create-windy 0.2.34 → 0.3.1

package/template/apps/server/src/auth/password.ts

@@ -1,5 +1,5 @@
 import argon2, { argon2id } from "argon2";
-import { PASSWORD_POLICY } from "@southwind-ai/shared";
+import { PASSWORD_POLICY, type PasswordPolicy } from "@southwind-ai/shared";
 
 export { PASSWORD_POLICY } from "@southwind-ai/shared";
 
@@ -15,30 +15,39 @@ export interface PasswordHasher {
   verify(hash: string, password: string): Promise<boolean>;
 }
 
-export const argon2PasswordHasher: PasswordHasher = {
-  async hash(password) {
-    assertPasswordPolicy(password);
-    return argon2.hash(password, ARGON2_OPTIONS);
-  },
-  async verify(hash, password) {
-    if (!password || password.length > PASSWORD_POLICY.maxLength) {
-      return false;
-    }
-    try {
-      return await argon2.verify(hash, password);
-    } catch {
-      return false;
-    }
-  },
-};
+export const argon2PasswordHasher = createArgon2PasswordHasher();
 
-export function assertPasswordPolicy(password: string): void {
+export function createArgon2PasswordHasher(
+  policyProvider: () => PasswordPolicy = () => PASSWORD_POLICY,
+): PasswordHasher {
+  return {
+    async hash(password) {
+      assertPasswordPolicy(password, policyProvider());
+      return argon2.hash(password, ARGON2_OPTIONS);
+    },
+    async verify(hash, password) {
+      if (!password || password.length > 512) {
+        return false;
+      }
+      try {
+        return await argon2.verify(hash, password);
+      } catch {
+        return false;
+      }
+    },
+  };
+}
+
+export function assertPasswordPolicy(
+  password: string,
+  policy: PasswordPolicy = PASSWORD_POLICY,
+): void {
   if (
-    password.length < PASSWORD_POLICY.minLength ||
-    password.length > PASSWORD_POLICY.maxLength
+    password.length < policy.minLength ||
+    password.length > policy.maxLength
   ) {
     throw new Error(
-      `密码长度必须为 ${PASSWORD_POLICY.minLength}-${PASSWORD_POLICY.maxLength} 个字符`,
+      `密码长度必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
     );
   }
 }

package/template/apps/server/src/auth/routes.test-support.ts

@@ -0,0 +1,94 @@
+import { expect } from "bun:test";
+import type { AuditEvent, PasswordPolicy } from "@southwind-ai/shared";
+import { Elysia } from "elysia";
+import { createServerRuntime } from "../runtime.js";
+import { RepositoryActorResolver } from "./actor-resolver.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
+import { AuthService } from "./service.js";
+
+export function authFixture(
+  users: AuthUserRecord[],
+  passwordPolicy?: () => PasswordPolicy,
+  sessionTtlSeconds?: () => number,
+) {
+  const repository = new InMemoryAuthRepository(users);
+  const resolver = new RepositoryActorResolver(repository, {
+    sessionCookieName: "windy.sid",
+  });
+  const events: AuditEvent[] = [];
+  const runtime = createServerRuntime({}, { actorResolver: resolver });
+  const service = new AuthService(repository, {
+    passwordPolicy,
+    sessionTtlSeconds,
+    auditWriter: {
+      write(event) {
+        events.push(event);
+      },
+    },
+  });
+  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
+    guardContext: await runtime.createGuardContext(request),
+  }));
+  registerAuthSessionRoute(app);
+  registerAuthRoutes(app, service, { secureCookie: false });
+  return { app, events, repository, runtime };
+}
+
+export function createActiveUser(passwordHash: string): AuthUserRecord {
+  return {
+    id: "user_admin",
+    username: "admin",
+    displayName: "平台管理员",
+    email: "admin@windy.local",
+    phone: "13800138000",
+    passwordHash,
+    credentialState: "active",
+    status: "active",
+    roleCodes: ["developer"],
+    permissionKeys: ["system.user.manage", "system.audit.read"],
+  };
+}
+
+export async function loginWithPassword(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+  password: string,
+) {
+  const response = await app.handle(
+    jsonRequest("/api/auth/api/login", {
+      username,
+      password,
+    }),
+  );
+  expect(response.status).toBe(200);
+  return (await response.json()) as {
+    token: string;
+    sessionId: string;
+    expiresAt: string;
+  };
+}
+
+export function readCookieValue(header: string, name: string): string {
+  const value = header.split(";")[0]?.slice(`${name}=`.length);
+  return value ? decodeURIComponent(value) : "";
+}
+
+export function jsonRequest(path: string, body: unknown): Request {
+  return new Request(`http://localhost${path}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+export function apiRequest(
+  path: string,
+  token: string,
+  method = "GET",
+): Request {
+  return new Request(`http://localhost${path}`, {
+    method,
+    headers: { authorization: `Bearer ${token}` },
+  });
+}

