create-windy 0.6.20 → 0.7.0

package/template/apps/server/src/auth/repository.ts

@@ -4,6 +4,7 @@ import type { DataAccessRolePolicy } from "../data-access/context.js";
 import { buildActorScopeContexts } from "../data-access/context.js";
 
 export interface AuthUserRecord {
+  deletedAt?: Date;
   id: string;
   username: string;
   displayName: string;
@@ -100,7 +101,7 @@ export class InMemoryAuthRepository implements AuthRepository {
     username: string,
   ): Promise<AuthUserRecord | undefined> {
     const user = [...this.users.values()].find(
-      (item) => item.username === username,
+      (item) => item.username === username && !item.deletedAt,
     );
     return user ? structuredClone(user) : undefined;
   }
@@ -109,7 +110,9 @@ export class InMemoryAuthRepository implements AuthRepository {
     reference: string,
   ): Promise<AuthUserRecord | undefined> {
     const user = [...this.users.values()].find(
-      (item) => item.id === reference || item.username === reference,
+      (item) =>
+        !item.deletedAt &&
+        (item.id === reference || item.username === reference),
     );
     return user ? structuredClone(user) : undefined;
   }
@@ -141,7 +144,7 @@ export class InMemoryAuthRepository implements AuthRepository {
       return undefined;
     }
     const user = this.users.get(session.userId);
-    if (!user || user.status !== "active") {
+    if (!user || user.deletedAt || user.status !== "active") {
       return undefined;
     }
     const current = this.sessions.get(session.id);
@@ -177,7 +180,7 @@ export class InMemoryAuthRepository implements AuthRepository {
     void updatedAt;
     void updatedBy;
     const user = this.users.get(userId);
-    if (!user) {
+    if (!user || user.deletedAt) {
       return false;
     }
     user.passwordHash = update.passwordHash;
@@ -195,7 +198,7 @@ export class InMemoryAuthRepository implements AuthRepository {
     void updatedAt;
     void updatedBy;
     const user = this.users.get(userId);
-    if (!user) return undefined;
+    if (!user || user.deletedAt) return undefined;
     user.displayName = input.displayName;
     user.email = input.email;
     user.phone = input.phone;
@@ -216,7 +219,7 @@ export class InMemoryAuthRepository implements AuthRepository {
       })
       .flatMap((session) => {
         const user = this.users.get(session.userId);
-        return user?.status === "active"
+        return user?.status === "active" && !user.deletedAt
           ? [
               {
                 sessionId: session.id,

package/template/apps/server/src/auth/routes.test-support.ts

@@ -20,6 +20,7 @@ export function authFixture(
   const events: AuditEvent[] = [];
   const runtime = createServerRuntime({}, { actorResolver: resolver });
   const service = new AuthService(repository, {
+    canManageUser: async () => true,
     passwordPolicy,
     sessionTtlSeconds,
     onSessionsRevoked,

package/template/apps/server/src/auth/runtime.ts

@@ -6,6 +6,8 @@ import { createArgon2PasswordHasher } from "./password.js";
 import { ReauthenticationService } from "./reauthentication.js";
 
 interface AuthRuntimeInput {
+  credentialMutationRunner?: import("../system/mutation-runner.js").MutationRunner;
+  canManageUser?: import("./user-credential-access.js").UserCredentialAccess;
   repository?: AuthRepository;
   sessionTtlSeconds: number | (() => number);
   passwordPolicy?: () => PasswordPolicy;
@@ -19,6 +21,8 @@ export function createAuthRuntime(input: AuthRuntimeInput) {
   const passwordHasher = createArgon2PasswordHasher(input.passwordPolicy);
   const authService = new AuthService(authRepository, {
     sessionTtlSeconds: input.sessionTtlSeconds,
+    canManageUser: input.canManageUser,
+    credentialMutationRunner: input.credentialMutationRunner,
     passwordPolicy: input.passwordPolicy,
     auditWriter: { write: input.auditWriter },
     auditReader: input.auditReader,

