create-windy 0.3.2 → 0.3.5

package/template/apps/server/src/data-governance/export/authorization-port.test.ts

@@ -1,11 +1,18 @@
 import { describe, expect, test } from "bun:test";
 import { buildActorScopeContexts } from "../../data-access/context.js";
-import { createFoundationSnapshot } from "../../foundation.js";
+import {
+  createFoundationSnapshot,
+  loadSystemModules,
+} from "../../foundation.js";
 import type { RequestActor } from "../../guards.js";
+import { createServerRuntime } from "../../runtime.js";
 import { createSystemRepositories } from "../../system/seed.js";
 import { SystemGovernedExportAuthorization } from "./authorization-port.js";
 import { captureGovernedExportScope } from "./scope-snapshot.js";
-import type { GovernedExportRequest } from "./types.js";
+import {
+  legacyGovernedExportRendererSnapshot,
+  type GovernedExportRequest,
+} from "./types.js";
 
 const actor: RequestActor = {
   id: "test-bootstrap",
@@ -17,7 +24,8 @@ const actor: RequestActor = {
 
 describe("governed export current authorization", () => {
   test("按当前角色权限与 Data Scope 重建执行授权", async () => {
-    const repositories = createSystemRepositories(createFoundationSnapshot());
+    const foundation = createFoundationSnapshot();
+    const repositories = createSystemRepositories(foundation);
     await repositories.roles.create(
       {
         id: "role-export-auditor",
@@ -52,7 +60,17 @@ describe("governed export current authorization", () => {
       ]).scopeContext,
     );
     const request = exportRequest(scope.snapshot, scope.hash);
-    const authorization = new SystemGovernedExportAuthorization(repositories);
+    const runtime = createServerRuntime(
+      {},
+      { featureCatalog: foundation.features },
+    );
+    const authorization = new SystemGovernedExportAuthorization(repositories, {
+      policies: loadSystemModules().flatMap(
+        (manifest) => manifest.dataPolicies ?? [],
+      ),
+      features: foundation.features,
+      runtime,
+    });
 
     expect(await authorization.evaluate(request)).toEqual({ allowed: true });
     await repositories.roles.update(
@@ -94,6 +112,7 @@ function exportRequest(
     scopeSnapshot,
     scopeHash,
     querySnapshot: { includeDeleted: false },
+    renderer: legacyGovernedExportRendererSnapshot,
     status: "queued",
     approvalRequired: false,
     expiresAt: "2027-01-01T00:00:00.000Z",

package/template/apps/server/src/data-governance/export/authorization-port.ts

@@ -1,5 +1,12 @@
-import { buildActorScopeContexts } from "../../data-access/context.js";
+import type {
+  DataGovernancePolicyDefinition,
+  FeatureFlagDefinition,
+} from "@southwind-ai/shared";
+import { featureKey } from "@southwind-ai/shared";
+import { evaluateRouteGuards, findFeature } from "../../route-guards.js";
+import type { createServerRuntime } from "../../runtime.js";
 import type { SystemRepositories } from "../../system/seed.js";
+import { resolveCurrentSystemActor } from "../../system/actor.js";
 import { captureGovernedExportScope } from "./scope-snapshot.js";
 import type { GovernedExportRequest } from "./types.js";
 
@@ -7,7 +14,11 @@ export type GovernedExportAuthorizationDecision =
   | { allowed: true }
   | {
       allowed: false;
-      reason: "user-inactive" | "permission-revoked" | "scope-changed";
+      reason:
+        | "user-inactive"
+        | "policy-changed"
+        | "permission-revoked"
+        | "scope-changed";
       currentScopeHash?: string;
     };
 
@@ -20,38 +31,34 @@ export interface GovernedExportAuthorizationPort {
 export class SystemGovernedExportAuthorization implements GovernedExportAuthorizationPort {
   constructor(
     private readonly repositories: Pick<SystemRepositories, "users" | "roles">,
+    private readonly options?: {
+      readonly policies: readonly DataGovernancePolicyDefinition[];
+      readonly features: readonly FeatureFlagDefinition[];
+      readonly runtime: Pick<
+        ReturnType<typeof createServerRuntime>,
+        "createGuardContextForActor" | "recordDecisions" | "resolveFeature"
+      >;
+    },
   ) {}
 
