create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/system/department-routes.ts

@@ -6,6 +6,11 @@ import type { ManagedDepartment } from "./entities.js";
 import { forbidden, resourceEvent, routeContext } from "./route-helpers.js";
 import type { EntityRepository } from "./repository.js";
 import type { RouteApp } from "./route-types.js";
+import type { MutationRunner } from "./mutation-runner.js";
+import {
+  DepartmentOrganizationPolicy,
+  type DepartmentTransitionAction,
+} from "./department-organization.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
@@ -14,6 +19,8 @@ export function registerDepartmentQuickCreateRoute(
   departments: EntityRepository<ManagedDepartment>,
   runtime: ServerRuntime,
   feature?: FeatureFlagDefinition,
+  policy?: DepartmentOrganizationPolicy,
+  mutationRunner?: MutationRunner,
 ): void {
   app.post("/system/departments/quick", async (rawContext) => {
     const { guardContext, body } = routeContext(rawContext);
@@ -28,36 +35,22 @@ export function registerDepartmentQuickCreateRoute(
     if (!decision.allowed) return forbidden(decision.reason);
     const parsed = parseDepartment(body);
     if (parsed instanceof Response) return parsed;
-    const duplicate = (await departments.all()).find(
-      (department) => department.code === parsed.code,
-    );
-    if (duplicate) {
-      return Response.json(
-        { error: "DUPLICATE_DEPARTMENT_CODE", message: "部门编码已存在" },
-        { status: 409 },
-      );
-    }
-    if (parsed.parentId) {
-      const parent = await departments.get(parsed.parentId);
-      if (!parent || parent.status !== "active") {
-        return Response.json(
-          {
-            error: "INVALID_DEPARTMENT_PARENT",
-            message: "上级部门不存在或已停用",
-          },
-          { status: 400 },
-        );
+    const create = async () => {
+      const policyError = await policy?.beforeCreate(parsed);
+      if (policyError) {
+        return Response.json(policyError, { status: 409 });
       }
-    }
-    const item = await departments.create(parsed, guardContext.actor);
-    await recordMutationAudit(
-      runtime,
-      "departments",
-      resourceEvent(guardContext, "crud.create", "departments", item.id, {
-        source: "user-form-shortcut",
-      }),
-    );
-    return item;
+      const item = await departments.create(parsed, guardContext.actor);
+      await recordMutationAudit(
+        runtime,
+        "departments",
+        resourceEvent(guardContext, "crud.create", "departments", item.id, {
+          source: "user-form-shortcut",
+        }),
+      );
+      return item;
+    };
+    return mutationRunner ? mutationRunner.run(create) : create();
   });
 }
 
@@ -75,16 +68,104 @@ function parseDepartment(body: unknown): Partial<ManagedDepartment> | Response {
       { status: 400 },
     );
   }
+  const parentId =
+    typeof value.parentId === "string" && value.parentId
+      ? value.parentId
+      : undefined;
+  if (!parentId) {
+    return Response.json(
+      {
+        error: "DEPARTMENT_PARENT_REQUIRED",
+        message: "平台只允许一个根组织，新部门必须选择上级部门",
+      },
+      { status: 400 },
+    );
+  }
   return {
     code,
     name,
-    parentId:
-      typeof value.parentId === "string" && value.parentId
-        ? value.parentId
-        : undefined,
+    parentId,
     order:
       typeof value.order === "number" && Number.isFinite(value.order)
         ? value.order
         : 100,
   };
 }
+
+export function registerDepartmentTransitionRoute(
+  app: RouteApp,
+  policy: DepartmentOrganizationPolicy,
+  mutationRunner: MutationRunner,
+  runtime: ServerRuntime,
+  feature?: FeatureFlagDefinition,
+): void {
+  app.post("/system/departments/:id/transition", async (rawContext) => {
+    const { guardContext, params, body } = routeContext(rawContext);
+    const decision = await evaluateRouteGuards(runtime, guardContext, {
+      permission: {
+        method: "POST",
+        path: "/api/system/departments/:id/transition",
+        permissionKey: "system.department.manage",
+      },
+      feature,
+    });
+    if (!decision.allowed) return forbidden(decision.reason);
+    const parsed = parseTransition(body);
+    if (parsed instanceof Response) return parsed;
+    return mutationRunner.run(async () => {
+      const result = await policy.transition(
+        String(params.id || ""),
+        parsed.action,
+        parsed.targetDepartmentId,
+        guardContext.actor,
+      );
+      if ("error" in result) {
+        return Response.json(result, { status: 409 });
+      }
+      await recordMutationAudit(
+        runtime,
+        "departments",
+        resourceEvent(
+          guardContext,
+          "organization.department.transition",
+          "departments",
+          result.department.id,
+          {
+            action: parsed.action,
+            targetDepartmentId: parsed.targetDepartmentId,
+            movedChildren: result.movedChildren,
+            movedUsers: result.movedUsers,
+            updatedRoles: result.updatedRoles,
+          },
+        ),
+      );
+      return result;
+    });
+  });
+}
+
+function parseTransition(body: unknown):
+  | {
+      action: DepartmentTransitionAction;
+      targetDepartmentId?: string;
+    }
+  | Response {
+  const value =
+    body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  if (value.action !== "disable" && value.action !== "delete") {
+    return Response.json(
+      {
+        error: "INVALID_DEPARTMENT_TRANSITION",
+        message: "部门处置动作只能是 disable 或 delete",
+      },
+      { status: 400 },
+    );
+  }
+  return {
+    action: value.action,
+    targetDepartmentId:
+      typeof value.targetDepartmentId === "string" && value.targetDepartmentId
+        ? value.targetDepartmentId
+        : undefined,
+  };
+}

