create-windy 0.5.2 → 0.6.1

package/template/apps/server/src/module-host/storage-writer-retention.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, test } from "bun:test";
+import type { ModuleStorageWriterSessionInputV1 } from "@southwind-ai/server-sdk";
+import {
+  FileService,
+  InMemoryUploadRepository,
+  MemoryBlobStore,
+  UploadService,
+  type UploadPolicy,
+} from "@southwind-ai/storage";
+import { createModuleStorageWritePort } from "./storage-write-port.js";
+
+const now = new Date("2026-07-31T00:00:00.000Z");
+const maximumRetentionMs = 365 * 24 * 60 * 60_000;
+
+describe("Module Storage Writer V1 保留策略", () => {
+  test("Writer 输入不暴露绝对 fileExpiresAt", () => {
+    const hasAbsoluteExpiry: "fileExpiresAt" extends keyof ModuleStorageWriterSessionInputV1
+      ? true
+      : false = false;
+    expect(hasAbsoluteExpiry).toBe(false);
+  });
+
+  test("用途未配置或配置越界保留期时 fail closed", async () => {
+    for (const fileRetentionMs of [
+      undefined,
+      59_999,
+      maximumRetentionMs + 1,
+      Number.MAX_SAFE_INTEGER,
+    ]) {
+      const fixture = setup(fileRetentionMs);
+      await expect(
+        fixture.writer.createUploadSession({
+          purpose: fixture.policy.purpose,
+          filename: "result.txt",
+          mimeType: "text/plain",
+          expectedByteSize: 1,
+        }),
+      ).rejects.toMatchObject({ code: "STORAGE_UNAVAILABLE" });
+      expect(await fixture.repository.listExpiredSessions("9999", 10)).toEqual(
+        [],
+      );
+    }
+  });
+
+  test("最大合法保留期由 Host 派生并在 Service 重建后保持", async () => {
+    const first = setup(maximumRetentionMs);
+    const session = await first.writer.createUploadSession({
+      purpose: first.policy.purpose,
+      filename: "result.txt",
+      mimeType: "text/plain",
+      expectedByteSize: 1,
+    });
+    expect(session.fileExpiresAt).toBe("2027-07-31T00:00:00.000Z");
+
+    const restarted = setup(maximumRetentionMs, first.repository, first.blobs);
+    await expect(
+      restarted.writer.getUploadSession(session.id),
+    ).resolves.toMatchObject({
+      id: session.id,
+      fileExpiresAt: "2027-07-31T00:00:00.000Z",
+    });
+  });
+});
+
+function setup(
+  fileRetentionMs: number | undefined,
+  repository = new InMemoryUploadRepository(),
+  blobs = new MemoryBlobStore(),
+) {
+  const policy: UploadPolicy = {
+    purpose: "evidence.output",
+    maxByteSize: 1024,
+    maxPartByteSize: 512,
+    sessionTtlMs: 60_000,
+    fileRetentionMs,
+    allowedTypes: { "text/plain": ["txt"] },
+    signature: "none",
+  };
+  const uploads = new UploadService({
+    repository,
+    blobStore: blobs,
+    policies: [policy],
+    now: () => now,
+  });
+  const writer = createModuleStorageWritePort(
+    { uploads, files: new FileService(repository, blobs) },
+    {
+      moduleName: "evidence",
+      ownerId: "user-evidence",
+      purposes: new Set([policy.purpose]),
+      uploadPolicies: new Map([[policy.purpose, policy]]),
+      authorizationBinding: {
+        moduleName: "evidence",
+        scopeHash: "a".repeat(64),
+      },
+      actor: {
+        id: "user-evidence",
+        type: "user",
+        name: "物证管理员",
+        roleCodes: ["investigator"],
+        permissionKeys: ["evidence.output.manage"],
+      },
+      requestId: "request-retention",
+      signal: new AbortController().signal,
+      recordUploadDecision() {},
+    },
+  );
+  return { repository, blobs, policy, writer };
+}

package/template/apps/server/src/module-host/user-directory-composition.test.ts

@@ -50,6 +50,7 @@ test("Composition Root 向业务 Handler 注入用户目录 Port", async () => {
   });
 
   const result = await app.invoke("GET", "/case/members", {
+    request: new Request("http://localhost/api/case/members"),
     guardContext: {
       requestId: "request-composition",
       actor: {