   async evaluate(
     request: GovernedExportRequest,
   ): Promise<GovernedExportAuthorizationDecision> {
-    const user = await this.repositories.users.get(request.requesterId);
-    if (!user || user.status !== "active") {
+    const actor = await resolveCurrentSystemActor(
+      this.repositories,
+      request.requesterId,
+    );
+    if (!actor) {
       return { allowed: false, reason: "user-inactive" };
     }
-    const roles = (
-      await Promise.all(
-        user.roleIds.map((id) => this.repositories.roles.get(id)),
-      )
-    ).filter(
-      (role): role is NonNullable<typeof role> => role?.status === "active",
-    );
-    const permissions = new Set(roles.flatMap((role) => role.permissionKeys));
-    if (!permissions.has("system.user.export")) {
+    const policy = this.resolvePolicy(request);
+    if (!policy) {
+      return { allowed: false, reason: "policy-changed" };
+    }
+    if (!(await this.accessAllowed(actor, policy))) {
       return { allowed: false, reason: "permission-revoked" };
     }
-    const current = captureGovernedExportScope(
-      buildActorScopeContexts(
-        user.id,
-        user.departmentId,
-        roles.map((role) => ({
-          id: role.id,
-          code: role.code,
-          dataScope: role.dataScope,
-          departmentIds: role.departmentIds || [],
-        })),
-      ).scopeContext,
-    );
+    const current = captureGovernedExportScope(actor.scopeContext);
     return current.hash === request.scopeHash
       ? { allowed: true }
       : {
@@ -60,6 +67,63 @@ export class SystemGovernedExportAuthorization implements GovernedExportAuthoriz
           currentScopeHash: current.hash,
         };
   }
+
+  private resolvePolicy(request: GovernedExportRequest) {
+    if (!this.options) {
+      return request.resourceType === "system.user" &&
+        request.policyKey === "system.user.fields" &&
+        request.policyVersion === "1"
+        ? {
+            key: request.policyKey,
+            resourceType: request.resourceType,
+            version: request.policyVersion,
+            featureKey: featureKey("system.rbac"),
+            exportPermissionKey: "system.user.export",
+          }
+        : undefined;
+    }
+    return this.options.policies.find(
+      (policy) =>
+        policy.key === request.policyKey &&
+        policy.resourceType === request.resourceType &&
+        policy.version === request.policyVersion,
+    );
+  }
+
+  private async accessAllowed(
+    actor: NonNullable<Awaited<ReturnType<typeof resolveCurrentSystemActor>>>,
+    policy: Pick<
+      DataGovernancePolicyDefinition,
+      "featureKey" | "exportPermissionKey"
+    >,
+  ) {
+    if (!this.options) {
+      return actor.permissionKeys.includes(policy.exportPermissionKey);
+    }
+    const feature = findFeature([...this.options.features], policy.featureKey);
+    if (!feature) return false;
+    const context = await this.options.runtime.createGuardContextForActor(
+      new Request("http://windy.internal/governed-export/authorize"),
+      actor,
+    );
+    return (
+      await evaluateRouteGuards(
+        this.options.runtime,
+        context,
+        {
+          permission: {
+            method: "POST",
+            path: "/internal/governed-export/authorize",
+            permissionKey: policy.exportPermissionKey,
+            featureKey: policy.featureKey,
+          },
+          feature,
+          restrictedModeAccess: "backup-export",
+        },
+        { record: false },
+      )
+    ).allowed;
+  }
 }
 
 export const allowGovernedExportExecution: GovernedExportAuthorizationPort = {

package/template/apps/server/src/data-governance/export/drizzle-repository.integration.test.ts

@@ -4,6 +4,7 @@ import { drizzle } from "drizzle-orm/node-postgres";
 import { migrate } from "drizzle-orm/node-postgres/migrator";
 import { Pool } from "pg";
 import { DrizzleGovernedExportRepository } from "./drizzle-repository.js";
+import { legacyGovernedExportRendererSnapshot } from "./types.js";
 
 const databaseUrl = process.env.GOVERNED_EXPORT_TEST_DATABASE_URL;
 const describePostgres = databaseUrl ? describe : describe.skip;
@@ -49,6 +50,7 @@ describePostgres("PostgreSQL governed export repository", () => {
       },
       scopeHash: "a".repeat(64),
       querySnapshot: { includeDeleted: false },
+      renderer: legacyGovernedExportRendererSnapshot,
       approvalRequired: false,
       expiresAt: "2026-07-17T02:00:00.000Z",
     };

