create-windy 0.2.32 → 0.2.34

package/template/apps/server/src/module-host/user-directory-port.test.ts

@@ -0,0 +1,238 @@
+import { describe, expect, test } from "bun:test";
+import { ModuleUserDirectoryError } from "@southwind-ai/server-sdk";
+import { buildScopeContext } from "../data-access/context.js";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor, RequestGuardContext } from "../guards.js";
+import { createServerRuntime } from "../runtime.js";
+import type { ManagedDepartment, ManagedUser } from "../system/entities.js";
+import { createSystemRepositories } from "../system/seed.js";
+import { createModuleUserDirectoryPort } from "./user-directory-port.js";
+
+describe("模块用户目录 Port", () => {
+  test("只返回启用用户最小投影，并在 Repository 查询中执行部门范围", async () => {
+    const fixture = await createFixture();
+    const page = await fixture.port.list({
+      page: 1,
+      pageSize: 10,
+      q: "案",
+      ...({ actorId: "forged", departmentId: "dept_other" } as object),
+    });
+
+    expect(page).toEqual({
+      items: [
+        {
+          id: "user_child",
+          displayName: "子部门办案员",
+        },
+      ],
+      total: 1,
+      page: 1,
+      pageSize: 10,
+    });
+    expect(Object.keys(page.items[0] ?? {}).sort()).toEqual([
+      "displayName",
+      "id",
+    ]);
+    expect(fixture.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "system.user-directory.query",
+        actor: expect.objectContaining({ id: "actor_manager" }),
+        metadata: expect.objectContaining({ resultCount: 1, total: 1 }),
+      }),
+    );
+  });
+
+  test("缺少权限或 Feature 停用时 fail closed 并记录拒绝", async () => {
+    const missingPermission = await createFixture({ permission: false });
+    await expect(missingPermission.port.list()).rejects.toMatchObject({
+      code: "USER_DIRECTORY_FORBIDDEN",
+    });
+    expect(missingPermission.runtime.auditSink.list()).toContainEqual(
+      expect.objectContaining({
+        action: "security.denied",
+        outcome: "denied",
+      }),
+    );
+
+    const disabledFeature = await createFixture({ featureEnabled: false });
+    await expect(disabledFeature.port.list()).rejects.toMatchObject({
+      code: "USER_DIRECTORY_FORBIDDEN",
+    });
+  });
+
+  test("拒绝越界分页与搜索 Schema", async () => {
+    const fixture = await createFixture();
+    for (const query of [
+      { page: 0 },
+      { pageSize: 101 },
+      { q: "x".repeat(101) },
+      { q: 23 } as never,
+    ]) {
+      await expect(fixture.port.list(query)).rejects.toBeInstanceOf(
+        ModuleUserDirectoryError,
+      );
+      await expect(fixture.port.list(query)).rejects.toMatchObject({
+        code: "USER_DIRECTORY_INVALID_QUERY",
+      });
+    }
+  });
+
+  test("V1 tenant、custom 与 self 均只读取宿主 nominal ScopeContext", async () => {
+    const tenant = await createFixture({ dataScope: "tenant" });
+    expect((await tenant.port.list({ q: "办案员" })).items).toHaveLength(2);
+
+    const custom = await createFixture({ dataScope: "custom" });
+    expect((await custom.port.list({ q: "办案员" })).items).toEqual([
+      { id: "user_child", displayName: "子部门办案员" },
+    ]);
+
+    const self = await createFixture({ dataScope: "self" });
+    expect((await self.port.list({ q: "办案员" })).items).toEqual([
+      { id: "user_child", displayName: "子部门办案员" },
+    ]);
+  });
+
+  test("缺少宿主 nominal ScopeContext 时拒绝，不回退全量目录", async () => {
+    const fixture = await createFixture({ dataScope: "missing" });
+    await expect(fixture.port.list()).rejects.toThrow("data-scope-denied");
+  });
+
+  test("生产关键审计不可持久化时不返回目录结果", async () => {
