create-windy 0.3.18 → 0.4.0

package/template/packages/modules/src/system-api-binding.ts

@@ -1,10 +1,25 @@
-import type { ApiPermissionBinding, HttpMethod } from "@southwind-ai/shared";
+import type {
+  ApiPermissionBinding,
+  AuditActionType,
+  HttpMethod,
+} from "@southwind-ai/shared";
 
 interface ResourceBindingInput {
   path: string;
   permissionResource: string;
   featureKey?: string;
   backupExport?: boolean;
+  auditActions?: Partial<ResourceAuditActions>;
+}
+
+interface ResourceAuditActions {
+  list: AuditActionType;
+  export: AuditActionType;
+  detail: AuditActionType;
+  import: AuditActionType;
+  create: AuditActionType;
+  update: AuditActionType;
+  delete: AuditActionType;
 }
 
 export function resourceBindings(
@@ -13,16 +28,34 @@ export function resourceBindings(
   const base = `/api/system/${input.path}`;
   const read = `system.${input.permissionResource}.read`;
   const manage = `system.${input.permissionResource}.manage`;
+  const audit = {
+    list: "data.read",
+    export: "data.export",
+    detail: "data.read",
+    import: "data.import",
+    create: "crud.create",
+    update: "crud.update",
+    delete: "crud.delete",
+    ...input.auditActions,
+  } satisfies ResourceAuditActions;
   return [
-    binding("GET", base, read, input.featureKey),
+    binding("GET", base, read, input.featureKey, audit.list),
     ...(input.backupExport === false
       ? []
-      : [binding("GET", `${base}/export`, read, input.featureKey)]),
-    binding("GET", `${base}/:id`, read, input.featureKey),
-    binding("POST", `${base}/import`, manage, input.featureKey),
-    binding("POST", base, manage, input.featureKey),
-    binding("PUT", `${base}/:id`, manage, input.featureKey),
-    binding("DELETE", `${base}/:id`, manage, input.featureKey),
+      : [
+          binding(
+            "GET",
+            `${base}/export`,
+            read,
+            input.featureKey,
+            audit.export,
+          ),
+        ]),
+    binding("GET", `${base}/:id`, read, input.featureKey, audit.detail),
+    binding("POST", `${base}/import`, manage, input.featureKey, audit.import),
+    binding("POST", base, manage, input.featureKey, audit.create),
+    binding("PUT", `${base}/:id`, manage, input.featureKey, audit.update),
+    binding("DELETE", `${base}/:id`, manage, input.featureKey, audit.delete),
   ];
 }
 
@@ -31,7 +64,8 @@ export function binding(
   path: string,
   permissionKey: string,
   featureKey?: string,
+  auditAction?: AuditActionType,
   anonymous?: boolean,
 ): ApiPermissionBinding {
-  return { method, path, permissionKey, featureKey, anonymous };
+  return { method, path, permissionKey, featureKey, auditAction, anonymous };
 }

