create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/work-order/opensearch-index.ts

@@ -0,0 +1,313 @@
+import type { WorkOrder } from "@southwind-ai/example-work-order";
+import type { DataScopeQuerySpecification } from "../data-access/query-specification.js";
+import {
+  OpenSearchClient,
+  type OpenSearchFetcher,
+  OpenSearchRequestError,
+  readOpenSearchConfig,
+} from "../search/opensearch-client.js";
+
+interface SearchHit {
+  _id: string;
+  _score?: number;
+  sort?: Array<string | number>;
+}
+
+interface SearchResponse {
+  hits: { hits: SearchHit[] };
+}
+
+interface BulkResponse {
+  errors: boolean;
+}
+
+export interface WorkOrderIndexSearchResult {
+  hits: Array<{ id: string; score?: number }>;
+  nextCursor?: string;
+}
+
+export class WorkOrderOpenSearchIndex {
+  private synchronized = false;
+  private synchronizing?: Promise<void>;
+
+  constructor(
+    private readonly client: OpenSearchClient,
+    private readonly indexName: string,
+  ) {}
+
+  async synchronize(
+    snapshot: () => Promise<WorkOrder[]>,
+    signal?: AbortSignal,
+  ): Promise<void> {
+    if (this.synchronized) return;
+    if (!this.synchronizing) {
+      this.synchronizing = snapshot()
+        .then((items) => this.replaceAll(items, signal))
+        .then(() => {
+          this.synchronized = true;
+        })
+        .finally(() => {
+          this.synchronizing = undefined;
+        });
+    }
+    await this.synchronizing;
+  }
+
+  async upsert(item: WorkOrder): Promise<void> {
+    if (!this.synchronized) return;
+    try {
+      if (item.status !== "active") {
+        await this.remove(item.id);
+        return;
+      }
+      await this.ensureIndex();
+      await this.client.request(
+        "PUT",
+        `/${this.index()}/_doc/${encodeURIComponent(item.id)}?refresh=wait_for`,
+        document(item),
+      );
+    } catch (error) {
+      this.synchronized = false;
+      throw error;
+    }
+  }
+
+  async remove(id: string): Promise<void> {
+    if (!this.synchronized) return;
+    try {
+      await this.client.request(
+        "DELETE",
+        `/${this.index()}/_doc/${encodeURIComponent(id)}?refresh=wait_for`,
+        undefined,
+      );
+    } catch (error) {
+      if (!(error instanceof OpenSearchRequestError && error.status === 404)) {
+        this.synchronized = false;
+        throw error;
+      }
+    }
+  }
+
+  async search(
+    text: string,
+    limit: number,
+    cursor: string | undefined,
+    scope: DataScopeQuerySpecification,
+    signal?: AbortSignal,
+  ): Promise<WorkOrderIndexSearchResult> {
+    const response = await this.client.request<SearchResponse>(
+      "POST",
+      `/${this.index()}/_search`,
+      {
+        size: limit,
+        track_total_hits: false,
+        ...(cursor ? { search_after: decodeCursor(cursor) } : {}),
+        sort: [{ _score: "desc" }, { updatedAt: "desc" }, { _id: "asc" }],
+        query: {
+          bool: {
+            must: [
+              {
+                bool: {
+                  should: [
+                    {
+                      multi_match: {
+                        query: text,
+                        fields: ["title^2", "description"],
+                      },
+                    },
+                    {
+                      wildcard: {
+                        "title.raw": {
+                          value: `*${escapeWildcard(text)}*`,
+                          case_insensitive: true,
+                          boost: 2,
+                        },
+                      },
+                    },
+                    {
+                      wildcard: {
+                        "description.raw": {
+                          value: `*${escapeWildcard(text)}*`,
+                          case_insensitive: true,
+                        },
+                      },
+                    },
+                  ],
+                  minimum_should_match: 1,
+                },
+              },
+            ],
+            filter: [{ term: { status: "active" } }, scopeFilter(scope)],
+          },
+        },
+      },
+      signal,
+    );
+    const hits = response.hits.hits;
+    const last = hits.at(-1)?.sort;
+    return {
+      hits: hits.map((hit) => ({
+        id: hit._id,
+        ...(hit._score !== undefined ? { score: hit._score } : {}),
+      })),
+      ...(hits.length === limit && last
+        ? { nextCursor: encodeCursor(last) }
+        : {}),
+    };
+  }
+
+  async health(signal?: AbortSignal) {
+    const health = await this.client.health(signal);
+    return {
