create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/search/opensearch-client.ts

@@ -0,0 +1,145 @@
+export interface OpenSearchClientConfig {
+  url: string;
+  username?: string;
+  password?: string;
+  requestTimeoutMs: number;
+}
+
+export interface OpenSearchHealth {
+  status: "green" | "yellow" | "red";
+}
+
+export type OpenSearchFetcher = (
+  input: string | URL | Request,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export class OpenSearchClient {
+  private readonly baseUrl: URL;
+  private readonly authorization?: string;
+
+  constructor(
+    private readonly config: OpenSearchClientConfig,
+    private readonly fetcher: OpenSearchFetcher = fetch,
+  ) {
+    this.baseUrl = parseBaseUrl(config.url);
+    if (Boolean(config.username) !== Boolean(config.password)) {
+      throw new Error(
+        "OPENSEARCH_USERNAME 与 OPENSEARCH_PASSWORD 必须同时配置",
+      );
+    }
+    this.authorization = config.username
+      ? `Basic ${btoa(`${config.username}:${config.password}`)}`
+      : undefined;
+  }
+
+  async request<T>(
+    method: string,
+    path: string,
+    body: unknown,
+    signal?: AbortSignal,
+    contentType = "application/json",
+  ): Promise<T> {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(
+      () => controller.abort(),
+      this.config.requestTimeoutMs,
+    );
+    try {
+      const headers = new Headers({ accept: "application/json" });
+      if (body !== undefined) headers.set("content-type", contentType);
+      if (this.authorization) headers.set("authorization", this.authorization);
+      const response = await this.fetcher(new URL(path, this.baseUrl), {
+        method,
+        headers,
+        body:
+          body === undefined
+            ? undefined
+            : typeof body === "string"
+              ? body
+              : JSON.stringify(body),
+        signal: controller.signal,
+      });
+      if (!response.ok) {
+        throw new OpenSearchRequestError(response.status);
+      }
+      if (response.status === 204 || method === "HEAD") return undefined as T;
+      return response.json() as Promise<T>;
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+    }
+  }
+
+  health(signal?: AbortSignal) {
+    return this.request<OpenSearchHealth>(
+      "GET",
+      "/_cluster/health?local=true",
+      undefined,
+      signal,
+    );
+  }
+}
+
+export class OpenSearchRequestError extends Error {
+  constructor(readonly status: number) {
+    super(`OpenSearch 请求失败（HTTP ${status}）`);
+    this.name = "OpenSearchRequestError";
+  }
+}
+
+export function readOpenSearchConfig(
+  environment: Record<string, string | undefined>,
+): OpenSearchClientConfig | undefined {
+  const url = environment.OPENSEARCH_URL?.trim();
+  if (!url) return undefined;
+  return {
+    url,
+    username: optional(environment.OPENSEARCH_USERNAME),
+    password: optional(environment.OPENSEARCH_PASSWORD),
+    requestTimeoutMs: boundedInteger(
+      "OPENSEARCH_REQUEST_TIMEOUT_MS",
+      environment.OPENSEARCH_REQUEST_TIMEOUT_MS,
+      100,
+      30_000,
+      3_000,
+    ),
+  };
+}
+
+function parseBaseUrl(value: string): URL {
+  const url = new URL(value);
+  if (
+    !["http:", "https:"].includes(url.protocol) ||
+    url.username ||
+    url.password ||
+    (url.pathname !== "/" && url.pathname !== "") ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error("OPENSEARCH_URL 必须是不含凭据、路径和参数的 HTTP(S) 地址");
+  }
+  return url;
+}
+
+function optional(value: string | undefined): string | undefined {
+  return value?.trim() || undefined;
+}
+
+function boundedInteger(
+  name: string,
+  value: string | undefined,
+  minimum: number,
+  maximum: number,
+  fallback: number,
+): number {
+  if (value === undefined) return fallback;
+  if (!/^\d+$/.test(value)) throw new Error(`${name} 必须是整数`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {
+    throw new Error(`${name} 必须位于 ${minimum}-${maximum}`);
+  }
+  return parsed;
+}

package/template/apps/server/src/search/service.ts

@@ -3,7 +3,7 @@ import type { ModuleManifest } from "@southwind-ai/modules";
 import type { AuditEvent } from "@southwind-ai/shared";
 import { evaluateAccessGuards } from "../access-guards.js";
 import { isServerScopeContext } from "../data-access/context.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import { decodeSearchCursor, encodeSearchCursor } from "./cursor.js";
 import { SearchProtocolError } from "./errors.js";
@@ -232,11 +232,7 @@ function searchEvent(
     id: randomUUIDv7(),
     action,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: "search-provider" },
     requestId: context.requestId,
     metadata,

package/template/apps/server/src/settings/routes.ts

@@ -22,15 +22,27 @@ export function registerBrandingSettingsRoutes(
   repository: BrandingSettingsRepository,
   runtime: ServerRuntime,
   features: FeatureFlagDefinition[],
+  runtimeSettings: () => Pick<
+    PlatformBrandingSettings,
+    "timeZone"
+  > = () => ({}),
 ): void {
   const feature = findFeature(features, "system.settings");
 
