create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/system/department-organization.ts

@@ -0,0 +1,320 @@
+import type { LifecycleStatus } from "@southwind-ai/shared";
+import type { RequestActor } from "../guards.js";
+import type {
+  ManagedDepartment,
+  ManagedRole,
+  ManagedUser,
+} from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+import type {
+  ResourcePolicyError,
+  ResourcePolicyResult,
+} from "./route-types.js";
+
+export type DepartmentTransitionAction = "disable" | "delete";
+
+export interface DepartmentTransitionResult {
+  department: ManagedDepartment;
+  movedChildren: number;
+  movedUsers: number;
+  updatedRoles: number;
+}
+
+interface OrganizationRepositories {
+  departments: EntityRepository<ManagedDepartment>;
+  users: EntityRepository<ManagedUser>;
+  roles: EntityRepository<ManagedRole>;
+}
+
+export class DepartmentOrganizationPolicy {
+  constructor(private readonly repositories: OrganizationRepositories) {}
+
+  async validateInput(
+    input: Partial<ManagedDepartment>,
+    current?: ManagedDepartment,
+  ): Promise<ResourcePolicyResult> {
+    if (
+      input.code !== undefined &&
+      (typeof input.code !== "string" ||
+        !/^[a-zA-Z][a-zA-Z0-9_-]{1,79}$/.test(input.code.trim()))
+    ) {
+      return invalid(
+        "INVALID_DEPARTMENT_CODE",
+        "部门编码需以字母开头且至少 2 位",
+      );
+    }
+    if (
+      input.name !== undefined &&
+      (typeof input.name !== "string" || !input.name.trim())
+    ) {
+      return invalid("INVALID_DEPARTMENT_NAME", "部门名称不能为空");
+    }
+    if (
+      input.order !== undefined &&
+      (!Number.isSafeInteger(input.order) || input.order < 0)
+    ) {
+      return invalid("INVALID_DEPARTMENT_ORDER", "部门排序必须是非负整数");
+    }
+    if (input.status !== undefined && !isLifecycleStatus(input.status)) {
+      return invalid("INVALID_DEPARTMENT_STATUS", "部门状态不合法");
+    }
+    if (
+      !current &&
+      (typeof input.code !== "string" ||
+        typeof input.name !== "string" ||
+        typeof input.parentId !== "string" ||
+        !input.parentId)
+    ) {
+      return invalid(
+        "DEPARTMENT_PARENT_REQUIRED",
+        "平台只允许一个根组织，新部门必须选择上级部门",
+      );
+    }
+    return undefined;
+  }
+
+  async beforeCreate(
+    input: Partial<ManagedDepartment>,
+  ): Promise<ResourcePolicyResult> {
+    const duplicate = (await this.repositories.departments.all()).find(
+      (department) => department.code === input.code?.trim(),
+    );
+    if (duplicate) {
+      return conflict("DUPLICATE_DEPARTMENT_CODE", "部门编码已存在");
+    }
+    return this.validateParent(undefined, input.parentId);
+  }
+
+  async beforeUpdate(
+    current: ManagedDepartment,
+    input: Partial<ManagedDepartment>,
+  ): Promise<ResourcePolicyResult> {
+    if (input.code && input.code !== current.code) {
+      const duplicate = (await this.repositories.departments.all()).find(
+        (department) =>
+          department.id !== current.id &&
+          department.code === input.code?.trim(),
+      );
+      if (duplicate) {
+        return conflict("DUPLICATE_DEPARTMENT_CODE", "部门编码已存在");
+      }
+    }
+    if (input.parentId !== undefined) {
+      const parentError = await this.validateParent(current, input.parentId);
+      if (parentError) return parentError;
+    }
+    if (
+      input.status !== undefined &&
+      input.status !== "active" &&
+      current.status === "active"
+    ) {
+      return this.validateCanLeaveActive(current);
+    }
+    if (input.status === "active") {
+      return this.validateParent(current, current.parentId);
+    }
+    return undefined;
+  }
+
+  beforeDelete(current: ManagedDepartment): Promise<ResourcePolicyResult> {
+    return this.validateCanLeaveActive(current);
+  }
+
+  async transition(
+    id: string,
+    action: DepartmentTransitionAction,
+    targetDepartmentId: string | undefined,