package/template/apps/server/src/module-preflight-secret.test.ts

@@ -0,0 +1,79 @@
+import { expect, test } from "bun:test";
+import { featureKey } from "@southwind-ai/shared";
+import { prepareServerModules } from "./module-preflight.js";
+import { manifest } from "./module-host/test-fixtures.js";
+
+test("Server preflight 拒绝 Secret 借用其它 Manifest 的 capability", async () => {
+  const alpha = manifest("alpha", {
+    features: [
+      {
+        key: featureKey("alpha.connection"),
+        module: "alpha",
+        label: "Alpha 连接",
+        enabled: true,
+        visible: "visible",
+        stage: "stable",
+      },
+    ],
+    permissions: [
+      {
+        key: "alpha.connection.read",
+        module: "alpha",
+        moduleLabel: "Alpha",
+        label: "读取 Alpha 连接",
+        resource: "connection",
+        resourceLabel: "连接",
+        action: "read",
+      },
+    ],
+    secrets: [
+      {
+        handle: "alpha.connection.password",
+        connection: "alpha.connection.primary",
+        purpose: "alpha.connection.read",
+        featureKey: featureKey("alpha.borrowed"),
+        permissionKey: "alpha.borrowed.read",
+        auditAction: "alpha.secret.resolve",
+      },
+    ],
+    auditActions: [
+      {
+        key: "alpha.secret.resolve",
+        label: "解析 Alpha 凭据",
+        description: "测试 preflight 精确归属。",
+      },
+    ],
+  });
+  const beta = manifest("beta", {
+    features: [
+      {
+        key: featureKey("alpha.borrowed"),
+        module: "beta",
+        label: "错误归属 Feature",
+        enabled: true,
+        visible: "visible",
+        stage: "stable",
+      },
+    ],
+    permissions: [
+      {
+        key: "alpha.borrowed.read",
+        module: "beta",
+        moduleLabel: "Beta",
+        label: "错误归属权限",
+        resource: "connection",
+        resourceLabel: "连接",
+        action: "read",
+      },
+    ],
+  });
+
+  await expect(
+    prepareServerModules({
+      modules: [alpha, beta],
+      installations: [],
+    }),
+  ).rejects.toThrow(
+    "Secret alpha.connection.password 引用了非本模块权限：alpha.borrowed.read",
+  );
+});

package/template/apps/server/src/module-preflight.ts

@@ -4,6 +4,7 @@ import {
 } from "@southwind-ai/modules";
 import type {
   InstallableServerModule,
+  ModuleSecretBinding,
   ModuleUploadPolicy,
 } from "@southwind-ai/server-sdk";
 import { loadFoundationModules } from "./foundation.js";
@@ -13,6 +14,7 @@ import { validateHostedModuleImplementations } from "./module-host/implementatio
 import { validateProjectServerAttachments } from "./module-host/project-attachments.js";
 import {
   runtimeBusinessModules,
+  runtimeModuleSecretBindings,
   serverComposition,
 } from "./module-host/runtime-composition.js";
 import type {
@@ -24,6 +26,7 @@ export async function prepareServerModules(input: {
   readonly modules: readonly ModuleManifest[];
   readonly installations: readonly InstallableServerModule<ModuleManifest>[];
   readonly baseUploadPolicies?: readonly ModuleUploadPolicy[];
+  readonly secretBindings?: readonly ModuleSecretBinding[];
   readonly adapters?: readonly WindyServerModuleAdapter<ModuleManifest>[];
   readonly attachments?: readonly WindyServerModuleAttachment<unknown>[];
   readonly enabledModuleNames?: ReadonlySet<string>;
@@ -51,6 +54,7 @@ export async function prepareServerModules(input: {
       ({ installation }) => installation,
     ),
     baseUploadPolicies: input.baseUploadPolicies,
+    secretBindings: input.secretBindings,
   });
   assertCanonicalManifestIntegrity(canonicalInstallations);
   validateModuleComposition(foundationModules);
@@ -89,6 +93,7 @@ export function prepareInstalledServerModules(
     modules: loadFoundationModules(),
     installations: runtimeBusinessModules,
     baseUploadPolicies,
+    secretBindings: runtimeModuleSecretBindings,
     adapters: serverCompositionDeclaration.adapters,
     attachments: serverCompositionDeclaration.attachments,
     enabledModuleNames: serverComposition.enabledModuleNames,

package/template/apps/server/src/platform-http-runtime.ts

@@ -19,8 +19,13 @@ import type { ModuleManifest } from "@southwind-ai/modules";
 import {
   createManifestAuthorizedRouteApp,
   createStaticRouteAuthorizer,
+  type StaticRouteAuthorizer,
 } from "./module-host/static-route-authorization.js";
 
