create-windy 0.6.12 → 0.6.15

package/template/apps/server/src/module-host/workflow-input-materialization.test.ts

@@ -0,0 +1,163 @@
+import { expect, test } from "bun:test";
+import type { DurableJobSnapshot, DurableJobs } from "@southwind-ai/jobs";
+import type { ModuleJobPort } from "@southwind-ai/server-sdk";
+import { artifactRef } from "@southwind-ai/storage";
+import { buildScopeContext } from "../data-access/context.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import type { RequestGuardContext } from "../guards.js";
+import { createModuleWorkflowInputMaterializationPort } from "./workflow-input-materialization.js";
+
+test("两阶段 coordinator 只在真实 module Job succeeded 后返回正式 artifact refs", async () => {
+  const context = guard();
+  const source = {
+    mode: "json" as const,
+    publicationKey: "case-1-v7",
+    kind: "structured-data",
+    filename: "case-1.json",
+    retentionPolicyKey: "case.analysis",
+    source: {
+      kind: "case",
+      id: "case-1",
+      version: "7",
+      sequence: 7,
+      digest: `sha256:${"a".repeat(64)}`,
+    },
+    value: { caseId: "case-1" },
+  };
+  let status: "running" | "succeeded" = "running";
+  let submittedPayload: Record<string, unknown> | undefined;
+  const snapshot = (): DurableJobSnapshot => ({
+    job: {
+      id: "job-real",
+      handlerKey: "case.workflow-input-materialize",
+      queue: "case",
+      status,
+      idempotencyKey: "materialize-case-1",
+      payload: submittedPayload!,
+      requestedBy: "actor-1",
+      authorizationScope: captureAuthorizationScope(context.actor.scopeContext)
+        .snapshot,
+      priority: 0,
+      maxAttempts: 3,
+      timeoutSeconds: 900,
+      availableAt: "2026-08-28T00:00:00.000Z",
+      createdAt: "2026-08-28T00:00:00.000Z",
+      updatedAt: "2026-08-28T00:00:00.000Z",
+    },
+    stages: [],
+    attempts: [],
+    leases: [],
+    progress: [],
+    failures: [],
+    recoveries: [],
+    artifacts:
+      status === "succeeded"
+        ? [
+            {
+              id: "dap_real",
+              jobId: "job-real",
+              kind: source.kind,
+              artifactRef: artifactRef(`blob_${"b".repeat(32)}`),
+              filename: source.filename,
+              contentType: "application/json",
+              byteSize: 19,
+              sha256: "c".repeat(64),
+              ownerId: "actor-1",
+              metadata: {
+                publicationKey: source.publicationKey,
+                retentionPolicyKey: source.retentionPolicyKey,
+                sourceModuleKey: "case",
+                sourceKind: source.source.kind,
+                sourceId: source.source.id,
+                sourceVersion: source.source.version,
+                sourceSequence: source.source.sequence,
+                sourceDigest: source.source.digest,
+              },
+              createdAt: "2026-08-28T00:00:00.000Z",
+            },
+          ]
+        : [],
+  });
+  const moduleJobs = {
+    async submit(input) {
+      submittedPayload = input.payload;
+      return { jobId: "job-real", created: true };
+    },
+    async get() {
+      return undefined;
+    },
+    async cancel() {
+      throw new Error("not used");
+    },
+    async recover() {
+      throw new Error("not used");
+    },
+  } satisfies ModuleJobPort;
+  const jobs = {
+    async submit() {
+      throw new Error("coordinator must use scoped module job port");
+    },
+    async get() {
+      return snapshot();
+    },
+    async list() {
+      return [];
+    },
+  } satisfies DurableJobs;
+  const port = createModuleWorkflowInputMaterializationPort({
+    moduleName: "case",
+    guardContext: context,
+    jobs,
+    moduleJobs,
+  });
+
+  const handle = await port.begin({
+    idempotencyKey: "materialize-case-1",
+    sources: [source],
+  });
+  await expect(port.resolve(handle)).resolves.toEqual({
+    ...handle,
+    status: "pending",
+  });
+  status = "succeeded";
+  await expect(port.resolve(handle)).resolves.toMatchObject({
+    status: "ready",
+    artifacts: [{ artifactId: "dap_real", source: { moduleKey: "case" } }],
+  });
+  expect(submittedPayload).toEqual({ schemaVersion: 1, sources: [source] });
+  await expect(
+    port.begin({
+      idempotencyKey: "materialize-invalid",
+      sources: [{ ...source, value: Number.POSITIVE_INFINITY }],
+    }),
+  ).rejects.toMatchObject({ code: "MATERIALIZATION_RESULT_INVALID" });
+});
+
+function guard(): RequestGuardContext {
+  const scope = buildScopeContext(
+    "actor-1",
+    undefined,
+    [
+      {
+        id: "analyst",
+        code: "analyst",
+        dataScope: "custom",
+        departmentIds: ["case-1", "case-2"],
+      },
+    ],
+    [{ scope: "custom", dimension: "caseId", values: ["case-1", "case-2"] }],
+  );
+  return {
+    requestId: "request-1",
+    actor: {
+      id: "actor-1",
+      type: "user",
+      name: "analyst",
+      roleCodes: ["analyst"],
+      permissionKeys: ["case.analysis"],
+      dataAccess: scope,
+      scopeContext: scope,
+    },
+    startedAt: "2026-08-28T00:00:00.000Z",
+  };
+}