+      status:
+        health.status === "red"
+          ? ("unavailable" as const)
+          : this.synchronized
+            ? ("healthy" as const)
+            : ("degraded" as const),
+      checkedAt: new Date().toISOString(),
+      ...(!this.synchronized ? { message: "OpenSearch 索引等待同步" } : {}),
+    };
+  }
+
+  private async replaceAll(items: WorkOrder[], signal?: AbortSignal) {
+    await this.ensureIndex(signal);
+    await this.client.request(
+      "POST",
+      `/${this.index()}/_delete_by_query?refresh=true&conflicts=proceed`,
+      { query: { match_all: {} } },
+      signal,
+    );
+    const active = items.filter(({ status }) => status === "active");
+    if (!active.length) return;
+    const lines = active.flatMap((item) => [
+      JSON.stringify({ index: { _index: this.indexName, _id: item.id } }),
+      JSON.stringify(document(item)),
+    ]);
+    const result = await this.client.request<BulkResponse>(
+      "POST",
+      "/_bulk?refresh=wait_for",
+      `${lines.join("\n")}\n`,
+      signal,
+      "application/x-ndjson",
+    );
+    if (result.errors) throw new Error("OpenSearch 批量索引存在失败项");
+  }
+
+  private async ensureIndex(signal?: AbortSignal) {
+    try {
+      await this.client.request("HEAD", `/${this.index()}`, undefined, signal);
+    } catch (error) {
+      if (!(error instanceof OpenSearchRequestError && error.status === 404)) {
+        throw error;
+      }
+      await this.client.request(
+        "PUT",
+        `/${this.index()}`,
+        {
+          settings: { number_of_shards: 1, number_of_replicas: 0 },
+          mappings: {
+            dynamic: "strict",
+            properties: {
+              title: { type: "text", fields: { raw: { type: "wildcard" } } },
+              description: {
+                type: "text",
+                fields: { raw: { type: "wildcard" } },
+              },
+              ownerId: { type: "keyword" },
+              departmentId: { type: "keyword" },
+              tenantId: { type: "keyword" },
+              status: { type: "keyword" },
+              updatedAt: { type: "date" },
+            },
+          },
+        },
+        signal,
+      );
+    }
+  }
+
+  private index() {
+    return encodeURIComponent(this.indexName);
+  }
+}
+
+export function createWorkOrderOpenSearchIndex(
+  environment: Record<string, string | undefined>,
+  fetcher: OpenSearchFetcher = fetch,
+): WorkOrderOpenSearchIndex | undefined {
+  const config = readOpenSearchConfig(environment);
+  if (!config) return undefined;
+  const indexName =
+    environment.OPENSEARCH_WORK_ORDER_INDEX?.trim() || "windy-work-orders-v1";
+  if (!/^[a-z0-9][a-z0-9_-]{0,127}$/.test(indexName)) {
+    throw new Error("OPENSEARCH_WORK_ORDER_INDEX 格式无效");
+  }
+  return new WorkOrderOpenSearchIndex(
+    new OpenSearchClient(config, fetcher),
+    indexName,
+  );
+}
+
+function document(item: WorkOrder) {
+  return {
+    title: item.title,
+    description: item.description,
+    ownerId: item.ownerId,
+    departmentId: item.departmentId || "",
+    tenantId: "single-tenant",
+    status: item.status,
+    updatedAt: item.updatedAt,
+  };
+}
+
+function scopeFilter(
+  scope: DataScopeQuerySpecification,
+): Record<string, unknown> {
+  if (scope.branches.some(({ kind }) => kind === "all"))
+    return { match_all: {} };
+  const should: Record<string, unknown>[] = [];
+  for (const branch of scope.branches) {
+    if (branch.kind === "tenant") {
+      should.push({ term: { tenantId: branch.tenantId } });
+    }
+    if (branch.kind === "owner") {
+      should.push({ term: { ownerId: branch.ownerId } });
+    }
+    if (branch.kind === "dimension" && branch.dimension === "departmentId") {
+      should.push({ terms: { departmentId: branch.values } });
+    }
+  }
+  return should.length
+    ? { bool: { should, minimum_should_match: 1 } }
+    : { match_none: {} };
+}
+
+function escapeWildcard(value: string) {
+  return value
+    .replaceAll("\\", "\\\\")
+    .replaceAll("*", "\\*")
+    .replaceAll("?", "\\?");
+}
+
+function encodeCursor(sort: Array<string | number>) {
+  return Buffer.from(JSON.stringify(sort)).toString("base64url");
+}
+
+function decodeCursor(value: string): Array<string | number> {
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (
+      !Array.isArray(parsed) ||
+      parsed.length !== 3 ||
+      parsed.some(
+        (item) => typeof item !== "string" && typeof item !== "number",
+      )
+    ) {
+      throw new Error();
+    }
+    return parsed;
+  } catch {
+    throw new Error("OpenSearch 搜索游标无效");
+  }
+}

