create-windy 0.3.0 → 0.3.2

package/template/apps/server/src/system/drizzle-system.ts

@@ -1,14 +1,3 @@
-import {
-  departments,
-  dictionaries,
-  featureFlags,
-  // @windy-module system.license begin
-  legacyLicenses,
-  // @windy-module system.license end
-  menus,
-  roles,
-  users,
-} from "@southwind-ai/database";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { ManifestFeatureRepository } from "../feature/manifest-feature-repository.js";
 import type {
@@ -22,33 +11,26 @@ import type {
   ManagedRole,
   ManagedUser,
 } from "./entities.js";
-import {
-  array,
-  auditEntity,
-  auditRow,
-  // @windy-module system.license begin
-  date,
-  iso,
-  optionalIso,
-  // @windy-module system.license end
-  pick,
-} from "./drizzle-mapping.js";
-import {
-  DrizzleEntityRepository,
-  type DrizzleEntityRepositoryConfig,
-} from "./drizzle-repository.js";
-import {
-  DrizzleScopedEntityRepository,
-  type DrizzleScopedEntityRepositoryConfig,
-} from "./drizzle-scoped-repository.js";
+import { DrizzleScopedEntityRepository } from "./drizzle-scoped-repository.js";
 import type { EntityRepository } from "./repository.js";
 import type { ScopedEntityRepository } from "../data-access/scoped-repository.js";
-import { userDataScopeBinding } from "./user-data-scope.js";
 import { DrizzleTransactionContext } from "./drizzle-transaction-context.js";
 import {
   PostgresAdvisoryMutationRunner,
   type MutationRunner,
 } from "./mutation-runner.js";
+import {
+  createSystemEntityRepository,
+  departmentConfig,
+  dictionaryConfig,
+  featureConfig,
+  // @windy-module system.license begin
+  licenseConfig,
+  // @windy-module system.license end
+  menuConfig,
+  roleConfig,
+  userConfig,
+} from "./drizzle-system-configs.js";
 
 export interface DrizzleSystemRepositorySeeds {
   users: ManagedUser[];
@@ -86,23 +68,39 @@ export function createDrizzleSystemRepositories(
       userConfig(seeds.users),
       transactionContext,
     ),
-    roles: repo(db, roleConfig(seeds.roles), transactionContext),
-    departments: repo(
+    roles: createSystemEntityRepository(
+      db,
+      roleConfig(seeds.roles),
+      transactionContext,
+    ),
+    departments: createSystemEntityRepository(
       db,
       departmentConfig(seeds.departments),
       transactionContext,
     ),
-    menus: repo(db, menuConfig(seeds.menus), transactionContext),
-    dictionaries: repo(
+    menus: createSystemEntityRepository(
+      db,
+      menuConfig(seeds.menus),
+      transactionContext,
+    ),
+    dictionaries: createSystemEntityRepository(
       db,
       dictionaryConfig(seeds.dictionaries),
       transactionContext,
     ),
     features: new ManifestFeatureRepository(
-      repo(db, featureConfig(seeds.features), transactionContext),
+      createSystemEntityRepository(
+        db,
+        featureConfig(seeds.features),
+        transactionContext,
+      ),
     ),
     // @windy-module system.license begin
-    licenses: repo(db, licenseConfig(seeds.licenses), transactionContext),
+    licenses: createSystemEntityRepository(
+      db,
+      licenseConfig(seeds.licenses),
+      transactionContext,
+    ),
     // @windy-module system.license end
     organizationMutationRunner: new PostgresAdvisoryMutationRunner(
       db,
@@ -111,281 +109,3 @@ export function createDrizzleSystemRepositories(
     ),
   };
 }
-
-function repo<
-  T extends
-    | ManagedUser
-    | ManagedRole
-    | ManagedDepartment
-    | ManagedMenu
-    | ManagedDictionary
-    | ManagedFeature
-    // @windy-module system.license begin
-    | ManagedLicense,
-  // @windy-module system.license end
->(
-  db: NodePgDatabase,
-  config: DrizzleEntityRepositoryConfig<T>,
-  transactionContext: DrizzleTransactionContext,
-) {
-  return new DrizzleEntityRepository<T>(db, config, transactionContext);
-}
-
-function userConfig(
-  seedItems: ManagedUser[],
-): DrizzleScopedEntityRepositoryConfig<ManagedUser> {
-  return {
-    table: users,
-    idColumn: "id",
-    seedItems,
-    dataScope: {
-      drizzle: {
-        ownerId: users.id,
-        tenant: { mode: "fixed", tenantId: "single-tenant" },
-        dimensions: { departmentId: users.departmentId },
-      },
-      entity: userDataScopeBinding,
-    },
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "username",
-        "displayName",
-        "email",
-        "phone",
-        "departmentId",
-        "roleIds",
-        "postIds",
-        "status",
-      ]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "username",
-          "displayName",
-          "email",
-          "phone",
-          "departmentId",
-          "postIds",
-          "status",
