create-windy 0.2.34 → 0.3.1

package/template/apps/server/src/system/routes.ts

@@ -1,45 +1,25 @@
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
-import { recordMutationAudit } from "../audit/policy.js";
 import { registerFeatureFlagRoutes } from "../feature/routes.js";
 import { findSystemFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
-import type { ManagedEntity } from "./entities.js";
 import { registerMenuRoutes } from "./menu-routes.js";
-import { registerDepartmentQuickCreateRoute } from "./department-routes.js";
 import {
-  asPartial,
-  notFound,
-  parseImportPayload,
-  parseListQuery,
-  requiredId,
-  resourceEvent,
-  routeContext,
-} from "./route-helpers.js";
-import type { ResourceRouteConfig, RouteApp } from "./route-types.js";
+  registerDepartmentQuickCreateRoute,
+  registerDepartmentTransitionRoute,
+} from "./department-routes.js";
+import type { RouteApp } from "./route-types.js";
 import type { SystemRepositories } from "./seed.js";
-import { resource, withPermission } from "./resource-route-support.js";
+import { resource } from "./resource-route-support.js";
 import type { AuthRepository } from "../auth/repository.js";
 import { identityRouteConfigs } from "./identity-route-config.js";
 // @windy-module system.audit begin
 import { registerAuditRoutes } from "./audit-routes.js";
 // @windy-module system.audit end
-import {
-  accessCall,
-  importNotSupported,
-  readAccessible,
-  resourceConflict,
-} from "./resource-access-response.js";
-import { runResourceMutation } from "./mutation-runner.js";
-import { registerResourceExportRoute } from "./resource-export-route.js";
-import {
-  projectEntity,
-  projectEntities,
-  projectImportResult,
-} from "./response-projection.js";
 // @windy-module system.data-governance begin
 import { registerUserPlaintextRoutes } from "../data-governance/user-plaintext-routes.js";
 // @windy-module system.data-governance end
-import { searchAuditEvent } from "../audit/search-summary.js";
+import { DepartmentOrganizationPolicy } from "./department-organization.js";
+import { registerResourceRoutes } from "./resource-routes.js";
 
 export type { RouteApp } from "./route-types.js";
 
@@ -57,6 +37,7 @@ export function registerSystemRoutes(
     features,
     options.authRepository,
   );
+  const departmentPolicy = new DepartmentOrganizationPolicy(repositories);
   // @windy-module system.data-governance begin
   registerUserPlaintextRoutes(app, identity.users, runtime);
   // @windy-module system.data-governance end
@@ -66,18 +47,37 @@ export function registerSystemRoutes(
     repositories.departments,
     runtime,
     findSystemFeature(features, "department"),
+    departmentPolicy,
+    repositories.organizationMutationRunner,
+  );
+  registerDepartmentTransitionRoute(
+    app,
+    departmentPolicy,
+    repositories.organizationMutationRunner,
+    runtime,
+    findSystemFeature(features, "department"),
   );
   registerResourceRoutes(app, identity.roles, runtime);
   registerResourceRoutes(
     app,
-    resource(
-      "departments",
-      "department",
-      repositories.departments,
-      features,
-      ["code", "name"],
-      { mode: "platform" },
-    ),
+    {
+      ...resource(
+        "departments",
+        "department",
+        repositories.departments,
+        features,
+        ["code", "name"],
+        { mode: "platform" },
+      ),
+      importable: false,
+      mutationRunner: repositories.organizationMutationRunner,
+      validateInput: (input, current) =>
+        departmentPolicy.validateInput(input, current),
+      beforeCreate: (input) => departmentPolicy.beforeCreate(input),
+      beforeUpdate: (current, input) =>
+        departmentPolicy.beforeUpdate(current, input),
+      beforeDelete: (current) => departmentPolicy.beforeDelete(current),
+    },
     runtime,
   );
   registerMenuRoutes(
@@ -120,235 +120,3 @@ export function registerSystemRoutes(
 
