create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/system/role-department-scope-policy.ts

@@ -0,0 +1,55 @@
+import type { ManagedDepartment, ManagedRole } from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+import type {
+  ResourcePolicyError,
+  ResourcePolicyResult,
+} from "./route-types.js";
+
+export class RoleDepartmentScopePolicy {
+  constructor(
+    private readonly departments: EntityRepository<ManagedDepartment>,
+  ) {}
+
+  async validate(
+    input: Partial<ManagedRole>,
+    current?: ManagedRole,
+  ): Promise<ResourcePolicyResult> {
+    const dataScope = input.dataScope ?? current?.dataScope;
+    const departmentIds = input.departmentIds ?? current?.departmentIds ?? [];
+    if (dataScope === "custom" && departmentIds.length === 0) {
+      return invalid(
+        "CUSTOM_DEPARTMENT_SCOPE_REQUIRED",
+        "自定义部门数据权限至少需要选择一个启用部门",
+      );
+    }
+    if (input.departmentIds === undefined && dataScope !== "custom") {
+      return undefined;
+    }
+    if (!Array.isArray(departmentIds) || departmentIds.some((id) => !id)) {
+      return invalid(
+        "INVALID_ROLE_DEPARTMENT_SCOPE",
+        "角色自定义部门范围必须是非空部门 ID 数组",
+      );
+    }
+    const departments = new Map(
+      (await this.departments.all()).map((item) => [item.id, item]),
+    );
+    const invalidIds = unique(departmentIds).filter(
+      (id) => departments.get(id)?.status !== "active",
+    );
+    return invalidIds.length
+      ? invalid(
+          "INVALID_ROLE_DEPARTMENT_SCOPE",
+          `角色数据权限引用了不存在或未启用的部门：${invalidIds.join(", ")}`,
+        )
+      : undefined;
+  }
+}
+
+function invalid(error: string, message: string): ResourcePolicyError {
+  return { error, message };
+}
+
+function unique(values: string[]): string[] {
+  return [...new Set(values)].sort();
+}

package/template/apps/server/src/system/route-helpers.ts

@@ -1,6 +1,7 @@
 import { randomUUIDv7 } from "bun";
 import type { AuditEvent, LifecycleStatus } from "@southwind-ai/shared";
 import type { RequestGuardContext } from "../guards.js";
+import { auditActor } from "../guards.js";
 import type { ManagedEntity } from "./entities.js";
 import { parsePagination } from "../pagination.js";
 
@@ -88,11 +89,7 @@ export function resourceEvent(
     id: randomUUIDv7(),
     action,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: {
       type: resourceName,
       id,

package/template/apps/server/src/system/route-types.ts

@@ -5,6 +5,14 @@ import type { ScopedResourceAccess } from "../data-access/scoped-resource.js";
 import type { RequestActor } from "../guards.js";
 import type { MutationRunner } from "./mutation-runner.js";
 
+export interface ResourcePolicyError {
+  error: string;
+  message: string;
+  details?: Record<string, unknown>;
+}
+
+export type ResourcePolicyResult = string | ResourcePolicyError | undefined;
+
 export interface RouteApp {
   get(path: string, handler: (context: unknown) => unknown): unknown;
   post(
@@ -33,16 +41,17 @@ export interface ResourceRouteConfig<T extends ManagedEntity> {
   validateInput?: (
     input: Partial<T>,
     current?: T,
-  ) => MaybePromise<string | undefined>;
+  ) => MaybePromise<ResourcePolicyResult>;
   dataAccess:
     | { readonly mode: "platform" }
     | { readonly mode: "request"; readonly access: ScopedResourceAccess<T> };
   projectResponse?: (entity: T) => Record<string, unknown>;
+  beforeCreate?: (input: Partial<T>) => MaybePromise<ResourcePolicyResult>;
   beforeUpdate?: (
     current: T,
     input: Partial<T>,
-  ) => MaybePromise<string | undefined>;
-  beforeDelete?: (current: T) => MaybePromise<string | undefined>;
+  ) => MaybePromise<ResourcePolicyResult>;
+  beforeDelete?: (current: T) => MaybePromise<ResourcePolicyResult>;
   afterUpdate?: (
     current: T,
     updated: T,