package/template/apps/server/src/module-host/workflow-input-materialization.ts

@@ -0,0 +1,161 @@
+import type { DurableJobArtifact, DurableJobs } from "@southwind-ai/jobs";
+import {
+  ModuleWorkflowInputMaterializationError,
+  moduleWorkflowInputMaterializationHandlerKey,
+  parseModuleWorkflowInputMaterializationBeginV1,
+  parseModuleWorkflowInputMaterializationPayloadV1,
+  type ModuleJobPort,
+  type ModuleWorkflowInputMaterializationPortV1,
+  type ModuleWorkflowInputMaterializationSourceV1,
+} from "@southwind-ai/server-sdk";
+import type { AgentWorkflowArtifactRef } from "@southwind-ai/shared";
+import type { RequestGuardContext } from "../guards.js";
+import { captureAuthorizationScope } from "../data-access/scope-snapshot.js";
+import { authorizationScopeContains } from "../data-access/scope-containment.js";
+
+export function createModuleWorkflowInputMaterializationPort(input: {
+  readonly moduleName: string;
+  readonly guardContext: RequestGuardContext;
+  readonly jobs: DurableJobs;
+  readonly moduleJobs: ModuleJobPort;
+  readonly reauthorize?: () => Promise<boolean>;
+}): ModuleWorkflowInputMaterializationPortV1 {
+  const handlerKey = moduleWorkflowInputMaterializationHandlerKey(
+    input.moduleName,
+  );
+  return {
+    async begin(request) {
+      let parsed;
+      try {
+        parsed = parseModuleWorkflowInputMaterializationBeginV1(request);
+      } catch {
+        throw invalid();
+      }
+      const submitted = await input.moduleJobs.submit({
+        handlerKey,
+        idempotencyKey: parsed.idempotencyKey,
+        payload: {
+          schemaVersion: 1,
+          sources: parsed.sources,
+        },
+      });
+      return { materializationId: submitted.jobId };
+    },
+    async resolve(handle) {
+      const snapshot = await currentSnapshot(input, handle.materializationId);
+      if (["queued", "running"].includes(snapshot.job.status)) {
+        return { ...handle, status: "pending" };
+      }
+      if (snapshot.job.status !== "succeeded") throw failed();
+      const sources = payloadSources(snapshot.job.payload);
+      if (snapshot.artifacts.length !== sources.length) throw invalid();
+      const artifacts = sources.map((source) =>
+        projectArtifact(snapshot.artifacts, source, input),
+      );
+      if (
+        new Set(artifacts.map(({ artifactId }) => artifactId)).size !==
+        artifacts.length
+      ) {
+        throw invalid();
+      }
+      return { ...handle, status: "ready", artifacts };
+    },
+    async cancel(handle) {
+      const current = await input.moduleJobs.get(handle.materializationId);
+      if (!current || current.handlerKey !== handlerKey) throw unavailable();
+      if (current.status === "cancelled") return;
+      if (!["queued", "running"].includes(current.status)) throw unavailable();
+      await input.moduleJobs.cancel({
+        jobId: handle.materializationId,
+        reason: handle.reason,
+        expectedStatus: current.status,
+        expectedVersion: current.version,
+      });
+    },
+  };
+}
+
+async function currentSnapshot(
+  input: Parameters<typeof createModuleWorkflowInputMaterializationPort>[0],
+  jobId: string,
+) {