-        ]),
-        roleIds: array(row.roleIds),
-      }) as ManagedUser,
-  };
-}
-
-function roleConfig(
-  seedItems: ManagedRole[],
-): DrizzleEntityRepositoryConfig<ManagedRole> {
-  return {
-    table: roles,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "code",
-        "name",
-        "dataScope",
-        "permissionKeys",
-        "menuKeys",
-        "departmentIds",
-        "status",
-      ]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "code", "name", "dataScope", "status"]),
-        permissionKeys: array(row.permissionKeys),
-        menuKeys: array(row.menuKeys),
-        departmentIds: array(row.departmentIds),
-      }) as ManagedRole,
-  };
-}
-
-function departmentConfig(
-  seedItems: ManagedDepartment[],
-): DrizzleEntityRepositoryConfig<ManagedDepartment> {
-  return {
-    table: departments,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, ["id", "parentId", "name", "code", "order", "status"]),
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "parentId", "name", "code", "order", "status"]),
-      }) as ManagedDepartment,
-  };
-}
-
-function menuConfig(
-  seedItems: ManagedMenu[],
-): DrizzleEntityRepositoryConfig<ManagedMenu> {
-  return {
-    table: menus,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "key",
-        "title",
-        "type",
-        "order",
-        "path",
-        "component",
-        "icon",
-        "permissionKey",
-        "featureKey",
-        "parentKey",
-        "status",
-      ]),
-      visible: item.visible ? "visible" : "hidden",
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "key",
-          "title",
-          "type",
-          "order",
-          "path",
-          "component",
-          "icon",
-          "permissionKey",
-          "featureKey",
-          "parentKey",
-          "status",
-        ]),
-        visible: row.visible !== "hidden",
-      }) as ManagedMenu,
-  };
-}
-
-function dictionaryConfig(
-  seedItems: ManagedDictionary[],
-): DrizzleEntityRepositoryConfig<ManagedDictionary> {
-  return {
-    table: dictionaries,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, ["id", "code", "name", "description", "status"]),
-      items: item.items || [],
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, ["id", "code", "name", "description", "status"]),
-        items: array(row.items),
-      }) as ManagedDictionary,
-  };
-}
-
-function featureConfig(
-  seedItems: ManagedFeature[],
-): DrizzleEntityRepositoryConfig<ManagedFeature> {
-  return {
-    table: featureFlags,
-    idColumn: "key",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      key: item.key || item.id,
-      module: item.module,
-      label: item.label,
-      description: item.description,
-      enabled: item.enabled,
-      visible: item.visible,
-      stage: item.stage,
-      licenseRequired: false,
-      licenseKey: item.requiredEntitlement,
-      allowedLicenseVersions: item.licenseVersionOverride,
-      dependencies: item.dependencies || [],
-      status: item.status,
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        id: String(row.key),
-        key: String(row.key),
-        module: String(row.module),
-        label: String(row.label),
-        description: row.description as string | undefined,
-        enabled: Boolean(row.enabled),
-        visible: row.visible === "hidden" ? "hidden" : "visible",
-        stage: String(row.stage || "stable") as ManagedFeature["stage"],
-        requiredEntitlement: row.licenseKey
-          ? (row.licenseKey as NonNullable<
-              ManagedFeature["requiredEntitlement"]
-            >)
-          : undefined,
-        licenseVersionOverride: Array.isArray(row.allowedLicenseVersions)
-          ? (row.allowedLicenseVersions as NonNullable<
-              ManagedFeature["licenseVersionOverride"]
-            >)
-          : undefined,
-        dependencies: array(row.dependencies),
-        status: String(row.status || "active") as ManagedFeature["status"],
-      }) as ManagedFeature,
-  };
-}
-
-// @windy-module system.license begin
-function licenseConfig(
-  seedItems: ManagedLicense[],
-): DrizzleEntityRepositoryConfig<ManagedLicense> {
-  return {
-    table: legacyLicenses,
-    idColumn: "id",
-    seedItems,
-    toRow: (item) => ({
-      ...auditRow(item),
-      ...pick(item, [
-        "id",
-        "licenseKey",
-        "subject",
-        "machineCode",
-        "publicKeyId",
-        "edition",
-        "modules",
-        "status",
-      ]),
-      issuedAt: date(item.issuedAt),
-      expiresAt: item.expiresAt ? date(item.expiresAt) : undefined,
-      payload: { modules: item.modules },
-      signature: "",