package/template/apps/server/src/system/drizzle-repository.ts

@@ -21,6 +21,7 @@ import type {
   EntityListQuery,
   EntityRepository,
 } from "./repository.js";
+import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
 
 type DbTable = unknown;
 
@@ -40,6 +41,7 @@ export class DrizzleEntityRepository<
   constructor(
     protected readonly db: NodePgDatabase,
     protected readonly config: DrizzleEntityRepositoryConfig<T>,
+    private readonly transactionContext?: DrizzleTransactionContext,
   ) {}
 
   async list(
@@ -99,7 +101,9 @@ export class DrizzleEntityRepository<
       updatedAt: now,
       updatedBy: actor.id,
     } as T;
-    await this.db.insert(this.table()).values(this.config.toRow(entity));
+    await this.database()
+      .insert(this.table())
+      .values(this.config.toRow(entity));
     return entity;
   }
 
@@ -119,7 +123,7 @@ export class DrizzleEntityRepository<
       updatedAt: new Date().toISOString(),
       updatedBy: actor.id,
     } as T;
-    await this.db
+    await this.database()
       .update(this.table())
       .set(this.config.toRow(entity))
       .where(eq(this.idColumn(), id));
@@ -133,7 +137,7 @@ export class DrizzleEntityRepository<
     if (updates.length === 0) return [];
     await this.ensureSeeded();
     const ids = updates.map(({ id }) => id);
-    const rows = await this.db
+    const rows = await this.database()
       .select()
       .from(this.table())
       .where(inArray(this.idColumn(), ids));
@@ -154,7 +158,7 @@ export class DrizzleEntityRepository<
       updatedAt: now,
       updatedBy: actor.id,
     })) as T[];
-    await this.db.transaction(async (transaction) => {
+    await this.database().transaction(async (transaction) => {
       for (const entity of entities) {
         await transaction
           .update(this.table())
@@ -221,7 +225,7 @@ export class DrizzleEntityRepository<
     if (items.length === 0) {
       return;
     }
-    await this.db
+    await this.database()
       .insert(this.table())
       .values(items.map((item) => this.config.toRow(item)))
       .onConflictDoNothing();
@@ -255,7 +259,7 @@ export class DrizzleEntityRepository<
     offset?: number,
   ) {
     const orderBy = this.orderBy(sort);
-    let query = this.db.select().from(this.table()).$dynamic();
+    let query = this.database().select().from(this.table()).$dynamic();
     if (where) query = query.where(where);
     if (orderBy.length) query = query.orderBy(...orderBy);
     if (limit) query = query.limit(limit);
@@ -266,7 +270,7 @@ export class DrizzleEntityRepository<
   protected countRows(
     where: SQL | undefined,
   ): Promise<Array<{ count: number }>> {
-    let query = this.db
+    let query = this.database()
       .select({ count: sql<number>`count(*)::int` })
       .from(this.table())
       .$dynamic();
@@ -295,4 +299,8 @@ export class DrizzleEntityRepository<
   protected table() {
     return this.config.table as never;
   }
+
+  protected database(): NodePgDatabase {
+    return this.transactionContext?.current(this.db) || this.db;
+  }
 }