+  if (input.reauthorize && !(await input.reauthorize())) throw unavailable();
+  const snapshot = await input.jobs.get(jobId);
+  const current = captureAuthorizationScope(
+    input.guardContext.actor.scopeContext,
+  ).snapshot;
+  const job = snapshot?.job;
+  if (
+    !snapshot ||
+    !job?.authorizationScope ||
+    job.queue !== input.moduleName ||
+    job.handlerKey !==
+      moduleWorkflowInputMaterializationHandlerKey(input.moduleName) ||
+    job.requestedBy !== input.guardContext.actor.id ||
+    !authorizationScopeContains(current, job.authorizationScope)
+  ) {
+    throw unavailable();
+  }
+  return snapshot;
+}
+
+function payloadSources(payload: Record<string, unknown>) {
+  try {
+    return parseModuleWorkflowInputMaterializationPayloadV1(payload).sources;
+  } catch {
+    throw invalid();
+  }
+}
+
+function projectArtifact(
+  artifacts: readonly DurableJobArtifact[],
+  source: ModuleWorkflowInputMaterializationSourceV1,
+  input: { moduleName: string; guardContext: RequestGuardContext },
+): AgentWorkflowArtifactRef {
+  const artifact = artifacts.find(
+    ({ metadata }) => metadata?.publicationKey === source.publicationKey,
+  );
+  const metadata = artifact?.metadata;
+  if (
+    !artifact ||
+    artifact.ownerId !== input.guardContext.actor.id ||
+    metadata?.sourceModuleKey !== input.moduleName ||
+    metadata.sourceKind !== source.source.kind ||
+    metadata.sourceId !== source.source.id ||
+    metadata.sourceVersion !== source.source.version ||
+    metadata.sourceSequence !== source.source.sequence ||
+    metadata.sourceDigest !== source.source.digest ||
+    metadata.retentionPolicyKey !== source.retentionPolicyKey ||
+    artifact.kind !== source.kind
+  ) {
+    throw invalid();
+  }
+  return {
+    artifactId: artifact.id,
+    kind: artifact.kind,
+    mediaType: artifact.contentType,
+    byteSize: artifact.byteSize,
+    sha256: artifact.sha256,
+    retentionPolicyKey: source.retentionPolicyKey,
+    source: {
+      moduleKey: input.moduleName,
+      ...source.source,
+    },
+  };
+}
+
+function unavailable() {
+  return new ModuleWorkflowInputMaterializationError(
+    "MATERIALIZATION_UNAVAILABLE",
+  );
+}
+
+function failed() {
+  return new ModuleWorkflowInputMaterializationError("MATERIALIZATION_FAILED");
+}
+
+function invalid() {
+  return new ModuleWorkflowInputMaterializationError(
+    "MATERIALIZATION_RESULT_INVALID",
+  );
+}

package/template/apps/server/src/module-host.ts

@@ -9,17 +9,15 @@ export {
   type RegisteredModuleTaskHandler,
   type RegisteredModuleToolHandler,
   type RegisteredModuleAiOperationHandler,
-  type RegisteredModuleDebugSessionProvider,
+  type RegisteredModuleAgentSessionProvider,
 } from "./module-host/initialize.js";
 export {
   buildModuleRequestContext,
   requestActorFromModule,
   toModuleActor,
 } from "./module-host/request-context.js";
-export {
-  installModuleRoutes,
-  type ModuleRouteInstallContext,
-} from "./module-host/route-installer.js";
+export { installModuleRoutes } from "./module-host/route-installer.js";
+export type { ModuleRouteInstallContext } from "./module-host/route-install-context.js";
 export {
   moduleRolePresetId,
   synchronizeModuleRolePresets,