-  app.get("/platform/branding", () => repository.get());
+  app.get("/platform/branding", async () => ({
+    ...(await repository.get()),
+    ...runtimeSettings(),
+  }));
 
   app.get("/system/settings/branding", async (rawContext) => {
     const { guardContext } = routeContext(rawContext);
     const denied = await guard(runtime, guardContext, READ_BINDING, feature);
-    return denied || repository.get();
+    return (
+      denied || {
+        ...(await repository.get()),
+        ...runtimeSettings(),
+      }
+    );
   });
 
   app.put("/system/settings/branding", async (rawContext) => {
@@ -61,7 +73,7 @@ export function registerBrandingSettingsRoutes(
         { changedFields: changedFields(parsed.value) },
       ),
     );
-    return updated;
+    return { ...updated, ...runtimeSettings() };
   });
 }
 

package/template/apps/server/src/settings/runtime.ts

@@ -16,6 +16,9 @@ import { registerWatermarkPolicyRoutes } from "./watermark-routes.js";
 export function createPlatformSettingsRuntime(
   db: NodePgDatabase | undefined,
   defaults: PlatformBrandingSettings,
+  runtimeSettings: () => Pick<PlatformBrandingSettings, "timeZone"> = () => ({
+    timeZone: defaults.timeZone,
+  }),
 ) {
   const branding = db
     ? new DrizzleBrandingSettingsRepository(db, defaults)
@@ -33,7 +36,13 @@ export function createPlatformSettingsRuntime(
       server: ReturnType<typeof createServerRuntime>,
       features: FeatureFlagDefinition[],
     ) {
-      registerBrandingSettingsRoutes(app, branding, server, features);
+      registerBrandingSettingsRoutes(
+        app,
+        branding,
+        server,
+        features,
+        runtimeSettings,
+      );
       registerWatermarkPolicyRoutes(app, watermark, server, features);
     },
   };

package/template/apps/server/src/storage/runtime.ts

@@ -1,4 +1,5 @@
 import { resolve } from "node:path";
+import type { PlatformConfig } from "@southwind-ai/config";
 import {
   FileService,
   InMemoryUploadRepository,
@@ -47,6 +48,18 @@ export const platformUploadPolicies: UploadPolicy[] = [
   },
 ];
 
+export function createPlatformUploadPolicies(
+  config: Pick<PlatformConfig, "storage">,
+): UploadPolicy[] {
+  return platformUploadPolicies.map((policy) => ({
+    ...policy,
+    maxByteSize:
+      policy.purpose === "bulk-data"
+        ? config.storage.bulkDataMaxByteSize
+        : config.storage.brandingLogoMaxByteSize,
+  }));
+}
+
 export function createStorageRuntime(
   env: Record<string, string | undefined>,
   db?: NodePgDatabase,

package/template/apps/server/src/system/audit-query.ts

@@ -1,9 +1,21 @@
-export function validateAuditTimeRange(
-  query: Record<string, string | undefined>,
-) {
+const ISO_TIME =
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+export const MAX_AUDIT_QUERY_LENGTH = 120;
+
+export function validateAuditQuery(query: Record<string, string | undefined>) {
+  const normalizedQuery = normalizeAuditKeyword(query.q);
+  if (normalizedQuery && normalizedQuery.length > MAX_AUDIT_QUERY_LENGTH) {
+    return Response.json(
+      {
+        error: "INVALID_AUDIT_QUERY",
+        message: `q 最多 ${MAX_AUDIT_QUERY_LENGTH} 个字符。`,
+      },
+      { status: 400 },
+    );
+  }
   for (const key of ["occurredAfter", "occurredBefore"] as const) {
     const value = query[key];
-    if (value && Number.isNaN(Date.parse(value))) {
+    if (value && (!ISO_TIME.test(value) || Number.isNaN(Date.parse(value)))) {
       return Response.json(
         {
           error: "INVALID_AUDIT_TIME_RANGE",
@@ -13,5 +25,22 @@ export function validateAuditTimeRange(
       );
     }
   }
+  if (
+    query.occurredAfter &&
+    query.occurredBefore &&
+    Date.parse(query.occurredAfter) > Date.parse(query.occurredBefore)
+  ) {
+    return Response.json(
+      {
+        error: "INVALID_AUDIT_TIME_RANGE",
+        message: "occurredAfter 不能晚于 occurredBefore。",
+      },
+      { status: 400 },
+    );
+  }
   return undefined;
 }
+
+export function normalizeAuditKeyword(value: string | undefined) {
+  return value?.normalize("NFKC").trim().replace(/\s+/g, " ") || undefined;
+}

package/template/apps/server/src/system/audit-routes.test.ts

@@ -1,9 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
-import {
-  createServerRuntime,
-  type AuditEventListQuery,
-} from "../runtime.js";
+import { createServerRuntime, type AuditEventListQuery } from "../runtime.js";
 import { FakeRouteApp } from "./route-test-app.js";
 import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
@@ -73,9 +70,11 @@ describe("audit routes", () => {
       params: {},
       query: {
         pageSize: "5",
+        q: "  审计员  ",
         actorId: "user_1",
         resource: "users",
         occurredAfter: "2026-07-01T00:00:00.000Z",
+        occurredBefore: "2026-07-31T23:59:59.999Z",
       },
     })) as { total: number; pageSize: number; items: Array<{ id: string }> };
 
