create-windy 0.3.19 → 0.4.0

package/template/packages/modules/src/system-api-permissions.ts

@@ -10,34 +10,69 @@ import { watermarkApiPermissionBindings } from "./system-api-watermark.js";
 import { dataGovernanceApiPermissionBindings } from "./system-api-data-governance.js";
 // @windy-module system.data-governance end
 import { systemOperationalApiPermissionBindings } from "./system-api-operational.js";
+import { systemControlPlaneApiPermissionBindings } from "./system-api-control-plane.js";
 
 export function systemApiPermissionBindings(): ApiPermissionBinding[] {
   return [
+    ...systemControlPlaneApiPermissionBindings(),
     binding(
       "GET",
       "/api/admin/bootstrap",
       "system.admin.access",
       "system.admin",
+      "data.read",
+    ),
+    binding(
+      "GET",
+      "/api/foundation",
+      "system.menu.read",
+      "system.rbac",
+      undefined,
+      true,
     ),
-    binding("GET", "/api/foundation", "system.menu.read", "system.rbac", true),
     // @windy-module system.search begin
     binding(
       "GET",
       "/api/search/providers",
       "system.search.read",
       "system.search",
+      "data.read",
+    ),
+    binding(
+      "POST",
+      "/api/search",
+      "system.search.read",
+      "system.search",
+      "search.query",
     ),
-    binding("POST", "/api/search", "system.search.read", "system.search"),
     // @windy-module system.search end
     // @windy-module system.agent begin
-    binding("GET", MCP_API_PATH, "system.agent.read", "system.agent"),
-    binding("POST", MCP_API_PATH, "system.agent.read", "system.agent"),
-    binding("DELETE", MCP_API_PATH, "system.agent.read", "system.agent"),
+    binding(
+      "GET",
+      MCP_API_PATH,
+      "system.agent.read",
+      "system.agent",
+      "agent.mcp.access",
+    ),
+    binding(
+      "POST",
+      MCP_API_PATH,
+      "system.agent.read",
+      "system.agent",
+      "agent.mcp.access",
+    ),
+    binding(
+      "DELETE",
+      MCP_API_PATH,
+      "system.agent.read",
+      "system.agent",
+      "agent.mcp.access",
+    ),
     // @windy-module system.agent end
     ...resourceBindings({
       path: "users",
       permissionResource: "user",
-      featureKey: "system.rbac",
+      featureKey: "system.user",
       backupExport: false,
     }),
     // @windy-module system.data-governance begin
@@ -47,72 +82,121 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "POST",
       "/api/auth/users/:id/password",
       "system.user.manage",
-      "system.rbac",
+      "system.user",
+      "auth.password.update",
     ),
     ...resourceBindings({
       path: "roles",
       permissionResource: "role",
-      featureKey: "system.rbac",
+      featureKey: "system.role",
     }),
     ...resourceBindings({
       path: "departments",
       permissionResource: "department",
-      featureKey: "system.rbac",
+      featureKey: "system.department",
     }),
     binding(
       "POST",
       "/api/system/departments/quick",
       "system.department.create",
-      "system.rbac",
+      "system.department",
+      "crud.create",
     ),
     binding(
       "POST",
       "/api/system/departments/:id/transition",
       "system.department.manage",
-      "system.rbac",
+      "system.department",
+      "organization.department.transition",
+    ),
+    binding(
+      "GET",
+      "/api/system/menus",
+      "system.menu.read",
+      "system.menu",
+      "data.read",
     ),
-    binding("GET", "/api/system/menus", "system.menu.read", "system.rbac"),
     binding(
       "GET",
       "/api/system/menus/export",
       "system.menu.read",
-      "system.rbac",
+      "system.menu",
+      "data.export",
+    ),
+    binding(
+      "GET",
+      "/api/system/menus/:id",
+      "system.menu.read",
+      "system.menu",
+      "data.read",
     ),
-    binding("GET", "/api/system/menus/:id", "system.menu.read", "system.rbac"),
     binding(
       "PUT",
       "/api/system/menus/:id/placement",
       "system.menu.manage",
-      "system.rbac",
+      "system.menu",
+      "menu.structure.update",
     ),
     binding(
       "PUT",
       "/api/system/menus/placements",
       "system.menu.manage",
-      "system.rbac",
+      "system.menu",
+      "menu.structure.update",
     ),
     ...resourceBindings({
       path: "dictionaries",
       permissionResource: "dict",
-      featureKey: "system.rbac",
+      featureKey: "system.dict",
     }),
     // @windy-module system.license begin
     ...resourceBindings({
       path: "licenses",
       permissionResource: "license",
       featureKey: "system.license",
+      auditActions: {
+        import: "license.update",
+        create: "license.update",
+        update: "license.update",
+        delete: "license.update",
+      },
     }),
     // @windy-module system.license end
-    binding("GET", "/api/system/features", "system.feature.read"),
-    binding("GET", "/api/system/features/export", "system.feature.read"),
-    binding("GET", "/api/system/features/:id", "system.feature.read"),
-    binding("PUT", "/api/system/features/:id", "system.feature.manage"),
+    binding(
+      "GET",
+      "/api/system/features",
+      "system.feature.read",
+      "system.feature",
+      "data.read",
+    ),
+    binding(
+      "GET",
+      "/api/system/features/export",
+      "system.feature.read",
+      "system.feature",
+      "data.export",
+    ),
+    binding(
+      "GET",
+      "/api/system/features/:id",
+      "system.feature.read",
+      "system.feature",
+      "data.read",
+    ),
+    binding(
+      "PUT",
+      "/api/system/features/:id",
+      "system.feature.manage",
+      "system.feature",
+      "feature.update",
+    ),
     // @windy-module system.settings begin
     binding(
       "GET",
       "/api/platform/branding",
       "system.settings.read",
       undefined,
+      undefined,
       true,
     ),
     binding(
@@ -120,12 +204,14 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/system/settings/branding",
       "system.settings.read",
       "system.settings",
+      "data.read",
     ),
     binding(
       "PUT",
       "/api/system/settings/branding",
       "system.settings.manage",
       "system.settings",
+      "config.update",
     ),
     ...watermarkApiPermissionBindings(),
     // @windy-module system.settings end
@@ -135,24 +221,28 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/system/configurations",
       "system.config.read",
       "system.config",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/system/configurations/:moduleKey/versions",
       "system.config.read",
       "system.config",
+      "data.read",
     ),
     binding(
       "POST",
       "/api/system/configurations/:moduleKey/versions",
       "system.config.manage",
       "system.config",
+      "config.update",
     ),
     binding(
       "POST",
       "/api/system/configurations/:moduleKey/versions/:version/rollback",
       "system.config.manage",
       "system.config",
+      "config.rollback",
     ),
     // @windy-module system.configuration end
     binding(
@@ -160,12 +250,14 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/system/profile",
       "system.profile.read",
       "system.profile",
+      "data.read",
     ),
     binding(
       "PUT",
       "/api/system/profile",
       "system.profile.manage",
       "system.profile",
+      "user.profile.update",
     ),
     // @windy-module system.audit begin
     binding(
@@ -173,12 +265,14 @@ export function systemApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/system/audit-logs",
       "system.audit.read",
       "system.audit",
+      "data.read",
     ),
     binding(
       "GET",
       "/api/system/audit-logs/export",
       "system.audit.read",
       "system.audit",
+      "data.export",
     ),
     // @windy-module system.audit end
     ...systemOperationalApiPermissionBindings(),