package/template/apps/server/src/system/routes-validation.test.ts

@@ -41,6 +41,32 @@ describe("system route query validation", () => {
       error: "INVALID_AUDIT_TIME_RANGE",
     });
   });
+
+  test("审计日志拒绝反向时间范围和过长关键字", async () => {
+    const fixture = await createFixture("/api/system/audit-logs");
+    const reversed = (await fixture.app.invoke("GET", "/system/audit-logs", {
+      guardContext: fixture.guardContext,
+      params: {},
+      query: {
+        occurredAfter: "2026-07-20T09:16:00.000Z",
+        occurredBefore: "2026-07-20T09:15:59.999Z",
+      },
+    })) as Response;
+    expect(reversed.status).toBe(400);
+    await expect(reversed.json()).resolves.toMatchObject({
+      error: "INVALID_AUDIT_TIME_RANGE",
+    });
+
+    const tooLong = (await fixture.app.invoke("GET", "/system/audit-logs", {
+      guardContext: fixture.guardContext,
+      params: {},
+      query: { q: "审".repeat(121) },
+    })) as Response;
+    expect(tooLong.status).toBe(400);
+    await expect(tooLong.json()).resolves.toMatchObject({
+      error: "INVALID_AUDIT_QUERY",
+    });
+  });
   // @windy-module system.audit end
 });
 

package/template/apps/server/src/system/routes.test.ts

@@ -223,7 +223,11 @@ describe("system routes", () => {
       guardContext,
       params: {},
       query: {},
-      body: { code: "dept-security", name: "安全部" },
+      body: {
+        code: "dept-security",
+        name: "安全部",
+        parentId: "dept_platform",
+      },
     });
 
     expect(policies).toEqual(["critical", "ordinary"]);
@@ -255,7 +259,11 @@ describe("system routes", () => {
         guardContext,
         params: {},
         query: {},
-        body: { code: "dept-available", name: "可用部门" },
+        body: {
+          code: "dept-available",
+          name: "可用部门",
+          parentId: "dept_platform",
+        },
       }),
     ).resolves.toMatchObject({ code: "dept-available" });
     await Bun.sleep(0);

package/template/apps/server/src/system/routes.ts

@@ -5,7 +5,10 @@ import { findSystemFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { ManagedEntity } from "./entities.js";
 import { registerMenuRoutes } from "./menu-routes.js";
-import { registerDepartmentQuickCreateRoute } from "./department-routes.js";
+import {
+  registerDepartmentQuickCreateRoute,
+  registerDepartmentTransitionRoute,
+} from "./department-routes.js";
 import {
   asPartial,
   notFound,
@@ -40,6 +43,7 @@ import {
 import { registerUserPlaintextRoutes } from "../data-governance/user-plaintext-routes.js";
 // @windy-module system.data-governance end
 import { searchAuditEvent } from "../audit/search-summary.js";
+import { DepartmentOrganizationPolicy } from "./department-organization.js";
 
 export type { RouteApp } from "./route-types.js";
 