package/template/apps/server/src/work-order/search-provider.ts

@@ -5,9 +5,12 @@ import type {
   ModuleSearchQuery,
 } from "@southwind-ai/server-sdk";
 import { requestActorFromModule } from "../module-host/request-context.js";
+import { DataAccessDeniedError } from "../data-access/errors.js";
+import { platformDataActor } from "../data-access/platform-actor.js";
 import { SearchProtocolError } from "../search/errors.js";
 import { maskSearchText } from "../search/masking.js";
 import type { WorkOrderService } from "./service.js";
+import type { WorkOrderOpenSearchIndex } from "./opensearch-index.js";
 
 export const WORK_ORDER_SEARCH_PROVIDER_KEY = "work-order.ticket.search";
 export const WORK_ORDER_SEARCH_PROVIDER_VERSION = "0.1.0";
@@ -20,13 +23,19 @@ export class WorkOrderSearchProvider implements ModuleSearchProvider {
   readonly key = WORK_ORDER_SEARCH_PROVIDER_KEY;
   readonly providerVersion = WORK_ORDER_SEARCH_PROVIDER_VERSION;
 
-  constructor(private readonly requireService: () => WorkOrderService) {}
+  constructor(
+    private readonly requireService: () => WorkOrderService,
+    private readonly searchIndex?: WorkOrderOpenSearchIndex,
+  ) {}
 
   async search(
     request: ModuleSearchQuery,
     context: ModuleSearchContext,
   ): Promise<ModuleSearchPage> {
     if (request.signal.aborted) throw new Error("search aborted");
+    if (this.searchIndex) {
+      return this.searchOpenSearch(request, context);
+    }
     const page = parseProviderCursor(request.cursor);
     const result = await this.requireService().list(
       { q: request.text, page, pageSize: request.limit },
@@ -48,11 +57,61 @@ export class WorkOrderSearchProvider implements ModuleSearchProvider {
   }
 