   return app;
 }
-
-function registerResourceRoutes<T extends ManagedEntity>(
-  app: RouteApp,
-  config: ResourceRouteConfig<T>,
-  runtime: Parameters<typeof registerSystemRoutes>[2],
-) {
-  app.get(`/system/${config.path}`, (rawContext) => {
-    const { guardContext, query } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "GET",
-      config.permissionResource,
-      "read",
-      config.feature,
-      async () => {
-        const listQuery = parseListQuery(query);
-        if (listQuery instanceof Response) return listQuery;
-        const result = await accessCall(() =>
-          config.dataAccess.mode === "request"
-            ? config.dataAccess.access.list(
-                listQuery,
-                config.searchFields,
-                guardContext.actor,
-              )
-            : config.repository.list(listQuery, config.searchFields),
-        );
-        if (result instanceof Response) return result;
-        const search = listQuery.q?.trim();
-        if (search) {
-          runtime.auditSink.recordEvent(
-            searchAuditEvent(guardContext, config.path, search, result.total),
-          );
-        }
-        return { ...result, items: projectEntities(config, result.items) };
-      },
-    );
-  });
-
-  if (config.backupExport !== false) {
-    registerResourceExportRoute(app, config, runtime);
-  }
-
-  app.get(`/system/${config.path}/:id`, (rawContext) => {
-    const { guardContext, params } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "GET",
-      config.permissionResource,
-      "read",
-      config.feature,
-      async () => {
-        const item = await readAccessible(
-          config,
-          requiredId(params),
-          guardContext.actor,
-        );
-        if (item instanceof Response) return item;
-        return item
-          ? projectEntity(config, item)
-          : notFound(config.path, requiredId(params));
-      },
-    );
-  });
-
-  if (config.readonly) {
-    return;
-  }
-
-  app.post(`/system/${config.path}/import`, (rawContext) => {
-    const { guardContext, body } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "POST",
-      config.permissionResource,
-      "manage",
-      config.feature,
-      async () => {
-        if (config.importable === false) {
-          return importNotSupported();
-        }
-        const payload = parseImportPayload<T>(body);
-        const result = await accessCall(() =>
-          config.dataAccess.mode === "request"
-            ? config.dataAccess.access.importMany(
-                payload.items,
-                guardContext.actor,
-                payload.mode,
-              )
-            : config.repository.importMany(
-                payload.items,
-                guardContext.actor,
-                payload.mode,
-              ),
-        );
-        if (result instanceof Response) return result;
-        await recordMutationAudit(
-          runtime,
-          config.path,
-          resourceEvent(guardContext, "data.import", config.path, undefined, {
-            created: result.created,
-            updated: result.updated,
-            skipped: result.skipped,
-            total: payload.items.length,
-          }),
-        );
-        return {
-          ...projectImportResult(config, result),
-          total: payload.items.length,
-        };
-      },
-    );
-  });
-
-  app.post(`/system/${config.path}`, (rawContext) => {
-    const { guardContext, body } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "POST",
-      config.permissionResource,
-      "manage",
-      config.feature,
-      async () => {
-        const input = asPartial<T>(body);
-        const validationError = await config.validateInput?.(input);
-        if (validationError) {
-          return Response.json(