+    actor: RequestActor,
+  ): Promise<DepartmentTransitionResult | ResourcePolicyError> {
+    const source = await this.repositories.departments.get(id);
+    if (!source) {
+      return conflict("DEPARTMENT_NOT_FOUND", "部门不存在或已删除");
+    }
+    if (!source.parentId) {
+      return conflict("ROOT_DEPARTMENT_IMMUTABLE", "根组织不能停用或删除");
+    }
+    const references = await this.references(source.id);
+    const referenceCount =
+      references.children.length +
+      references.users.length +
+      references.roles.length;
+    let target: ManagedDepartment | undefined;
+    if (referenceCount > 0) {
+      if (!targetDepartmentId) {
+        return conflict(
+          "DEPARTMENT_MIGRATION_REQUIRED",
+          "部门仍有关联数据，请选择迁移目标后重试",
+          referenceDetails(references),
+        );
+      }
+      target = await this.repositories.departments.get(targetDepartmentId);
+      const targetError = await this.validateMigrationTarget(source, target);
+      if (targetError) return targetError;
+    } else if (targetDepartmentId) {
+      target = await this.repositories.departments.get(targetDepartmentId);
+      const targetError = await this.validateMigrationTarget(source, target);
+      if (targetError) return targetError;
+    }
+
+    if (target) {
+      await this.repositories.departments.updateMany(
+        references.children.map((child) => ({
+          id: child.id,
+          input: { parentId: target.id },
+        })),
+        actor,
+      );
+      await this.repositories.users.updateMany(
+        references.users.map((user) => ({
+          id: user.id,
+          input: { departmentId: target.id },
+        })),
+        actor,
+      );
+      await this.repositories.roles.updateMany(
+        references.roles.map((role) => ({
+          id: role.id,
+          input: {
+            departmentIds: unique(
+              (role.departmentIds || []).map((departmentId) =>
+                departmentId === source.id ? target.id : departmentId,
+              ),
+            ),
+          },
+        })),
+        actor,
+      );
+    }
+    const department =
+      action === "delete"
+        ? await this.repositories.departments.softDelete(source.id, actor)
+        : await this.repositories.departments.update(
+            source.id,
+            { status: "disabled" },
+            actor,
+          );
+    if (!department) {
+      return conflict("DEPARTMENT_NOT_FOUND", "部门不存在或已删除");
+    }
+    return {
+      department,
+      movedChildren: references.children.length,
+      movedUsers: references.users.length,
+      updatedRoles: references.roles.length,
+    };
+  }
+
+  private async validateParent(
+    current: ManagedDepartment | undefined,
+    parentId: string | undefined,
+  ): Promise<ResourcePolicyResult> {
+    if (current && !current.parentId) {
+      return parentId === undefined
+        ? undefined
+        : conflict("ROOT_DEPARTMENT_IMMUTABLE", "根组织不能迁移到其它部门");
+    }
+    if (!parentId) {
+      return conflict(
+        "DEPARTMENT_PARENT_REQUIRED",
+        "平台只允许一个根组织，部门必须保留上级部门",
+      );
+    }
+    const parent = await this.repositories.departments.get(parentId);
+    if (!parent || parent.status !== "active") {
+      return conflict("INVALID_DEPARTMENT_PARENT", "上级部门不存在或未启用");
+    }
+    if (!current) return undefined;
+    return (await this.isDescendant(parent.id, current.id))
+      ? conflict("DEPARTMENT_CYCLE", "不能把部门移动到自身或其下级部门")
+      : undefined;
+  }
+
+  private async validateCanLeaveActive(
+    current: ManagedDepartment,
+  ): Promise<ResourcePolicyResult> {
+    if (!current.parentId) {
+      return conflict("ROOT_DEPARTMENT_IMMUTABLE", "根组织不能停用或删除");
+    }
+    const references = await this.references(current.id);
+    return references.children.length ||
+      references.users.length ||
+      references.roles.length
+      ? conflict(