-    }),
-    toEntity: (row) =>
-      ({
-        ...auditEntity(row),
-        ...pick(row, [
-          "id",
-          "licenseKey",
-          "subject",
-          "machineCode",
-          "publicKeyId",
-          "edition",
-          "status",
-        ]),
-        modules: array(row.modules),
-        issuedAt: iso(row.issuedAt),
-        expiresAt: optionalIso(row.expiresAt),
-      }) as ManagedLicense,
-  };
-}
-// @windy-module system.license end

package/template/apps/server/src/system/resource-routes.ts

@@ -0,0 +1,270 @@
+import { recordMutationAudit } from "../audit/policy.js";
+import { searchAuditEvent } from "../audit/search-summary.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { ManagedEntity } from "./entities.js";
+import {
+  asPartial,
+  notFound,
+  parseImportPayload,
+  parseListQuery,
+  requiredId,
+  resourceEvent,
+  routeContext,
+} from "./route-helpers.js";
+import type { ResourceRouteConfig, RouteApp } from "./route-types.js";
+import { withPermission } from "./resource-route-support.js";
+import {
+  accessCall,
+  importNotSupported,
+  readAccessible,
+  resourceConflict,
+} from "./resource-access-response.js";
+import { runResourceMutation } from "./mutation-runner.js";
+import { registerResourceExportRoute } from "./resource-export-route.js";
+import {
+  projectEntity,
+  projectEntities,
+  projectImportResult,
+} from "./response-projection.js";
+
+export function registerResourceRoutes<T extends ManagedEntity>(
+  app: RouteApp,
+  config: ResourceRouteConfig<T>,
+  runtime: ReturnType<typeof createServerRuntime>,
+) {
+  app.get(`/system/${config.path}`, (rawContext) => {
+    const { guardContext, query } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "GET",
+      config.permissionResource,
+      "read",
+      config.feature,
+      async () => {
+        const listQuery = parseListQuery(query);
+        if (listQuery instanceof Response) return listQuery;
+        const result = await accessCall(() =>
+          config.dataAccess.mode === "request"
+            ? config.dataAccess.access.list(
+                listQuery,
+                config.searchFields,
+                guardContext.actor,
+              )
+            : config.repository.list(listQuery, config.searchFields),
+        );
+        if (result instanceof Response) return result;
+        const search = listQuery.q?.trim();
+        if (search) {
+          runtime.auditSink.recordEvent(
+            searchAuditEvent(guardContext, config.path, search, result.total),
+          );
+        }
+        return { ...result, items: projectEntities(config, result.items) };
+      },
+    );
+  });
+
+  if (config.backupExport !== false) {
+    registerResourceExportRoute(app, config, runtime);
+  }
+
+  app.get(`/system/${config.path}/:id`, (rawContext) => {
+    const { guardContext, params } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "GET",
+      config.permissionResource,
+      "read",
+      config.feature,
+      async () => {
+        const item = await readAccessible(
+          config,
+          requiredId(params),
+          guardContext.actor,
+        );
+        if (item instanceof Response) return item;
+        return item
+          ? projectEntity(config, item)
+          : notFound(config.path, requiredId(params));
+      },
+    );
+  });
+
+  if (config.readonly) {
+    return;
+  }
+
+  app.post(`/system/${config.path}/import`, (rawContext) => {
+    const { guardContext, body } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "POST",
+      config.permissionResource,
+      "manage",
+      config.feature,
+      async () => {
+        if (config.importable === false) {
+          return importNotSupported();
+        }
+        const payload = parseImportPayload<T>(body);
+        const result = await accessCall(() =>
+          config.dataAccess.mode === "request"
+            ? config.dataAccess.access.importMany(
+                payload.items,
+                guardContext.actor,
+                payload.mode,
+              )
+            : config.repository.importMany(
+                payload.items,
+                guardContext.actor,
+                payload.mode,
+              ),
+        );
+        if (result instanceof Response) return result;
+        await recordMutationAudit(
+          runtime,
+          config.path,
+          resourceEvent(guardContext, "data.import", config.path, undefined, {
+            created: result.created,
+            updated: result.updated,
+            skipped: result.skipped,
+            total: payload.items.length,
+          }),
+        );
+        return {
+          ...projectImportResult(config, result),