+type StaticRouteAuthorizationOptions = Parameters<
+  StaticRouteAuthorizer["authorize"]
+>[3];
+
 export interface PlatformServerAppInput {
   runtime: ReturnType<typeof createServerRuntime>;
   persistence: ReturnType<typeof createServerPersistence>;
@@ -62,10 +67,7 @@ export async function createPlatformServerApp(input: PlatformServerAppInput) {
   const guardedApp = createManifestAuthorizedRouteApp(
     app,
     authorizer,
-    (method, path) =>
-      immutableCoreRoutes.has(`${method} /api${path}`)
-        ? { immutableCoreAccess: true }
-        : undefined,
+    platformStaticRouteAuthorizationOptions,
   );
   input.observability.register(
     createManifestAuthorizedRouteApp(app, authorizer, () => ({
@@ -91,9 +93,19 @@ const immutableCoreRoutes = new Set([
   "POST /api/auth/login",
   "POST /api/auth/api/login",
   "GET /api/auth/password/policy",
+  "POST /api/auth/password/change",
   "POST /api/auth/logout",
 ]);
 
+export function platformStaticRouteAuthorizationOptions(
+  method: string,
+  path: string,
+): StaticRouteAuthorizationOptions {
+  return immutableCoreRoutes.has(`${method} /api${path}`)
+    ? { immutableCoreAccess: true as const }
+    : undefined;
+}
+
 export function listenPlatformServer(
   app: ReturnType<typeof createPlatformHttpApp>,
 ): number {