-            { error: "INVALID_RESOURCE", message: validationError },
-            { status: 400 },
-          );
-        }
-        const item = await accessCall(() =>
-          config.dataAccess.mode === "request"
-            ? config.dataAccess.access.create(input, guardContext.actor)
-            : config.repository.create(input, guardContext.actor),
-        );
-        if (item instanceof Response) return item;
-        await recordMutationAudit(
-          runtime,
-          config.path,
-          resourceEvent(guardContext, "crud.create", config.path, item.id),
-        );
-        return projectEntity(config, item);
-      },
-    );
-  });
-
-  app.put(`/system/${config.path}/:id`, (rawContext) => {
-    const { guardContext, params, body } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "PUT",
-      config.permissionResource,
-      "manage",
-      config.feature,
-      async () =>
-        runResourceMutation(config, async () => {
-          const id = requiredId(params);
-          const input = asPartial<T>(body);
-          const current = await readAccessible(config, id, guardContext.actor);
-          if (current instanceof Response) return current;
-          if (!current) return notFound(config.path, id);
-          const validationError = await config.validateInput?.(input, current);
-          if (validationError) {
-            return Response.json(
-              { error: "INVALID_RESOURCE", message: validationError },
-              { status: 400 },
-            );
-          }
-          const policyError = await config.beforeUpdate?.(current, input);
-          if (policyError) return resourceConflict(policyError);
-          const item = await accessCall(() =>
-            config.dataAccess.mode === "request"
-              ? config.dataAccess.access.update(id, input, guardContext.actor)
-              : config.repository.update(id, input, guardContext.actor),
-          );
-          if (item instanceof Response) return item;
-          if (!item) {
-            return notFound(config.path, id);
-          }
-          await config.afterUpdate?.(current, item, guardContext.actor);
-          await recordMutationAudit(
-            runtime,
-            config.path,
-            resourceEvent(guardContext, "crud.update", config.path, id),
-          );
-          return projectEntity(config, item);
-        }),
-    );
-  });
-
-  app.delete(`/system/${config.path}/:id`, (rawContext) => {
-    const { guardContext, params } = routeContext(rawContext);
-    return withPermission(
-      runtime,
-      guardContext,
-      "DELETE",
-      config.permissionResource,
-      "manage",
-      config.feature,
-      async () =>
-        runResourceMutation(config, async () => {
-          const id = requiredId(params);
-          const current = await readAccessible(config, id, guardContext.actor);
-          if (current instanceof Response) return current;
-          if (!current) return notFound(config.path, id);
-          const policyError = await config.beforeDelete?.(current);
-          if (policyError) return resourceConflict(policyError);
-          const item = await accessCall(() =>
-            config.dataAccess.mode === "request"
-              ? config.dataAccess.access.softDelete(id, guardContext.actor)
-              : config.repository.softDelete(id, guardContext.actor),
-          );
-          if (item instanceof Response) return item;
-          if (!item) {
-            return notFound(config.path, id);
-          }
-          await config.afterDelete?.(item, guardContext.actor);
-          await recordMutationAudit(
-            runtime,
-            config.path,
-            resourceEvent(guardContext, "crud.delete", config.path, id),
-          );
-          return projectEntity(config, item);
-        }),
-    );
-  });
-}

