create-windy 0.2.31 → 0.2.33

package/dist/cli.js

@@ -1114,7 +1114,7 @@ function rewriteCustomerDockerfile(source) {
     return !supplierWorkspaceCopies.includes(line) && !supplierWorkspacePaths.some((path) => line.includes(path)) && !line.includes("deploy/production/server-entrypoint.sh");
   });
   return lines.join(`
-`).replace("COPY package.json bun.lock ./", "COPY package.json ./").replace("RUN bun install --frozen-lockfile", "RUN bun install");
+`);
 }
 
 // src/code-quality.ts
@@ -1927,6 +1927,7 @@ var templateDocumentationFiles = [
   "docs/architecture/object-storage.md",
   "docs/architecture/search-provider-protocol.md",
   "docs/development/crud-generator.md",
+  "docs/development/custom-login-page.md",
   "docs/license/license-offline-activation-code.md",
   "docs/operations/observability.md",
   "docs/platform/agent-tools.md",
@@ -4361,7 +4362,9 @@ var recipes = [
   { id: "starter-0.2.27-to-0.2.28", from: "0.2.27", to: "0.2.28" },
   { id: "starter-0.2.28-to-0.2.29", from: "0.2.28", to: "0.2.29" },
   { id: "starter-0.2.29-to-0.2.30", from: "0.2.29", to: "0.2.30" },
-  { id: "starter-0.2.30-to-0.2.31", from: "0.2.30", to: "0.2.31" }
+  { id: "starter-0.2.30-to-0.2.31", from: "0.2.30", to: "0.2.31" },
+  { id: "starter-0.2.31-to-0.2.32", from: "0.2.31", to: "0.2.32" },
+  { id: "starter-0.2.32-to-0.2.33", from: "0.2.32", to: "0.2.33" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (sourceVersion === targetVersion)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "5d781a968ffc243b9c29c1ee31382cd61a5f4ab7",
-  "generatorVersion": "0.2.31",
+  "templateCommit": "395761d19b6dac6f4135547bedf996e3a53249a7",
+  "generatorVersion": "0.2.33",
   "modules": [
     {
       "name": "system",

package/template/AGENTS.md

@@ -39,11 +39,18 @@
   对 `windy-managed` 路径仅在没有可用扩展点时做最小改动。
 - 确需修改 Windy 受管代码时，使用独立小提交记录原因和影响；升级前先运行
   `bun run windy update --dry-run`，根据三方合并计划处理冲突。
+- 完整定制登录页时，在 project-owned 的
+  `apps/web/src/app/auth/login-page.ts` 注册业务组件；不要修改
+  `apps/web/src/pages/auth/LoginPage.vue` 或 Router。业务页面复用
+  `useLoginFlow`、`DevelopmentAuthWarning` 和平台品牌设置，保留安全
+  `returnTo`、真实认证与开发认证提示。
 
 ## 常用入口
 
 - `.agents/skills/windy-business-module/SKILL.md`：新增或修改业务模块、Agent Tool
   或 MCP 暴露时使用的仓库内开发流程。
+- `docs/development/custom-login-page.md`：完整替换登录页的 ownership、认证复用和
+  升级迁移说明。
 - `bun run dev`：复用 Docker 镜像启动 PostgreSQL、自动 migration、Server 与支持热更新的 Web。
 - `bun run dev:build`：依赖、Dockerfile 或 lockfile 变化后重建并启动开发环境。
 - `bun run dev:web`：启动 Web 开发服务。

package/template/apps/server/src/settings/drizzle-watermark-repository.integration.test.ts

@@ -39,6 +39,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
       {
         enabled: true,
         businessPagesEnabled: true,
+        density: "high",
+        contentFields: ["username", "phone"],
         customContent: "内部资料",
       },
       "user_settings",
@@ -51,6 +53,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
     expect(await restarted.get()).toEqual({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "phone"],
       customContent: "内部资料",
     });
   });