+          "DEPARTMENT_MIGRATION_REQUIRED",
+          "部门仍有关联数据，请通过组织迁移完成停用或删除",
+          referenceDetails(references),
+        )
+      : undefined;
+  }
+
+  private async validateMigrationTarget(
+    source: ManagedDepartment,
+    target: ManagedDepartment | undefined,
+  ): Promise<ResourcePolicyError | undefined> {
+    if (!target || target.status !== "active") {
+      return conflict("INVALID_MIGRATION_TARGET", "迁移目标不存在或未启用");
+    }
+    if (await this.isDescendant(target.id, source.id)) {
+      return conflict("DEPARTMENT_CYCLE", "迁移目标不能是当前部门或其下级部门");
+    }
+    return undefined;
+  }
+
+  private async isDescendant(
+    candidateId: string,
+    ancestorId: string,
+  ): Promise<boolean> {
+    if (candidateId === ancestorId) return true;
+    const departments = await this.repositories.departments.all();
+    const byId = new Map(departments.map((item) => [item.id, item]));
+    const visited = new Set<string>();
+    let current = byId.get(candidateId);
+    while (current?.parentId && !visited.has(current.id)) {
+      visited.add(current.id);
+      if (current.parentId === ancestorId) return true;
+      current = byId.get(current.parentId);
+    }
+    return false;
+  }
+
+  private async references(departmentId: string) {
+    const departments = await this.repositories.departments.all();
+    const users = await this.repositories.users.all();
+    const roles = await this.repositories.roles.all();
+    return {
+      children: departments.filter((item) => item.parentId === departmentId),
+      users: users.filter((item) => item.departmentId === departmentId),
+      roles: roles.filter((item) => item.departmentIds?.includes(departmentId)),
+    };
+  }
+}
+
+function referenceDetails(
+  references: Awaited<ReturnType<DepartmentOrganizationPolicy["references"]>>,
+): Record<string, unknown> {
+  return {
+    childDepartmentCount: references.children.length,
+    userCount: references.users.length,
+    roleCount: references.roles.length,
+  };
+}
+
+function invalid(error: string, message: string): ResourcePolicyError {
+  return { error, message };
+}
+
+function conflict(
+  error: string,
+  message: string,
+  details?: Record<string, unknown>,
+): ResourcePolicyError {
+  return { error, message, ...(details ? { details } : {}) };
+}
+
+function unique(values: string[]): string[] {
+  return [...new Set(values)].sort();
+}
+
+function isLifecycleStatus(value: unknown): value is LifecycleStatus {
+  return ["draft", "active", "disabled", "archived"].includes(String(value));
+}

package/template/apps/server/src/system/department-routes.test.ts

@@ -1,35 +1,33 @@
 import { describe, expect, test } from "bun:test";
 import { createFoundationSnapshot } from "../foundation.js";
 import { createServerRuntime } from "../runtime.js";
-import { registerSystemRoutes, type RouteApp } from "./routes.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import { registerSystemRoutes } from "./routes.js";
 import { createSystemRepositories } from "./seed.js";
 
-class FakeRouteApp implements RouteApp {
-  private readonly handlers = new Map<string, (context: unknown) => unknown>();
-
-  get(path: string, handler: (context: unknown) => unknown): void {
-    this.handlers.set(`GET ${path}`, handler);
-  }
-  post(path: string, handler: (context: unknown) => unknown): void {
-    this.handlers.set(`POST ${path}`, handler);
-  }
-  put(path: string, handler: (context: unknown) => unknown): void {
-    this.handlers.set(`PUT ${path}`, handler);
-  }
-  delete(path: string, handler: (context: unknown) => unknown): void {
-    this.handlers.set(`DELETE ${path}`, handler);
-  }
-  invoke(method: string, path: string, context: unknown): unknown {
-    const handler = this.handlers.get(`${method} ${path}`);
-    if (!handler) throw new Error(`未注册路由 ${method} ${path}`);
-    return handler(context);
-  }
