create-windy 0.2.33 → 0.3.0

package/template/apps/server/src/application-services.ts

@@ -20,6 +20,7 @@ import { DrizzleSchedulerRepository } from "./scheduler/drizzle-repository.js";
 import { InMemorySchedulerRepository } from "./scheduler/repository.js";
 import type { ScheduledTaskDefinition } from "./scheduler/types.js";
 import type { createStorageRuntime } from "./storage/runtime.js";
+import type { PlatformConfig } from "@southwind-ai/config";
 import type { DurableHandlerRegistry } from "@southwind-ai/jobs";
 import { collectActiveBlobRefs } from "./storage/blob-reference-registry.js";
 import type { createSystemRepositories } from "./system/seed.js";
@@ -33,6 +34,17 @@ import {
 } from "./workflow/effects.js";
 import { InMemoryWorkflowRepository } from "./workflow/repository.js";
 import { WorkflowService } from "./workflow/service.js";
+import { NotificationChannelRegistry } from "./notification/channel-adapter.js";
+import { DrizzleNotificationDeliveryRepository } from "./notification/delivery-repository.js";
+import { NotificationDeliveryWorker } from "./notification/delivery-worker.js";
+import { InMemoryNotificationDeliveryRepository } from "./notification/memory-delivery-repository.js";
+import {
+  DrizzleNotificationPreferenceRepository,
+  InMemoryNotificationPreferenceRepository,
+} from "./notification/preference-repository.js";
+import { SystemNotificationRecipientDirectory } from "./notification/recipient-directory.js";
+import { NotificationService } from "./notification/service.js";
+import { SmtpNotificationChannelAdapter } from "./notification/smtp-adapter.js";
 
 interface ApplicationServicesInput {
   persistence: ReturnType<typeof createServerPersistence>;
@@ -42,6 +54,7 @@ interface ApplicationServicesInput {
   storage: ReturnType<typeof createStorageRuntime>;
   moduleTasks: ScheduledTaskDefinition[];
   bulkRetentionDays: number;
+  mailConfig?: PlatformConfig["mail"];
   installModuleDurableHandlers?: (registry: DurableHandlerRegistry) => void;
 }
 
@@ -52,6 +65,32 @@ export async function createApplicationServices(
   const notifications = persistence
     ? new DrizzleNotificationRepository(persistence.db)
     : new InMemoryNotificationRepository();
+  const notificationPreferences = persistence
+    ? new DrizzleNotificationPreferenceRepository(persistence.db)
+    : new InMemoryNotificationPreferenceRepository();
+  const notificationDeliveries = persistence
+    ? new DrizzleNotificationDeliveryRepository(persistence.db)
+    : new InMemoryNotificationDeliveryRepository();
+  const notificationRecipients = new SystemNotificationRecipientDirectory(
+    input.systemRepositories,
+  );
+  const notificationChannels = new NotificationChannelRegistry(
+    input.mailConfig?.enabled
+      ? [new SmtpNotificationChannelAdapter(input.mailConfig)]
+      : [],
+  );
+  const notificationService = new NotificationService(
+    notifications,
+    notificationPreferences,
+    notificationDeliveries,
+    notificationRecipients,
+    { mandatoryCategories: ["安全"] },
+  );
+  const notificationDeliveryWorker = new NotificationDeliveryWorker(
+    notificationDeliveries,
+    notificationRecipients,
+    notificationChannels,
+  );
   const deferredTimeout = new DeferredWorkflowTimeoutScheduler();
   const workflow = new WorkflowService(
     persistence
@@ -89,6 +128,15 @@ export async function createApplicationServices(
         const result = await governedExportDispatch.runNext?.();
         return { claimed: Boolean(result && result.status !== "idle") };
       },
+      notificationDispatch: async () => {
+        const scheduled = await notificationService.dispatchScheduled();
+        const delivery = await notificationDeliveryWorker.runNext();
+        return {
+          claimed: scheduled.claimed + delivery.claimed > 0,
+          scheduled,
+          delivery,
+        };
+      },
     }),
     ...input.moduleTasks,
   ];
@@ -149,6 +197,8 @@ export async function createApplicationServices(
   return {
     ...services,
     notifications,
+    notificationService,
+    notificationDeliveryWorker,
     workflow,
     governedExports,
     governedExportService,

package/template/apps/server/src/audit/drizzle-log-store.ts

@@ -74,6 +74,7 @@ export class DrizzleAuditLogReader {
 
 function auditWhere(query: AuditEventListQuery): SQL | undefined {
   const clauses = [
+    query.q ? keywordClause(query.q) : undefined,
     query.includeScheduler
       ? undefined
       : ne(auditLogs.actorId, "system_scheduler"),
@@ -91,6 +92,30 @@ function auditWhere(query: AuditEventListQuery): SQL | undefined {
   return clauses.length ? and(...clauses) : undefined;
 }
 