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -38,6 +38,8 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         set: {
           enabled: policy.enabled,
           businessPagesEnabled: policy.businessPagesEnabled,
+          density: policy.density,
+          contentFields: policy.contentFields,
           customContent: policy.customContent,
           updatedAt: new Date(),
           updatedBy: actorId,
@@ -52,11 +54,15 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
 function toPolicy(row: {
   enabled: boolean;
   businessPagesEnabled: boolean;
+  density: PlatformWatermarkPolicy["density"];
+  contentFields: PlatformWatermarkPolicy["contentFields"];
   customContent: string;
 }): PlatformWatermarkPolicy {
   return {
     enabled: row.enabled,
     businessPagesEnabled: row.businessPagesEnabled,
+    density: row.density,
+    contentFields: row.contentFields,
     customContent: row.customContent,
   };
 }

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -43,7 +43,9 @@ describe("平台水印策略路由", () => {
 
     expect(policy).toEqual({
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     });
   });
@@ -53,6 +55,8 @@ describe("平台水印策略路由", () => {
     const input: PlatformWatermarkPolicy = {
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "phone", "custom"],
       customContent: "内部资料",
     };
 
@@ -79,7 +83,7 @@ describe("平台水印策略路由", () => {
           action: "config.update",
           target: { type: "platform-watermark", id: "platform" },
           metadata: expect.objectContaining({
-            changedFields: ["businessPagesEnabled", "customContent"],
+            changedFields: ["density", "contentFields", "customContent"],
           }),
         }),
       ]),
@@ -97,6 +101,8 @@ describe("平台水印策略路由", () => {
     const denied = (await update(fixture, {
       enabled: false,
       businessPagesEnabled: false,
+      density: "low",
+      contentFields: ["username"],
       customContent: "",
     })) as Response;
 
@@ -130,13 +136,17 @@ describe("平台水印策略路由", () => {
     const response = (await update(fixture, {
       enabled: true,
       businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username"],
       customContent: "x".repeat(81),
     })) as Response;
 
     expect(response.status).toBe(400);
     expect(await fixture.repository.get()).toEqual({
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     });
     expect(fixture.runtime.auditSink.list()).toHaveLength(0);

package/template/apps/server/src/settings/watermark-routes.ts

@@ -3,6 +3,10 @@ import type {
   FeatureFlagDefinition,
   PlatformWatermarkPolicy,
 } from "@southwind-ai/shared";
+import {
+  WATERMARK_CONTENT_FIELDS,
+  WATERMARK_DENSITIES,
+} from "@southwind-ai/shared";
 import { evaluateRouteGuards, findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import { resourceEvent, routeContext } from "../system/route-helpers.js";
@@ -108,15 +112,43 @@ function parseWatermarkPolicy(body: unknown): WatermarkParseResult {
   if (typeof source.customContent !== "string") {
     return { ok: false, message: "自定义内容必须是字符串" };
   }
+  if (
+    typeof source.density !== "string" ||
+    !WATERMARK_DENSITIES.includes(
+      source.density as (typeof WATERMARK_DENSITIES)[number],
+    )
+  ) {
+    return { ok: false, message: "水印密度无效" };
+  }
+  if (
+    !Array.isArray(source.contentFields) ||
+    source.contentFields.length === 0 ||
+    !source.contentFields.every(
+      (field) =>
+        typeof field === "string" &&
+        WATERMARK_CONTENT_FIELDS.includes(
+          field as (typeof WATERMARK_CONTENT_FIELDS)[number],
+        ),
+    )
+  ) {
+    return { ok: false, message: "请至少选择一项有效的水印内容" };
+  }
   const customContent = source.customContent.trim();
   if (customContent.length > 80) {
     return { ok: false, message: "自定义内容不能超过 80 个字符" };
   }
+  const contentFields = [
+    ...new Set(
+      source.contentFields as PlatformWatermarkPolicy["contentFields"],
+    ),
+  ];
   return {
     ok: true,
     value: {
       enabled: source.enabled,
       businessPagesEnabled: source.businessPagesEnabled,
+      density: source.density as PlatformWatermarkPolicy["density"],
+      contentFields,
       customContent,
     },
   };
@@ -126,9 +158,15 @@ function changedFields(
   before: PlatformWatermarkPolicy,
   after: PlatformWatermarkPolicy,
 ): string[] {
-  return ["enabled", "businessPagesEnabled", "customContent"].filter(
+  return [
+    "enabled",
+    "businessPagesEnabled",
+    "density",
+    "contentFields",
+    "customContent",
+  ].filter(
     (field) =>
-      before[field as keyof PlatformWatermarkPolicy] !==
-      after[field as keyof PlatformWatermarkPolicy],
+      JSON.stringify(before[field as keyof PlatformWatermarkPolicy]) !==
+      JSON.stringify(after[field as keyof PlatformWatermarkPolicy]),
   );
 }

