create-windy 0.2.34 → 0.3.1

package/template/apps/server/src/system/drizzle-system.ts

@@ -1,14 +1,3 @@
-import {
-  departments,
-  dictionaries,
-  featureFlags,
-  // @windy-module system.license begin
-  legacyLicenses,
-  // @windy-module system.license end
-  menus,
-  roles,
-  users,
-} from "@southwind-ai/database";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { ManifestFeatureRepository } from "../feature/manifest-feature-repository.js";
 import type {
@@ -22,28 +11,26 @@ import type {
   ManagedRole,
   ManagedUser,
 } from "./entities.js";
+import { DrizzleScopedEntityRepository } from "./drizzle-scoped-repository.js";
+import type { EntityRepository } from "./repository.js";
+import type { ScopedEntityRepository } from "../data-access/scoped-repository.js";
+import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
+import {
+  PostgresAdvisoryMutationRunner,
+  type MutationRunner,
+} from "./mutation-runner.js";
 import {
-  array,
-  auditEntity,
-  auditRow,
+  createSystemEntityRepository,
+  departmentConfig,
+  dictionaryConfig,
+  featureConfig,
   // @windy-module system.license begin
-  date,
-  iso,
-  optionalIso,
+  licenseConfig,
   // @windy-module system.license end
-  pick,
-} from "./drizzle-mapping.js";
-import {
-  DrizzleEntityRepository,
-  type DrizzleEntityRepositoryConfig,
-} from "./drizzle-repository.js";
-import {
-  DrizzleScopedEntityRepository,
-  type DrizzleScopedEntityRepositoryConfig,
-} from "./drizzle-scoped-repository.js";
-import type { EntityRepository } from "./repository.js";
-import type { ScopedEntityRepository } from "../data-access/scoped-repository.js";
-import { userDataScopeBinding } from "./user-data-scope.js";
+  menuConfig,
+  roleConfig,
+  userConfig,
+} from "./drizzle-system-configs.js";
 
 export interface DrizzleSystemRepositorySeeds {
   users: ManagedUser[];
@@ -67,297 +54,58 @@ export interface DrizzleSystemRepositories {
   // @windy-module system.license begin
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
+  organizationMutationRunner: MutationRunner;
 }
 