package/template/apps/server/src/system/seed.ts

@@ -26,6 +26,10 @@ import type {
   ManagedUser,
 } from "./entities.js";
 import { userDataScopeBinding } from "./user-data-scope.js";
+import {
+  SerialMutationRunner,
+  type MutationRunner,
+} from "./mutation-runner.js";
 
 export interface SystemRepositories {
   users: ScopedEntityRepository<ManagedUser>;
@@ -38,6 +42,7 @@ export interface SystemRepositories {
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
   menuRegistry: ManifestMenuRegistry;
+  organizationMutationRunner: MutationRunner;
 }
 
 export interface CreateSystemRepositoryOptions {
@@ -53,6 +58,7 @@ export function createSystemRepositories(
     const repositories = createDrizzleSystemRepositories(options.db, seeds);
     return {
       ...repositories,
+      organizationMutationRunner: repositories.organizationMutationRunner,
       menuRegistry: new ManifestMenuRegistry(
         repositories.menus,
         snapshot.menus,
@@ -81,6 +87,7 @@ export function createSystemRepositories(
   };
   return {
     ...repositories,
+    organizationMutationRunner: new SerialMutationRunner(),
     menuRegistry: new ManifestMenuRegistry(repositories.menus, snapshot.menus),
   };
 }

package/template/apps/server/src/work-order/data-scope.integration.test.ts

@@ -47,12 +47,19 @@ describePostgres("PostgreSQL Work Order data-scope enforcement", () => {
       features: [],
       licenses: [],
     });
-    await repositories.departments.create(department("dept_a"), setupActor);
+    await repositories.departments.create(department("org_root"), setupActor);
+    await repositories.departments.create(
+      department("dept_a", "org_root"),
+      setupActor,
+    );
     await repositories.departments.create(
       department("dept_a_child", "dept_a"),
       setupActor,
     );
-    await repositories.departments.create(department("dept_b"), setupActor);
+    await repositories.departments.create(
+      department("dept_b", "org_root"),
+      setupActor,
+    );
     const workOrders = createDrizzleWorkOrderRepository(database);
     await workOrders.create(
       ticket("ticket_self", "user_a", "dept_a"),

package/template/apps/server/src/work-order/opensearch-index.test.ts

@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import type { WorkOrder } from "@southwind-ai/example-work-order";
+import { createWorkOrderOpenSearchIndex } from "./opensearch-index.js";
+
+describe("工单 OpenSearch 可重建索引", () => {
+  test("同步业务事实后把 dataScope 编译进 OpenSearch 查询", async () => {
+    const requests: Request[] = [];
+    const fetcher = async (
+      input: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      const request = new Request(input, init);
+      requests.push(request);
+      if (request.method === "HEAD") return new Response(null, { status: 404 });
+      if (request.url.endsWith("/_bulk?refresh=wait_for")) {
+        return Response.json({ errors: false });
+      }
+      if (request.url.endsWith("/_search")) {
+        return Response.json({
+          hits: {
+            hits: [
+              {
+                _id: "ticket_1",
+                _score: 3,
+                sort: [3, "2026-07-26T00:00:00.000Z", "ticket_1"],
+              },
+            ],
+          },
+        });
+      }
+      return Response.json({});
+    };
+    const index = createWorkOrderOpenSearchIndex(
+      { OPENSEARCH_URL: "http://opensearch:9200" },
+      fetcher,
+    )!;
+
+    await index.synchronize(async () => [workOrder()]);
+    const result = await index.search("网络", 1, undefined, {
+      actorId: "user_1",
+      branches: [{ kind: "owner", ownerId: "user_1" }],
+    });
+
+    expect(result.hits).toEqual([{ id: "ticket_1", score: 3 }]);
+    expect(result.nextCursor).toBeString();
+    const searchRequest = requests.find(({ url }) => url.endsWith("/_search"));
+    const body = (await searchRequest?.json()) as {
+      query: { bool: { filter: unknown[] } };
+    };
+    expect(JSON.stringify(body.query.bool.filter)).toContain(
+      '"ownerId":"user_1"',
+    );
+    expect(
+      requests.find(({ url }) => url.endsWith("/_bulk?refresh=wait_for")),
+    ).toBeDefined();
+  });
+
+  test("无范围授权时使用 match_none", async () => {
+    let searchBody = "";
+    const index = createWorkOrderOpenSearchIndex(
+      { OPENSEARCH_URL: "http://opensearch:9200" },
+      async (input, init) => {
+        const request = new Request(input, init);
+        if (request.method === "HEAD")
+          return new Response(null, { status: 200 });
+        if (request.url.endsWith("/_search")) {
+          searchBody = await request.text();
+          return Response.json({ hits: { hits: [] } });
+        }
+        return Response.json({});
+      },
+    )!;
+    await index.synchronize(async () => []);
+    await index.search("工单", 5, undefined, {
+      actorId: "user_none",
+      branches: [],
+    });
+    expect(searchBody).toContain('"match_none"');
+  });
+});
+
+function workOrder(): WorkOrder {
+  return {
+    id: "ticket_1",
+    title: "办公网络中断",
+    description: "网络连接不稳定",
+    priority: "high",
+    workflowStatus: "open",
+    ownerId: "user_1",
+    departmentId: "dept_1",
+    status: "active",
+    createdAt: "2026-07-26T00:00:00.000Z",
+    createdBy: "user_1",
+    updatedAt: "2026-07-26T00:00:00.000Z",
+    updatedBy: "user_1",
+  };
+}