   async health(signal: AbortSignal) {
+    if (this.searchIndex) return this.searchIndex.health(signal);
     return {
       status: signal.aborted ? ("unavailable" as const) : ("healthy" as const),
       checkedAt: new Date().toISOString(),
     };
   }
+
+  private async searchOpenSearch(
+    request: ModuleSearchQuery,
+    context: ModuleSearchContext,
+  ): Promise<ModuleSearchPage> {
+    const service = this.requireService();
+    await this.searchIndex!.synchronize(
+      () =>
+        service.searchIndexSnapshot(
+          platformDataActor("search_work_order_index", "工单搜索索引同步"),
+        ),
+      request.signal,
+    );
+    const actor = requestActorFromModule(context.actor);
+    const result = await this.searchIndex!.search(
+      request.text,
+      request.limit,
+      request.cursor,
+      await service.searchScope(actor),
+      request.signal,
+    );
+    const items = await Promise.all(
+      result.hits.map(async (hit) => {
+        try {
+          const item = await service.get(hit.id, actor);
+          return item ? { item, score: hit.score } : undefined;
+        } catch (error) {
+          if (error instanceof DataAccessDeniedError) return undefined;
+          throw error;
+        }
+      }),
+    );
+    return {
+      hits: items.flatMap((entry) =>
+        entry
+          ? [
+              {
+                id: entry.item.id,
+                resourceType: "work-order",
+                maskedTitle: maskSearchText(entry.item.title),
+                maskedExcerpt: maskSearchText(entry.item.description, 8),
+                ...(entry.score !== undefined ? { score: entry.score } : {}),
+              },
+            ]
+          : [],
+      ),
+      nextCursor: result.nextCursor,
+    };
+  }
 }
 
 function parseProviderCursor(value: string | undefined): number {

package/template/apps/server/src/work-order/service.ts

@@ -6,22 +6,26 @@ import type {
 } from "@southwind-ai/example-work-order";
 import { DataScopedResourceService } from "../data-access/scoped-resource.js";
 import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import { isServerScopeContext } from "../data-access/context.js";
+import { DataAccessDeniedError } from "../data-access/errors.js";
+import { buildDataScopeQuerySpecification } from "../data-access/query-specification.js";
 import type { RequestActor } from "../guards.js";
 import type { ManagedDepartment } from "../system/entities.js";
 import type { EntityRepository } from "../system/repository.js";
 import type { ScopedEntityRepository } from "../data-access/scoped-repository.js";
+import type { WorkOrderOpenSearchIndex } from "./opensearch-index.js";
 
 export class WorkOrderService {
   private readonly access: DataScopedResourceService<WorkOrder>;
+  private readonly descendantIds: (departmentId: string) => Promise<string[]>;
 
   constructor(
     private readonly repository: ScopedEntityRepository<WorkOrder>,
     departments: EntityRepository<ManagedDepartment>,
+    private readonly searchIndex?: WorkOrderOpenSearchIndex,
   ) {
-    this.access = new DataScopedResourceService(
-      repository,
-      departmentDescendantResolver(departments),
-    );
+    this.descendantIds = departmentDescendantResolver(departments);
+    this.access = new DataScopedResourceService(repository, this.descendantIds);
   }
 
   list(query: WorkOrderListQuery, actor: RequestActor) {
@@ -41,8 +45,8 @@ export class WorkOrderService {
     return this.access.get(id, actor);
   }
 
-  create(input: CreateWorkOrderInput, actor: RequestActor) {
-    return this.access.create(
+  async create(input: CreateWorkOrderInput, actor: RequestActor) {
+    const item = await this.access.create(
       {
         ...input,
         workflowStatus: "open",
@@ -52,14 +56,33 @@ export class WorkOrderService {
       },
       actor,
     );
+    await this.updateIndex(item);
+    return item;
+  }
+
+  async update(id: string, input: UpdateWorkOrderInput, actor: RequestActor) {
+    const item = await this.access.update(id, input, actor);
+    if (item) await this.updateIndex(item);
+    return item;
   }
 
