create-windy 0.6.21 → 0.7.0

package/template/apps/server/src/system/identity-role-assignment.test.ts

@@ -0,0 +1,199 @@
+import { describe, expect, test } from "bun:test";
+import type { RequestActor } from "../guards.js";
+import { buildActorScopeContexts } from "../data-access/context.js";
+import type { ManagedDepartment, ManagedRole } from "./entities.js";
+import { IdentityRoleAssignment } from "./identity-role-assignment.js";
+import { InMemoryEntityRepository } from "./repository.js";
+
+const audit = {
+  createdAt: "2026-09-10T00:00:00Z",
+  updatedAt: "2026-09-10T00:00:00Z",
+  createdBy: "system",
+  updatedBy: "system",
+};
+const departmentRole: ManagedRole = {
+  ...audit,
+  id: "department-role",
+  code: "department-manager",
+  name: "部门管理员",
+  dataScope: "department",
+  departmentIds: [],
+  permissionKeys: ["system.user.manage"],
+  menuKeys: [],
+  status: "active",
+};
+const customRole: ManagedRole = {
+  ...departmentRole,
+  id: "custom-role",
+  code: "custom",
+  dataScope: "custom",
+  departmentIds: ["a", "b"],
+};
+const rootRole: ManagedRole = {
+  ...departmentRole,
+  id: "root-role",
+  code: "super-admin",
+  dataScope: "all",
+};
+const departments = new InMemoryEntityRepository<ManagedDepartment>(
+  ["a", "b"].map((id) => ({
+    ...audit,
+    id,
+    name: id,
+    code: id,
+    order: 0,
+    status: "active",
+  })),
+);
+const policy = new IdentityRoleAssignment(
+  departments,
+  new InMemoryEntityRepository([departmentRole, customRole, rootRole]),
+);
+function actor(roles: ManagedRole[]): RequestActor {
+  return {
+    id: "manager",
+    name: "管理员",
+    type: "user",
+    roleCodes: roles.map((role) => role.code),
+    permissionKeys: ["system.user.manage"],
+    ...buildActorScopeContexts(
+      "manager",
+      "a",
+      roles.map((role) => ({
+        ...role,
+        departmentIds: role.departmentIds || [],
+      })),
+    ),
+  };
+}
+
+describe("delegated role assignment", () => {
+  test("委派管理员不能把自己提为超管，超管可授予所有启用角色", async () => {
+    expect(
+      await policy.validateUser(
+        { id: "manager", departmentId: "a", roleIds: [rootRole.id] },
+        undefined,
+        actor([departmentRole]),
+      ),
+    ).toContain("超级管理员");
+    expect(
+      await policy.validateUser(
+        { departmentId: "b", roleIds: [departmentRole.id] },
+        undefined,
+        actor([rootRole]),
+      ),
+    ).toBeUndefined();
+  });
+
+  test("不能先修改同部门高权账户资料或移除角色，再接管身份", async () => {
+    const target = {
+      ...audit,
+      id: "root-user",
+      username: "root",
+      displayName: "超级管理员",
+      departmentId: "a",
+      roleIds: [rootRole.id],
+      status: "active" as const,
+    };
+    expect(
+      await policy.validateUser(
+        { displayName: "改名" },
+        target,
+        actor([departmentRole]),
+      ),
+    ).toContain("超级管理员");
+    expect(
+      await policy.validateUser(
+        { roleIds: [departmentRole.id] },
+        target,
+        actor([departmentRole]),
+      ),
+    ).toContain("超级管理员");
+  });
+
+  test("跨部门使用本人角色仍须证明目标授权范围不扩大", async () => {
+    expect(
+      await policy.validateUser(
+        { id: "other", departmentId: "b", roleIds: [departmentRole.id] },
+        undefined,
+        actor([departmentRole]),
+      ),
+    ).toContain("扩大");
+    expect(
+      await policy.validateUser(
+        { id: "other", departmentId: "b", roleIds: [departmentRole.id] },
+        undefined,
+        actor([departmentRole, customRole]),
+      ),
+    ).toBeUndefined();
+  });
+
+  test("新建未持有角色可授予范围内账户，但权限或目标范围超限仍拒绝", async () => {
+    const roles = new InMemoryEntityRepository<ManagedRole>([departmentRole]);
+    const assignment = new IdentityRoleAssignment(departments, roles);
+    const manager = actor([departmentRole]);
+    const draft = {
+      ...departmentRole,
+      id: "new-role",
+      code: "new-role",
+      name: "新角色",
+    };
+    expect(
+      await assignment.validateRole(draft, undefined, manager),
+    ).toBeUndefined();
+    await roles.create(draft, manager);
+    expect(
+      await assignment.validateUser(
+        { departmentId: "a", roleIds: [draft.id] },
+        undefined,
+        manager,
+      ),
+    ).toBeUndefined();
+    expect(
+      await assignment.validateUser(
+        { departmentId: "b", roleIds: [draft.id] },
+        undefined,
+        manager,
+      ),
+    ).toContain("扩大");
+    expect(
+      await assignment.validateRole({ name: "改共享角色" }, draft, manager),
+    ).toContain("本人持有");
+    await roles.update(
+      draft.id,
+      { permissionKeys: ["system.role.manage"] },
+      manager,
+    );
+    expect(
+      await assignment.validateUser(
+        { departmentId: "a", roleIds: [draft.id] },
+        undefined,
+        manager,
+      ),
+    ).toContain("超出");
+  });
+
+  test("不能通过修改共享角色或改超级管理员编码提升权限", async () => {
+    expect(
+      await policy.validateRole(
+        { code: "super-admin" },
+        departmentRole,
+        actor([departmentRole]),
+      ),
+    ).toContain("超出");
+    expect(
+      await policy.validateRole(
+        { dataScope: "all" },
+        departmentRole,
+        actor([departmentRole]),
+      ),
+    ).toContain("共享角色");
+    expect(
+      await policy.validateRole(
+        { permissionKeys: ["system.role.manage"] },
+        departmentRole,
+        actor([departmentRole]),
+      ),
+    ).toContain("超出");
+  });
+});