package/template/apps/server/src/runtime.ts

@@ -31,17 +31,10 @@ import {
   requestSourcePolicyFromEnv,
   resolveRequestSource,
 } from "./http/request-source.js";
-import { resolveRequestActor } from "./runtime-request-actor.js";
 import {
   matchesAuditQuery,
   type AuditEventListQuery,
 } from "./runtime-audit-query.js";
-// @windy-module system.agent begin
-import {
-  createAdkDebugRuntime,
-  type AdkDebugActorResolver,
-} from "./runtime-adk-debug.js";
-// @windy-module system.agent end
 
 export type {
   FeatureFlagRuntimeResolver,
@@ -79,9 +72,6 @@ export interface ServerRuntimeOptions {
   disabledModuleNames?: ReadonlySet<string>;
   auditWriter?: AuditEventWriter;
   auditReader?: AuditEventReader;
-  // @windy-module system.agent begin
-  adkDebugActorResolver?: AdkDebugActorResolver;
-  // @windy-module system.agent end
 }
 
 export class InMemorySessionStore {
@@ -190,19 +180,6 @@ export function createServerRuntime(
   options: ServerRuntimeOptions = {},
 ) {
   const developmentAuth = readDevelopmentAuthBypass(env);
-  // @windy-module system.agent begin
-  const adkDebug = createAdkDebugRuntime(
-    env,
-    undefined,
-    options.adkDebugActorResolver,
-  );
-  if (adkDebug.usesToken(developmentAuth.token)) {
-    throw new Error("ADK Web 调试 Token 不能复用开发管理员 Token");
-  }
-  if (adkDebug.usesToken(env.AGENT_SERVER_INTERNAL_TOKEN?.trim())) {
-    throw new Error("ADK Web 调试 Token 不能复用 Agent 内部服务 Token");
-  }
-  // @windy-module system.agent end
   const sessionStore = new InMemorySessionStore(
     developmentAuth.token
       ? [{ token: developmentAuth.token, actor: developmentAdminActor() }]
@@ -234,15 +211,9 @@ export function createServerRuntime(
         metadata.clientIp,
         requestSourcePolicy,
       );
-      const actor = await resolveRequestActor(
-        request,
-        async () =>
-          (await options.actorResolver?.resolve(request)) ||
-          sessionStore.resolve(request),
-        // @windy-module system.agent begin
-        adkDebug,
-        // @windy-module system.agent end
-      );
+      const actor =
+        (await options.actorResolver?.resolve(request)) ||
+        sessionStore.resolve(request);
       const license =
         (await options.licenseResolver?.resolve()) || licenseStore.resolve();
       return createRequestGuardContext(request, {
@@ -252,10 +223,6 @@ export function createServerRuntime(
         licenseEnforced: options.licenseEnforced,
       });
     },
-    // @windy-module system.agent begin
-    resolveEphemeralActor: adkDebug.resolveActor,
-    agentDebugOperationForActor: adkDebug.operationForActor,
-    // @windy-module system.agent end
     async createGuardContextForActor(
       request: Request,
       actor: RequestActor,

package/template/apps/server/src/storage/routes-stream-cancellation.test.ts

@@ -69,6 +69,25 @@ describe("legacy Storage 分片路由取消未读请求体", () => {
     ).rejects.toThrow("injected guard failure");
     expect(request.cancelled()).toBe(true);
   });
+
+  test("运行时请求体缺少 cancel 时 Guard 拒绝仍保留 403", async () => {
+    const fixture = setup();
+    const request = new Request("http://localhost/api/system/storage/upload", {
+      method: "PUT",
+    });
+    Object.defineProperty(request, "body", {
+      value: {},
+      configurable: true,
+    });
+
+    const response = await fixture.invoke(
+      actor([]),
+      "upload_44444444444444444444444444444444",
+      request,
+    );
+
+    expect(response.status).toBe(403);
+  });
 });
 
 function setup(guardFailure = false) {

package/template/apps/server/src/storage/routes.ts

@@ -311,7 +311,9 @@ async function cancelUnreadBody(
   body: ReadableStream<Uint8Array> | null | undefined,
   reason: string,
 ): Promise<void> {
-  await body?.cancel(reason).catch(() => undefined);
+  const cancel = body?.cancel;
+  if (typeof cancel !== "function") return;
+  await cancel.call(body, reason).catch(() => undefined);
 }
 