+    const fixture = await createFixture({ productionAudit: true });
+    await expect(fixture.port.list()).rejects.toThrow(
+      "关键审计事件无法持久化或进入恢复队列",
+    );
+  });
+});
+
+interface FixtureOptions {
+  permission?: boolean;
+  featureEnabled?: boolean;
+  dataScope?: DirectoryScope;
+  productionAudit?: boolean;
+}
+
+type DirectoryScope =
+  | "all"
+  | "tenant"
+  | "department-and-children"
+  | "custom"
+  | "self"
+  | "missing";
+
+async function createFixture(options: FixtureOptions = {}) {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  await seedDirectory(repositories);
+  const actor = directoryActor(
+    options.permission ?? true,
+    options.dataScope ?? "department-and-children",
+  );
+  const runtime = createServerRuntime(
+    options.productionAudit ? { NODE_ENV: "production" } : {},
+    {
+      featureCatalog: snapshot.features,
+      featureResolver: {
+        resolve: (key) => ({
+          key,
+          enabled: options.featureEnabled ?? true,
+          visible: "visible",
+        }),
+      },
+    },
+  );
+  const context: RequestGuardContext = {
+    requestId: "request-directory",
+    actor,
+    startedAt: "2026-07-25T00:00:00.000Z",
+  };
+  return {
+    runtime,
+    port: createModuleUserDirectoryPort(
+      { repositories, runtime, features: snapshot.features },
+      context,
+    ),
+  };
+}
+
+async function seedDirectory(
+  repositories: ReturnType<typeof createSystemRepositories>,
+) {
+  const system = directoryActor(true, "all");
+  for (const departmentInput of [
+    department("dept_root", "业务部门"),
+    department("dept_child", "子部门", "dept_root"),
+    department("dept_other", "其它部门"),
+  ]) {
+    await repositories.departments.create(departmentInput, system);
+  }
+  for (const userInput of [
+    user("user_root", "根部门用户", "dept_root"),
+    user("user_child", "子部门办案员", "dept_child"),
+    user("user_other", "其它办案员", "dept_other"),
+    user("user_disabled", "停用办案员", "dept_child", "disabled"),
+  ]) {
+    await repositories.users.create(userInput, system);
+  }
+}
+
+function directoryActor(
+  permission: boolean,
+  scope: DirectoryScope = "department-and-children",
+): RequestActor {
+  const actorId = scope === "self" ? "user_child" : "actor_manager";
+  const role =
+    scope === "custom"
+      ? {
+          id: "role",
+          code: "role",
+          dataScope: "custom" as const,
+          departmentIds: ["dept_child"],
+        }
+      : {
+          id: "role",
+          code: "role",
+          dataScope: scope === "missing" ? ("self" as const) : scope,
+          departmentIds: [],
+        };
+  return {
+    id: scope === "all" ? "system_seed" : actorId,
+    type: "user",
+    name: "部门负责人",
+    roleCodes: ["department-manager"],
+    permissionKeys: permission ? ["system.user-directory.read"] : [],
+    ...(scope === "missing"
+      ? {}
+      : {
+          scopeContext: buildScopeContext(
+            scope === "all" ? "system_seed" : actorId,
+            scope === "all" || scope === "tenant" ? undefined : "dept_root",
+            [role],
+          ),
+        }),
+  };
+}
+
+function department(
+  id: string,
+  name: string,
+  parentId?: string,
+): Partial<ManagedDepartment> {
+  return { id, name, code: id, order: 10, status: "active", parentId };
+}
+
+function user(
+  id: string,
+  displayName: string,
+  departmentId: string,
+  status: ManagedUser["status"] = "active",
+): Partial<ManagedUser> {
+  return {
+    id,
+    username: id,
+    displayName,
+    departmentId,
+    roleIds: [],
+    status,
+  };
+}