package/template/apps/server/src/report-staging/archive-frame-stream.test.ts

@@ -0,0 +1,209 @@
+import { mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import { afterEach, describe, expect, test } from "bun:test";
+import type { ModuleReportStagingPolicyV1 } from "@southwind-ai/server-sdk";
+import { consumeArchiveFrames } from "./archive-frame-stream.js";
+import type { ArchiveListing } from "./archive-process.js";
+import { ReportStagingEntryCatalog } from "./metadata-spool.js";
+
+const roots: string[] = [];
+const catalogs: ReportStagingEntryCatalog[] = [];
+
+afterEach(async () => {
+  catalogs.splice(0).forEach((catalog) => catalog.close());
+  await Promise.all(
+    roots.splice(0).map((root) => rm(root, { recursive: true, force: true })),
+  );
+});
+
+describe("报告解包 framing Host", () => {
+  test("preflight 与 wx 0600 extraction 使用相同有序元数据", async () => {
+    const output = frames([
+      { path: "messages", directory: true, body: Buffer.alloc(0) },
+      { path: "messages/a.txt", directory: false, body: Buffer.from("hello") },
+    ]);
+    const listing = await consumeArchiveFrames({
+      stdout: fragmented(output),
+      policy: policy(),
+      catalog: await catalog(),
+    });
+    const destination = await temporaryRoot();
+    await consumeArchiveFrames({
+      stdout: fragmented(output),
+      policy: policy(),
+      catalog: listing.catalog,
+      destination,
+      expected: listing,
+    });
+    const target = join(destination, "messages/a.txt");
+    expect(await readFile(target, "utf8")).toBe("hello");
+    expect((await stat(target)).mode & 0o777).toBe(0o600);
+  });
+
+  test("data frame 越过 entry 配额时不写入可接受前缀", async () => {
+    const destination = await temporaryRoot();
+    const listing = await expected("overshoot.bin", 5);
+    const output = rawFrames("overshoot.bin", 5, Buffer.from("123456"));
+    await expect(
+      consumeArchiveFrames({
+        stdout: Readable.from([output]),
+        policy: policy(),
+        catalog: listing.catalog,
+        destination,
+        expected: listing,
+      }),
+    ).rejects.toMatchObject({ code: "REPORT_STAGING_LIMIT" });
+    expect((await stat(join(destination, "overshoot.bin"))).size).toBe(0);
+  });
+
+  test("二次读取 path/type/size/order 漂移时 fail closed", async () => {
+    const listing = await expected("a.txt", 1);
+    await expect(
+      consumeArchiveFrames({
+        stdout: Readable.from([rawFrames("b.txt", 1, Buffer.from("x"))]),
+        policy: policy(),
+        catalog: listing.catalog,
+        destination: await temporaryRoot(),
+        expected: listing,
+      }),
+    ).rejects.toMatchObject({ code: "REPORT_STAGING_UNSAFE_ARCHIVE" });
+  });
+
+  test("截断、未知 frame 和尾随字节均拒绝", async () => {
+    const good = frames([]);
+    for (const output of [
+      good.subarray(0, 7),
+      Buffer.concat([magic(), frame(9)]),
+      Buffer.concat([good, Buffer.from([1])]),
+    ]) {
+      await expect(
+        consumeArchiveFrames({
+          stdout: Readable.from([output]),
+          policy: policy(),
+          catalog: await catalog(),
+        }),
+      ).rejects.toMatchObject({ code: "REPORT_STAGING_UNSAFE_ARCHIVE" });
+    }
+  });
+
+  test("Host consumer 在 framing 与写盘边界协作响应取消", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    await expect(
+      consumeArchiveFrames({
+        stdout: Readable.from([frames([])]),
+        policy: policy(),
+        catalog: await catalog(),
+        signal: controller.signal,
+      }),
+    ).rejects.toMatchObject({ code: "REPORT_STAGING_CANCELLED" });
+  });
+
+  test("open 后取消分支会在 current 接管前显式 close fd", async () => {
+    const source = await Bun.file(
+      join(import.meta.dir, "archive-frame-stream.ts"),
+    ).text();
+    expect(source).toContain("if (signal?.aborted)");
+    expect(source).toContain("await file.close().catch");
+  });
+});
+
+async function temporaryRoot() {
+  const root = await mkdtemp(join(tmpdir(), "windy-frame-stream-"));
+  roots.push(root);
+  return root;
+}
+
+function fragmented(value: Buffer) {
+  return Readable.from([...value].map((byte) => Buffer.from([byte])));
+}
+
+function frames(
+  entries: readonly {
+    readonly path: string;
+    readonly directory: boolean;
+    readonly body: Buffer;
+  }[],
+) {
+  return Buffer.concat([
+    magic(),
+    ...entries.flatMap((entry) => {
+      const metadata = entryMetadata(entry.path, entry.body.byteLength);
+      return entry.directory
+        ? [frame(2, metadata), frame(4)]
+        : [frame(1, metadata), frame(3, entry.body), frame(4)];
+    }),
+    frame(5),
+  ]);
+}
+
+function rawFrames(path: string, declared: number, body: Buffer) {
+  return Buffer.concat([
+    magic(),
+    frame(1, entryMetadata(path, declared)),
+    frame(3, body),
+    frame(4),
+    frame(5),
+  ]);
+}
+
+function entryMetadata(pathValue: string, size: number) {
+  const path = Buffer.from(pathValue);
+  const output = Buffer.alloc(12 + path.byteLength);
+  output.writeUInt32BE(path.byteLength, 0);
+  output.writeBigUInt64BE(BigInt(size), 4);
+  path.copy(output, 12);
+  return output;
+}
+
+function magic() {
+  return Buffer.from([0x57, 0x52, 0x53, 0x46, 1, 0, 0, 0]);
+}
+
+function frame(type: number, payload: Buffer = Buffer.alloc(0)): Buffer {
+  const header = Buffer.alloc(5);
+  header[0] = type;
+  header.writeUInt32BE(payload.byteLength, 1);
+  return Buffer.concat([header, payload]);
+}
+
+async function expected(path: string, size: number): Promise<ArchiveListing> {
+  const spool = await catalog();
+  spool.declareArchiveEntry(path, false, size);
+  return {
+    catalog: spool,
+    entryCount: 1,
+    expandedByteSize: spool.expandedByteSize,
+  };
+}
+
+async function catalog() {
+  const root = await temporaryRoot();
+  const spool = await ReportStagingEntryCatalog.create({
+    path: join(root, "metadata", "index.sqlite"),
+    groupId: "rsg_11111111111111111111111111111111",
+    policy: policy(),
+  });
+  catalogs.push(spool);
+  return spool;
+}
+
+function policy(): ModuleReportStagingPolicyV1 {
+  return {
+    purpose: "evidence.report-staging",
+    sourcePurposes: ["evidence.original"],
+    retentionMs: 60_000,
+    claimTtlMs: 30_000,
+    maxReadLeaseMs: 10_000,
+    maxProcessMs: 10_000,
+    maxSources: 4,
+    maxArchiveBytes: 1_024,
+    maxExpandedBytes: 4_096,
+    maxEntryBytes: 2_048,
+    maxEntries: 20,
+    maxCompressionRatio: 100,
+    maxPathDepth: 8,
+  };
+}