@@ -57,6 +61,7 @@ export function registerSystemRoutes(
     features,
     options.authRepository,
   );
+  const departmentPolicy = new DepartmentOrganizationPolicy(repositories);
   // @windy-module system.data-governance begin
   registerUserPlaintextRoutes(app, identity.users, runtime);
   // @windy-module system.data-governance end
@@ -66,18 +71,37 @@ export function registerSystemRoutes(
     repositories.departments,
     runtime,
     findSystemFeature(features, "department"),
+    departmentPolicy,
+    repositories.organizationMutationRunner,
+  );
+  registerDepartmentTransitionRoute(
+    app,
+    departmentPolicy,
+    repositories.organizationMutationRunner,
+    runtime,
+    findSystemFeature(features, "department"),
   );
   registerResourceRoutes(app, identity.roles, runtime);
   registerResourceRoutes(
     app,
-    resource(
-      "departments",
-      "department",
-      repositories.departments,
-      features,
-      ["code", "name"],
-      { mode: "platform" },
-    ),
+    {
+      ...resource(
+        "departments",
+        "department",
+        repositories.departments,
+        features,
+        ["code", "name"],
+        { mode: "platform" },
+      ),
+      importable: false,
+      mutationRunner: repositories.organizationMutationRunner,
+      validateInput: (input, current) =>
+        departmentPolicy.validateInput(input, current),
+      beforeCreate: (input) => departmentPolicy.beforeCreate(input),
+      beforeUpdate: (current, input) =>
+        departmentPolicy.beforeUpdate(current, input),
+      beforeDelete: (current) => departmentPolicy.beforeDelete(current),
+    },
     runtime,
   );
   registerMenuRoutes(
@@ -245,28 +269,26 @@ function registerResourceRoutes<T extends ManagedEntity>(
       config.permissionResource,
       "manage",
       config.feature,
-      async () => {
-        const input = asPartial<T>(body);
-        const validationError = await config.validateInput?.(input);
-        if (validationError) {
-          return Response.json(
-            { error: "INVALID_RESOURCE", message: validationError },
-            { status: 400 },
+      async () =>
+        runResourceMutation(config, async () => {
+          const input = asPartial<T>(body);
+          const validationError = await config.validateInput?.(input);
+          if (validationError) return invalidResource(validationError);
+          const policyError = await config.beforeCreate?.(input);
+          if (policyError) return resourceConflict(policyError);
+          const item = await accessCall(() =>
+            config.dataAccess.mode === "request"
+              ? config.dataAccess.access.create(input, guardContext.actor)
+              : config.repository.create(input, guardContext.actor),
           );
-        }
-        const item = await accessCall(() =>
-          config.dataAccess.mode === "request"
-            ? config.dataAccess.access.create(input, guardContext.actor)
-            : config.repository.create(input, guardContext.actor),
-        );
-        if (item instanceof Response) return item;
-        await recordMutationAudit(
-          runtime,
-          config.path,
-          resourceEvent(guardContext, "crud.create", config.path, item.id),
-        );
-        return projectEntity(config, item);
-      },
+          if (item instanceof Response) return item;
+          await recordMutationAudit(
+            runtime,
+            config.path,
+            resourceEvent(guardContext, "crud.create", config.path, item.id),
+          );
+          return projectEntity(config, item);
+        }),
     );
   });
 
@@ -287,12 +309,7 @@ function registerResourceRoutes<T extends ManagedEntity>(
           if (current instanceof Response) return current;
           if (!current) return notFound(config.path, id);
           const validationError = await config.validateInput?.(input, current);
-          if (validationError) {
-            return Response.json(
-              { error: "INVALID_RESOURCE", message: validationError },
-              { status: 400 },
-            );
-          }
+          if (validationError) return invalidResource(validationError);
           const policyError = await config.beforeUpdate?.(current, input);
           if (policyError) return resourceConflict(policyError);
           const item = await accessCall(() =>
@@ -352,3 +369,20 @@ function registerResourceRoutes<T extends ManagedEntity>(
     );
   });
 }
+
+function invalidResource(
+  error: NonNullable<
+    Awaited<
+      ReturnType<
+        NonNullable<ResourceRouteConfig<ManagedEntity>["validateInput"]>
+      >
+    >
+  >,
+): Response {
+  return Response.json(
+    typeof error === "string"
+      ? { error: "INVALID_RESOURCE", message: error }
+      : error,
+    { status: 400 },
+  );
+}

package/template/apps/server/src/system/seed.ts

@@ -26,6 +26,10 @@ import type {
   ManagedUser,
 } from "./entities.js";
 import { userDataScopeBinding } from "./user-data-scope.js";
+import {
+  SerialMutationRunner,
+  type MutationRunner,
+} from "./mutation-runner.js";
 
 export interface SystemRepositories {
   users: ScopedEntityRepository<ManagedUser>;
@@ -38,6 +42,7 @@ export interface SystemRepositories {
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
   menuRegistry: ManifestMenuRegistry;
+  organizationMutationRunner: MutationRunner;
 }
 
 export interface CreateSystemRepositoryOptions {
@@ -53,6 +58,7 @@ export function createSystemRepositories(
     const repositories = createDrizzleSystemRepositories(options.db, seeds);
     return {
       ...repositories,
+      organizationMutationRunner: repositories.organizationMutationRunner,
       menuRegistry: new ManifestMenuRegistry(
         repositories.menus,
         snapshot.menus,
@@ -81,6 +87,7 @@ export function createSystemRepositories(
   };
   return {
     ...repositories,
+    organizationMutationRunner: new SerialMutationRunner(),
     menuRegistry: new ManifestMenuRegistry(repositories.menus, snapshot.menus),
   };
 }