package/template/apps/server/src/system/identity-role-assignment.ts

@@ -0,0 +1,148 @@
+import type { RequestActor } from "../guards.js";
+import {
+  buildScopeContext,
+  isServerScopeContext,
+} from "../data-access/context.js";
+import {
+  buildDataScopeQuerySpecification,
+  type DataScopeQueryBranch,
+} from "../data-access/query-specification.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import type {
+  ManagedDepartment,
+  ManagedRole,
+  ManagedUser,
+} from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+
+export class IdentityRoleAssignment {
+  constructor(
+    private readonly departments: EntityRepository<ManagedDepartment>,
+    private readonly roles: EntityRepository<ManagedRole>,
+  ) {}
+
+  async validateUser(
+    input: Partial<ManagedUser>,
+    current: ManagedUser | undefined,
+    actor: RequestActor | undefined,
+  ): Promise<string | undefined> {
+    if (!actor) return "缺少角色授权主体";
+    if (actor.roleCodes.includes("super-admin")) return undefined;
+    if (!isServerScopeContext(actor.scopeContext))
+      return "缺少角色授权数据范围";
+    const candidates = current ? [current, { ...current, ...input }] : [input];
+    for (const user of candidates) {
+      const ids = user.roleIds || [];
+      for (const id of ids) {
+        const role = await this.roles.get(id);
+        if (!role) return "角色不存在或已删除";
+        if (role.code === "super-admin")
+          return "只有超级管理员能授予或维护超级管理员身份";
+        if (
+          !role.permissionKeys.every((key) =>
+            actor.permissionKeys.includes(key),
+          )
+        )
+          return "不能授予超出本人权限的角色";
+        if (
+          !(await this.withinScope(
+            role,
+            user.id || "new-user",
+            user.departmentId,
+            actor,
+          ))
+        )
+          return "角色授权不能扩大操作者的数据范围";
+      }
+    }
+    return undefined;
+  }
+
+  async validateRole(
+    input: Partial<ManagedRole>,
+    current: ManagedRole | undefined,
+    actor: RequestActor | undefined,
+  ): Promise<string | undefined> {
+    if (!actor) return "缺少角色授权主体";
+    if (actor.roleCodes.includes("super-admin")) return undefined;
+    if (!isServerScopeContext(actor.scopeContext))
+      return "缺少角色授权数据范围";
+    const role = { ...current, ...input } as ManagedRole;
+    if (current && !actor.scopeContext.roleIds.includes(current.id))
+      return "只能维护本人持有的角色";
+    if (
+      role.code === "super-admin" ||
+      !role.permissionKeys.every((key) => actor.permissionKeys.includes(key))
+    )
+      return "角色权限不能超出操作者权限";
+    // Changing a shared role can expand every member, even when the editor's own scope is unchanged.
+    if (
+      current &&
+      (role.dataScope !== current.dataScope ||
+        JSON.stringify(role.departmentIds || []) !==
+          JSON.stringify(current.departmentIds || []))
+    )
+      return "委派管理员不能修改共享角色的数据范围";
+    return (await this.withinScope(
+      role,
+      actor.id,
+      actor.scopeContext.departmentId,
+      actor,
+    ))
+      ? undefined
+      : "角色数据范围不能超出操作者范围";
+  }
+
+  private async withinScope(
+    role: ManagedRole,
+    userId: string,
+    departmentId: string | undefined,
+    actor: RequestActor,
+  ): Promise<boolean> {
+    if (!isServerScopeContext(actor.scopeContext)) return false;
+    const resolver = {
+      descendants: departmentDescendantResolver(this.departments),
+    };
+    const target = await buildDataScopeQuerySpecification(
+      buildScopeContext(userId, departmentId, [
+        { ...role, departmentIds: role.departmentIds || [] },
+      ]),
+      resolver,
+    );
+    const allowed = await buildDataScopeQuerySpecification(
+      actor.scopeContext,
+      resolver,
+    );
+    return target.branches.every((branch) =>
+      included(branch, allowed.branches, departmentId),
+    );
+  }
+}
+
+function included(
+  target: DataScopeQueryBranch,
+  allowed: readonly DataScopeQueryBranch[],
+  departmentId: string | undefined,
+): boolean {
+  if (
+    allowed.some((branch) => branch.kind === "all" || branch.kind === "tenant")
+  )
+    return true;
+  if (target.kind === "all" || target.kind === "tenant") return false;
+  if (target.kind === "owner")
+    return allowed.some((branch) =>
+      branch.kind === "owner"
+        ? branch.ownerId === target.ownerId
+        : branch.kind === "dimension" &&
+          branch.dimension === "departmentId" &&
+          Boolean(departmentId && branch.values.includes(departmentId)),
+    );
+  const values = new Set(
+    allowed.flatMap((branch) =>
+      branch.kind === "dimension" && branch.dimension === target.dimension
+        ? [...branch.values]
+        : [],
+    ),
+  );
+  return target.values.every((value) => values.has(value));
+}