+function keywordClause(query: string): SQL {
+  const pattern = `%${escapeLike(query.toLowerCase())}%`;
+  return sql`lower(concat_ws(' ',
+    ${auditLogs.action},
+    ${auditLogs.actorId},
+    ${auditLogs.resource},
+    ${auditLogs.resourceId},
+    ${auditLogs.ip},
+    coalesce(${auditLogs.metadata} ->> 'actorName', ''),
+    coalesce(${auditLogs.metadata} ->> 'targetLabel', ''),
+    coalesce(${auditLogs.metadata} ->> 'message', ''),
+    coalesce(${auditLogs.metadata} ->> 'module', ''),
+    coalesce(${auditLogs.metadata} ->> 'requestId', ''),
+    coalesce(${auditLogs.metadata}::text, '')
+  )) like ${pattern} escape '\\'`;
+}
+
+function escapeLike(value: string): string {
+  return value
+    .replaceAll("\\", "\\\\")
+    .replaceAll("%", "\\%")
+    .replaceAll("_", "\\_");
+}
+
 function rowToAuditEvent(row: typeof auditLogs.$inferSelect): AuditEvent {
   const metadata = readMetadata(row.metadata);
   const outcome = readString(metadata.outcome, "success") as AuditOutcome;

package/template/apps/server/src/audit/search-summary.ts

@@ -1,6 +1,6 @@
 import type { AuditEvent } from "@southwind-ai/shared";
 import { randomUUIDv7 } from "bun";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 
 export function searchAuditMetadata(
   query: string,
@@ -26,11 +26,7 @@ export function searchAuditEvent(
     id: randomUUIDv7(),
     action: "data.search",
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: resourceName },
     requestId: context.requestId,
     metadata: searchAuditMetadata(query, matched),

package/template/apps/server/src/auth/credential-restriction.ts

@@ -2,6 +2,7 @@ import type { RequestGuardContext } from "../guards.js";
 
 const PASSWORD_CHANGE_ALLOWLIST = new Set([
   "GET /api/auth/session",
+  "GET /api/auth/password/policy",
   "POST /api/auth/password/change",
   "POST /api/auth/logout",
 ]);

package/template/apps/server/src/auth/password.ts

@@ -1,5 +1,5 @@
 import argon2, { argon2id } from "argon2";
-import { PASSWORD_POLICY } from "@southwind-ai/shared";
+import { PASSWORD_POLICY, type PasswordPolicy } from "@southwind-ai/shared";
 
 export { PASSWORD_POLICY } from "@southwind-ai/shared";
 
@@ -15,30 +15,39 @@ export interface PasswordHasher {
   verify(hash: string, password: string): Promise<boolean>;
 }
 
-export const argon2PasswordHasher: PasswordHasher = {
-  async hash(password) {
-    assertPasswordPolicy(password);
-    return argon2.hash(password, ARGON2_OPTIONS);
-  },
-  async verify(hash, password) {
-    if (!password || password.length > PASSWORD_POLICY.maxLength) {
-      return false;
-    }
-    try {
-      return await argon2.verify(hash, password);
-    } catch {
-      return false;
-    }
-  },
-};
+export const argon2PasswordHasher = createArgon2PasswordHasher();
 
-export function assertPasswordPolicy(password: string): void {
+export function createArgon2PasswordHasher(
+  policyProvider: () => PasswordPolicy = () => PASSWORD_POLICY,
+): PasswordHasher {
+  return {
+    async hash(password) {
+      assertPasswordPolicy(password, policyProvider());
+      return argon2.hash(password, ARGON2_OPTIONS);
+    },
+    async verify(hash, password) {
+      if (!password || password.length > 512) {
+        return false;
+      }
+      try {
+        return await argon2.verify(hash, password);
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
+export function assertPasswordPolicy(
+  password: string,
+  policy: PasswordPolicy = PASSWORD_POLICY,
+): void {
   if (
-    password.length < PASSWORD_POLICY.minLength ||
-    password.length > PASSWORD_POLICY.maxLength
+    password.length < policy.minLength ||
+    password.length > policy.maxLength
   ) {
     throw new Error(
-      `密码长度必须为 ${PASSWORD_POLICY.minLength}-${PASSWORD_POLICY.maxLength} 个字符`,
+      `密码长度必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
     );
   }
 }