-  update(id: string, input: UpdateWorkOrderInput, actor: RequestActor) {
-    return this.access.update(id, input, actor);
+  async archive(id: string, actor: RequestActor) {
+    const item = await this.access.softDelete(id, actor);
+    if (item) await this.updateIndex(item);
+    return item;
   }
 
-  archive(id: string, actor: RequestActor) {
-    return this.access.softDelete(id, actor);
+  searchIndexSnapshot(actor: RequestActor) {
+    return this.access.all({ status: "active" }, [], actor);
+  }
+
+  searchScope(actor: RequestActor) {
+    if (!isServerScopeContext(actor.scopeContext)) {
+      throw new DataAccessDeniedError();
+    }
+    return buildDataScopeQuerySpecification(actor.scopeContext, {
+      descendants: this.descendantIds,
+    });
   }
 
   async operationalSnapshot(
@@ -79,4 +102,13 @@ export class WorkOrderService {
       ).length,
     };
   }
+
+  private async updateIndex(item: WorkOrder): Promise<void> {
+    if (!this.searchIndex) return;
+    try {
+      await this.searchIndex.upsert(item);
+    } catch {
+      // OpenSearch 是可重建投影；写入失败不回滚已经提交的业务事实。
+    }
+  }
 }

package/template/apps/web/src/app/error-pages.ts

@@ -0,0 +1,9 @@
+import PlatformErrorPage from "@/pages/errors/PlatformErrorPage.vue";
+import { defineErrorPageComponents } from "@/pages/errors/error-page-extension";
+
+export const errorPageComponents = defineErrorPageComponents({
+  notFound: PlatformErrorPage,
+  internal: PlatformErrorPage,
+  maintenance: PlatformErrorPage,
+  network: PlatformErrorPage,
+});

package/template/apps/web/src/components/auth/PasswordChangeForm.vue

@@ -1,12 +1,19 @@
 <script setup lang="ts">
 import { computed, shallowRef } from "vue";
 import { KeyRoundIcon, LoaderCircleIcon } from "@lucide/vue";
-import { PASSWORD_POLICY } from "@southwind-ai/shared";
+import { PASSWORD_POLICY, type PasswordPolicy } from "@southwind-ai/shared";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import type { PasswordChangeInput } from "@/services/auth-api";
 
-const props = defineProps<{ error?: string; loading?: boolean }>();
+const props = withDefaults(
+  defineProps<{
+    error?: string;
+    loading?: boolean;
+    policy?: PasswordPolicy;
+  }>(),
+  { policy: () => PASSWORD_POLICY },
+);
 const emit = defineEmits<{ submit: [input: PasswordChangeInput] }>();
 
 const currentPassword = shallowRef("");
@@ -14,11 +21,11 @@ const newPassword = shallowRef("");
 const confirmation = shallowRef("");
 const newPasswordError = computed(() => {
   if (!newPassword.value) return "";
-  if (newPassword.value.length < PASSWORD_POLICY.minLength) {
-    return `新密码至少需要 ${PASSWORD_POLICY.minLength} 个字符，当前为 ${newPassword.value.length} 个。`;
+  if (newPassword.value.length < props.policy.minLength) {
+    return `新密码至少需要 ${props.policy.minLength} 个字符，当前为 ${newPassword.value.length} 个。`;
   }
-  if (newPassword.value.length > PASSWORD_POLICY.maxLength) {
-    return `新密码不能超过 ${PASSWORD_POLICY.maxLength} 个字符。`;
+  if (newPassword.value.length > props.policy.maxLength) {
+    return `新密码不能超过 ${props.policy.maxLength} 个字符。`;
   }
   if (currentPassword.value && newPassword.value === currentPassword.value) {
     return "新密码不能与当前密码相同。";
@@ -70,8 +77,8 @@ function submit() {
         v-model="newPassword"
         type="password"
         autocomplete="new-password"
-        :minlength="PASSWORD_POLICY.minLength"
-        :maxlength="PASSWORD_POLICY.maxLength"
+        :minlength="policy.minLength"
+        :maxlength="policy.maxLength"
         :aria-describedby="
           newPasswordError
             ? 'new-password-help new-password-error'
@@ -82,9 +89,7 @@ function submit() {
         required
       />
       <p id="new-password-help" class="text-xs text-muted-foreground">
-        密码要求：{{ PASSWORD_POLICY.minLength }}-{{
-          PASSWORD_POLICY.maxLength
-        }}
+        密码要求：{{ policy.minLength }}-{{ policy.maxLength }}
         个字符，且不能与当前密码相同。
       </p>
       <p