package/template/apps/server/src/data-governance/export/drizzle-repository.ts

@@ -86,6 +86,7 @@ function mapRequest(row: Row): GovernedExportRequest {
     fieldKeys: [...row.fieldKeys],
     scopeSnapshot: structuredClone(row.scopeSnapshot),
     querySnapshot: structuredClone(row.querySnapshot),
+    renderer: structuredClone(row.renderer),
     status: row.status as GovernedExportRequest["status"],
     approvalRequired: row.approvalRequired,
     approvalId: row.approvalId || undefined,

package/template/apps/server/src/data-governance/export/job-runtime.test.ts

@@ -15,6 +15,7 @@ import type { GovernedExportAuthorizationPort } from "./authorization-port.js";
 import { InMemoryGovernedExportRepository } from "./repository.js";
 import { captureGovernedExportScope } from "./scope-snapshot.js";
 import type { GovernedExportSource } from "./source.js";
+import { legacyGovernedExportRendererSnapshot } from "./types.js";
 
 const base = new Date("2026-07-16T03:00:00.000Z");
 const canary = "sensitive-canary-13800138000";
@@ -124,14 +125,18 @@ describe("governed export job runtime", () => {
     expect(await new Response(downloadable.body).text()).toContain(canary);
   });
 
-  test("执行时权限或范围失效会在查询与 Blob 写入前终止申请", async () => {
+  test("分页间权限或范围失效会在读取下一页前终止申请", async () => {
+    let checks = 0;
     const fixture = await createFixture(
       undefined,
       new MemoryBlobStore(),
       () => base,
       {
         async evaluate() {
-          return { allowed: false, reason: "scope-changed" };
+          checks += 1;
+          return checks < 3
+            ? { allowed: true }
+            : { allowed: false, reason: "scope-changed" };
         },
       },
     );
@@ -141,7 +146,7 @@ describe("governed export job runtime", () => {
       status: "failed",
       jobId: job.id,
     });
-    expect(fixture.pageReads()).toBe(0);
+    expect(fixture.pageReads()).toBe(1);
     expect(fixture.blobs.size).toBe(0);
     expect(await fixture.requests.get(fixture.request.id)).toMatchObject({
       status: "failed",
@@ -151,6 +156,10 @@ describe("governed export job runtime", () => {
         .list()
         .filter(({ action }) => action === "data.governed-export.generate"),
     ).toEqual([
+      expect.objectContaining({
+        outcome: "attempted",
+        metadata: expect.objectContaining({ phase: "intent" }),
+      }),
       expect.objectContaining({
         outcome: "denied",
         metadata: expect.objectContaining({
@@ -263,8 +272,8 @@ describe("governed export job runtime", () => {
       }),
     ]);
   });
-});
 
+});
 async function createFixture(
   auditWriter?: AuditEventWriter,
   blobStore: BlobStore = new MemoryBlobStore(),
@@ -283,6 +292,7 @@ async function createFixture(
     async *pages() {
       pageReads += 1;
       yield [{ id: "user-1", phone: canary }];
+      pageReads += 1;
       yield [{ id: "user-2", email: canary }];
     },
   };
@@ -311,6 +321,7 @@ async function createFixture(
       scopeSnapshot: scope.snapshot,
       scopeHash: scope.hash,
       querySnapshot: { includeDeleted: false },
+      renderer: legacyGovernedExportRendererSnapshot,
       approvalRequired: false,
       expiresAt: "2026-07-17T03:00:00.000Z",
     },

