ["json", "relation"],
+      permissionKeys: [
+        "system.role.read",
+        "system.user.manage",
+        "system.user.read",
+      ],
+      dataAccessRoles: [
+        {
+          id: "role_json",
+          code: "json",
+          dataScope: "self",
+          departmentIds: [],
+        },
+        {
+          id: "role_relation",
+          code: "relation",
+          dataScope: "custom",
+          departmentIds: ["dept_a", "dept_b"],
+        },
+      ],
+    });
+  });
+});
+
+function role(id: string, permissionKeys: unknown) {
+  return {
+    id,
+    code: id,
+    status: "active",
+    dataScope: "self" as const,
+    departmentIds: [],
+    permissionKeys,
+  };
+}

package/template/apps/server/src/auth/authorization-snapshot.ts

@@ -0,0 +1,98 @@
+import type { DataAccessRolePolicy } from "../data-access/context.js";
+
+export interface AuthorizationRoleSource extends DataAccessRolePolicy {
+  status: string;
+  permissionKeys: unknown;
+}
+
+export interface AuthorizationPermissionSource {
+  roleId: string;
+  permissionKey: string;
+}
+
+export interface AuthorizationSnapshot {
+  roleCodes: string[];
+  permissionKeys: string[];
+  dataAccessRoles: DataAccessRolePolicy[];
+}
+
+/** canonical 数组存在（包括空数组）时具有权威性；仅缺失时回退兼容关系表。 */
+export function selectAuthorizationRoleIds(
+  canonicalRoleIds: unknown,
+  compatibilityRoleIds: string[],
+): string[] {
+  return unique(
+    Array.isArray(canonicalRoleIds)
+      ? readStringArray(canonicalRoleIds)
+      : compatibilityRoleIds,
+  );
+}
+
+export function buildAuthorizationSnapshot(
+  roleSources: AuthorizationRoleSource[],
+  permissionSources: AuthorizationPermissionSource[],
+): AuthorizationSnapshot {
+  const activeRoles = uniqueActiveRoles(roleSources);
+  const activeRoleIds = new Set(activeRoles.map((role) => role.id));
+  const compatibilityPermissions = groupPermissions(
+    permissionSources.filter((permission) =>
+      activeRoleIds.has(permission.roleId),
+    ),
+  );
+  const permissionKeys = unique(
+    activeRoles.flatMap((role) =>
+      Array.isArray(role.permissionKeys)
+        ? readStringArray(role.permissionKeys)
+        : (compatibilityPermissions.get(role.id) ?? []),
+    ),
+  );
+
+  return {
+    roleCodes: unique(activeRoles.map((role) => role.code)),
+    permissionKeys,
+    dataAccessRoles: activeRoles.map((role) => ({
+      id: role.id,
+      code: role.code,
+      dataScope: role.dataScope,
+      departmentIds: unique(role.departmentIds),
+    })),
+  };
+}
+
+function groupPermissions(
+  permissionSources: AuthorizationPermissionSource[],
+): Map<string, string[]> {
+  const permissions = new Map<string, string[]>();
+  for (const permission of permissionSources) {
+    const rolePermissions = permissions.get(permission.roleId) ?? [];
+    rolePermissions.push(permission.permissionKey);
+    permissions.set(permission.roleId, rolePermissions);
+  }
+  return permissions;
+}
+
+function uniqueActiveRoles(
+  roleSources: AuthorizationRoleSource[],
+): AuthorizationRoleSource[] {
+  const roles = new Map<string, AuthorizationRoleSource>();
+  for (const role of roleSources) {
+    if (role.status === "active" && !roles.has(role.id)) {
+      roles.set(role.id, role);
+    }
+  }
+  return [...roles.values()].sort((left, right) =>
+    left.id.localeCompare(right.id),
+  );
+}
+
+function readStringArray(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter(
+        (item): item is string => typeof item === "string" && item.length > 0,
+      )
+    : [];
+}
+
+function unique(values: string[]): string[] {
+  return [...new Set(values.filter((value) => value.length > 0))].sort();
+}

package/template/apps/server/src/auth/bearer-token.ts

@@ -0,0 +1,5 @@
+export function readBearerToken(request: Request): string | undefined {
+  const authorization = request.headers.get("authorization");
+  const match = authorization?.match(/^Bearer\s+(.+)$/i);
+  return match?.[1]?.trim();
+}

package/template/apps/server/src/auth/bootstrap-admin.ts

@@ -0,0 +1,33 @@
+import type { AuthRepository } from "./repository.js";
+import type { AuthService } from "./service.js";
+import type { SystemRepositories } from "../system/seed.js";
+
+export interface BootstrapAdminPasswordInput {
+  authService?: AuthService;
+  authRepository?: AuthRepository;
+  repositories: SystemRepositories;
+  password?: string;
+}
+
+export async function bootstrapAdminPassword(
+  input: BootstrapAdminPasswordInput,
+): Promise<void> {
+  if (!input.authService || !input.authRepository || !input.password) return;
+  await input.repositories.users.get("user_dev_admin");
+  await input.repositories.roles.get("role_developer");
+  const admin =
+    await input.authRepository.findUserByReference("user_dev_admin");
+  if (!admin || admin.passwordHash) return;
+  const result = await input.authService.updatePassword(
+    admin.id,
+    input.password,
+    {
+      id: "system_bootstrap",
+      type: "service",
+      name: "平台初始化",
+      roleCodes: ["system"],
+      permissionKeys: ["system.user.manage"],
+    },
+  );
+  if (!result.ok) throw new Error(`初始化管理员密码失败：${result.code}`);
+}

package/template/apps/server/src/auth/credential-restriction.ts

@@ -0,0 +1,29 @@
+import type { RequestGuardContext } from "../guards.js";
+
+const PASSWORD_CHANGE_ALLOWLIST = new Set([
+  "GET /api/auth/session",
+  "POST /api/auth/password/change",
+  "POST /api/auth/logout",
+]);
+
+export function credentialRestrictedResponse(
+  context: RequestGuardContext,
+  request: Request,
+): Response | undefined {
+  if (context.actor.credentialState !== "must-change-password") {
+    return undefined;
+  }
+  const url = new URL(request.url);
+  const capability = `${request.method.toUpperCase()} ${url.pathname}`;
+  if (PASSWORD_CHANGE_ALLOWLIST.has(capability)) {
+    return undefined;
+  }
+  return Response.json(
+    {
+      error: "PASSWORD_CHANGE_REQUIRED",
+      reason: "credential-state",
+      credentialState: context.actor.credentialState,
+    },
+    { status: 403 },
+  );
+}