package/template/apps/web/src/app/auth/login-page.ts

@@ -0,0 +1,4 @@
+import PlatformLoginPage from "@/pages/auth/LoginPage.vue";
+import { defineLoginPageComponent } from "@/pages/auth/login-page-extension";
+
+export const loginPageComponent = defineLoginPageComponent(PlatformLoginPage);

package/template/apps/web/src/composables/useLoginFlow.webtest.ts

@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  auth: {
+    error: { value: "" },
+    login: vi.fn(),
+    phase: { value: "anonymous" },
+  },
+  replace: vi.fn(),
+  resetAccessSnapshot: vi.fn(),
+  // @windy-module system.license begin
+  resetLicenseRuntime: vi.fn(),
+  // @windy-module system.license end
+  resetSessionContext: vi.fn(),
+  returnTo: "/admin?tab=active#top" as unknown,
+}));
+
+vi.mock("vue-router", () => ({
+  useRoute: () => ({ query: { returnTo: mocks.returnTo } }),
+  useRouter: () => ({ replace: mocks.replace }),
+}));
+vi.mock("@/composables/useAccessSnapshot", () => ({
+  resetAccessSnapshot: mocks.resetAccessSnapshot,
+}));
+vi.mock("@/composables/useAuthSession", () => ({
+  useAuthSession: () => mocks.auth,
+}));
+// @windy-module system.license begin
+vi.mock("@/composables/useLicenseRuntime", () => ({
+  resetLicenseRuntime: mocks.resetLicenseRuntime,
+}));
+// @windy-module system.license end
+vi.mock("@/composables/useSessionContext", () => ({
+  resetSessionContext: mocks.resetSessionContext,
+}));
+
+import { useLoginFlow } from "./useLoginFlow";
+
+describe("登录流程扩展契约", () => {
+  beforeEach(() => {
+    mocks.auth.error.value = "";
+    mocks.auth.phase.value = "anonymous";
+    mocks.auth.login.mockReset();
+    mocks.replace.mockReset();
+    mocks.resetAccessSnapshot.mockReset();
+    // @windy-module system.license begin
+    mocks.resetLicenseRuntime.mockReset();
+    // @windy-module system.license end
+    mocks.resetSessionContext.mockReset();
+    mocks.returnTo = "/admin?tab=active#top";
+  });
+
+  test("成功登录后重置会话派生状态并进入安全 returnTo", async () => {
+    mocks.auth.login.mockResolvedValue(undefined);
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "secret-password" });
+
+    expect(mocks.auth.login).toHaveBeenCalledWith({
+      username: "admin",
+      password: "secret-password",
+    });
+    expect(mocks.resetAccessSnapshot).toHaveBeenCalledOnce();
+    // @windy-module system.license begin
+    expect(mocks.resetLicenseRuntime).toHaveBeenCalledOnce();
+    // @windy-module system.license end
+    expect(mocks.resetSessionContext).toHaveBeenCalledOnce();
+    expect(mocks.replace).toHaveBeenCalledWith("/admin?tab=active#top");
+  });
+
+  test("业务登录页不能借 returnTo 跳转到站外", async () => {
+    mocks.returnTo = "https://evil.example/phishing";
+    mocks.auth.login.mockResolvedValue(undefined);
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "secret-password" });
+
+    expect(mocks.replace).toHaveBeenCalledWith("/");
+  });
+
+  test("认证失败保留当前页面并暴露服务端错误", async () => {
+    mocks.auth.error.value = "用户名或密码错误";
+    mocks.auth.login.mockRejectedValue(new Error("unauthorized"));
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "wrong-password" });
+
+    expect(flow.submitError.value).toBe("用户名或密码错误");
+    expect(mocks.replace).not.toHaveBeenCalled();
+  });
+});