package/template/apps/server/src/module-host/user-directory-port.ts

@@ -0,0 +1,143 @@
+import { randomUUIDv7 } from "bun";
+import {
+  ModuleUserDirectoryError,
+  type ModuleUserDirectoryPage,
+  type ModuleUserDirectoryPort,
+  type ModuleUserDirectoryQuery,
+} from "@southwind-ai/server-sdk";
+import type { AuditEvent, FeatureFlagDefinition } from "@southwind-ai/shared";
+import { DataScopedResourceService } from "../data-access/scoped-resource.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import type { RequestGuardContext } from "../guards.js";
+import { evaluateRouteGuards, findFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { SystemRepositories } from "../system/seed.js";
+
+const featureKey = "system.user-directory";
+const permissionKey = "system.user-directory.read";
+const auditAction = "system.user-directory.query";
+
+type ServerRuntime = ReturnType<typeof createServerRuntime>;
+
+export interface ModuleUserDirectoryServices {
+  readonly repositories: Pick<SystemRepositories, "users" | "departments">;
+  readonly runtime: ServerRuntime;
+  readonly features: readonly FeatureFlagDefinition[];
+}
+
+export function createModuleUserDirectoryPort(
+  services: ModuleUserDirectoryServices,
+  context: RequestGuardContext,
+): ModuleUserDirectoryPort {
+  const feature = findFeature([...services.features], featureKey);
+  const access = new DataScopedResourceService(
+    services.repositories.users,
+    departmentDescendantResolver(services.repositories.departments),
+  );
+  return {
+    async list(rawQuery = {}) {
+      if (!feature) {
+        throw new ModuleUserDirectoryError(
+          "USER_DIRECTORY_UNAVAILABLE",
+          `宿主未注册 Feature：${featureKey}`,
+        );
+      }
+      const decision = await evaluateRouteGuards(services.runtime, context, {
+        permission: {
+          method: "GET",
+          path: "/internal/module-user-directory",
+          permissionKey,
+        },
+        feature,
+      });
+      if (!decision.allowed) {
+        throw new ModuleUserDirectoryError(
+          "USER_DIRECTORY_FORBIDDEN",
+          `用户目录访问被拒绝：${decision.reason}`,
+        );
+      }
+      const query = normalizeQuery(rawQuery);
+      const page = await access.list(
+        {
+          page: query.page,
+          pageSize: query.pageSize,
+          q: query.q,
+          status: "active",
+          sort: [{ field: "displayName", order: "asc" }],
+        },
+        ["displayName", "username"],
+        context.actor,
+      );
+      const result: ModuleUserDirectoryPage = {
+        items: page.items.map((user) => ({
+          id: user.id,
+          displayName:
+            user.displayName?.trim() || user.username || "未命名用户",
+        })),
+        total: page.total,
+        page: page.page,
+        pageSize: page.pageSize,
+      };
+      await services.runtime.auditSink.recordCriticalEvent(
+        queryAuditEvent(context, result),
+      );
+      return result;
+    },
+  };
+}
+
+function normalizeQuery(
+  query: ModuleUserDirectoryQuery,
+): Required<Pick<ModuleUserDirectoryQuery, "page" | "pageSize">> &
+  Pick<ModuleUserDirectoryQuery, "q"> {
+  const page = positiveInteger(query.page ?? 1, "page", 10_000);
+  const pageSize = positiveInteger(query.pageSize ?? 20, "pageSize", 100);
+  if (query.q !== undefined && typeof query.q !== "string") {
+    invalidQuery("q 必须是字符串");
+  }
+  const q = query.q?.trim();
+  if (q && q.length > 100) {
+    invalidQuery("q 最多 100 个字符");
+  }
+  return { page, pageSize, ...(q ? { q } : {}) };
+}
+
+function positiveInteger(
+  value: number,
+  field: string,
+  maximum: number,
+): number {
+  if (!Number.isInteger(value) || value < 1 || value > maximum) {
+    invalidQuery(`${field} 必须是 1-${maximum} 的整数`);
+  }
+  return value;
+}
+
+function invalidQuery(message: string): never {
+  throw new ModuleUserDirectoryError("USER_DIRECTORY_INVALID_QUERY", message);
+}
+
+function queryAuditEvent(
+  context: RequestGuardContext,
+  result: ModuleUserDirectoryPage,
+): AuditEvent {
+  return {
+    id: randomUUIDv7(),
+    action: auditAction,
+    outcome: "success",
+    actor: {
+      id: context.actor.id,
+      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
+      name: context.actor.name,
+    },
+    target: { type: "system.user-directory", id: "enabled-users" },
+    requestId: context.requestId,
+    metadata: {
+      page: result.page,
+      pageSize: result.pageSize,
+      resultCount: result.items.length,
+      total: result.total,
+    },
+    occurredAt: new Date().toISOString(),
+  };
+}