package/template/apps/server/src/auth/service-options.ts

@@ -4,6 +4,8 @@ import type { AuthenticationProviderRegistry } from "./authentication-provider.j
 import type { PasswordHasher } from "./password.js";
 
 export interface AuthServiceOptions {
+  credentialMutationRunner?: import("../system/mutation-runner.js").MutationRunner;
+  canManageUser?: import("./user-credential-access.js").UserCredentialAccess;
   sessionTtlSeconds?: number | (() => number);
   passwordPolicy?: () => PasswordPolicy;
   now?: () => Date;

package/template/apps/server/src/auth/service.ts

@@ -81,6 +81,8 @@ export class AuthService {
       this.passwordHasher,
       options.auditWriter,
       this.now,
+      options.canManageUser,
+      options.credentialMutationRunner,
     );
     this.ownSessions = new OwnSessionService(
       repository,

package/template/apps/server/src/auth/user-credential-access.ts

@@ -0,0 +1,37 @@
+import { IdentityRoleAssignment } from "../system/identity-role-assignment.js";
+import type { RequestActor } from "../guards.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import {
+  DataScopedResourceService,
+  DataAccessDeniedError,
+} from "../data-access/scoped-resource.js";
+import type { SystemRepositories } from "../system/seed.js";
+
+export type UserCredentialAccess = (
+  id: string,
+  actor: RequestActor,
+) => Promise<boolean>;
+
+export function createUserCredentialAccess(
+  repositories: SystemRepositories,
+): UserCredentialAccess {
+  const access = new DataScopedResourceService(
+    repositories.users,
+    departmentDescendantResolver(repositories.departments),
+  );
+  const assignment = new IdentityRoleAssignment(
+    repositories.departments,
+    repositories.roles,
+  );
+  return async (id, actor) => {
+    try {
+      const target = await access.get(id, actor);
+      return Boolean(
+        target && !(await assignment.validateUser({}, target, actor)),
+      );
+    } catch (error) {
+      if (error instanceof DataAccessDeniedError) return false;
+      throw error;
+    }
+  };
+}

package/template/apps/server/src/foundation-activation.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { loadPlatformConfig } from "@southwind-ai/config";
 import {
   // @windy-module system.settings begin
   composeModuleMenus,
@@ -6,9 +7,31 @@ import {
   // @windy-module system.settings end
   systemModuleManifests,
 } from "@southwind-ai/modules";
-import { applyPlatformModuleActivation } from "./foundation.js";
+import {
+  applyPlatformModuleActivation,
+  createFoundationSnapshot,
+} from "./foundation.js";
 
 describe("平台 Module 运行时启停", () => {
+  test("平台快照只公开当前运行能力，不携带旧库兼容状态", () => {
+    const snapshot = createFoundationSnapshot(
+      loadPlatformConfig({}),
+      systemModuleManifests(),
+    );
+
+    expect(Object.keys(snapshot.platform).sort()).toEqual([
+      "auditEnabled",
+      "databaseDialect",
+      "enableAI",
+      "licenseEnabled",
+      "name",
+    ]);
+    expect(snapshot.platform.databaseDialect).toBe("postgresql");
+    expect(snapshot.features.map(({ key }) => key)).not.toContain(
+      "system.ruoyi-compat",
+    );
+  });
+
   // @windy-module system.operations begin
   test("停用只关闭能力与入口，保留静态实现声明用于一致性校验", () => {
     const source = systemModuleManifests().find(

package/template/apps/server/src/foundation.ts

@@ -26,7 +26,6 @@ export interface FoundationSnapshot {
     databaseDialect: string;
     licenseEnabled: boolean;
     auditEnabled: boolean;
-    ruoyiCompatibilityEnabled: boolean;
   };
   modules: Array<
     Pick<ModuleManifest, "name" | "version" | "label" | "description">
@@ -147,7 +146,6 @@ export function createFoundationSnapshot(
             metadata?.runtimeActivation !== "disabled",
         ),
       auditEnabled: config.audit.enabled,
-      ruoyiCompatibilityEnabled: config.compatibility.ruoyiVue.enabled,
     },
     modules: modules.map(({ name, version, label, description }) => ({
       name,