package/template/apps/web/src/components/auth/PasswordChangeForm.webtest.ts

@@ -40,4 +40,18 @@ describe("首次改密表单", () => {
       ],
     ]);
   });
+
+  test("使用服务端下发的密码长度策略", async () => {
+    const wrapper = mount(PasswordChangeForm, {
+      props: { policy: { minLength: 16, maxLength: 32 } },
+    });
+
+    await wrapper.get("#current-password").setValue("initial-password");
+    await wrapper.get("#new-password").setValue("twelve-chars");
+
+    expect(wrapper.get("#new-password-help").text()).toContain("16-32");
+    expect(wrapper.get("[role='alert']").text()).toContain(
+      "至少需要 16 个字符",
+    );
+  });
 });

package/template/apps/web/src/components/common/FormDialog.vue

@@ -24,6 +24,7 @@ const props = withDefaults(
     submitDisabled?: boolean;
     contentClass?: string;
     preventOutsideClose?: boolean;
+    beforeClose?: () => boolean | Promise<boolean>;
   }>(),
   {
     title: "编辑信息",
@@ -41,7 +42,8 @@ const emit = defineEmits<{
   cancel: [];
 }>();
 
-function handleCancel() {
+async function handleCancel() {
+  if (!(await canClose())) return;
   emit("cancel");
   open.value = false;
 }
@@ -49,10 +51,22 @@ function handleCancel() {
 function handleInteractOutside(event: { preventDefault(): void }) {
   if (props.preventOutsideClose) event.preventDefault();
 }
+
+async function handleOpenChange(value: boolean) {
+  if (value) {
+    open.value = true;
+    return;
+  }
+  if (await canClose()) open.value = false;
+}
+
+async function canClose() {
+  return props.beforeClose ? await props.beforeClose() : true;
+}
 </script>
 
 <template>
-  <Dialog v-model:open="open">
+  <Dialog :open="open" @update:open="handleOpenChange">
     <DialogContent
       :class="contentClass"
       @interact-outside="handleInteractOutside"

package/template/apps/web/src/components/common/ModalLayout.webtest.ts

@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, test, vi } from "vitest";
 import { flushPromises, mount } from "@vue/test-utils";
 import FormDialog from "./FormDialog.vue";
-import { DialogContent } from "@/components/ui/dialog";
+import { Dialog, DialogContent } from "@/components/ui/dialog";
 
 afterEach(() => {
   document.body.innerHTML = "";
@@ -51,4 +51,23 @@ describe("Modal 布局", () => {
 
     expect(preventDefault).toHaveBeenCalledTimes(1);
   });
+
+  test("关闭前置检查拒绝时保持打开，通过后才通知父组件关闭", async () => {
+    const beforeClose = vi
+      .fn<() => boolean | Promise<boolean>>()
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    const wrapper = mount(FormDialog, {
+      props: { open: true, beforeClose },
+    });
+
+    wrapper.getComponent(Dialog).vm.$emit("update:open", false);
+    await flushPromises();
+    expect(wrapper.emitted("update:open")).toBeUndefined();
+
+    wrapper.getComponent(Dialog).vm.$emit("update:open", false);
+    await flushPromises();
+    expect(wrapper.emitted("update:open")).toEqual([[false]]);
+    expect(beforeClose).toHaveBeenCalledTimes(2);
+  });
 });