package/template/apps/server/src/module-host.ts

@@ -33,6 +33,10 @@ export {
   type ModuleStorageScope,
   type ModuleStorageServices,
 } from "./module-host/storage-port.js";
+export {
+  createModuleUserDirectoryPort,
+  type ModuleUserDirectoryServices,
+} from "./module-host/user-directory-port.js";
 // @windy-module system.scheduler begin
 export { createModuleTaskDefinitions } from "./module-host/task-definitions.js";
 // @windy-module system.scheduler end

package/template/apps/server/src/runtime-development.ts

@@ -25,6 +25,7 @@ export function developmentAdminActor(): RequestActor {
       "system.menu.read",
       "system.user.read",
       "system.user.manage",
+      "system.user-directory.read",
       "system.role.read",
       "system.role.manage",
       "system.department.read",

package/template/apps/server/src/settings/drizzle-watermark-repository.integration.test.ts

@@ -39,6 +39,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
       {
         enabled: true,
         businessPagesEnabled: true,
+        density: "high",
+        contentFields: ["username", "phone"],
         customContent: "内部资料",
       },
       "user_settings",
@@ -51,6 +53,8 @@ describePostgres("PostgreSQL watermark policy repository", () => {
     expect(await restarted.get()).toEqual({
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "phone"],
       customContent: "内部资料",
     });
   });

package/template/apps/server/src/settings/drizzle-watermark-repository.ts

@@ -38,6 +38,8 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
         set: {
           enabled: policy.enabled,
           businessPagesEnabled: policy.businessPagesEnabled,
+          density: policy.density,
+          contentFields: policy.contentFields,
           customContent: policy.customContent,
           updatedAt: new Date(),
           updatedBy: actorId,
@@ -52,11 +54,15 @@ export class DrizzleWatermarkPolicyRepository implements WatermarkPolicyReposito
 function toPolicy(row: {
   enabled: boolean;
   businessPagesEnabled: boolean;
+  density: PlatformWatermarkPolicy["density"];
+  contentFields: PlatformWatermarkPolicy["contentFields"];
   customContent: string;
 }): PlatformWatermarkPolicy {
   return {
     enabled: row.enabled,
     businessPagesEnabled: row.businessPagesEnabled,
+    density: row.density,
+    contentFields: row.contentFields,
     customContent: row.customContent,
   };
 }

package/template/apps/server/src/settings/watermark-routes.test.ts

@@ -43,7 +43,9 @@ describe("平台水印策略路由", () => {
 
     expect(policy).toEqual({
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     });
   });
@@ -53,6 +55,8 @@ describe("平台水印策略路由", () => {
     const input: PlatformWatermarkPolicy = {
       enabled: true,
       businessPagesEnabled: true,
+      density: "high",
+      contentFields: ["username", "phone", "custom"],
       customContent: "内部资料",
     };
 