package/template/apps/server/src/index.ts

@@ -113,6 +113,7 @@ const {
   reauthentication,
   // @windy-module system.data-governance end
 } = createComposedAuthRuntime({
+  repositories: systemRepositories,
   platformConfig,
   persistence,
   runtime,

package/template/apps/server/src/runtime-development.ts

@@ -23,6 +23,8 @@ export function developmentAdminActor(): RequestActor {
     permissionKeys: [
       "system.admin.access",
       "system.menu.read",
+      "system.profile.read",
+      "system.profile.manage",
       "system.user.read",
       "system.user.manage",
       "system.user-directory.read",

package/template/apps/server/src/runtime.test.ts

@@ -22,6 +22,15 @@ describe("server runtime", () => {
 
     expect(context.actor.id).toBe("user_dev_admin");
     expect(context.actor.permissionKeys).toContain("system.menu.read");
+    const profilePermissions = createFoundationSnapshot()
+      .permissions.filter(({ key }) => key.startsWith("system.profile."))
+      .map(({ key }) => key);
+    expect(profilePermissions).toEqual(
+      expect.arrayContaining(["system.profile.read", "system.profile.manage"]),
+    );
+    expect(context.actor.permissionKeys).toEqual(
+      expect.arrayContaining(profilePermissions),
+    );
     // @windy-module work-order begin
     expect(context.actor.permissionKeys).toContain("work-order.ticket.read");
     // @windy-module work-order end
@@ -58,7 +67,7 @@ describe("server runtime", () => {
 
   test("未知 token 保持匿名，License 可由环境变量提供 Entitlement", async () => {
     const runtime = createServerRuntime({
-      WINDY_LICENSE_ENTITLEMENTS: "capability.ruoyi-compat, capability.agent",
+      WINDY_LICENSE_ENTITLEMENTS: "capability.example, capability.agent",
     });
     const request = new Request("http://localhost/api/foundation", {
       headers: { authorization: "Bearer missing" },
@@ -68,7 +77,7 @@ describe("server runtime", () => {
 
     expect(context.actor.type).toBe("anonymous");
     expect(context.license?.entitlements).toEqual([
-      entitlementKey("capability.ruoyi-compat"),
+      entitlementKey("capability.example"),
       entitlementKey("capability.agent"),
     ]);
   });
@@ -186,7 +195,7 @@ describe("server runtime", () => {
         licenseResolver: {
           async resolve() {
             return {
-              entitlements: [entitlementKey("capability.ruoyi-compat")],
+              entitlements: [entitlementKey("capability.example")],
             };
           },
         },
@@ -197,7 +206,7 @@ describe("server runtime", () => {
     const context = await runtime.createGuardContext(request);
 
     expect(context.license?.entitlements).toEqual([
-      entitlementKey("capability.ruoyi-compat"),
+      entitlementKey("capability.example"),
     ]);
   });
 

package/template/apps/server/src/system/department-organization.ts

@@ -1,4 +1,5 @@
-import type { LifecycleStatus } from "@southwind-ai/shared";
+import { validateDepartmentInput } from "./department-validation.js";
+import { resolveSystemActorForUser } from "./actor.js";
 import type { RequestActor } from "../guards.js";
 import type {
   ManagedDepartment,
@@ -27,58 +28,22 @@ interface OrganizationRepositories {
 }
 
 export class DepartmentOrganizationPolicy {
-  constructor(private readonly repositories: OrganizationRepositories) {}
+  constructor(
+    private readonly repositories: OrganizationRepositories,
+    private readonly changed?: (
+      actors: RequestActor[],
+      occurredAt: string,
+    ) => Promise<void>,
+  ) {}
 