+async function fixture() {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+  const app = new FakeRouteApp();
+  registerSystemRoutes(app, repositories, runtime, snapshot.features);
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/departments", {
+      headers: { authorization: "Bearer token_1" },
+    }),
+  );
+  return {
+    app,
+    repositories,
+    runtime,
+    context: { guardContext, params: {}, query: {} },
+  };
 }
 
-describe("部门归属路由", () => {
-  test("用户表单快捷创建部门并拒绝绑定不存在的部门", async () => {
+describe("部门组织路由", () => {
+  test("部门处置缺少权限时经过统一 Guard 拒绝", async () => {
     const snapshot = createFoundationSnapshot();
-    const runtime = createServerRuntime({ WINDY_DEV_ADMIN_TOKEN: "token_1" });
+    const runtime = createServerRuntime();
     const app = new FakeRouteApp();
     registerSystemRoutes(
       app,
@@ -38,43 +36,204 @@ describe("部门归属路由", () => {
       snapshot.features,
     );
     const guardContext = await runtime.createGuardContext(
-      new Request("http://localhost/api/system/users", {
-        headers: { authorization: "Bearer token_1" },
-      }),
+      new Request(
+        "http://localhost/api/system/departments/dept_platform/transition",
+      ),
     );
-    const context = { guardContext, params: {}, query: {} };
+    const response = (await app.invoke(
+      "POST",
+      "/system/departments/:id/transition",
+      {
+        guardContext,
+        params: { id: "dept_platform" },
+        query: {},
+        body: { action: "delete" },
+      },
+    )) as Response;
 
+    expect(response.status).toBe(403);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "FORBIDDEN",
+    });
+    expect(runtime.auditSink.list()[0]?.action).toBe("security.denied");
+  });
+
+  test("快捷创建必须挂到唯一根组织并拒绝第二个根", async () => {
+    const { app, context } = await fixture();
+    const missingParent = (await app.invoke(
+      "POST",
+      "/system/departments/quick",
+      {
+        ...context,
+        body: { code: "sales", name: "销售部" },
+      },
+    )) as Response;
     const department = (await app.invoke("POST", "/system/departments/quick", {
       ...context,
-      body: { code: "sales", name: "销售部" },
-    })) as { id: string; code: string };
-    const user = (await app.invoke("POST", "/system/users", {
+      body: {
+        code: "sales",
+        name: "销售部",
+        parentId: "dept_platform",
+      },
+    })) as { id: string; parentId: string };
+    const secondRoot = (await app.invoke("POST", "/system/departments", {
+      ...context,
+      body: { code: "root2", name: "第二根组织", order: 20 },
+    })) as Response;
+
+    expect(missingParent.status).toBe(400);
+    await expect(missingParent.json()).resolves.toMatchObject({
+      error: "DEPARTMENT_PARENT_REQUIRED",
+    });
+    expect(department.parentId).toBe("dept_platform");
+    expect(secondRoot.status).toBe(400);
+    await expect(secondRoot.json()).resolves.toMatchObject({
+      error: "DEPARTMENT_PARENT_REQUIRED",
+    });
+  });
+
+  test("移动部门会拒绝自身、下级和根组织变更", async () => {
+    const { app, context } = await fixture();
+    await createDepartment(app, context, "dept_a", "部门 A", "dept_platform");
+    await createDepartment(app, context, "dept_b", "部门 B", "dept_a");
+
+    const cycle = (await app.invoke("PUT", "/system/departments/:id", {
+      ...context,
+      params: { id: "dept_a" },
+      body: { parentId: "dept_b" },
+    })) as Response;
+    const rootMove = (await app.invoke("PUT", "/system/departments/:id", {
+      ...context,
+      params: { id: "dept_platform" },
+      body: { parentId: "dept_a" },
+    })) as Response;
+
+    expect(cycle.status).toBe(409);
+    await expect(cycle.json()).resolves.toMatchObject({
+      error: "DEPARTMENT_CYCLE",
+    });
+    expect(rootMove.status).toBe(409);
+    await expect(rootMove.json()).resolves.toMatchObject({
+      error: "ROOT_DEPARTMENT_IMMUTABLE",
+    });
+  });