package/template/apps/server/src/auth/routes.test.ts

@@ -1,12 +1,14 @@
 import { beforeAll, describe, expect, test } from "bun:test";
-import type { AuditEvent } from "@southwind-ai/shared";
-import { Elysia } from "elysia";
-import { createServerRuntime } from "../runtime.js";
-import { RepositoryActorResolver } from "./actor-resolver.js";
+import type { PasswordPolicy } from "@southwind-ai/shared";
 import { argon2PasswordHasher } from "./password.js";
-import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
-import { registerAuthRoutes, registerAuthSessionRoute } from "./routes.js";
-import { AuthService } from "./service.js";
+import {
+  apiRequest,
+  authFixture,
+  createActiveUser,
+  jsonRequest,
+  loginWithPassword,
+  readCookieValue,
+} from "./routes.test-support.js";
 
 let passwordHash = "";
 
@@ -14,7 +16,49 @@ beforeAll(async () => {
   passwordHash = await argon2PasswordHasher.hash("test-only-password");
 });
 
+function activeUser() {
+  return createActiveUser(passwordHash);
+}
+
+function login(
+  app: { handle(request: Request): Response | Promise<Response> },
+  username: string,
+) {
+  return loginWithPassword(app, username, "test-only-password");
+}
+
 describe("platform auth API", () => {
+  test("密码策略端点返回当前运行时策略且禁止缓存", async () => {
+    let policy: PasswordPolicy = { minLength: 16, maxLength: 64 };
+    const fixture = authFixture([activeUser()], () => policy);
+
+    const first = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    expect(first.headers.get("cache-control")).toBe("no-store");
+    await expect(first.json()).resolves.toEqual(policy);
+
+    policy = { minLength: 20, maxLength: 80 };
+    const second = await fixture.app.handle(
+      new Request("http://localhost/api/auth/password/policy"),
+    );
+    await expect(second.json()).resolves.toEqual(policy);
+  });
+
+  test("会话有效期配置即时影响后续签发会话", async () => {
+    let ttlSeconds = 60;
+    const fixture = authFixture([activeUser()], undefined, () => ttlSeconds);
+    const first = await login(fixture.app, "admin");
+
+    ttlSeconds = 120;
+    const second = await login(fixture.app, "admin");
+
+    expect(
+      new Date(second.expiresAt).getTime() -
+        new Date(first.expiresAt).getTime(),
+    ).toBeGreaterThan(59_000);
+  });
+
   test("会话探测只返回当前 Actor，不暴露 Token", async () => {
     const fixture = authFixture([activeUser()]);
     const anonymous = await fixture.app.handle(
@@ -277,74 +321,3 @@ describe("platform auth API", () => {
     );
   });
 });
-
-function authFixture(users: AuthUserRecord[]) {
-  const repository = new InMemoryAuthRepository(users);
-  const resolver = new RepositoryActorResolver(repository, {
-    sessionCookieName: "windy.sid",
-  });
-  const events: AuditEvent[] = [];
-  const runtime = createServerRuntime({}, { actorResolver: resolver });
-  const service = new AuthService(repository, {
-    auditWriter: {
-      write(event) {
-        events.push(event);
-      },
-    },
-  });
-  const app = new Elysia({ prefix: "/api" }).derive(async ({ request }) => ({
-    guardContext: await runtime.createGuardContext(request),
-  }));
-  registerAuthSessionRoute(app);
-  registerAuthRoutes(app, service, { secureCookie: false });
-  return { app, events, repository, runtime };
-}
-
-function activeUser(): AuthUserRecord {
-  return {
-    id: "user_admin",
-    username: "admin",
-    displayName: "平台管理员",
-    email: "admin@windy.local",
-    phone: "13800138000",
-    passwordHash,
-    credentialState: "active",
-    status: "active",
-    roleCodes: ["developer"],
-    permissionKeys: ["system.user.manage", "system.audit.read"],
-  };
-}
-
-async function login(
-  app: { handle(request: Request): Response | Promise<Response> },
-  username: string,
-) {
-  const response = await app.handle(
-    jsonRequest("/api/auth/api/login", {
-      username,
-      password: "test-only-password",
-    }),
-  );
-  expect(response.status).toBe(200);
-  return (await response.json()) as { token: string; sessionId: string };
-}
-
-function readCookieValue(header: string, name: string): string {
-  const value = header.split(";")[0]?.slice(`${name}=`.length);
-  return value ? decodeURIComponent(value) : "";
-}
-
-function jsonRequest(path: string, body: unknown): Request {
-  return new Request(`http://localhost${path}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body),
-  });
-}
-
-function apiRequest(path: string, token: string, method = "GET"): Request {
-  return new Request(`http://localhost${path}`, {
-    method,
-    headers: { authorization: `Bearer ${token}` },
-  });
-}