-  async validateInput(
-    input: Partial<ManagedDepartment>,
-    current?: ManagedDepartment,
-  ): Promise<ResourcePolicyResult> {
-    if (
-      input.code !== undefined &&
-      (typeof input.code !== "string" ||
-        !/^[a-zA-Z][a-zA-Z0-9_-]{1,79}$/.test(input.code.trim()))
-    ) {
-      return invalid(
-        "INVALID_DEPARTMENT_CODE",
-        "部门编码需以字母开头且至少 2 位",
-      );
-    }
-    if (
-      input.name !== undefined &&
-      (typeof input.name !== "string" || !input.name.trim())
-    ) {
-      return invalid("INVALID_DEPARTMENT_NAME", "部门名称不能为空");
-    }
-    if (
-      input.order !== undefined &&
-      (!Number.isSafeInteger(input.order) || input.order < 0)
-    ) {
-      return invalid("INVALID_DEPARTMENT_ORDER", "部门排序必须是非负整数");
-    }
-    if (input.status !== undefined && !isLifecycleStatus(input.status)) {
-      return invalid("INVALID_DEPARTMENT_STATUS", "部门状态不合法");
-    }
-    if (
-      !current &&
-      (typeof input.code !== "string" ||
-        typeof input.name !== "string" ||
-        typeof input.parentId !== "string" ||
-        !input.parentId)
-    ) {
-      return invalid(
-        "DEPARTMENT_PARENT_REQUIRED",
-        "平台只允许一个根组织，新部门必须选择上级部门",
-      );
-    }
-    return undefined;
-  }
+  validateInput = validateDepartmentInput;
 
   async beforeCreate(
     input: Partial<ManagedDepartment>,
   ): Promise<ResourcePolicyResult> {
-    const duplicate = (await this.repositories.departments.all()).find(
-      (department) => department.code === input.code?.trim(),
-    );
+    const duplicate = (
+      await this.repositories.departments.all({ includeDeleted: true })
+    ).find((department) => department.code === input.code?.trim());
     if (duplicate) {
       return conflict("DUPLICATE_DEPARTMENT_CODE", "部门编码已存在");
     }
@@ -90,7 +55,9 @@ export class DepartmentOrganizationPolicy {
     input: Partial<ManagedDepartment>,
   ): Promise<ResourcePolicyResult> {
     if (input.code && input.code !== current.code) {
-      const duplicate = (await this.repositories.departments.all()).find(
+      const duplicate = (
+        await this.repositories.departments.all({ includeDeleted: true })
+      ).find(
         (department) =>
           department.id !== current.id &&
           department.code === input.code?.trim(),
@@ -111,7 +78,7 @@ export class DepartmentOrganizationPolicy {
       return this.validateCanLeaveActive(current);
     }
     if (input.status === "active") {
-      return this.validateParent(current, current.parentId);
+      return this.validateParent(current, input.parentId ?? current.parentId);
     }
     return undefined;
   }
@@ -125,6 +92,7 @@ export class DepartmentOrganizationPolicy {
     action: DepartmentTransitionAction,
     targetDepartmentId: string | undefined,
     actor: RequestActor,
+    updates: Partial<ManagedDepartment> = {},
   ): Promise<DepartmentTransitionResult | ResourcePolicyError> {
     const source = await this.repositories.departments.get(id);
     if (!source) {
@@ -133,6 +101,13 @@ export class DepartmentOrganizationPolicy {
     if (!source.parentId) {
       return conflict("ROOT_DEPARTMENT_IMMUTABLE", "根组织不能停用或删除");
     }
+    const updateError =
+      (await this.validateInput(updates, source)) ||
+      (await this.beforeUpdate(source, updates));
+    if (updateError)
+      return typeof updateError === "string"
+        ? conflict("INVALID_DEPARTMENT", updateError)
+        : updateError;
     const references = await this.references(source.id);
     const referenceCount =
       references.children.length +
@@ -156,6 +131,15 @@ export class DepartmentOrganizationPolicy {
       if (targetError) return targetError;
     }
 