package/template/apps/server/src/system/drizzle-scoped-repository.ts

@@ -19,6 +19,7 @@ import {
   type DrizzleEntityRepositoryConfig,
 } from "./drizzle-repository.js";
 import type { EntityImportResult, EntityListQuery } from "./repository.js";
+import type { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
 
 export interface DrizzleScopedEntityRepositoryConfig<
   T extends ManagedEntity,
@@ -38,8 +39,9 @@ export class DrizzleScopedEntityRepository<T extends ManagedEntity>
   constructor(
     db: NodePgDatabase,
     config: DrizzleScopedEntityRepositoryConfig<T>,
+    transactionContext?: DrizzleTransactionContext,
   ) {
-    super(db, config);
+    super(db, config, transactionContext);
   }
 
   async listScoped(
@@ -98,7 +100,7 @@ export class DrizzleScopedEntityRepository<T extends ManagedEntity>
   ): Promise<T[] | undefined> {
     if (ids.length === 0) return [];
     await this.ensureSeeded();
-    return this.db.transaction(
+    return this.database().transaction(
       async (transaction) => {
         await transaction.execute(sql`select 1`);
         await this.afterBatchSnapshotEstablished();
@@ -157,7 +159,7 @@ export class DrizzleScopedEntityRepository<T extends ManagedEntity>
       updatedBy: actor.id,
     } as T;
     assertEntityInDataScope(entity, scope, this.config.dataScope.entity);
-    const rows = (await this.db
+    const rows = (await this.database()
       .update(this.table())
       .set(this.config.toRow(entity))
       .where(this.idWhere(id, scope))

package/template/apps/server/src/system/drizzle-system.ts

@@ -44,6 +44,11 @@ import {
 import type { EntityRepository } from "./repository.js";
 import type { ScopedEntityRepository } from "../data-access/scoped-repository.js";
 import { userDataScopeBinding } from "./user-data-scope.js";
+import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
+import {
+  PostgresAdvisoryMutationRunner,
+  type MutationRunner,
+} from "./mutation-runner.js";
 
 export interface DrizzleSystemRepositorySeeds {
   users: ManagedUser[];
@@ -67,24 +72,43 @@ export interface DrizzleSystemRepositories {
   // @windy-module system.license begin
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
+  organizationMutationRunner: MutationRunner;
 }
 
 export function createDrizzleSystemRepositories(
   db: NodePgDatabase,
   seeds: DrizzleSystemRepositorySeeds,
 ): DrizzleSystemRepositories {
+  const transactionContext = new DrizzleTransactionContext();
   return {
-    users: new DrizzleScopedEntityRepository(db, userConfig(seeds.users)),
-    roles: repo(db, roleConfig(seeds.roles)),
-    departments: repo(db, departmentConfig(seeds.departments)),
-    menus: repo(db, menuConfig(seeds.menus)),
-    dictionaries: repo(db, dictionaryConfig(seeds.dictionaries)),
+    users: new DrizzleScopedEntityRepository(
+      db,
+      userConfig(seeds.users),
+      transactionContext,
+    ),
+    roles: repo(db, roleConfig(seeds.roles), transactionContext),
+    departments: repo(
+      db,
+      departmentConfig(seeds.departments),
+      transactionContext,
+    ),
+    menus: repo(db, menuConfig(seeds.menus), transactionContext),
+    dictionaries: repo(
+      db,
+      dictionaryConfig(seeds.dictionaries),
+      transactionContext,
+    ),
     features: new ManifestFeatureRepository(
-      repo(db, featureConfig(seeds.features)),
+      repo(db, featureConfig(seeds.features), transactionContext),
     ),
     // @windy-module system.license begin
-    licenses: repo(db, licenseConfig(seeds.licenses)),
+    licenses: repo(db, licenseConfig(seeds.licenses), transactionContext),
     // @windy-module system.license end
+    organizationMutationRunner: new PostgresAdvisoryMutationRunner(
+      db,
+      "windy:system:organization",
+      transactionContext,
+    ),
   };
 }
 