 function record(

package/template/apps/server/src/system/actor.ts

@@ -1,5 +1,6 @@
 import { buildActorScopeContexts } from "../data-access/context.js";
 import type { RequestActor } from "../guards.js";
+import type { ManagedRole, ManagedUser } from "./entities.js";
 import type { SystemRepositories } from "./seed.js";
 
 export async function resolveCurrentSystemActor(
@@ -7,9 +8,21 @@ export async function resolveCurrentSystemActor(
   actorId: string,
 ): Promise<RequestActor | undefined> {
   const user = await repositories.users.get(actorId);
-  if (!user || user.status !== "active") return undefined;
+  if (!user) return undefined;
+  return resolveSystemActorForUser(repositories, user);
+}
+
+export async function resolveSystemActorForUser(
+  repositories: Pick<SystemRepositories, "roles">,
+  user: ManagedUser,
+  roleOverrides: readonly ManagedRole[] = [],
+): Promise<RequestActor | undefined> {
+  if (user.status !== "active") return undefined;
+  const overrides = new Map(roleOverrides.map((role) => [role.id, role]));
   const roles = (
-    await Promise.all(user.roleIds.map((id) => repositories.roles.get(id)))
+    await Promise.all(
+      user.roleIds.map((id) => overrides.get(id) ?? repositories.roles.get(id)),
+    )
   ).filter(
     (role): role is NonNullable<typeof role> => role?.status === "active",
   );

package/template/apps/server/src/system/authorization-invalidation-bridge.ts

@@ -0,0 +1,30 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { RequestActor } from "../guards.js";
+
+export interface AgentAuthorizationInvalidationInput {
+  readonly previousActor: RequestActor;
+  readonly eventId: string;
+  readonly occurredAt: string;
+  readonly database: NodePgDatabase;
+}
+
+export type AgentAuthorizationInvalidationTarget = (
+  input: AgentAuthorizationInvalidationInput,
+) => Promise<void>;
+
+/** Routes are registered before Agent composition, so startup binds this once. */
+export class DeferredAgentAuthorizationInvalidation {
+  #target?: AgentAuthorizationInvalidationTarget;
+
+  bind(target: AgentAuthorizationInvalidationTarget | undefined) {
+    if (this.#target) throw new Error("Agent 授权失效传播已绑定");
+    this.#target = target;
+  }
+
+  async publish(input: AgentAuthorizationInvalidationInput) {
+    if (!this.#target) {
+      throw new Error("Agent 授权失效传播暂不可用");
+    }
+    await this.#target(input);
+  }
+}

package/template/apps/server/src/system/authorization-invalidation-composition.ts

@@ -0,0 +1,36 @@
+import type { PlatformConfig } from "@southwind-ai/config";
+import type { AgentAuthorizationInvalidationTarget } from "./authorization-invalidation-bridge.js";
+import { DeferredAgentAuthorizationInvalidation } from "./authorization-invalidation-bridge.js";
+import type { ServerPersistence } from "../persistence.js";
+import type { SystemRepositories } from "./seed.js";
+
+export function createAuthorizationInvalidationComposition(input: {
+  readonly platformConfig: PlatformConfig;
+  readonly persistence?: ServerPersistence;
+  readonly repositories: SystemRepositories;
+}) {
+  const bridge = new DeferredAgentAuthorizationInvalidation();
+  const authorizationRevocations =
+    input.platformConfig.enableAI && input.persistence?.db
+      ? {
+          publish: (
+            event: Omit<Parameters<typeof bridge.publish>[0], "database">,
+          ) =>
+            bridge.publish({
+              ...event,
+              database:
+                input.repositories.organizationTransaction?.currentDatabase() ??
+                input.persistence!.db!,
+            }),
+        }
+      : undefined;
+  return {
+    systemRouteOptions: {
+      authRepository: input.persistence?.authRepository,
+      ...(authorizationRevocations ? { authorizationRevocations } : {}),
+    },
+    bind(target: AgentAuthorizationInvalidationTarget | undefined) {
+      bridge.bind(target);
+    },
+  };
+}