package/template/apps/server/src/auth/routes.test.ts

@@ -1,5 +1,5 @@
 import { beforeAll, describe, expect, test } from "bun:test";
-import type { AuditEvent } from "@southwind-ai/shared";
+import type { AuditEvent, PasswordPolicy } from "@southwind-ai/shared";
 import { Elysia } from "elysia";
 import { createServerRuntime } from "../runtime.js";
 import { RepositoryActorResolver } from "./actor-resolver.js";
@@ -15,6 +15,37 @@ beforeAll(async () => {
 });
 
 describe("platform auth API", () => {
+  test("密码策略端点返回当前运行时策略且禁止缓存", async () => {
+    let policy: PasswordPolicy = { minLength: 16, maxLength: 64 };
+    const fixture = authFixture([activeUser()], () => policy);
+
+    const first = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    expect(first.headers.get("cache-control")).toBe("no-store");
+    await expect(first.json()).resolves.toEqual(policy);
+
+    policy = { minLength: 20, maxLength: 80 };
+    const second = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    await expect(second.json()).resolves.toEqual(policy);
+  });
+
+  test("会话有效期配置即时影响后续签发会话", async () => {
+    let ttlSeconds = 60;
+    const fixture = authFixture([activeUser()], undefined, () => ttlSeconds);
+    const first = await login(fixture.app, "admin");
+
+    ttlSeconds = 120;
+    const second = await login(fixture.app, "admin");
+
+    expect(
+      new Date(second.expiresAt).getTime() -
+        new Date(first.expiresAt).getTime(),
+    ).toBeGreaterThan(59_000);
+  });
+
   test("会话探测只返回当前 Actor，不暴露 Token", async () => {
     const fixture = authFixture([activeUser()]);
     const anonymous = await fixture.app.handle(
@@ -278,7 +309,11 @@ describe("platform auth API", () => {
   });
 });
 
-function authFixture(users: AuthUserRecord[]) {
+function authFixture(
+  users: AuthUserRecord[],
+  passwordPolicy?: () => PasswordPolicy,
+  sessionTtlSeconds?: () => number,
+) {
   const repository = new InMemoryAuthRepository(users);
   const resolver = new RepositoryActorResolver(repository, {
     sessionCookieName: "windy.sid",
@@ -286,6 +321,8 @@ function authFixture(users: AuthUserRecord[]) {
   const events: AuditEvent[] = [];
   const runtime = createServerRuntime({}, { actorResolver: resolver });
   const service = new AuthService(repository, {
+    passwordPolicy,
+    sessionTtlSeconds,
     auditWriter: {
       write(event) {
         events.push(event);
@@ -326,7 +363,11 @@ async function login(
     }),
   );
   expect(response.status).toBe(200);
-  return (await response.json()) as { token: string; sessionId: string };
+  return (await response.json()) as {
+    token: string;
+    sessionId: string;
+    expiresAt: string;
+  };
 }
 
 function readCookieValue(header: string, name: string): string {

package/template/apps/server/src/auth/routes.ts

@@ -53,6 +53,10 @@ export function registerAuthRoutes(
   registerLoginRoutes(app, authService, options);
   registerOwnSessionRoutes(app, authService, options);
 
+  app.get("/auth/password/policy", () =>
+    json(authService.getPasswordPolicy(), 200, { "cache-control": "no-store" }),
+  );
+
   app.post("/auth/logout", async (rawContext) => {
     const context = rawContext as AuthRouteContext;
     const token = readRequestSessionToken(context.request, cookieName);
@@ -112,10 +116,11 @@ export function registerAuthRoutes(
       INVALID_PASSWORD: 400,
       PASSWORD_UNCHANGED: 400,
     } as const;
+    const policy = authService.getPasswordPolicy();
     const messages = {
       USER_NOT_FOUND: "当前账号不存在",
       INVALID_CURRENT_PASSWORD: "当前密码错误",
-      INVALID_PASSWORD: "新密码必须为 12-128 个字符",
+      INVALID_PASSWORD: `新密码必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
       PASSWORD_UNCHANGED: "新密码不能与当前密码相同",
     } as const;
     return json(