@@ -83,11 +82,66 @@ describe("audit routes", () => {
     expect(result.pageSize).toBe(5);
     expect(result.items[0]?.id).toBe("audit_from_db");
     expect(receivedAuditQuery).toMatchObject({
+      q: "审计员",
       occurredAfter: "2026-07-01T00:00:00.000Z",
+      occurredBefore: "2026-07-31T23:59:59.999Z",
       includeScheduler: false,
     });
   });
 
+  test("列表与导出原样使用关键字、操作者、动作和分钟范围", async () => {
+    const received: AuditEventListQuery[] = [];
+    const runtime = createServerRuntime(
+      { WINDY_DEV_ADMIN_TOKEN: "token_1" },
+      {
+        auditReader: {
+          async list(query) {
+            received.push(query);
+            return {
+              items: [],
+              total: 0,
+              page: query.page,
+              pageSize: query.pageSize,
+            };
+          },
+        },
+      },
+    );
+    const app = new FakeRouteApp();
+    registerSystemRoutes(
+      app,
+      createSystemRepositories(createFoundationSnapshot()),
+      runtime,
+    );
+    const guardContext = await runtime.createGuardContext(
+      new Request("http://localhost/api/system/audit-logs", {
+        headers: { authorization: "Bearer token_1" },
+      }),
+    );
+    const filters = {
+      q: "案件甲",
+      actorId: "user_1",
+      action: "case.review",
+      occurredAfter: "2026-07-20T01:15:00.000Z",
+      occurredBefore: "2026-07-20T01:20:59.999Z",
+    };
+
+    await app.invoke("GET", "/system/audit-logs", {
+      guardContext,
+      params: {},
+      query: filters,
+    });
+    await app.invoke("GET", "/system/audit-logs/export", {
+      guardContext,
+      params: {},
+      query: { ...filters, includeScheduler: "true" },
+    });
+
+    expect(received).toHaveLength(2);
+    expect(received[0]).toMatchObject({ ...filters, includeScheduler: false });
+    expect(received[1]).toMatchObject({ ...filters, includeScheduler: true });
+  });
+
   test("列表固定排除调度器，导出可显式包含", async () => {
     const { app, runtime, guardContext } = await auditFixture();
     const event = {

package/template/apps/server/src/system/audit-routes.ts

@@ -5,7 +5,7 @@ import { parsePagination } from "../pagination.js";
 import { resourceEvent, routeContext } from "./route-helpers.js";
 import type { RouteApp } from "./route-types.js";
 import { withPermission } from "./resource-route-support.js";
-import { validateAuditTimeRange } from "./audit-query.js";
+import { normalizeAuditKeyword, validateAuditQuery } from "./audit-query.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -27,8 +27,8 @@ export function registerAuditRoutes(
       async () => {
         const pagination = parsePagination(query);
         if (pagination instanceof Response) return pagination;
-        const invalidTimeRange = validateAuditTimeRange(query);
-        if (invalidTimeRange) return invalidTimeRange;
+        const invalidQuery = validateAuditQuery(query);
+        if (invalidQuery) return invalidQuery;
         return runtime.listAuditEvents({
           ...pagination,
           ...auditFilters(query),
@@ -48,8 +48,8 @@ export function registerAuditRoutes(
       "read",
       feature,
       async () => {
-        const invalidTimeRange = validateAuditTimeRange(query);
-        if (invalidTimeRange) return invalidTimeRange;
+        const invalidQuery = validateAuditQuery(query);
+        if (invalidQuery) return invalidQuery;
         const includeScheduler = query.includeScheduler === "true";
         const items = await listAll(runtime, {
           ...auditFilters(query),
@@ -82,6 +82,7 @@ export function registerAuditRoutes(
 
 function auditFilters(query: Record<string, string | undefined>) {
   return {
+    q: normalizeAuditKeyword(query.q),
     actorId: query.actorId,
     action: query.action,
     resource: query.resource,

package/template/apps/server/src/system/built-in-roles.ts

@@ -34,6 +34,7 @@ export function createBuiltInRoleSeeds(
     ...ordinaryPermissions,
     "system.department.read",
     "system.user.read",
+    "system.user-directory.read",
   ].sort();
   return [
     role(