+    const previousActors = this.changed
+      ? (
+          await Promise.all(
+            (
+              await this.repositories.users.all({ status: "active" })
+            ).map((user) => resolveSystemActorForUser(this.repositories, user)),
+          )
+        ).filter((value): value is RequestActor => !!value)
+      : [];
     if (target) {
       await this.repositories.departments.updateMany(
         references.children.map((child) => ({
@@ -190,12 +174,13 @@ export class DepartmentOrganizationPolicy {
         ? await this.repositories.departments.softDelete(source.id, actor)
         : await this.repositories.departments.update(
             source.id,
-            { status: "disabled" },
+            { ...updates, status: "disabled" },
             actor,
           );
     if (!department) {
       return conflict("DEPARTMENT_NOT_FOUND", "部门不存在或已删除");
     }
+    await this.changed?.(previousActors, department.updatedAt);
     return {
       department,
       movedChildren: references.children.length,
@@ -277,6 +262,28 @@ export class DepartmentOrganizationPolicy {
     return false;
   }
 
+  async afterUpdate(current: ManagedDepartment, updated: ManagedDepartment) {
+    if (
+      !this.changed ||
+      (current.parentId === updated.parentId &&
+        current.status === updated.status)
+    )
+      return;
+    const users = await this.repositories.users.all({ status: "active" });
+    const actors = (
+      await Promise.all(
+        users.map((user) => resolveSystemActorForUser(this.repositories, user)),
+      )
+    ).filter((value): value is RequestActor => !!value);
+    await this.changed(actors, updated.updatedAt);
+  }
+
+  async preview(departmentId: string) {
+    if (!(await this.repositories.departments.get(departmentId)))
+      return undefined;
+    return referenceDetails(await this.references(departmentId));
+  }
+
   private async references(departmentId: string) {
     const departments = await this.repositories.departments.all();
     const users = await this.repositories.users.all();
@@ -299,10 +306,6 @@ function referenceDetails(
   };
 }
 
-function invalid(error: string, message: string): ResourcePolicyError {
-  return { error, message };
-}
-
 function conflict(
   error: string,
   message: string,
@@ -314,7 +317,3 @@ function conflict(
 function unique(values: string[]): string[] {
   return [...new Set(values)].sort();
 }
-
-function isLifecycleStatus(value: unknown): value is LifecycleStatus {
-  return ["draft", "active", "disabled", "archived"].includes(String(value));
-}

package/template/apps/server/src/system/department-read-routes.ts

@@ -0,0 +1,54 @@
+import type { MutationRunner } from "./mutation-runner.js";
+import { accessCall } from "./resource-access-response.js";
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { createServerRuntime } from "../runtime.js";
+import { evaluateRouteGuards, findSystemFeature } from "../route-guards.js";
+import { forbidden, routeContext } from "./route-helpers.js";
+import type { DepartmentOrganizationPolicy } from "./department-organization.js";
+import type { identityReadModel } from "./identity-read-model.js";
+import type { RouteApp } from "./route-types.js";
+
+export function registerDepartmentReadRoutes(
+  app: RouteApp,
+  policy: DepartmentOrganizationPolicy,
+  readModel: ReturnType<typeof identityReadModel>,
+  runtime: ReturnType<typeof createServerRuntime>,
+  features: FeatureFlagDefinition[],
+  mutationRunner: MutationRunner,
+) {
+  app.get("/system/departments/organization", async (raw) => {
+    const { guardContext } = routeContext(raw);
+    const decision = await evaluateRouteGuards(runtime, guardContext, {
+      permission: {
+        method: "GET",
+        path: "/api/system/departments/organization",
+        permissionKey: "system.department.read",
+      },
+      feature: findSystemFeature(features, "department"),
+    });
+    if (!decision.allowed) return forbidden(decision.reason);
+    return accessCall(() => readModel.organization(guardContext));
+  });
+  app.get("/system/departments/:id/transition-preview", async (raw) => {
+    const { guardContext, params } = routeContext(raw);
+    const decision = await evaluateRouteGuards(runtime, guardContext, {
+      permission: {
+        method: "GET",
+        path: "/api/system/departments/:id/transition-preview",
+        permissionKey: "system.department.manage",
+      },
+      feature: findSystemFeature(features, "department"),
+    });
+    if (!decision.allowed) return forbidden(decision.reason);
+    const result = await mutationRunner.run(() =>
+      policy.preview(String(params.id ?? "")),
+    );
+    return (
+      result ??
+      Response.json(
+        { error: "NOT_FOUND", message: "部门不存在或已删除" },
+        { status: 404 },
+      )
+    );
+  });
+}