package/template/apps/server/src/auth/runtime.ts

@@ -1,10 +1,12 @@
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import type { PasswordPolicy } from "@southwind-ai/shared";
 import { InMemoryAuthRepository, type AuthRepository } from "./repository.js";
 import { AuthService } from "./service.js";
 
 interface AuthRuntimeInput {
   repository?: AuthRepository;
-  sessionTtlSeconds: number;
+  sessionTtlSeconds: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   auditWriter: AuditEventWriter["write"];
   auditReader?: AuditEventReader;
 }
@@ -13,6 +15,7 @@ export function createAuthRuntime(input: AuthRuntimeInput) {
   const authRepository = input.repository ?? new InMemoryAuthRepository();
   const authService = new AuthService(authRepository, {
     sessionTtlSeconds: input.sessionTtlSeconds,
+    passwordPolicy: input.passwordPolicy,
     auditWriter: { write: input.auditWriter },
     auditReader: input.auditReader,
   });

package/template/apps/server/src/auth/service.ts

@@ -1,6 +1,10 @@
 import { randomBytes } from "node:crypto";
 import { randomUUIDv7 } from "bun";
-import type { AuditEvent } from "@southwind-ai/shared";
+import {
+  PASSWORD_POLICY,
+  type AuditEvent,
+  type PasswordPolicy,
+} from "@southwind-ai/shared";
 import type { RequestActor } from "../guards.js";
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
 import { hashSessionToken } from "./actor-resolver.js";
@@ -8,7 +12,7 @@ import {
   AuthenticationProviderRegistry,
   LocalArgon2AuthenticationAdapter,
 } from "./authentication-provider.js";
-import { argon2PasswordHasher, type PasswordHasher } from "./password.js";
+import { createArgon2PasswordHasher, type PasswordHasher } from "./password.js";
 import type { AuthRepository, AuthSessionRecord } from "./repository.js";
 import {
   CredentialService,
@@ -42,7 +46,8 @@ export type RevokeResult =
   | { ok: false; code: "SESSION_NOT_FOUND" | "FORBIDDEN" };
 
 export interface AuthServiceOptions {
-  sessionTtlSeconds?: number;
+  sessionTtlSeconds?: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   now?: () => Date;
   tokenFactory?: () => string;
   passwordHasher?: PasswordHasher;
@@ -52,7 +57,8 @@ export interface AuthServiceOptions {
 }
 
 export class AuthService {
-  private readonly sessionTtlSeconds: number;
+  private readonly sessionTtlSeconds: () => number;
+  private readonly passwordPolicy: () => PasswordPolicy;
   private readonly now: () => Date;
   private readonly tokenFactory: () => string;
   private readonly passwordHasher: PasswordHasher;
@@ -64,11 +70,17 @@ export class AuthService {
     private readonly repository: AuthRepository,
     private readonly options: AuthServiceOptions,
   ) {
-    this.sessionTtlSeconds = options.sessionTtlSeconds || 60 * 60 * 8;
+    const sessionTtlSeconds = options.sessionTtlSeconds;
+    this.sessionTtlSeconds =
+      typeof sessionTtlSeconds === "function"
+        ? sessionTtlSeconds
+        : () => sessionTtlSeconds || 60 * 60 * 8;
+    this.passwordPolicy = options.passwordPolicy || (() => PASSWORD_POLICY);
     this.now = options.now || (() => new Date());
     this.tokenFactory =
       options.tokenFactory || (() => randomBytes(32).toString("base64url"));
-    this.passwordHasher = options.passwordHasher || argon2PasswordHasher;
+    this.passwordHasher =
+      options.passwordHasher || createArgon2PasswordHasher(this.passwordPolicy);
     this.authenticationProviders =
       options.authenticationProviders ||
       new AuthenticationProviderRegistry(
@@ -140,7 +152,9 @@ export class AuthService {
       tokenHash: hashSessionToken(token),
       status: "active",
       issuedAt,
-      expiresAt: new Date(issuedAt.getTime() + this.sessionTtlSeconds * 1_000),
+      expiresAt: new Date(
+        issuedAt.getTime() + this.sessionTtlSeconds() * 1_000,
+      ),
       ip: metadata.ip,
       userAgent: metadata.userAgent,
     };
@@ -211,6 +225,10 @@ export class AuthService {
     );
   }
 