package/template/packages/modules/src/system-api-watermark.ts

@@ -8,6 +8,7 @@ export function watermarkApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/platform/watermark-policy",
       "system.watermark.read",
       undefined,
+      undefined,
       true,
     ),
     binding(
@@ -15,12 +16,14 @@ export function watermarkApiPermissionBindings(): ApiPermissionBinding[] {
       "/api/system/settings/watermark",
       "system.watermark.read",
       "system.watermark",
+      "data.read",
     ),
     binding(
       "PUT",
       "/api/system/settings/watermark",
       "system.watermark.manage",
       "system.watermark",
+      "config.update",
     ),
   ];
 }

package/template/packages/modules/src/system-audit-actions.ts

@@ -8,6 +8,9 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   "crud.create",
   "crud.update",
   "crud.delete",
+  "data.read",
+  "data.import",
+  "data.export",
   {
     key: "system.user-directory.query",
     label: "查询业务用户目录",
@@ -19,6 +22,7 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.configuration end
   // @windy-module system.license begin
   "license.verify",
+  "license.update",
   // @windy-module system.license end
   "feature.update",
   "menu.structure.update",
@@ -73,12 +77,15 @@ export const systemAuditActions: ModuleManifest["auditActions"] = [
   // @windy-module system.bulk-data end
   // @windy-module system.storage begin
   "file.upload.create",
+  "file.upload.part.write",
   "file.upload.complete",
   "file.upload.abort",
   "file.download",
   // @windy-module system.storage end
   // @windy-module system.agent begin
+  "agent.mcp.access",
   "agent.tool.execute",
+  "agent.operation.execute",
   // @windy-module system.agent end
   "security.denied",
   "system.error",

package/template/packages/modules/src/system-data-governance.ts

@@ -1,11 +1,14 @@
-import { featureKey, type DataGovernancePolicyDefinition } from "@southwind-ai/shared";
+import {
+  featureKey,
+  type DataGovernancePolicyDefinition,
+} from "@southwind-ai/shared";
 
 export const systemDataPolicies: DataGovernancePolicyDefinition[] = [
   {
     key: "system.user.fields",
     resourceType: "system.user",
     version: "1",
-    featureKey: featureKey("system.rbac"),
+    featureKey: featureKey("system.user"),
     readPermissionKey: "system.user.read",
     revealPermissionKey: "system.user.reveal",
     exportPermissionKey: "system.user.export",