@@ -99,8 +123,12 @@ function repo<
     // @windy-module system.license begin
     | ManagedLicense,
   // @windy-module system.license end
->(db: NodePgDatabase, config: DrizzleEntityRepositoryConfig<T>) {
-  return new DrizzleEntityRepository<T>(db, config);
+>(
+  db: NodePgDatabase,
+  config: DrizzleEntityRepositoryConfig<T>,
+  transactionContext: DrizzleTransactionContext,
+) {
+  return new DrizzleEntityRepository<T>(db, config, transactionContext);
 }
 
 function userConfig(

package/template/apps/server/src/system/drizzle-transaction-context.ts

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+
+export class DrizzleTransactionContext {
+  private readonly storage = new AsyncLocalStorage<NodePgDatabase>();
+
+  current(fallback: NodePgDatabase): NodePgDatabase {
+    return this.storage.getStore() || fallback;
+  }
+
+  run<T>(database: NodePgDatabase, mutation: () => Promise<T>): Promise<T> {
+    return this.storage.run(database, mutation);
+  }
+}

package/template/apps/server/src/system/identity-route-config.ts

@@ -8,8 +8,8 @@ import type { ResourceRouteConfig } from "./route-types.js";
 import type { SystemRepositories } from "./seed.js";
 import { UserAccountPolicy } from "./user-account-policy.js";
 import { userDepartmentValidator } from "./user-department-validation.js";
-import { SerialMutationRunner } from "./mutation-runner.js";
 import { projectMaskedUser } from "./user-projection.js";
+import { RoleDepartmentScopePolicy } from "./role-department-scope-policy.js";
 
 export function identityRouteConfigs(
   repositories: SystemRepositories,
@@ -24,7 +24,10 @@ export function identityRouteConfigs(
     repositories.roles,
     authRepository,
   );
-  const mutationRunner = new SerialMutationRunner();
+  const roleDepartmentScope = new RoleDepartmentScopePolicy(
+    repositories.departments,
+  );
+  const mutationRunner = repositories.organizationMutationRunner;
   return {
     users: {
       ...resource(
@@ -65,6 +68,8 @@ export function identityRouteConfigs(
       ),
       beforeUpdate: (current, input) =>
         policy.protectRoleUpdate(current, input),
+      validateInput: (input, current) =>
+        roleDepartmentScope.validate(input, current),
       beforeDelete: (current) => policy.protectRoleDelete(current),
       importable: false,
       mutationRunner,

package/template/apps/server/src/system/mutation-runner.ts

@@ -1,5 +1,8 @@
+import { sql } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ManagedEntity } from "./entities.js";
 import type { ResourceRouteConfig } from "./route-types.js";
+import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
 
 export interface MutationRunner {
   run<T>(mutation: () => Promise<T>): Promise<T>;
@@ -23,6 +26,26 @@ export class SerialMutationRunner implements MutationRunner {
   }
 }
 
+export class PostgresAdvisoryMutationRunner implements MutationRunner {
+  constructor(
+    private readonly db: NodePgDatabase,
+    private readonly lockKey: string,
+    private readonly transactionContext: DrizzleTransactionContext,
+  ) {}
+
+  run<T>(mutation: () => Promise<T>): Promise<T> {
+    return this.db.transaction(async (transaction) => {
+      await transaction.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${this.lockKey}, 0))`,
+      );
+      return this.transactionContext.run(
+        transaction as unknown as NodePgDatabase,
+        mutation,
+      );
+    });
+  }
+}
+
 export function runResourceMutation<T extends ManagedEntity, R>(
   config: ResourceRouteConfig<T>,
   mutation: () => Promise<R>,

package/template/apps/server/src/system/organization-postgres.integration.test.ts