package/template/apps/server/src/auth/routes.ts

@@ -53,6 +53,10 @@ export function registerAuthRoutes(
   registerLoginRoutes(app, authService, options);
   registerOwnSessionRoutes(app, authService, options);
 
+  app.get("/auth/password/policy", () =>
+    json(authService.getPasswordPolicy(), 200, { "cache-control": "no-store" }),
+  );
+
   app.post("/auth/logout", async (rawContext) => {
     const context = rawContext as AuthRouteContext;
     const token = readRequestSessionToken(context.request, cookieName);
@@ -112,10 +116,11 @@ export function registerAuthRoutes(
       INVALID_PASSWORD: 400,
       PASSWORD_UNCHANGED: 400,
     } as const;
+    const policy = authService.getPasswordPolicy();
     const messages = {
       USER_NOT_FOUND: "当前账号不存在",
       INVALID_CURRENT_PASSWORD: "当前密码错误",
-      INVALID_PASSWORD: "新密码必须为 12-128 个字符",
+      INVALID_PASSWORD: `新密码必须为 ${policy.minLength}-${policy.maxLength} 个字符`,
       PASSWORD_UNCHANGED: "新密码不能与当前密码相同",
     } as const;
     return json(

package/template/apps/server/src/auth/runtime.ts

@@ -1,10 +1,12 @@
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
+import type { PasswordPolicy } from "@southwind-ai/shared";
 import { InMemoryAuthRepository, type AuthRepository } from "./repository.js";
 import { AuthService } from "./service.js";
 
 interface AuthRuntimeInput {
   repository?: AuthRepository;
-  sessionTtlSeconds: number;
+  sessionTtlSeconds: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   auditWriter: AuditEventWriter["write"];
   auditReader?: AuditEventReader;
 }
@@ -13,6 +15,7 @@ export function createAuthRuntime(input: AuthRuntimeInput) {
   const authRepository = input.repository ?? new InMemoryAuthRepository();
   const authService = new AuthService(authRepository, {
     sessionTtlSeconds: input.sessionTtlSeconds,
+    passwordPolicy: input.passwordPolicy,
     auditWriter: { write: input.auditWriter },
     auditReader: input.auditReader,
   });