package/template/apps/server/src/system/identity-route-config.ts

@@ -1,3 +1,10 @@
+import { IdentityRoleAssignment } from "./identity-role-assignment.js";
+import {
+  userWritableFields,
+  roleWritableFields,
+  validateUserFields,
+  validateRoleFields,
+} from "./identity-write-validation.js";
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { AuthRepository } from "../auth/repository.js";
 import { departmentDescendantResolver } from "../data-access/department-tree.js";
@@ -17,7 +24,8 @@ import { RoleDepartmentScopePolicy } from "./role-department-scope-policy.js";
 export function identityRouteConfigs(
   repositories: SystemRepositories,
   features: FeatureFlagDefinition[],
-  authRepository?: Pick<AuthRepository, "revokeUserSessions">,
+  authRepository?: Pick<AuthRepository, "revokeUserSessions"> &
+    Partial<Pick<AuthRepository, "findUserByReference">>,
   authorizationRevocations?: AuthorizationRevocationPublisher,
 ): {
   users: ResourceRouteConfig<ManagedUser>;
@@ -32,6 +40,10 @@ export function identityRouteConfigs(
   const roleDepartmentScope = new RoleDepartmentScopePolicy(
     repositories.departments,
   );
+  const assignment = new IdentityRoleAssignment(
+    repositories.departments,
+    repositories.roles,
+  );
   const mutationRunner = repositories.organizationMutationRunner;
   return {
     users: {
@@ -50,14 +62,19 @@ export function identityRouteConfigs(
         },
       ),
       projectResponse: projectMaskedUser,
-      validateInput: async (input, current) =>
+      writableFields: userWritableFields,
+      validateInput: async (input, current, actor) =>
+        (await validateUserFields(input, repositories.users, current)) ||
         (await userDepartmentValidator(repositories.departments)(input)) ||
-        (await policy.validate(input, current)),
+        (await policy.validate(input, current)) ||
+        (await assignment.validateUser(input, current, actor)),
       importable: false,
       backupExport: false,
       mutationRunner,
       beforeUpdate: (current, input) => policy.protectUpdate(current, input),
-      beforeDelete: (current) => policy.protectDelete(current),
+      beforeDelete: async (current, actor) =>
+        (await assignment.validateUser({}, current, actor)) ||
+        (await policy.protectDelete(current)),
       afterUpdate: (current, updated, actor) =>
         policy.afterUpdate(current, updated, actor),
       afterDelete: (deleted) => policy.afterDelete(deleted),
@@ -73,9 +90,14 @@ export function identityRouteConfigs(
       ),
       beforeUpdate: (current, input) =>
         policy.protectRoleUpdate(current, input),
-      validateInput: (input, current) =>
-        roleDepartmentScope.validate(input, current),
-      beforeDelete: (current) => policy.protectRoleDelete(current),
+      writableFields: roleWritableFields,
+      validateInput: async (input, current, actor) =>
+        (await validateRoleFields(input, repositories.roles, current)) ||
+        (await roleDepartmentScope.validate(input, current)) ||
+        (await assignment.validateRole(input, current, actor)),
+      beforeDelete: async (current, actor) =>
+        (await assignment.validateRole({}, current, actor)) ||
+        policy.protectRoleDelete(current),
       afterUpdate: (current, updated) =>
         policy.afterRoleUpdate(current, updated),
       afterDelete: (deleted) => policy.afterRoleDelete(deleted),