@@ -0,0 +1,176 @@
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor } from "../guards.js";
+import { DepartmentOrganizationPolicy } from "./department-organization.js";
+import { createSystemRepositories } from "./seed.js";
+import { userDepartmentValidator } from "./user-department-validation.js";
+
+const databaseUrl = process.env.ORGANIZATION_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL organization invariants", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    await migrate(drizzle(pool), {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__organization_test_migrations",
+    });
+  });
+
+  beforeEach(async () => {
+    await pool.query("truncate table users, roles, departments cascade");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("数据库约束拒绝并发创建第二个根组织", async () => {
+    const results = await Promise.allSettled([
+      insertRoot(pool, "root_a"),
+      insertRoot(pool, "root_b"),
+    ]);
+
+    expect(results.filter(({ status }) => status === "fulfilled")).toHaveLength(
+      1,
+    );
+    expect(
+      await pool.query(
+        "select count(*)::int as count from departments where parent_id is null and deleted_at is null",
+      ),
+    ).toMatchObject({ rows: [{ count: 1 }] });
+  });
+
+  test("跨 Server advisory lock 让并发互相移动只成功一次", async () => {
+    const left = repositories(pool);
+    const right = repositories(pool);
+    await left.departments.all();
+    await left.departments.create(department("dept_a", "dept_platform"), actor);
+    await left.departments.create(department("dept_b", "dept_platform"), actor);
+
+    const results = await Promise.all([
+      move(left, "dept_a", "dept_b"),
+      move(right, "dept_b", "dept_a"),
+    ]);
+    expect(results.filter((result) => result === "moved")).toHaveLength(1);
+    expect(
+      results.filter((result) => result === "DEPARTMENT_CYCLE"),
+    ).toHaveLength(1);
+  });
+
+  test("用户归属写入与部门停用并发后不会产生启用用户挂在停用部门", async () => {
+    const left = repositories(pool);
+    const right = repositories(pool);
+    await left.departments.all();
+    await left.departments.create(department("source", "dept_platform"), actor);
+    const policy = new DepartmentOrganizationPolicy(left);
+
+    const [transition, assignment] = await Promise.all([
+      left.organizationMutationRunner.run(() =>
+        policy.transition("source", "disable", undefined, actor),
+      ),
+      right.organizationMutationRunner.run(async () => {
+        const error = await userDepartmentValidator(right.departments)({
+          departmentId: "source",
+        });
+        if (error) return "rejected";
+        await right.users.create(
+          {
+            id: "user_source",
+            username: "source-user",
+            displayName: "来源用户",
+            departmentId: "source",
+            roleIds: [],
+          },
+          actor,
+        );
+        return "created";
+      }),
+    ]);
+
+    const source = await left.departments.get("source");
+    const user = await left.users.get("user_source");
+    if (source?.status === "disabled") {
+      expect(assignment).toBe("rejected");
+      expect(user).toBeUndefined();
+    } else {
+      expect(assignment).toBe("created");
+      expect(transition).toMatchObject({
+        error: "DEPARTMENT_MIGRATION_REQUIRED",
+      });
+      expect(user?.departmentId).toBe("source");
+    }
+  });
+});
+
+function repositories(pool: Pool) {
+  return createSystemRepositories(createFoundationSnapshot(), {
+    db: drizzle(pool),
+  });
+}
+
+async function move(
+  repositories: ReturnType<typeof createSystemRepositories>,
+  id: string,
+  parentId: string,
+) {
+  const policy = new DepartmentOrganizationPolicy(repositories);
+  return repositories.organizationMutationRunner.run(async () => {
+    const current = await repositories.departments.get(id);
+    if (!current) throw new Error(`missing ${id}`);
+    const conflict = await policy.beforeUpdate(current, { parentId });
+    if (conflict && typeof conflict !== "string") return conflict.error;
+    await repositories.departments.update(id, { parentId }, actor);
+    return "moved";
+  });
+}
+
+function department(id: string, parentId?: string) {
+  return {
+    id,
+    parentId,
+    code: id,
+    name: id,
+    order: 10,
+    status: "active" as const,
+  };
+}
+
+function insertRoot(pool: Pool, id: string) {
+  return pool.query(
+    `insert into departments (
+       id, name, code, "order", status,
+       created_at, created_by, updated_at, updated_by
+     ) values ($1, $1, $1, 10, 'active', now(), 'test', now(), 'test')`,
+    [id],
+  );
+}
+
+const actor: RequestActor = {
+  id: "organization-test",
+  type: "service",
+  name: "组织回归",
+  roleCodes: ["system"],
+  permissionKeys: [
+    "system.department.manage",
+    "system.user.manage",
+    "system.role.manage",
+  ],
+};

package/template/apps/server/src/system/resource-access-response.ts

@@ -2,13 +2,19 @@ import { DataAccessDeniedError } from "../data-access/scoped-resource.js";
 import { forbidden } from "./route-helpers.js";
 import type { RequestActor } from "../guards.js";
 import type { ManagedEntity } from "./entities.js";
-import type { ResourceRouteConfig } from "./route-types.js";
+import type {
+  ResourcePolicyResult,
+  ResourceRouteConfig,
+} from "./route-types.js";
 
-export function resourceConflict(message: string) {
-  return Response.json(
-    { error: "RESOURCE_POLICY_CONFLICT", message },
-    { status: 409 },
-  );
+export function resourceConflict(
+  conflict: Exclude<ResourcePolicyResult, undefined>,
+) {
+  const payload =
+    typeof conflict === "string"
+      ? { error: "RESOURCE_POLICY_CONFLICT", message: conflict }
+      : conflict;
+  return Response.json(payload, { status: 409 });
 }
 
 export function importNotSupported() {