package/template/packages/modules/src/system-api-control-plane.ts

@@ -0,0 +1,202 @@
+import type { ApiPermissionBinding } from "@southwind-ai/shared";
+import { binding } from "./system-api-binding.js";
+
+/**
+ * 不走资源 CRUD 的平台入口仍必须进入 Manifest。
+ *
+ * 认证自服务 Route 使用 anonymous=true 表示不受 RBAC 权限点控制；Handler 仍会校验
+ * 登录态、当前会话和对象所有权。Swagger 等纯框架 Route 不在这里声明。
+ */
+export function systemControlPlaneApiPermissionBindings(): ApiPermissionBinding[] {
+  return [
+    ...runtimeBindings(),
+    ...sessionBindings(),
+    // @windy-module system.agent begin
+    ...aiRuntimeBindings(),
+    // @windy-module system.agent end
+    // @windy-module system.license begin
+    binding(
+      "GET",
+      "/api/license/runtime",
+      "system.license.read",
+      "system.license",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/license/runtime/install",
+      "system.license.manage",
+      "system.license",
+      "license.update",
+    ),
+    // @windy-module system.license end
+    // @windy-module system.agent begin
+    binding(
+      "GET",
+      "/api/agent/tools",
+      "system.agent.read",
+      "system.agent",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/agent/tools/:key/execute",
+      "system.agent.read",
+      "system.agent",
+      "agent.tool.execute",
+    ),
+    // @windy-module system.agent end
+  ];
+}
+
+// @windy-module system.agent begin
+function aiRuntimeBindings(): ApiPermissionBinding[] {
+  const read = [
+    "/api/internal/ai/artifacts",
+    "/api/document/runs/:runId/events",
+    "/api/document/runs/:runId/result",
+    "/api/speech/runs/:runId/events",
+    "/api/speech/runs/:runId/result",
+    "/api/speech/runs/:runId/artifact",
+    "/api/agent/runs/:runId/events",
+    "/api/agent/runs/:runId/result",
+  ].map((path) =>
+    binding(
+      "GET",
+      path,
+      "system.agent.read",
+      "system.agent",
+      "data.read",
+      path.startsWith("/api/internal/"),
+    ),
+  );
+  const execute = [
+    "/api/document/runs",
+    "/api/document/runs/:runId/cancel",
+    "/api/speech/runs",
+    "/api/speech/runs/:runId/cancel",
+    "/api/embeddings",
+    "/api/agent/runs",
+    "/api/agent/runs/:runId/cancel",
+    "/api/agent/runs/:runId/attach",
+    "/api/internal/agent/tools/execute",
+  ].map((path) =>
+    binding(
+      "POST",
+      path,
+      "system.agent.read",
+      "system.agent",
+      "agent.operation.execute",
+      path.startsWith("/api/internal/"),
+    ),
+  );
+  return [...read, ...execute];
+}
+// @windy-module system.agent end
+
+function runtimeBindings(): ApiPermissionBinding[] {
+  return ["/api/live", "/api/ready", "/api/health", "/api/metrics"].map(
+    (path) =>
+      binding(
+        "GET",
+        path,
+        "system.runtime.read",
+        "system.runtime",
+        undefined,
+        true,
+      ),
+  );
+}
+
+function sessionBindings(): ApiPermissionBinding[] {
+  return [
+    binding(
+      "GET",
+      "/api/auth/session",
+      "system.auth.access",
+      "system.auth",
+      "data.read",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/login",
+      "system.auth.access",
+      "system.auth",
+      "auth.login",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/api/login",
+      "system.auth.access",
+      "system.auth",
+      "auth.login",
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/auth/sessions",
+      "system.profile.read",
+      "system.profile",
+      "data.read",
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/auth/login-events",
+      "system.profile.read",
+      "system.profile",
+      "data.read",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/sessions/revoke-all",
+      "system.profile.manage",
+      "system.profile",
+      "auth.session.revoke",
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/auth/password/policy",
+      "system.auth.access",
+      "system.auth",
+      "data.read",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/logout",
+      "system.auth.access",
+      "system.auth",
+      "auth.session.revoke",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/password/change",
+      "system.profile.manage",
+      "system.profile",
+      "auth.password.update",
+      true,
+    ),
+    binding(
+      "POST",
+      "/api/auth/sessions/:id/revoke",
+      "system.profile.manage",
+      "system.profile",
+      "auth.session.revoke",
+      true,
+    ),
+    binding(
+      "GET",
+      "/api/session/context",
+      "system.auth.access",
+      "system.auth",
+      "data.read",
+      true,
+    ),
+  ];
+}

package/template/packages/modules/src/system-api-data-governance.ts

@@ -9,13 +9,15 @@ export function dataGovernanceApiPermissionBindings(): ApiPermissionBinding[] {
       "GET",
       "/api/system/users/:id/plaintext",
       "system.user.reveal",
-      "system.rbac",
+      "system.user",
+      "data.plaintext.read",
     ),
     binding(
       "POST",
       "/api/system/users/plaintext/batch",
       "system.user.reveal",
-      "system.rbac",
+      "system.user",
+      "data.plaintext.batch-read",
     ),
   ];
 }