+
+  test("有关联数据时要求显式迁移，并原子更新子级、用户和角色范围", async () => {
+    const { app, context, repositories, runtime } = await fixture();
+    await createDepartment(
+      app,
+      context,
+      "dept_source",
+      "待处置部门",
+      "dept_platform",
+    );
+    await createDepartment(
+      app,
+      context,
+      "dept_child",
+      "下级部门",
+      "dept_source",
+    );
+    await app.invoke("POST", "/system/roles", {
       ...context,
       body: {
-        username: "sales-user",
-        displayName: "销售用户",
-        roleIds: ["role_user"],
-        departmentId: department.id,
+        id: "role_custom",
+        code: "custom-scope",
+        name: "自定义范围",
+        dataScope: "custom",
+        departmentIds: ["dept_source"],
+        permissionKeys: [],
+        menuKeys: [],
       },
-    })) as { departmentId: string };
-    const invalid = (await app.invoke("POST", "/system/users", {
+    });
+    await app.invoke("POST", "/system/users", {
       ...context,
       body: {
-        username: "ghost-user",
-        displayName: "无部门用户",
-        roleIds: ["role_user"],
-        departmentId: "dept_missing",
+        id: "user_source",
+        username: "source-user",
+        displayName: "来源用户",
+        roleIds: ["role_custom"],
+        departmentId: "dept_source",
       },
+    });
+
+    const blocked = (await app.invoke("DELETE", "/system/departments/:id", {
+      ...context,
+      params: { id: "dept_source" },
     })) as Response;
+    expect(blocked.status).toBe(409);
+    await expect(blocked.json()).resolves.toMatchObject({
+      error: "DEPARTMENT_MIGRATION_REQUIRED",
+      details: {
+        childDepartmentCount: 1,
+        userCount: 1,
+        roleCount: 1,
+      },
+    });
 
-    expect(department.code).toBe("sales");
-    expect(user.departmentId).toBe(department.id);
-    expect(invalid.status).toBe(400);
-    await expect(invalid.json()).resolves.toMatchObject({
-      error: "INVALID_RESOURCE",
+    const transitioned = (await app.invoke(
+      "POST",
+      "/system/departments/:id/transition",
+      {
+        ...context,
+        params: { id: "dept_source" },
+        body: {
+          action: "delete",
+          targetDepartmentId: "dept_platform",
+        },
+      },
+    )) as {
+      movedChildren: number;
+      movedUsers: number;
+      updatedRoles: number;
+    };
+    expect(transitioned).toMatchObject({
+      movedChildren: 1,
+      movedUsers: 1,
+      updatedRoles: 1,
+    });
+    expect(await repositories.departments.get("dept_source")).toBeUndefined();
+    expect(await repositories.departments.get("dept_child")).toMatchObject({
+      parentId: "dept_platform",
     });
-    expect(runtime.auditSink.list().map(({ action }) => action)).toContain(
-      "crud.create",
+    expect(await repositories.users.get("user_source")).toMatchObject({
+      departmentId: "dept_platform",
+    });
+    expect(await repositories.roles.get("role_custom")).toMatchObject({
+      departmentIds: ["dept_platform"],
+    });
+    expect(runtime.auditSink.list().at(-1)?.action).toBe(
+      "organization.department.transition",
     );
   });
+
+  test("角色自定义数据权限只接受启用部门", async () => {
+    const { app, context } = await fixture();
+    const response = (await app.invoke("POST", "/system/roles", {
+      ...context,
+      body: {
+        code: "invalid-custom",
+        name: "无效范围",
+        dataScope: "custom",
+        departmentIds: ["dept_missing"],
+      },
+    })) as Response;
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "INVALID_ROLE_DEPARTMENT_SCOPE",
+    });
+  });
 });
+
+function createDepartment(
+  app: FakeRouteApp,
+  context: Record<string, unknown>,
+  id: string,
+  name: string,
+  parentId: string,
+) {
+  return app.invoke("POST", "/system/departments", {
+    ...context,
+    body: { id, code: id, name, parentId, order: 10 },
+  });
+}