@@ -79,7 +83,7 @@ describe("平台水印策略路由", () => {
           action: "config.update",
           target: { type: "platform-watermark", id: "platform" },
           metadata: expect.objectContaining({
-            changedFields: ["businessPagesEnabled", "customContent"],
+            changedFields: ["density", "contentFields", "customContent"],
           }),
         }),
       ]),
@@ -97,6 +101,8 @@ describe("平台水印策略路由", () => {
     const denied = (await update(fixture, {
       enabled: false,
       businessPagesEnabled: false,
+      density: "low",
+      contentFields: ["username"],
       customContent: "",
     })) as Response;
 
@@ -130,13 +136,17 @@ describe("平台水印策略路由", () => {
     const response = (await update(fixture, {
       enabled: true,
       businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username"],
       customContent: "x".repeat(81),
     })) as Response;
 
     expect(response.status).toBe(400);
     expect(await fixture.repository.get()).toEqual({
       enabled: true,
-      businessPagesEnabled: false,
+      businessPagesEnabled: true,
+      density: "medium",
+      contentFields: ["username", "displayName"],
       customContent: "",
     });
     expect(fixture.runtime.auditSink.list()).toHaveLength(0);

package/template/apps/server/src/settings/watermark-routes.ts

@@ -3,6 +3,10 @@ import type {
   FeatureFlagDefinition,
   PlatformWatermarkPolicy,
 } from "@southwind-ai/shared";
+import {
+  WATERMARK_CONTENT_FIELDS,
+  WATERMARK_DENSITIES,
+} from "@southwind-ai/shared";
 import { evaluateRouteGuards, findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import { resourceEvent, routeContext } from "../system/route-helpers.js";
@@ -108,15 +112,43 @@ function parseWatermarkPolicy(body: unknown): WatermarkParseResult {
   if (typeof source.customContent !== "string") {
     return { ok: false, message: "自定义内容必须是字符串" };
   }
+  if (
+    typeof source.density !== "string" ||
+    !WATERMARK_DENSITIES.includes(
+      source.density as (typeof WATERMARK_DENSITIES)[number],
+    )
+  ) {
+    return { ok: false, message: "水印密度无效" };
+  }
+  if (
+    !Array.isArray(source.contentFields) ||
+    source.contentFields.length === 0 ||
+    !source.contentFields.every(
+      (field) =>
+        typeof field === "string" &&
+        WATERMARK_CONTENT_FIELDS.includes(
+          field as (typeof WATERMARK_CONTENT_FIELDS)[number],
+        ),
+    )
+  ) {
+    return { ok: false, message: "请至少选择一项有效的水印内容" };
+  }
   const customContent = source.customContent.trim();
   if (customContent.length > 80) {
     return { ok: false, message: "自定义内容不能超过 80 个字符" };
   }
+  const contentFields = [
+    ...new Set(
+      source.contentFields as PlatformWatermarkPolicy["contentFields"],
+    ),
+  ];
   return {
     ok: true,
     value: {
       enabled: source.enabled,
       businessPagesEnabled: source.businessPagesEnabled,
+      density: source.density as PlatformWatermarkPolicy["density"],
+      contentFields,
       customContent,
     },
   };
@@ -126,9 +158,15 @@ function changedFields(
   before: PlatformWatermarkPolicy,
   after: PlatformWatermarkPolicy,
 ): string[] {
-  return ["enabled", "businessPagesEnabled", "customContent"].filter(
+  return [
+    "enabled",
+    "businessPagesEnabled",
+    "density",
+    "contentFields",
+    "customContent",
+  ].filter(
     (field) =>
-      before[field as keyof PlatformWatermarkPolicy] !==
-      after[field as keyof PlatformWatermarkPolicy],
+      JSON.stringify(before[field as keyof PlatformWatermarkPolicy]) !==
+      JSON.stringify(after[field as keyof PlatformWatermarkPolicy]),
   );
 }

package/template/apps/server/src/system/built-in-roles.ts

@@ -34,6 +34,7 @@ export function createBuiltInRoleSeeds(
     ...ordinaryPermissions,
     "system.department.read",
     "system.user.read",
+    "system.user-directory.read",
   ].sort();
   return [
     role(