 export function createDrizzleSystemRepositories(
   db: NodePgDatabase,
   seeds: DrizzleSystemRepositorySeeds,
 ): DrizzleSystemRepositories {
+  const transactionContext = new DrizzleTransactionContext();
   return {
-    users: new DrizzleScopedEntityRepository(db, userConfig(seeds.users)),
-    roles: repo(db, roleConfig(seeds.roles)),
-    departments: repo(db, departmentConfig(seeds.departments)),
-    menus: repo(db, menuConfig(seeds.menus)),
-    dictionaries: repo(db, dictionaryConfig(seeds.dictionaries)),
+    users: new DrizzleScopedEntityRepository(
+      db,
+      userConfig(seeds.users),
+      transactionContext,
+    ),
+    roles: createSystemEntityRepository(
+      db,
+      roleConfig(seeds.roles),
+      transactionContext,
+    ),
+    departments: createSystemEntityRepository(
+      db,
+      departmentConfig(seeds.departments),
+      transactionContext,
+    ),
+    menus: createSystemEntityRepository(
+      db,
+      menuConfig(seeds.menus),
+      transactionContext,
+    ),
+    dictionaries: createSystemEntityRepository(
+      db,
+      dictionaryConfig(seeds.dictionaries),
+      transactionContext,
+    ),
     features: new ManifestFeatureRepository(
-      repo(db, featureConfig(seeds.features)),
+      createSystemEntityRepository(
+        db,
+        featureConfig(seeds.features),
+        transactionContext,
+      ),
     ),
     // @windy-module system.license begin
-    licenses: repo(db, licenseConfig(seeds.licenses)),
+    licenses: createSystemEntityRepository(
+      db,
+      licenseConfig(seeds.licenses),
+      transactionContext,
+    ),
     // @windy-module system.license end
+    organizationMutationRunner: new PostgresAdvisoryMutationRunner(
+      db,
+      "windy:system:organization",
+      transactionContext,
+    ),
   };
 }
-
-function repo<
-  T extends
-    | ManagedUser
-    | ManagedRole
-    | ManagedDepartment
-    | ManagedMenu
-    | ManagedDictionary
-    | ManagedFeature
-    // @windy-module system.license begin
-    | ManagedLicense,
-  // @windy-module system.license end
->(db: NodePgDatabase, config: DrizzleEntityRepositoryConfig<T>) {
-  return new DrizzleEntityRepository<T>(db, config);
-}
-
-function userConfig(
-  seedItems: ManagedUser[],
-): DrizzleScopedEntityRepositoryConfig<ManagedUser> {
-  return {
-    table: users,
-    idColumn: "id",
-    seedItems,
-    dataScope: {
-      drizzle: {
-        ownerId: users.id,
-        tenant: { mode: "fixed", tenantId: "single-tenant" },
-        dimensions: { departmentId: users.departmentId },
-      },
-      entity: userDataScopeBinding,
-    },
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "username",
-        "displayName",
-        "email",
-        "phone",
-        "departmentId",
-        "roleIds",
-        "postIds",
-        "status",
-      ]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "username",
-          "displayName",
-          "email",
-          "phone",
-          "departmentId",
-          "postIds",
-          "status",
-        ]),
-        roleIds: array(row.roleIds),
-      }) as ManagedUser,
-  };
-}
-
-function roleConfig(
-  seedItems: ManagedRole[],
-): DrizzleEntityRepositoryConfig<ManagedRole> {
-  return {
-    table: roles,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "code",
-        "name",
-        "dataScope",
-        "permissionKeys",
-        "menuKeys",
-        "departmentIds",
-        "status",
-      ]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "code", "name", "dataScope", "status"]),
-        permissionKeys: array(row.permissionKeys),
-        menuKeys: array(row.menuKeys),
-        departmentIds: array(row.departmentIds),
-      }) as ManagedRole,
-  };
-}
-
-function departmentConfig(
-  seedItems: ManagedDepartment[],
-): DrizzleEntityRepositoryConfig<ManagedDepartment> {
-  return {
-    table: departments,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, ["id", "parentId", "name", "code", "order", "status"]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "parentId", "name", "code", "order", "status"]),
-      }) as ManagedDepartment,
-  };
-}
-
-function menuConfig(
-  seedItems: ManagedMenu[],
-): DrizzleEntityRepositoryConfig<ManagedMenu> {
-  return {
-    table: menus,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "key",
-        "title",
-        "type",
-        "order",
-        "path",
-        "component",
-        "icon",
-        "permissionKey",
-        "featureKey",
-        "parentKey",
-        "status",
-      ]),
-      visible: item.visible ? "visible" : "hidden",
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "key",
-          "title",
-          "type",
-          "order",
-          "path",
-          "component",
-          "icon",
-          "permissionKey",
-          "featureKey",
-          "parentKey",
-          "status",
-        ]),
-        visible: row.visible !== "hidden",
-      }) as ManagedMenu,
-  };
-}
-
-function dictionaryConfig(
-  seedItems: ManagedDictionary[],
-): DrizzleEntityRepositoryConfig<ManagedDictionary> {
-  return {
-    table: dictionaries,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, ["id", "code", "name", "description", "status"]),
-      items: item.items || [],
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "code", "name", "description", "status"]),
-        items: array(row.items),
-      }) as ManagedDictionary,
-  };
-}
-
-function featureConfig(
-  seedItems: ManagedFeature[],
-): DrizzleEntityRepositoryConfig<ManagedFeature> {
-  return {
-    table: featureFlags,
-    idColumn: "key",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      key: item.key || item.id,
-      module: item.module,
-      label: item.label,
-      description: item.description,
-      enabled: item.enabled,
-      visible: item.visible,
-      stage: item.stage,
-      licenseRequired: false,
-      licenseKey: item.requiredEntitlement,
-      allowedLicenseVersions: item.licenseVersionOverride,
-      dependencies: item.dependencies || [],
-      status: item.status,
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        id: String(row.key),
-        key: String(row.key),
-        module: String(row.module),
-        label: String(row.label),
-        description: row.description as string | undefined,
-        enabled: Boolean(row.enabled),
-        visible: row.visible === "hidden" ? "hidden" : "visible",
-        stage: String(row.stage || "stable") as ManagedFeature["stage"],
-        requiredEntitlement: row.licenseKey
-          ? (row.licenseKey as NonNullable<
-              ManagedFeature["requiredEntitlement"]
-            >)
-          : undefined,
-        licenseVersionOverride: Array.isArray(row.allowedLicenseVersions)
-          ? (row.allowedLicenseVersions as NonNullable<
-              ManagedFeature["licenseVersionOverride"]
-            >)
-          : undefined,
-        dependencies: array(row.dependencies),
-        status: String(row.status || "active") as ManagedFeature["status"],
-      }) as ManagedFeature,
-  };
-}
-
-// @windy-module system.license begin
-function licenseConfig(
-  seedItems: ManagedLicense[],
-): DrizzleEntityRepositoryConfig<ManagedLicense> {
-  return {
-    table: legacyLicenses,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "licenseKey",
-        "subject",
-        "machineCode",
-        "publicKeyId",
-        "edition",
-        "modules",
-        "status",
-      ]),
-      issuedAt: date(item.issuedAt),
-      expiresAt: item.expiresAt ? date(item.expiresAt) : undefined,
-      payload: { modules: item.modules },
-      signature: "",
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "licenseKey",
-          "subject",
-          "machineCode",
-          "publicKeyId",
-          "edition",
-          "status",
-        ]),
-        modules: array(row.modules),
-        issuedAt: iso(row.issuedAt),
-        expiresAt: optionalIso(row.expiresAt),
-      }) as ManagedLicense,
-  };
-}
-// @windy-module system.license end