package/template/apps/server/src/auth/service.ts

@@ -1,6 +1,10 @@
 import { randomBytes } from "node:crypto";
 import { randomUUIDv7 } from "bun";
-import type { AuditEvent } from "@southwind-ai/shared";
+import {
+  PASSWORD_POLICY,
+  type AuditEvent,
+  type PasswordPolicy,
+} from "@southwind-ai/shared";
 import type { RequestActor } from "../guards.js";
 import type { AuditEventReader, AuditEventWriter } from "../runtime.js";
 import { hashSessionToken } from "./actor-resolver.js";
@@ -8,7 +12,7 @@ import {
   AuthenticationProviderRegistry,
   LocalArgon2AuthenticationAdapter,
 } from "./authentication-provider.js";
-import { argon2PasswordHasher, type PasswordHasher } from "./password.js";
+import { createArgon2PasswordHasher, type PasswordHasher } from "./password.js";
 import type { AuthRepository, AuthSessionRecord } from "./repository.js";
 import {
   CredentialService,
@@ -42,7 +46,8 @@ export type RevokeResult =
   | { ok: false; code: "SESSION_NOT_FOUND" | "FORBIDDEN" };
 
 export interface AuthServiceOptions {
-  sessionTtlSeconds?: number;
+  sessionTtlSeconds?: number | (() => number);
+  passwordPolicy?: () => PasswordPolicy;
   now?: () => Date;
   tokenFactory?: () => string;
   passwordHasher?: PasswordHasher;
@@ -52,7 +57,8 @@ export interface AuthServiceOptions {
 }
 
 export class AuthService {
-  private readonly sessionTtlSeconds: number;
+  private readonly sessionTtlSeconds: () => number;
+  private readonly passwordPolicy: () => PasswordPolicy;
   private readonly now: () => Date;
   private readonly tokenFactory: () => string;
   private readonly passwordHasher: PasswordHasher;
@@ -64,11 +70,17 @@ export class AuthService {
     private readonly repository: AuthRepository,
     private readonly options: AuthServiceOptions,
   ) {
-    this.sessionTtlSeconds = options.sessionTtlSeconds || 60 * 60 * 8;
+    const sessionTtlSeconds = options.sessionTtlSeconds;
+    this.sessionTtlSeconds =
+      typeof sessionTtlSeconds === "function"
+        ? sessionTtlSeconds
+        : () => sessionTtlSeconds || 60 * 60 * 8;
+    this.passwordPolicy = options.passwordPolicy || (() => PASSWORD_POLICY);
     this.now = options.now || (() => new Date());
     this.tokenFactory =
       options.tokenFactory || (() => randomBytes(32).toString("base64url"));
-    this.passwordHasher = options.passwordHasher || argon2PasswordHasher;
+    this.passwordHasher =
+      options.passwordHasher || createArgon2PasswordHasher(this.passwordPolicy);
     this.authenticationProviders =
       options.authenticationProviders ||
       new AuthenticationProviderRegistry(
@@ -140,7 +152,9 @@ export class AuthService {
       tokenHash: hashSessionToken(token),
       status: "active",
       issuedAt,
-      expiresAt: new Date(issuedAt.getTime() + this.sessionTtlSeconds * 1_000),
+      expiresAt: new Date(
+        issuedAt.getTime() + this.sessionTtlSeconds() * 1_000,
+      ),
       ip: metadata.ip,
       userAgent: metadata.userAgent,
     };
@@ -211,6 +225,10 @@ export class AuthService {
     );
   }
 