package/template/apps/web/src/app/auth/login-page.ts

@@ -0,0 +1,4 @@
+import PlatformLoginPage from "@/pages/auth/LoginPage.vue";
+import { defineLoginPageComponent } from "@/pages/auth/login-page-extension";
+
+export const loginPageComponent = defineLoginPageComponent(PlatformLoginPage);

package/template/apps/web/src/composables/useLoginFlow.webtest.ts

@@ -0,0 +1,91 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  auth: {
+    error: { value: "" },
+    login: vi.fn(),
+    phase: { value: "anonymous" },
+  },
+  replace: vi.fn(),
+  resetAccessSnapshot: vi.fn(),
+  // @windy-module system.license begin
+  resetLicenseRuntime: vi.fn(),
+  // @windy-module system.license end
+  resetSessionContext: vi.fn(),
+  returnTo: "/admin?tab=active#top" as unknown,
+}));
+
+vi.mock("vue-router", () => ({
+  useRoute: () => ({ query: { returnTo: mocks.returnTo } }),
+  useRouter: () => ({ replace: mocks.replace }),
+}));
+vi.mock("@/composables/useAccessSnapshot", () => ({
+  resetAccessSnapshot: mocks.resetAccessSnapshot,
+}));
+vi.mock("@/composables/useAuthSession", () => ({
+  useAuthSession: () => mocks.auth,
+}));
+// @windy-module system.license begin
+vi.mock("@/composables/useLicenseRuntime", () => ({
+  resetLicenseRuntime: mocks.resetLicenseRuntime,
+}));
+// @windy-module system.license end
+vi.mock("@/composables/useSessionContext", () => ({
+  resetSessionContext: mocks.resetSessionContext,
+}));
+
+import { useLoginFlow } from "./useLoginFlow";
+
+describe("登录流程扩展契约", () => {
+  beforeEach(() => {
+    mocks.auth.error.value = "";
+    mocks.auth.phase.value = "anonymous";
+    mocks.auth.login.mockReset();
+    mocks.replace.mockReset();
+    mocks.resetAccessSnapshot.mockReset();
+    // @windy-module system.license begin
+    mocks.resetLicenseRuntime.mockReset();
+    // @windy-module system.license end
+    mocks.resetSessionContext.mockReset();
+    mocks.returnTo = "/admin?tab=active#top";
+  });
+
+  test("成功登录后重置会话派生状态并进入安全 returnTo", async () => {
+    mocks.auth.login.mockResolvedValue(undefined);
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "secret-password" });
+
+    expect(mocks.auth.login).toHaveBeenCalledWith({
+      username: "admin",
+      password: "secret-password",
+    });
+    expect(mocks.resetAccessSnapshot).toHaveBeenCalledOnce();
+    // @windy-module system.license begin
+    expect(mocks.resetLicenseRuntime).toHaveBeenCalledOnce();
+    // @windy-module system.license end
+    expect(mocks.resetSessionContext).toHaveBeenCalledOnce();
+    expect(mocks.replace).toHaveBeenCalledWith("/admin?tab=active#top");
+  });
+
+  test("业务登录页不能借 returnTo 跳转到站外", async () => {
+    mocks.returnTo = "https://evil.example/phishing";
+    mocks.auth.login.mockResolvedValue(undefined);
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "secret-password" });
+
+    expect(mocks.replace).toHaveBeenCalledWith("/");
+  });
+
+  test("认证失败保留当前页面并暴露服务端错误", async () => {
+    mocks.auth.error.value = "用户名或密码错误";
+    mocks.auth.login.mockRejectedValue(new Error("unauthorized"));
+    const flow = useLoginFlow();
+
+    await flow.submit({ username: "admin", password: "wrong-password" });
+
+    expect(flow.submitError.value).toBe("用户名或密码错误");
+    expect(mocks.replace).not.toHaveBeenCalled();
+  });
+});