package/template/apps/server/src/system/drizzle-transaction-context.ts

@@ -0,0 +1,14 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+
+export class DrizzleTransactionContext {
+  private readonly storage = new AsyncLocalStorage<NodePgDatabase>();
+
+  current(fallback: NodePgDatabase): NodePgDatabase {
+    return this.storage.getStore() || fallback;
+  }
+
+  run<T>(database: NodePgDatabase, mutation: () => Promise<T>): Promise<T> {
+    return this.storage.run(database, mutation);
+  }
+}

package/template/apps/server/src/system/identity-route-config.ts

@@ -8,8 +8,8 @@ import type { ResourceRouteConfig } from "./route-types.js";
 import type { SystemRepositories } from "./seed.js";
 import { UserAccountPolicy } from "./user-account-policy.js";
 import { userDepartmentValidator } from "./user-department-validation.js";
-import { SerialMutationRunner } from "./mutation-runner.js";
 import { projectMaskedUser } from "./user-projection.js";
+import { RoleDepartmentScopePolicy } from "./role-department-scope-policy.js";
 
 export function identityRouteConfigs(
   repositories: SystemRepositories,
@@ -24,7 +24,10 @@ export function identityRouteConfigs(
     repositories.roles,
     authRepository,
   );
-  const mutationRunner = new SerialMutationRunner();
+  const roleDepartmentScope = new RoleDepartmentScopePolicy(
+    repositories.departments,
+  );
+  const mutationRunner = repositories.organizationMutationRunner;
   return {
     users: {
       ...resource(
@@ -65,6 +68,8 @@ export function identityRouteConfigs(
       ),
       beforeUpdate: (current, input) =>
         policy.protectRoleUpdate(current, input),
+      validateInput: (input, current) =>
+        roleDepartmentScope.validate(input, current),
       beforeDelete: (current) => policy.protectRoleDelete(current),
       importable: false,
       mutationRunner,

package/template/apps/server/src/system/mutation-runner.ts

@@ -1,5 +1,8 @@
+import { sql } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ManagedEntity } from "./entities.js";
 import type { ResourceRouteConfig } from "./route-types.js";
+import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
 
 export interface MutationRunner {
   run<T>(mutation: () => Promise<T>): Promise<T>;
@@ -23,6 +26,26 @@ export class SerialMutationRunner implements MutationRunner {
   }
 }
 
+export class PostgresAdvisoryMutationRunner implements MutationRunner {
+  constructor(
+    private readonly db: NodePgDatabase,
+    private readonly lockKey: string,
+    private readonly transactionContext: DrizzleTransactionContext,
+  ) {}
+
+  run<T>(mutation: () => Promise<T>): Promise<T> {
+    return this.db.transaction(async (transaction) => {
+      await transaction.execute(
+        sql`select pg_advisory_xact_lock(hashtextextended(${this.lockKey}, 0))`,
+      );
+      return this.transactionContext.run(
+        transaction as unknown as NodePgDatabase,
+        mutation,
+      );
+    });
+  }
+}
+
 export function runResourceMutation<T extends ManagedEntity, R>(
   config: ResourceRouteConfig<T>,
   mutation: () => Promise<R>,

package/template/apps/server/src/system/organization-postgres.integration.test.ts