+  getPasswordPolicy(): PasswordPolicy {
+    return { ...this.passwordPolicy() };
+  }
+
   async revokeSession(
     sessionId: string,
     actor: RequestActor,

package/template/apps/server/src/configuration/bootstrap.ts

@@ -3,6 +3,10 @@ import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { FoundationSnapshot } from "../foundation.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { RouteApp } from "../system/route-types.js";
+// @windy-module system.storage begin
+import type { UploadService } from "@southwind-ai/storage";
+import { createPlatformUploadPolicies } from "../storage/runtime.js";
+// @windy-module system.storage end
 import {
   createRedisHealthProbe,
   type RedisHealthProbe,
@@ -21,6 +25,9 @@ export async function bootstrapModuleConfiguration(
 ): Promise<{
   service: ModuleConfigurationService;
   bindFoundation(snapshot: FoundationSnapshot): void;
+  // @windy-module system.storage begin
+  bindStorage(uploads: Pick<UploadService, "setPolicy">): void;
+  // @windy-module system.storage end
   redisHealthProbe: RedisHealthProbe;
   register(
     app: Pick<RouteApp, "get" | "post">,
@@ -37,12 +44,24 @@ export async function bootstrapModuleConfiguration(
   return {
     service,
     bindFoundation(snapshot) {
-      adapter.setListener({
+      snapshot.platform.enableAI = config.enableAI;
+      adapter.addListener({
         applied(current) {
           snapshot.platform.enableAI = current.enableAI;
         },
       });
     },
+    // @windy-module system.storage begin
+    bindStorage(uploads: Pick<UploadService, "setPolicy">) {
+      adapter.addListener({
+        applied(current) {
+          for (const policy of createPlatformUploadPolicies(current)) {
+            uploads.setPolicy(policy);
+          }
+        },
+      });
+    },
+    // @windy-module system.storage end
     redisHealthProbe: createLiveRedisHealthProbe(config),
     register(app, runtime, features) {
       registerModuleConfigurationRoutes(app, service, runtime, features);

package/template/apps/server/src/configuration/definition.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, test } from "bun:test";
+import { loadPlatformConfig } from "@southwind-ai/config";
+import { PlatformConfigApplyAdapter } from "./definition.js";
+
+describe("平台类型化运行配置", () => {
+  test("白名单不包含 SMTP Secret 且旧版本缺失字段由环境基线补齐", () => {
+    const config = loadPlatformConfig({
+      MAIL_SMTP_URL: "smtp://secret-marker@example.invalid",
+    });
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    expect(definition.fields.map((field) => field.path)).not.toContain(
+      "mail.smtpUrl",
+    );
+    expect(JSON.stringify(definition.baseValues())).not.toContain(
+      "secret-marker",
+    );
+    expect(
+      definition.validate({
+        enableAI: true,
+        "cache.healthTimeoutMs": 500,
+      }),
+    ).toMatchObject({
+      enableAI: true,
+      "cache.healthTimeoutMs": 500,
+      "security.passwordMinLength": 12,
+      "security.passwordMaxLength": 128,
+      "regional.timeZone": "Asia/Shanghai",
+    });
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.smtpUrl": "smtp://must-not-persist",
+      }),
+    ).toThrow();
+    expect(() =>
+      definition.validate({
+        ...definition.baseValues(),
+        "mail.enabled": true,
+      }),
+    ).toThrow();
+  });
+
+  test("即时字段应用到共享运行配置对象", async () => {
+    const config = loadPlatformConfig({});
+    const definition = new PlatformConfigApplyAdapter(config).definition();
+
+    await definition.apply(
+      definition.validate({
+        ...definition.baseValues(),
+        "security.sessionTtlSeconds": 3_600,
+        "security.passwordMinLength": 16,
+        "security.passwordMaxLength": 64,
+        "storage.bulkDataMaxByteSize": 1_048_576,
+        "storage.brandingLogoMaxByteSize": 262_144,
+        "regional.timeZone": "UTC",
+      }),
+    );
+
+    expect(config.security).toMatchObject({
+      sessionTtlSeconds: 3_600,
+      passwordMinLength: 16,
+      passwordMaxLength: 64,
+    });
+    expect(config.storage).toEqual({
+      bulkDataMaxByteSize: 1_048_576,
+      brandingLogoMaxByteSize: 262_144,
+    });
+    expect(config.regional.timeZone).toBe("UTC");
+  });
+});