package/template/apps/server/src/data-governance/export/job-runtime.ts

@@ -1,12 +1,18 @@
-import { DurableHandlerError, type DurableHandlerRegistry } from "@southwind-ai/jobs";
+import {
+  DurableHandlerError,
+  type DurableHandlerRegistry,
+} from "@southwind-ai/jobs";
 import type { BlobStore } from "@southwind-ai/storage";
 import type { createServerRuntime } from "../../runtime.js";
 import type { DurableJobService } from "../../jobs/service.js";
 import type { DurableJobWorker } from "../../jobs/worker.js";
 import type { GovernedExportRepository } from "./repository.js";
 import type { GovernedExportSource } from "./source.js";
-import { createWatermarkedNdjsonStream } from "./ndjson-stream.js";
 import type { GovernedExportRequest } from "./types.js";
+import {
+  createGovernedExportRenderSession,
+  type GovernedExportRendererBinding,
+} from "./renderer-runtime.js";
 import {
   allowGovernedExportExecution,
   type GovernedExportAuthorizationDecision,
@@ -30,6 +36,7 @@ export class GovernedExportJobRuntime {
     ) => Promise<boolean> = async (request) => !request.approvalRequired,
     private readonly authorization: GovernedExportAuthorizationPort = allowGovernedExportExecution,
     private readonly now: () => Date = () => new Date(),
+    private readonly renderers: readonly GovernedExportRendererBinding[] = [],
   ) {
     registry.register({
       key: handlerKey,
@@ -129,39 +136,64 @@ export class GovernedExportJobRuntime {
     } catch {
       throw safeFailure("EXPORT_AUDIT_UNAVAILABLE", true);
     }
-    let stored;
+    let stored: Awaited<ReturnType<BlobStore["put"]>> | undefined;
+    let session;
     try {
-      stored = await this.blobStore.put({
-        body: createWatermarkedNdjsonStream({
+      session = await createGovernedExportRenderSession(
+        {
           request,
           source,
           signal: context.signal,
-          watermark: {
-            actorId: request.requesterId,
-            generatedAt,
-            scopeHash: request.scopeHash,
-            jobId: context.jobId,
-            requestId: request.id,
+          jobId: context.jobId,
+          generatedAt,
+          heartbeat: context.heartbeat,
+          beforePage: async () => {
+            const authorization = await this.authorization.evaluate(request);
+            if (!authorization.allowed) {
+              await this.denyAuthorization(request, authorization);
+            }
           },
           pageCompleted: async (completed) => {
             await context.heartbeat();
             await context.progress({ completedUnits: completed });
           },
-        }),
+        },
+        this.renderers,
+      );
+      stored = await this.blobStore.put({
+        body: session.body,
       });
-    } catch {
+      session.assertRecordsConsumed();
+    } catch (error) {
+      if (stored) await this.blobStore.delete(stored.ref);
+      if (error instanceof DurableHandlerError) throw error;
+      if (context.signal.aborted) throw error;
+      throw safeFailure("EXPORT_STREAM_FAILED", isRetryableRenderFailure(error));
+    } finally {
+      session?.dispose();
+    }
+    if (!stored || !session) {
       throw safeFailure("EXPORT_STREAM_FAILED", true);
     }
     try {
       await context.publishArtifact({
         kind: "governed-export",
         artifactRef: stored.ref,
-        filename: "governed-users.ndjson",
-        contentType: "application/x-ndjson",
+        filename: `${safeFilename(request.resourceType)}.${request.renderer.filenameExtension}`,
+        contentType: request.renderer.contentType,
         byteSize: stored.byteSize,
         sha256: stored.contentHash.value,
         ownerId: request.requesterId,
         expiresAt: request.expiresAt,
+        metadata: {
+          formatKey: request.renderer.formatKey,
+          templateKey: request.renderer.templateKey,
+          templateVersion: request.renderer.templateVersion,
+          inputSchemaKey: request.renderer.inputSchemaKey,
+          ...(session?.contentMetadata
+            ? { contentMetadata: session.contentMetadata }
+            : {}),
+        },
       });
     } catch (error) {
       await this.blobStore.delete(stored.ref);
@@ -183,6 +215,10 @@ function parsePayload(value: unknown): { requestId: string } {
   return { requestId: payload.requestId };
 }
 
+function safeFilename(resourceType: string) {
+  return `governed-${resourceType.replaceAll(/[^a-zA-Z0-9_-]/g, "-")}`;
+}
+
 function safeFailure(code: string, retryable: boolean) {
   return new DurableHandlerError(code, "治理导出生成失败", retryable);
 }
@@ -206,6 +242,11 @@ function generationIntentEvent(
     metadata: {
       policyKey: request.policyKey,
       policyVersion: request.policyVersion,
+      formatKey: request.renderer.formatKey,
+      templateKey: request.renderer.templateKey,
+      templateVersion: request.renderer.templateVersion,
+      inputSchemaKey: request.renderer.inputSchemaKey,
+      contentType: request.renderer.contentType,
       scopeHash: request.scopeHash,
       jobId,
       phase: "intent",
@@ -214,6 +255,18 @@ function generationIntentEvent(
   };
 }
 