package/template/apps/server/src/system/drizzle-system.ts

@@ -55,6 +55,9 @@ export interface DrizzleSystemRepositories {
   licenses: EntityRepository<ManagedLicense>;
   // @windy-module system.license end
   organizationMutationRunner: MutationRunner;
+  organizationTransaction: {
+    currentDatabase(): NodePgDatabase;
+  };
 }
 
 export function createDrizzleSystemRepositories(
@@ -62,7 +65,7 @@ export function createDrizzleSystemRepositories(
   seeds: DrizzleSystemRepositorySeeds,
 ): DrizzleSystemRepositories {
   const transactionContext = new DrizzleTransactionContext();
-  return {
+  const repositories = {
     users: new DrizzleScopedEntityRepository(
       db,
       userConfig(seeds.users),
@@ -107,5 +110,9 @@ export function createDrizzleSystemRepositories(
       "windy:system:organization",
       transactionContext,
     ),
+    organizationTransaction: {
+      currentDatabase: () => transactionContext.current(db),
+    },
   };
+  return repositories;
 }

package/template/apps/server/src/system/identity-route-config.ts

@@ -6,7 +6,10 @@ import type { ManagedRole, ManagedUser } from "./entities.js";
 import { resource } from "./resource-route-support.js";
 import type { ResourceRouteConfig } from "./route-types.js";
 import type { SystemRepositories } from "./seed.js";
-import { UserAccountPolicy } from "./user-account-policy.js";
+import {
+  type AuthorizationRevocationPublisher,
+  UserAccountPolicy,
+} from "./user-account-policy.js";
 import { userDepartmentValidator } from "./user-department-validation.js";
 import { projectMaskedUser } from "./user-projection.js";
 import { RoleDepartmentScopePolicy } from "./role-department-scope-policy.js";
@@ -15,6 +18,7 @@ export function identityRouteConfigs(
   repositories: SystemRepositories,
   features: FeatureFlagDefinition[],
   authRepository?: Pick<AuthRepository, "revokeUserSessions">,
+  authorizationRevocations?: AuthorizationRevocationPublisher,
 ): {
   users: ResourceRouteConfig<ManagedUser>;
   roles: ResourceRouteConfig<ManagedRole>;
@@ -23,6 +27,7 @@ export function identityRouteConfigs(
     repositories.users,
     repositories.roles,
     authRepository,
+    authorizationRevocations,
   );
   const roleDepartmentScope = new RoleDepartmentScopePolicy(
     repositories.departments,
@@ -71,6 +76,9 @@ export function identityRouteConfigs(
       validateInput: (input, current) =>
         roleDepartmentScope.validate(input, current),
       beforeDelete: (current) => policy.protectRoleDelete(current),
+      afterUpdate: (current, updated) =>
+        policy.afterRoleUpdate(current, updated),
+      afterDelete: (deleted) => policy.afterRoleDelete(deleted),
       importable: false,
       mutationRunner,
     },

package/template/apps/server/src/system/routes.ts

@@ -20,6 +20,7 @@ import { registerUserPlaintextRoutes } from "../data-governance/user-plaintext-r
 // @windy-module system.data-governance end
 import { DepartmentOrganizationPolicy } from "./department-organization.js";
 import { registerResourceRoutes } from "./resource-routes.js";
+import type { AuthorizationRevocationPublisher } from "./user-account-policy.js";
 
 export type { RouteApp } from "./route-types.js";
 
@@ -30,12 +31,14 @@ export function registerSystemRoutes(
   features: FeatureFlagDefinition[],
   options: {
     authRepository?: Pick<AuthRepository, "revokeUserSessions">;
+    authorizationRevocations?: AuthorizationRevocationPublisher;
   } = {},
 ) {
   const identity = identityRouteConfigs(
     repositories,
     features,
     options.authRepository,
+    options.authorizationRevocations,
   );
   const departmentPolicy = new DepartmentOrganizationPolicy(repositories);
   // @windy-module system.data-governance begin

package/template/apps/server/src/system/seed.ts

@@ -43,6 +43,9 @@ export interface SystemRepositories {
   // @windy-module system.license end
   menuRegistry: ManifestMenuRegistry;
   organizationMutationRunner: MutationRunner;
+  organizationTransaction?: {
+    currentDatabase(): NodePgDatabase;
+  };
 }
 
 export interface CreateSystemRepositoryOptions {