package/template/packages/modules/src/system-api-operational.ts

@@ -10,47 +10,60 @@ export function systemOperationalApiPermissionBindings(): ApiPermissionBinding[]
       "/api/system/storage/uploads",
       "system.storage.create",
       "system.storage",
+      "file.upload.create",
     ),
     binding(
       "GET",
       "/api/system/storage/uploads/:id",
       "system.storage.create",
       "system.storage",
+      "data.read",
     ),
     binding(
       "PUT",
       "/api/system/storage/uploads/:id/parts/:partNumber",
       "system.storage.create",
       "system.storage",
+      "file.upload.part.write",
     ),
     binding(
       "POST",
       "/api/system/storage/uploads/:id/complete",
       "system.storage.create",
       "system.storage",
+      "file.upload.complete",
     ),
     binding(
       "DELETE",
       "/api/system/storage/uploads/:id",
       "system.storage.create",
       "system.storage",
+      "file.upload.abort",
     ),
     binding(
       "GET",
       "/api/system/storage/files/:id",
       "system.storage.read",
       "system.storage",
+      "file.download",
     ),
     binding(
       "GET",
       "/api/platform/files/:id",
       "system.settings.read",
       "system.settings",
+      undefined,
       true,
     ),
     // @windy-module system.storage end
     // @windy-module system.operations begin
-    binding("GET", "/api/system/operations", "system.ops.read", "system.ops"),
+    binding(
+      "GET",
+      "/api/system/operations",
+      "system.ops.read",
+      "system.ops",
+      "data.read",
+    ),
     // @windy-module system.operations end
     // @windy-module system.notification begin
     binding(
@@ -58,78 +71,91 @@ export function systemOperationalApiPermissionBindings(): ApiPermissionBinding[]
       "/api/notifications",
       "system.notification.read",
       "system.notification",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/notifications/preferences",
       "system.notification.read",
       "system.notification",
+      "data.read",
     ),
     binding(
       "PUT",
       "/api/notifications/preferences",
       "system.notification.read",
       "system.notification",
+      "notification.preference.update",
     ),
     binding(
       "POST",
       "/api/notifications/:id/read",
       "system.notification.read",
       "system.notification",
+      "notification.read",
     ),
     binding(
       "PUT",
       "/api/notifications/:id/favorite",
       "system.notification.read",
       "system.notification",
+      "notification.favorite",
     ),
     binding(
       "DELETE",
       "/api/notifications/:id/favorite",
       "system.notification.read",
       "system.notification",
+      "notification.unfavorite",
     ),
     binding(
       "GET",
       "/api/system/notifications/audience-options",
       "system.notification.manage",
       "system.notification",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/system/notifications/:id/deliveries",
       "system.notification.manage",
       "system.notification",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/system/notifications",
       "system.notification.manage",
       "system.notification",
+      "data.read",
     ),
     binding(
       "POST",
       "/api/system/notifications",
       "system.notification.manage",
       "system.notification",
+      "notification.publish",
     ),
     binding(
       "PUT",
       "/api/system/notifications/:id",
       "system.notification.update",
       "system.notification",
+      "notification.update",
     ),
     binding(
       "GET",
       "/api/system/notifications/:id/revisions",
       "system.notification.manage",
       "system.notification",
+      "data.read",
     ),
     binding(
       "DELETE",
       "/api/system/notifications/:id",
       "system.notification.manage",
       "system.notification",
+      "notification.archive",
     ),
     // @windy-module system.notification end
     // @windy-module system.workflow begin
@@ -138,31 +164,44 @@ export function systemOperationalApiPermissionBindings(): ApiPermissionBinding[]
       "/api/workflow/work-items",
       "system.workflow.read",
       "system.workflow",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/workflow/work-items/:id",
       "system.workflow.read",
       "system.workflow",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/workflow/work-items/:id/history",
       "system.workflow.read",
       "system.workflow",
+      "data.read",
     ),
     binding(
       "POST",
       "/api/workflow/work-items",
       "system.workflow.create",
       "system.workflow",
-    ),
-    ...["claim", "transfer", "approve", "reject", "cancel"].map((command) =>
+      "workflow.create",
+    ),
+    ...(
+      [
+        ["claim", "workflow.claim"],
+        ["transfer", "workflow.transfer"],
+        ["approve", "workflow.decide"],
+        ["reject", "workflow.decide"],
+        ["cancel", "workflow.cancel"],
+      ] as const
+    ).map(([command, auditAction]) =>
       binding(
         "POST",
         `/api/workflow/work-items/:id/${command}`,
         "system.workflow.approve",
         "system.workflow",
+        auditAction,
       ),
     ),
     // @windy-module system.workflow end
@@ -172,62 +211,72 @@ export function systemOperationalApiPermissionBindings(): ApiPermissionBinding[]
       "/api/system/scheduled-tasks",
       "system.scheduler.read",
       "system.scheduler",
+      "task.read",
     ),
     binding(
       "GET",
       "/api/system/scheduled-task-runs",
       "system.scheduler.read",
       "system.scheduler",
+      "task.read",
     ),
     binding(
       "GET",
       "/api/system/operations/scheduler",
       "system.scheduler.read",
       "system.scheduler",
+      "task.read",
     ),
     binding(
       "POST",
       "/api/system/scheduled-tasks/:id/trigger",
       "system.scheduler.manage",
       "system.scheduler",
+      "task.trigger",
     ),
     binding(
       "POST",
       "/api/system/scheduled-tasks/:id/runs/:runId/recover",
       "system.scheduler.manage",
       "system.scheduler",
+      "task.recover",
     ),
     // @windy-module system.scheduler end
     // @windy-module system.bulk-data begin
     binding(
       "GET",
       "/api/system/bulk-data/jobs",
-      "system.dict.read",
+      "system.bulk-data.manage",
       "system.bulk-data",
+      "task.read",
     ),
     binding(
       "GET",
       "/api/system/bulk-data/jobs/:id",
-      "system.dict.read",
+      "system.bulk-data.manage",
       "system.bulk-data",
+      "task.read",
     ),
     binding(
       "GET",
       "/api/system/bulk-data/jobs/:id/artifacts/:kind",
-      "system.dict.read",
+      "system.bulk-data.manage",
       "system.bulk-data",
+      "data.bulk-artifact.download",
     ),
     binding(
       "POST",
       "/api/system/bulk-data/dictionaries/import",
-      "system.dict.manage",
+      "system.bulk-data.manage",
       "system.bulk-data",
+      "data.bulk-import.create",
     ),
     binding(
       "POST",
       "/api/system/bulk-data/dictionaries/export",
-      "system.dict.read",
+      "system.bulk-data.manage",
       "system.bulk-data",
+      "data.bulk-export.create",
     ),
     // @windy-module system.bulk-data end
   ];