+function isRetryableRenderFailure(error: unknown) {
+  const code = error instanceof Error ? error.message : "";
+  return ![
+    "EXPORT_RENDERER_NOT_REGISTERED",
+    "EXPORT_RENDERER_VERSION_DRIFT",
+    "EXPORT_RECORD_LIMIT_EXCEEDED",
+    "EXPORT_OUTPUT_LIMIT_EXCEEDED",
+    "EXPORT_RECORDS_NOT_CONSUMED",
+    "EXPORT_CONTENT_METADATA_TOO_LARGE",
+  ].includes(code);
+}
+
 function authorizationDeniedEvent(
   request: GovernedExportRequest,
   decision: Extract<GovernedExportAuthorizationDecision, { allowed: false }>,

package/template/apps/server/src/data-governance/export/ndjson-stream.ts

@@ -14,6 +14,8 @@ export function createWatermarkedNdjsonStream(input: {
   source: GovernedExportSource;
   watermark: ExportWatermark;
   signal: AbortSignal;
+  maxRecords?: number;
+  beforePage(): Promise<void>;
   pageCompleted(completed: number): Promise<void>;
 }) {
   const iterator = lines(input)[Symbol.asyncIterator]();
@@ -42,6 +44,8 @@ async function* lines(input: {
   source: GovernedExportSource;
   watermark: ExportWatermark;
   signal: AbortSignal;
+  maxRecords?: number;
+  beforePage(): Promise<void>;
   pageCompleted(completed: number): Promise<void>;
 }) {
   yield {
@@ -51,12 +55,27 @@ async function* lines(input: {
     watermark: input.watermark,
   };
   let completed = 0;
-  for await (const page of input.source.pages(input.request)) {
-    if (input.signal.aborted) throw new Error("EXPORT_ABORTED");
-    for (const record of page) {
-      yield { type: "record", watermark: input.watermark, data: record };
-      completed += 1;
+  const sourcePages = input.source.pages(input.request, input.signal);
+  const pages = sourcePages[Symbol.asyncIterator]();
+  try {
+    while (true) {
+      await input.beforePage();
+      const result = await pages.next();
+      if (result.done) return;
+      if (input.signal.aborted) throw new Error("EXPORT_ABORTED");
+      for (const record of result.value) {
+        if (
+          input.maxRecords !== undefined &&
+          completed >= input.maxRecords
+        ) {
+          throw new Error("EXPORT_RECORD_LIMIT_EXCEEDED");
+        }
+        yield { type: "record", watermark: input.watermark, data: record };
+        completed += 1;
+      }
+      await input.pageCompleted(completed);
     }
-    await input.pageCompleted(completed);
+  } finally {
+    await pages.return?.();
   }
 }

package/template/apps/server/src/data-governance/export/postgres-recovery.integration.test.ts

@@ -21,6 +21,7 @@ import {
   createPostgresApiFixture,
   ownerCanaries,
 } from "./postgres-api-fixture.js";
+import { legacyGovernedExportRendererSnapshot } from "./types.js";
 import { captureGovernedExportScope } from "./scope-snapshot.js";
 import type { GovernedExportSource } from "./source.js";
 
@@ -190,7 +191,7 @@ async function exerciseFailureRetry(
   const request = await fixture.requests.create(
     {
       id: Bun.randomUUIDv7(),
-      resourceType: "canary.failure",
+      resourceType: "system.user",
       policyKey: "system.user.fields",
       policyVersion: "1",
       fieldKeys: ["phone"],
@@ -202,6 +203,7 @@ async function exerciseFailureRetry(
       scopeSnapshot: scope.snapshot,
       scopeHash: scope.hash,
       querySnapshot: { includeDeleted: false },
+      renderer: legacyGovernedExportRendererSnapshot,
       approvalRequired: false,
       expiresAt: new Date(
         fixture.clock.current.getTime() + 86_400_000,
@@ -210,7 +212,7 @@ async function exerciseFailureRetry(
     fixture.clock.current,
   );
   const failing: GovernedExportSource = {
-    resourceType: "canary.failure",
+    resourceType: "system.user",
     async *pages() {
       yield [];
       throw new Error(`source failed ${ownerCanaries[1]}`);