package/template/apps/server/src/system/identity-write-security.test.ts

@@ -0,0 +1,127 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
+import { createSystemRepositories } from "./seed.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import { registerSystemRoutes } from "./routes.js";
+import {
+  identityMutationResponse,
+  validateUserFields,
+  validateRoleFields,
+} from "./identity-write-validation.js";
+import { UserAccountPolicy } from "./user-account-policy.js";
+
+async function fixture() {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  const runtime = createRouteTestRuntime(snapshot, {
+    WINDY_DEV_ADMIN_TOKEN: "identity-security",
+  });
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/users", {
+      headers: { authorization: "Bearer identity-security" },
+    }),
+  );
+  const app = new FakeRouteApp();
+  registerSystemRoutes(app, repositories, runtime, snapshot.features);
+  return { app, repositories, guardContext };
+}
+
+describe("identity write boundary", () => {
+  test("用户写入审计字段被拒绝，最后管理员保持可见", async () => {
+    const { app, repositories, guardContext } = await fixture();
+    const current = (await repositories.users.all())[0]!;
+    for (const field of [
+      "deletedAt",
+      "deletedBy",
+      "createdBy",
+      "createdAt",
+      "id",
+      "passwordHash",
+    ]) {
+      const response = (await app.invoke("PUT", "/system/users/:id", {
+        guardContext,
+        params: { id: current.id },
+        query: {},
+        body: { [field]: "injected" },
+      })) as Response;
+      expect(response.status).toBe(400);
+      expect(await repositories.users.get(current.id)).toEqual(current);
+    }
+  });
+
+  test("用户与角色缺必填、非法状态和重复唯一字段返回业务错误", async () => {
+    const { repositories } = await fixture();
+    expect(
+      await validateUserFields(
+        { username: "", displayName: "测试", roleIds: [] },
+        repositories.users,
+      ),
+    ).toContain("用户名");
+    expect(
+      await validateRoleFields(
+        { code: "role", name: "角色" },
+        repositories.roles,
+      ),
+    ).toContain("权限");
+    const current = (await repositories.users.all())[0]!;
+    expect(
+      await validateUserFields(
+        {
+          username: current.username,
+          displayName: "重复",
+          roleIds: ["role_user"],
+        },
+        repositories.users,
+      ),
+    ).toMatchObject({ error: "DUPLICATE_IDENTITY" });
+    const result = (await identityMutationResponse(async () => {
+      throw { cause: { code: "23505", detail: "private value" } };
+    })) as Response;
+    expect(result.status).toBe(409);
+    expect(JSON.stringify(await result.json())).not.toContain("private value");
+  });
+
+  test("无凭据的第二管理员不能让最后可登录管理员被停用", async () => {
+    const { repositories, guardContext } = await fixture();
+    const first = (await repositories.users.all())[0]!;
+    await repositories.users.update(
+      first.id,
+      { roleIds: ["role_super_admin"] },
+      guardContext.actor,
+    );
+    const current = (await repositories.users.get(first.id))!;
+    await repositories.users.create(
+      {
+        username: "not-initialized",
+        displayName: "未初始化管理员",
+        departmentId: current.departmentId,
+        roleIds: ["role_super_admin"],
+      },
+      guardContext.actor,
+    );
+    const policy = new UserAccountPolicy(
+      repositories.users,
+      repositories.roles,
+      {
+        revokeUserSessions: async () => 0,
+        findUserByReference: async (id) =>
+          id === current.id
+            ? {
+                id,
+                username: current.username,
+                displayName: current.displayName,
+                passwordHash: "credential",
+                credentialState: "active",
+                status: "active",
+                roleCodes: ["super-admin"],
+                permissionKeys: [],
+              }
+            : undefined,
+      },
+    );
+    expect(
+      await policy.protectUpdate(current, { status: "disabled" }),
+    ).toContain("至少一个");
+  });
+});