package/template/apps/server/src/work-order/data-scope.integration.test.ts

@@ -47,12 +47,19 @@ describePostgres("PostgreSQL Work Order data-scope enforcement", () => {
       features: [],
       licenses: [],
     });
-    await repositories.departments.create(department("dept_a"), setupActor);
+    await repositories.departments.create(department("org_root"), setupActor);
+    await repositories.departments.create(
+      department("dept_a", "org_root"),
+      setupActor,
+    );
     await repositories.departments.create(
       department("dept_a_child", "dept_a"),
       setupActor,
     );
-    await repositories.departments.create(department("dept_b"), setupActor);
+    await repositories.departments.create(
+      department("dept_b", "org_root"),
+      setupActor,
+    );
     const workOrders = createDrizzleWorkOrderRepository(database);
     await workOrders.create(
       ticket("ticket_self", "user_a", "dept_a"),

package/template/apps/server/src/work-order/opensearch-index.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import type { WorkOrder } from "@southwind-ai/example-work-order";
+import { createWorkOrderOpenSearchIndex } from "./opensearch-index.js";
+
+describe("工单 OpenSearch 可重建索引", () => {
+  test("同步业务事实后把 dataScope 编译进 OpenSearch 查询", async () => {
+    const requests: Request[] = [];
+    const fetcher = async (
+      input: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      const request = new Request(input, init);
+      requests.push(request);
+      if (request.method === "HEAD") return new Response(null, { status: 404 });
+      if (request.url.endsWith("/_bulk?refresh=wait_for")) {
+        return Response.json({ errors: false });
+      }
+      if (request.url.endsWith("/_search")) {
+        return Response.json({
+          hits: {
+            hits: [
+              {
+                _id: "ticket_1",
+                _score: 3,
+                sort: [3, "2026-07-26T00:00:00.000Z", "ticket_1"],
+              },
+            ],
+          },
+        });
+      }
+      return Response.json({});
+    };
+    const index = createWorkOrderOpenSearchIndex(
+      { OPENSEARCH_URL: "http://opensearch:9200" },
+      fetcher,
+    )!;
+
+    await index.synchronize(async () => [workOrder()]);
+    const result = await index.search("网络", 1, undefined, {
+      actorId: "user_1",
+      branches: [{ kind: "owner", ownerId: "user_1" }],
+    });
+
+    expect(result.hits).toEqual([{ id: "ticket_1", score: 3 }]);
+    expect(result.nextCursor).toBeString();
+    const searchRequest = requests.find(({ url }) => url.endsWith("/_search"));
+    const body = (await searchRequest?.json()) as {
+      query: { bool: { filter: unknown[] } };
+    };
+    expect(JSON.stringify(body.query.bool.filter)).toContain(
+      '"ownerId":"user_1"',
+    );
+    expect(
+      requests.find(({ url }) => url.endsWith("/_bulk?refresh=wait_for")),
+    ).toBeDefined();
+  });
+
+  test("无范围授权时使用 match_none", async () => {
+    let searchBody = "";
+    const index = createWorkOrderOpenSearchIndex(
+      { OPENSEARCH_URL: "http://opensearch:9200" },
+      async (input, init) => {
+        const request = new Request(input, init);
+        if (request.method === "HEAD")
+          return new Response(null, { status: 200 });
+        if (request.url.endsWith("/_search")) {
+          searchBody = await request.text();
+          return Response.json({ hits: { hits: [] } });
+        }
+        return Response.json({});
+      },
+    )!;
+    await index.synchronize(async () => []);
+    await index.search("工单", 5, undefined, {
+      actorId: "user_none",
+      branches: [],
+    });
+    expect(searchBody).toContain('"match_none"');
+  });
+});
+
+function workOrder(): WorkOrder {
+  return {
+    id: "ticket_1",
+    title: "办公网络中断",
+    description: "网络连接不稳定",
+    priority: "high",
+    workflowStatus: "open",
+    ownerId: "user_1",
+    departmentId: "dept_1",
+    status: "active",
+    createdAt: "2026-07-26T00:00:00.000Z",
+    createdBy: "user_1",
+    updatedAt: "2026-07-26T00:00:00.000Z",
+    updatedBy: "user_1",
+  };
+}