package/template/apps/server/src/system/department-routes.test.ts

@@ -95,9 +95,15 @@ describe("部门组织路由", () => {
   });
 
   test("移动部门会拒绝自身、下级和根组织变更", async () => {
-    const { app, context } = await fixture();
-    await createDepartment(app, context, "dept_a", "部门 A", "dept_platform");
-    await createDepartment(app, context, "dept_b", "部门 B", "dept_a");
+    const { app, context, repositories } = await fixture();
+    await createDepartment(
+      repositories,
+      context,
+      "dept_a",
+      "部门 A",
+      "dept_platform",
+    );
+    await createDepartment(repositories, context, "dept_b", "部门 B", "dept_a");
 
     const cycle = (await app.invoke("PUT", "/system/departments/:id", {
       ...context,
@@ -123,22 +129,21 @@ describe("部门组织路由", () => {
   test("有关联数据时要求显式迁移，并原子更新子级、用户和角色范围", async () => {
     const { app, context, repositories, runtime } = await fixture();
     await createDepartment(
-      app,
+      repositories,
       context,
       "dept_source",
       "待处置部门",
       "dept_platform",
     );
     await createDepartment(
-      app,
+      repositories,
       context,
       "dept_child",
       "下级部门",
       "dept_source",
     );
-    await app.invoke("POST", "/system/roles", {
-      ...context,
-      body: {
+    await repositories.roles.create(
+      {
         id: "role_custom",
         code: "custom-scope",
         name: "自定义范围",
@@ -147,17 +152,18 @@ describe("部门组织路由", () => {
         permissionKeys: [],
         menuKeys: [],
       },
-    });
-    await app.invoke("POST", "/system/users", {
-      ...context,
-      body: {
+      context.guardContext.actor,
+    );
+    await repositories.users.create(
+      {
         id: "user_source",
         username: "source-user",
         displayName: "来源用户",
         roleIds: ["role_custom"],
         departmentId: "dept_source",
       },
-    });
+      context.guardContext.actor,
+    );
 
     const blocked = (await app.invoke("DELETE", "/system/departments/:id", {
       ...context,
@@ -218,6 +224,8 @@ describe("部门组织路由", () => {
         name: "无效范围",
         dataScope: "custom",
         departmentIds: ["dept_missing"],
+        permissionKeys: [],
+        menuKeys: [],
       },
     })) as Response;
     expect(response.status).toBe(400);
@@ -228,14 +236,14 @@ describe("部门组织路由", () => {
 });
 
 function createDepartment(
-  app: FakeRouteApp,
-  context: Record<string, unknown>,
+  repositories: Awaited<ReturnType<typeof fixture>>["repositories"],
+  context: Awaited<ReturnType<typeof fixture>>["context"],
   id: string,
   name: string,
   parentId: string,
 ) {
-  return app.invoke("POST", "/system/departments", {
-    ...context,
-    body: { id, code: id, name, parentId, order: 10 },
-  });
+  return repositories.departments.create(
+    { id, code: id, name, parentId, order: 10 },
+    context.guardContext.actor,
+  );
 }