@@ -0,0 +1,176 @@
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor } from "../guards.js";
+import { DepartmentOrganizationPolicy } from "./department-organization.js";
+import { createSystemRepositories } from "./seed.js";
+import { userDepartmentValidator } from "./user-department-validation.js";
+
+const databaseUrl = process.env.ORGANIZATION_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+
+describePostgres("PostgreSQL organization invariants", () => {
+  let pool: Pool;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    await migrate(drizzle(pool), {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__organization_test_migrations",
+    });
+  });
+
+  beforeEach(async () => {
+    await pool.query("truncate table users, roles, departments cascade");
+  });
+
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  test("数据库约束拒绝并发创建第二个根组织", async () => {
+    const results = await Promise.allSettled([
+      insertRoot(pool, "root_a"),
+      insertRoot(pool, "root_b"),
+    ]);
+
+    expect(results.filter(({ status }) => status === "fulfilled")).toHaveLength(
+      1,
+    );
+    expect(
+      await pool.query(
+        "select count(*)::int as count from departments where parent_id is null and deleted_at is null",
+      ),
+    ).toMatchObject({ rows: [{ count: 1 }] });
+  });
+
+  test("跨 Server advisory lock 让并发互相移动只成功一次", async () => {
+    const left = repositories(pool);
+    const right = repositories(pool);
+    await left.departments.all();
+    await left.departments.create(department("dept_a", "dept_platform"), actor);
+    await left.departments.create(department("dept_b", "dept_platform"), actor);
+
+    const results = await Promise.all([
+      move(left, "dept_a", "dept_b"),
+      move(right, "dept_b", "dept_a"),
+    ]);
+    expect(results.filter((result) => result === "moved")).toHaveLength(1);
+    expect(
+      results.filter((result) => result === "DEPARTMENT_CYCLE"),
+    ).toHaveLength(1);
+  });
+
+  test("用户归属写入与部门停用并发后不会产生启用用户挂在停用部门", async () => {
+    const left = repositories(pool);
+    const right = repositories(pool);
+    await left.departments.all();
+    await left.departments.create(department("source", "dept_platform"), actor);
+    const policy = new DepartmentOrganizationPolicy(left);
+
+    const [transition, assignment] = await Promise.all([
+      left.organizationMutationRunner.run(() =>
+        policy.transition("source", "disable", undefined, actor),
+      ),
+      right.organizationMutationRunner.run(async () => {
+        const error = await userDepartmentValidator(right.departments)({
+          departmentId: "source",
+        });
+        if (error) return "rejected";
+        await right.users.create(
+          {
+            id: "user_source",
+            username: "source-user",
+            displayName: "来源用户",
+            departmentId: "source",
+            roleIds: [],
+          },
+          actor,
+        );
+        return "created";
+      }),
+    ]);
+
+    const source = await left.departments.get("source");
+    const user = await left.users.get("user_source");
+    if (source?.status === "disabled") {
+      expect(assignment).toBe("rejected");
+      expect(user).toBeUndefined();
+    } else {
+      expect(assignment).toBe("created");
+      expect(transition).toMatchObject({
+        error: "DEPARTMENT_MIGRATION_REQUIRED",
+      });
+      expect(user?.departmentId).toBe("source");
+    }
+  });
+});
+
+function repositories(pool: Pool) {
+  return createSystemRepositories(createFoundationSnapshot(), {
+    db: drizzle(pool),
+  });
+}
+
+async function move(
+  repositories: ReturnType<typeof createSystemRepositories>,
+  id: string,
+  parentId: string,
+) {
+  const policy = new DepartmentOrganizationPolicy(repositories);
+  return repositories.organizationMutationRunner.run(async () => {
+    const current = await repositories.departments.get(id);
+    if (!current) throw new Error(`missing ${id}`);
+    const conflict = await policy.beforeUpdate(current, { parentId });
+    if (conflict && typeof conflict !== "string") return conflict.error;
+    await repositories.departments.update(id, { parentId }, actor);
+    return "moved";
+  });
+}
+
+function department(id: string, parentId?: string) {
+  return {
+    id,
+    parentId,
+    code: id,
+    name: id,
+    order: 10,
+    status: "active" as const,
+  };
+}
+
+function insertRoot(pool: Pool, id: string) {
+  return pool.query(
+    `insert into departments (
+       id, name, code, "order", status,
+       created_at, created_by, updated_at, updated_by
+     ) values ($1, $1, $1, 10, 'active', now(), 'test', now(), 'test')`,
+    [id],
+  );
+}
+
+const actor: RequestActor = {
+  id: "organization-test",
+  type: "service",
+  name: "组织回归",
+  roleCodes: ["system"],
+  permissionKeys: [
+    "system.department.manage",
+    "system.user.manage",
+    "system.role.manage",
+  ],
+};

package/template/apps/server/src/system/resource-access-response.ts

@@ -2,13 +2,19 @@ import { DataAccessDeniedError } from "../data-access/scoped-resource.js";
 import { forbidden } from "./route-helpers.js";
 import type { RequestActor } from "../guards.js";
 import type { ManagedEntity } from "./entities.js";
-import type { ResourceRouteConfig } from "./route-types.js";
+import type {
+  ResourcePolicyResult,
+  ResourceRouteConfig,
+} from "./route-types.js";
 
-export function resourceConflict(message: string) {
-  return Response.json(
-    { error: "RESOURCE_POLICY_CONFLICT", message },
-    { status: 409 },
-  );
+export function resourceConflict(
+  conflict: Exclude<ResourcePolicyResult, undefined>,
+) {
+  const payload =
+    typeof conflict === "string"
+      ? { error: "RESOURCE_POLICY_CONFLICT", message: conflict }
+      : conflict;
+  return Response.json(payload, { status: 409 });
 }
 
 export function importNotSupported() {