package/template/packages/modules/src/system-features.ts

@@ -12,11 +12,31 @@ export const systemFeatures: ModuleManifest["features"] = [
     "Windy 管理面",
     "平台管理员、运维与授权审计人员使用的控制面准入能力。",
   ),
+  feature("system.runtime", "运行状态", "健康、就绪与指标等部署运行状态入口。"),
+  feature(
+    "system.auth",
+    "认证恢复",
+    "登录、登出、会话探测与密码策略等不可关闭的认证恢复入口。",
+  ),
   feature(
     "system.rbac",
     "RBAC 权限链路",
     "用户、角色、权限点与数据范围的统一访问控制链路。",
   ),
+  rbacFeature("system.user", "用户管理", "平台用户账号与敏感资料治理。"),
+  rbacFeature("system.role", "角色与权限", "角色、授权和数据范围策略管理。"),
+  rbacFeature(
+    "system.department",
+    "部门组织",
+    "部门层级、负责人和组织关系管理。",
+  ),
+  rbacFeature("system.menu", "菜单管理", "平台菜单目录与入口编排。"),
+  rbacFeature("system.dict", "字典管理", "业务字典类型与条目管理。"),
+  feature(
+    "system.feature",
+    "功能开关管理",
+    "查看和恢复平台 Feature 状态的核心控制面能力。",
+  ),
   feature(
     "system.user-directory",
     "业务用户目录",
@@ -148,3 +168,14 @@ function feature(
     stage: "stable",
   };
 }
+
+function rbacFeature(
+  key: string,
+  label: string,
+  description: string,
+): ModuleManifest["features"][number] {
+  return {
+    ...feature(key, label, description),
+    dependencies: [featureKey("system.rbac")],
+  };
+}

package/template/packages/modules/src/system-governed-export-bindings.ts

@@ -7,25 +7,29 @@ export function governedUserExportBindings(): ApiPermissionBinding[] {
       "POST",
       "/api/system/users/exports",
       "system.user.export",
-      "system.rbac",
+      "system.user",
+      "data.governed-export.request",
     ),
     binding(
       "GET",
       "/api/system/users/exports/:id",
       "system.user.export",
-      "system.rbac",
+      "system.user",
+      "data.read",
     ),
     binding(
       "POST",
       "/api/system/users/exports/:id/cancel",
       "system.user.export",
-      "system.rbac",
+      "system.user",
+      "data.governed-export.cancel",
     ),
     binding(
       "GET",
       "/api/system/users/exports/:id/download",
       "system.user.export",
-      "system.rbac",
+      "system.user",
+      "data.governed-export.download",
     ),
   ];
 }

package/template/packages/modules/src/system-module-catalog.test.ts

@@ -2,8 +2,11 @@ import { describe, expect, test } from "bun:test";
 import { validateModuleComposition } from "./composition.js";
 import { composeModuleMenus } from "./menu-composition.js";
 import {
+  // @windy-module system.operations begin
+  systemModuleManifest as operationsModuleManifest,
+  // @windy-module system.operations end
   // @windy-module system.data-governance begin
-  systemModuleManifest,
+  systemModuleManifest as governanceModuleManifest,
   // @windy-module system.data-governance end
   systemModuleManifests,
 } from "./system-module-catalog.js";
@@ -101,10 +104,31 @@ describe("系统能力模块目录", () => {
     );
   });
 
+  test("Manifest 记录运行时真实模块依赖", () => {
+    // @windy-module system.operations begin
+    expect(operationsModuleManifest("system.operations").dependencies).toEqual([
+      "system",
+      "system.configuration",
+    ]);
+    // @windy-module system.operations end
+    // @windy-module system.data-governance begin
+    expect(
+      governanceModuleManifest("system.data-governance").dependencies,
+    ).toEqual([
+      "system",
+      "system.identity",
+      "system.audit",
+      "system.storage",
+      "system.workflow",
+      "system.scheduler",
+    ]);
+    // @windy-module system.data-governance end
+  });
+
   // @windy-module system.data-governance begin
   test("能力声明归属到对应模块而不是继续挂在 system 聚合项", () => {
-    const workflow = systemModuleManifest("system.workflow");
-    const identity = systemModuleManifest("system.identity");
+    const workflow = governanceModuleManifest("system.workflow");
+    const identity = governanceModuleManifest("system.identity");
 
     expect(workflow.features.map(({ key }) => key)).toEqual([
       "system.workflow",
@@ -119,6 +143,17 @@ describe("系统能力模块目录", () => {
     expect(identity.features.map(({ key }) => key)).toContain(
       "system.user-directory",
     );
+    for (const key of [
+      "system.user",
+      "system.role",
+      "system.department",
+      "system.menu",
+      "system.dict",
+    ]) {
+      expect(identity.features.find((feature) => feature.key === key)).toEqual(
+        expect.objectContaining({ dependencies: ["system.rbac"] }),
+      );
+    }
     expect(identity.permissions.map(({ key }) => key)).toContain(
       "system.user-directory.read",
     );
@@ -133,7 +168,7 @@ describe("系统能力模块目录", () => {
       ),
     ).toContain("system.user-directory.query");
     expect(
-      systemModuleManifest("system.data-governance").dataPolicies?.map(
+      governanceModuleManifest("system.data-governance").dataPolicies?.map(
         ({ key }) => key,
       ),
     ).toEqual(["system.user.fields"]);