+  getPasswordPolicy(): PasswordPolicy {
+    return { ...this.passwordPolicy() };
+  }
+
   async revokeSession(
     sessionId: string,
     actor: RequestActor,

package/template/apps/server/src/configuration/bootstrap.ts

@@ -3,6 +3,10 @@ import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { FoundationSnapshot } from "../foundation.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { RouteApp } from "../system/route-types.js";
+// @windy-module system.storage begin
+import type { UploadService } from "@southwind-ai/storage";
+import { createPlatformUploadPolicies } from "../storage/runtime.js";
+// @windy-module system.storage end
 import {
   createRedisHealthProbe,
   type RedisHealthProbe,
@@ -21,6 +25,9 @@ export async function bootstrapModuleConfiguration(
 ): Promise<{
   service: ModuleConfigurationService;
   bindFoundation(snapshot: FoundationSnapshot): void;
+  // @windy-module system.storage begin
+  bindStorage(uploads: Pick<UploadService, "setPolicy">): void;
+  // @windy-module system.storage end
   redisHealthProbe: RedisHealthProbe;
   register(
     app: Pick<RouteApp, "get" | "post">,
@@ -37,12 +44,24 @@ export async function bootstrapModuleConfiguration(
   return {
     service,
     bindFoundation(snapshot) {
-      adapter.setListener({
+      snapshot.platform.enableAI = config.enableAI;
+      adapter.addListener({
         applied(current) {
           snapshot.platform.enableAI = current.enableAI;
         },
       });
     },
+    // @windy-module system.storage begin
+    bindStorage(uploads: Pick<UploadService, "setPolicy">) {
+      adapter.addListener({
+        applied(current) {
+          for (const policy of createPlatformUploadPolicies(current)) {
+            uploads.setPolicy(policy);
+          }
+        },
+      });
+    },
+    // @windy-module system.storage end
     redisHealthProbe: createLiveRedisHealthProbe(config),
     register(app, runtime, features) {
       registerModuleConfigurationRoutes(app, service, runtime, features);

package/template/apps/server/src/configuration/definition.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, test } from "bun:test";
+import { loadPlatformConfig } from "@southwind-ai/config";
+import { PlatformConfigApplyAdapter } from "./definition.js";
+
+describe("平台类型化运行配置", () => {
+  test("白名单不包含 SMTP Secret 且旧版本缺失字段由环境基线补齐", () => {
+    const config = loadPlatformConfig({
+      MAIL_SMTP_URL: "smtp://secret-marker@example.invalid",
+    });
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    expect(definition.fields.map((field) => field.path)).not.toContain(
+      "mail.smtpUrl",
+    );
+    expect(JSON.stringify(definition.baseValues())).not.toContain(
+      "secret-marker",
+    );
+    expect(
+      definition.validate({
+        enableAI: true,
+        "cache.healthTimeoutMs": 500,
+      }),
+    ).toMatchObject({
+      enableAI: true,
+      "cache.healthTimeoutMs": 500,
+      "security.passwordMinLength": 12,
+      "security.passwordMaxLength": 128,
+      "regional.timeZone": "Asia/Shanghai",
+    });
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.smtpUrl": "smtp://must-not-persist",
+      }),
+    ).toThrow();
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.enabled": true,
+      }),
+    ).toThrow();
+  });
+
+  test("即时字段应用到共享运行配置对象", async () => {
+    const config = loadPlatformConfig({});
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    await definition.apply(
+      definition.validate({
+        ...definition.baseValues(),
+        "security.sessionTtlSeconds": 3_600,
+        "security.passwordMinLength": 16,
+        "security.passwordMaxLength": 64,
+        "storage.bulkDataMaxByteSize": 1_048_576,
+        "storage.brandingLogoMaxByteSize": 262_144,
+        "regional.timeZone": "UTC",
+      }),
+    );
+
+    expect(config.security).toMatchObject({
+      sessionTtlSeconds: 3_600,
+      passwordMinLength: 16,
+      passwordMaxLength: 64,
+    });
+    expect(config.storage).toEqual({
+      bulkDataMaxByteSize: 1_048_576,
+      brandingLogoMaxByteSize: 262_144,
+    });
+    expect(config.regional.timeZone).toBe("UTC");
+  });
+});