package/template/apps/web/src/composables/useWatermarkSettings.ts

@@ -10,8 +10,8 @@ import {
   type PlatformWatermarkPolicy,
 } from "@southwind-ai/shared";
 import {
-  defaultWatermarkContent,
   normalizeWatermarkPolicy,
+  watermarkContent,
 } from "./watermark-settings";
 
 const policy = shallowRef<PlatformWatermarkPolicy>({
@@ -26,8 +26,12 @@ let pending: Promise<PlatformWatermarkPolicy> | undefined;
 export function useWatermarkSettings(
   actor: Readonly<Ref<WebAccessActor | undefined>>,
 ) {
-  const content = computed(
-    () => policy.value.customContent || defaultWatermarkContent(actor.value),
+  const content = computed(() =>
+    watermarkContent(
+      actor.value,
+      policy.value.contentFields,
+      policy.value.customContent,
+    ),
   );
 
   return {

package/template/apps/web/src/composables/useWatermarkSettings.webtest.ts

@@ -27,6 +27,8 @@ describe("全局水印策略状态", () => {
     api.loadPublic.mockResolvedValue({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["custom"],
       customContent: "全局审计",
     });
     const { useWatermarkSettings } = await import("./useWatermarkSettings");
@@ -37,6 +39,8 @@ describe("全局水印策略状态", () => {
     expect(watermark.policy.value).toEqual({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["custom"],
       customContent: "全局审计",
     });
     expect(localStorageRead).not.toHaveBeenCalled();
@@ -47,11 +51,15 @@ describe("全局水印策略状态", () => {
     api.loadManaged.mockResolvedValue({
       enabled: true,
       businessPagesEnabled: false,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     });
     api.update.mockResolvedValue({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "custom"],
       customContent: "  内部资料  ",
     });
     const { useWatermarkSettings } = await import("./useWatermarkSettings");
@@ -69,17 +77,23 @@ describe("全局水印策略状态", () => {
     await first.save({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "custom"],
       customContent: "内部资料",
     });
 
     expect(api.update).toHaveBeenCalledWith({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "custom"],
       customContent: "内部资料",
     });
     expect(second.policy.value).toEqual({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "custom"],
       customContent: "内部资料",
     });
   });

package/template/apps/web/src/composables/watermark-settings.ts

@@ -1,25 +1,147 @@
 import type { WebAccessActor } from "@/layout/navigation";
-import type { PlatformWatermarkPolicy } from "@southwind-ai/shared";
+import {
+  DEFAULT_PLATFORM_WATERMARK_POLICY,
+  WATERMARK_CONTENT_FIELDS,
+  WATERMARK_DENSITIES,
+  type PlatformWatermarkPolicy,
+  type WatermarkContentField,
+  type WatermarkDensity,
+} from "@southwind-ai/shared";
 
-export function defaultWatermarkContent(
+const DENSITY_GAPS: Record<
+  WatermarkDensity,
+  { horizontal: number; vertical: number }
+> = {
+  low: { horizontal: 112, vertical: 76 },
+  medium: { horizontal: 72, vertical: 48 },
+  high: { horizontal: 36, vertical: 24 },
+};
+const FONT_SIZE = 14;
+const LINE_HEIGHT = 22;
+const ROTATION_RADIANS = (22 * Math.PI) / 180;
+const MAX_LINE_WEIGHT = 32;
+
+export function watermarkContent(
   actor: WebAccessActor | undefined,
+  contentFields: readonly WatermarkContentField[],
+  customContent: string,
 ): string {
   if (!actor || actor.type === "anonymous") return "";
-  const username = actor.username?.trim() || actor.name.trim();
-  const identity =
-    actor.phone?.trim() ||
-    actor.email?.trim() ||
-    actor.displayName?.trim() ||
-    actor.name.trim();
-  return [...new Set([username, identity].filter(Boolean))].join(" · ");
+  const values: Record<WatermarkContentField, string> = {
+    username: actor.username?.trim() || actor.name.trim(),
+    displayName: actor.displayName?.trim() || actor.name.trim(),
+    phone: actor.phone?.trim() || "",
+    email: actor.email?.trim() || "",
+    custom: customContent.trim(),
+  };
+  const selected = [
+    ...new Set(contentFields.map((field) => values[field]).filter(Boolean)),
+  ];
+  return selected.length > 0
+    ? selected.join(" · ")
+    : actor.username?.trim() || actor.name.trim();
 }
 