+          total: payload.items.length,
+        };
+      },
+    );
+  });
+
+  app.post(`/system/${config.path}`, (rawContext) => {
+    const { guardContext, body } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "POST",
+      config.permissionResource,
+      "manage",
+      config.feature,
+      async () =>
+        runResourceMutation(config, async () => {
+          const input = asPartial<T>(body);
+          const validationError = await config.validateInput?.(input);
+          if (validationError) return invalidResource(validationError);
+          const policyError = await config.beforeCreate?.(input);
+          if (policyError) return resourceConflict(policyError);
+          const item = await accessCall(() =>
+            config.dataAccess.mode === "request"
+              ? config.dataAccess.access.create(input, guardContext.actor)
+              : config.repository.create(input, guardContext.actor),
+          );
+          if (item instanceof Response) return item;
+          await recordMutationAudit(
+            runtime,
+            config.path,
+            resourceEvent(guardContext, "crud.create", config.path, item.id),
+          );
+          return projectEntity(config, item);
+        }),
+    );
+  });
+
+  app.put(`/system/${config.path}/:id`, (rawContext) => {
+    const { guardContext, params, body } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "PUT",
+      config.permissionResource,
+      "manage",
+      config.feature,
+      async () =>
+        runResourceMutation(config, async () => {
+          const id = requiredId(params);
+          const input = asPartial<T>(body);
+          const current = await readAccessible(config, id, guardContext.actor);
+          if (current instanceof Response) return current;
+          if (!current) return notFound(config.path, id);
+          const validationError = await config.validateInput?.(input, current);
+          if (validationError) return invalidResource(validationError);
+          const policyError = await config.beforeUpdate?.(current, input);
+          if (policyError) return resourceConflict(policyError);
+          const item = await accessCall(() =>
+            config.dataAccess.mode === "request"
+              ? config.dataAccess.access.update(id, input, guardContext.actor)
+              : config.repository.update(id, input, guardContext.actor),
+          );
+          if (item instanceof Response) return item;
+          if (!item) {
+            return notFound(config.path, id);
+          }
+          await config.afterUpdate?.(current, item, guardContext.actor);
+          await recordMutationAudit(
+            runtime,
+            config.path,
+            resourceEvent(guardContext, "crud.update", config.path, id),
+          );
+          return projectEntity(config, item);
+        }),
+    );
+  });
+
+  app.delete(`/system/${config.path}/:id`, (rawContext) => {
+    const { guardContext, params } = routeContext(rawContext);
+    return withPermission(
+      runtime,
+      guardContext,
+      "DELETE",
+      config.permissionResource,
+      "manage",
+      config.feature,
+      async () =>
+        runResourceMutation(config, async () => {
+          const id = requiredId(params);
+          const current = await readAccessible(config, id, guardContext.actor);
+          if (current instanceof Response) return current;
+          if (!current) return notFound(config.path, id);
+          const policyError = await config.beforeDelete?.(current);
+          if (policyError) return resourceConflict(policyError);
+          const item = await accessCall(() =>
+            config.dataAccess.mode === "request"
+              ? config.dataAccess.access.softDelete(id, guardContext.actor)
+              : config.repository.softDelete(id, guardContext.actor),
+          );
+          if (item instanceof Response) return item;
+          if (!item) {
+            return notFound(config.path, id);
+          }
+          await config.afterDelete?.(item, guardContext.actor);
+          await recordMutationAudit(
+            runtime,
+            config.path,
+            resourceEvent(guardContext, "crud.delete", config.path, id),
+          );
+          return projectEntity(config, item);
+        }),
+    );
+  });
+}
+
+function invalidResource(
+  error: NonNullable<
+    Awaited<
+      ReturnType<
+        NonNullable<ResourceRouteConfig<ManagedEntity>["validateInput"]>
+      >
+    >
+  >,
+): Response {
+  return Response.json(
+    typeof error === "string"
+      ? { error: "INVALID_RESOURCE", message: error }
+      : error,
+    { status: 400 },
+  );
+}