 export function normalizeWatermarkPolicy(
   value: PlatformWatermarkPolicy,
 ): PlatformWatermarkPolicy {
+  const density = WATERMARK_DENSITIES.includes(value.density)
+    ? value.density
+    : DEFAULT_PLATFORM_WATERMARK_POLICY.density;
+  const receivedFields = Array.isArray(value.contentFields)
+    ? value.contentFields
+    : DEFAULT_PLATFORM_WATERMARK_POLICY.contentFields;
+  const contentFields = [
+    ...new Set(
+      receivedFields.filter((field) =>
+        WATERMARK_CONTENT_FIELDS.includes(field),
+      ),
+    ),
+  ];
   return {
     enabled: value.enabled,
     businessPagesEnabled: value.businessPagesEnabled,
+    density,
+    contentFields:
+      contentFields.length > 0
+        ? contentFields
+        : [...DEFAULT_PLATFORM_WATERMARK_POLICY.contentFields],
     customContent: value.customContent.trim().slice(0, 80),
   };
 }
+
+export interface WatermarkPattern {
+  image: string;
+  size: string;
+}
+
+export function createWatermarkPattern(
+  content: string,
+  density: WatermarkDensity,
+): WatermarkPattern {
+  const lines = wrapWatermarkContent(content);
+  const textWidth = Math.max(...lines.map(estimatedTextWidth));
+  const textHeight = lines.length * LINE_HEIGHT;
+  const rotatedWidth =
+    textWidth * Math.cos(ROTATION_RADIANS) +
+    textHeight * Math.sin(ROTATION_RADIANS);
+  const rotatedHeight =
+    textWidth * Math.sin(ROTATION_RADIANS) +
+    textHeight * Math.cos(ROTATION_RADIANS);
+  const gap = DENSITY_GAPS[density];
+  const width = Math.ceil(rotatedWidth + gap.horizontal);
+  const height = Math.ceil(rotatedHeight + gap.vertical);
+  const firstLineY = (height - textHeight) / 2 + FONT_SIZE;
+  const tspans = lines
+    .map(
+      (line, index) =>
+        `<tspan x="${width / 2}" y="${firstLineY + index * LINE_HEIGHT}">${escapeXml(line)}</tspan>`,
+    )
+    .join("");
+  const svg =
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${height}" viewBox="0 0 ${width} ${height}">` +
+    `<g transform="rotate(-22 ${width / 2} ${height / 2})">` +
+    `<text text-anchor="middle" font-family="system-ui,sans-serif" font-size="${FONT_SIZE}" font-weight="500" fill="black">${tspans}</text>` +
+    "</g></svg>";
+  return {
+    image: `url("data:image/svg+xml,${encodeURIComponent(svg)}")`,
+    size: `${width}px ${height}px`,
+  };
+}
+
+function wrapWatermarkContent(content: string): string[] {
+  const lines: string[] = [];
+  let current = "";
+  for (const character of content.trim()) {
+    const next = current + character;
+    if (current && textWeight(next) > MAX_LINE_WEIGHT) {
+      lines.push(current.trim());
+      current = character;
+    } else {
+      current = next;
+    }
+  }
+  if (current.trim()) lines.push(current.trim());
+  return lines.length > 0 ? lines : [""];
+}
+
+function estimatedTextWidth(value: string): number {
+  return Math.max(1, textWeight(value)) * (FONT_SIZE * 0.56);
+}
+
+function textWeight(value: string): number {
+  return [...value].reduce(
+    (total, character) =>
+      total + (/[\u2e80-\u9fff\uff00-\uffef]/u.test(character) ? 1.75 : 1),
+    0,
+  );
+}
+
+function escapeXml(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
+}