create-windy 0.6.21 → 0.7.0

package/template/apps/server/src/system/identity-write-validation.ts

@@ -0,0 +1,170 @@
+import type { ManagedRole, ManagedUser } from "./entities.js";
+import type { EntityRepository } from "./repository.js";
+import type { ResourcePolicyResult } from "./route-types.js";
+
+export const userWritableFields = [
+  "username",
+  "displayName",
+  "email",
+  "phone",
+  "departmentId",
+  "roleIds",
+  "postIds",
+  "status",
+] as const;
+export const roleWritableFields = [
+  "code",
+  "name",
+  "dataScope",
+  "permissionKeys",
+  "menuKeys",
+  "departmentIds",
+  "status",
+] as const;
+
+export function validateWritableFields(
+  body: unknown,
+  fields: readonly PropertyKey[],
+): string | undefined {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return "请求必须是对象";
+  return Object.keys(body).some((key) => !fields.includes(key))
+    ? "请求包含不可写字段"
+    : undefined;
+}
+
+export async function validateUserFields(
+  input: Partial<ManagedUser>,
+  repository: EntityRepository<ManagedUser>,
+  current?: ManagedUser,
+): Promise<ResourcePolicyResult> {
+  const error =
+    textField(input.username, "用户名", 80, !current) ||
+    textField(input.displayName, "姓名", 120, !current) ||
+    textField(input.email, "邮箱", 160, false, true) ||
+    textField(input.phone, "手机号", 32, false, true) ||
+    statusField(input.status) ||
+    stringArray(input.roleIds, "角色", !current) ||
+    stringArray(input.postIds, "岗位", false);
+  if (error) return error;
+  if (input.username !== undefined && /\s/.test(input.username))
+    return "用户名不能包含空白字符";
+  if (input.email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input.email))
+    return "邮箱格式不正确";
+  if (input.phone && !/^\+?[0-9][0-9 -]{5,30}[0-9]$/.test(input.phone))
+    return "手机号格式不正确";
+  const users = await repository.all({ includeDeleted: true });
+  if (
+    users.some(
+      (user) => user.id !== current?.id && user.username === input.username,
+    )
+  )
+    return duplicate("用户名已存在");
+  if (
+    input.phone &&
+    users.some((user) => user.id !== current?.id && user.phone === input.phone)
+  )
+    return duplicate("手机号已被使用");
+  return undefined;
+}
+
+export async function validateRoleFields(
+  input: Partial<ManagedRole>,
+  repository: EntityRepository<ManagedRole>,
+  current?: ManagedRole,
+): Promise<ResourcePolicyResult> {
+  const error =
+    textField(input.code, "角色编码", 80, !current) ||
+    textField(input.name, "角色名称", 120, !current) ||
+    statusField(input.status) ||
+    stringArray(input.permissionKeys, "权限", !current) ||
+    stringArray(input.menuKeys, "菜单", !current) ||
+    stringArray(input.departmentIds, "部门范围", false);
+  if (error) return error;
+  if (
+    (!current || input.dataScope !== undefined) &&
+    ![
+      "all",
+      "tenant",
+      "self",
+      "department",
+      "department-and-children",
+      "custom",
+    ].includes(input.dataScope || "")
+  )
+    return "角色数据范围无效";
+  if (input.code !== undefined && !/^[A-Za-z0-9_.-]+$/.test(input.code))
+    return "角色编码格式不正确";
+  const roles = await repository.all({ includeDeleted: true });
+  if (roles.some((role) => role.id !== current?.id && role.code === input.code))
+    return duplicate("角色编码已存在");
+  return undefined;
+}
+
+function textField(
+  value: unknown,
+  label: string,
+  max: number,
+  required: boolean,
+  empty = false,
+): string | undefined {
+  if (value === undefined && !required) return undefined;
+  if (
+    typeof value !== "string" ||
+    value.length > max ||
+    (!empty && !value.trim()) ||
+    value !== value.trim()
+  )
+    return `${label}必须为${empty ? "不超过" : "非空且不超过"} ${max} 个字符的文本`;
+  return undefined;
+}
+function statusField(value: unknown): string | undefined {
+  return value !== undefined &&
+    !["active", "disabled", "archived"].includes(String(value))
+    ? "账号或角色状态无效"
+    : undefined;
+}
+function stringArray(
+  value: unknown,
+  label: string,
+  required: boolean,
+): string | undefined {
+  if (value === undefined && !required) return undefined;
+  return !Array.isArray(value) ||
+    value.length > 1000 ||
+    value.some(
+      (entry) =>
+        typeof entry !== "string" || !entry.trim() || entry.length > 160,
+    ) ||
+    new Set(value).size !== value.length
+    ? `${label}必须为不重复的非空字符串数组`
+    : undefined;
+}
+function duplicate(message: string) {
+  return { error: "DUPLICATE_IDENTITY", message };
+}
+
+export async function identityMutationResponse<T>(
+  mutation: () => Promise<T>,
+): Promise<T | Response> {
+  try {
+    return await mutation();
+  } catch (error) {
+    const seen = new Set<unknown>();
+    let cause: unknown = error;
+    while (cause && typeof cause === "object" && !seen.has(cause)) {
+      seen.add(cause);
+      const record = cause as Record<string, unknown>;
+      if (record.code === "23505")
+        return Response.json(
+          {
+            error: "DUPLICATE_IDENTITY",
+            message: "唯一字段已被使用，请检查用户名、手机号或编码",
+          },
+          { status: 409 },
+        );
+      cause = record.cause;
+    }
+    throw error;
+  }
+}

package/template/apps/server/src/system/organization-read-security.test.ts

@@ -0,0 +1,221 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { buildActorScopeContexts } from "../data-access/context.js";
+import { createSystemRepositories } from "./seed.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
+import { registerSystemRoutes } from "./routes.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import type { ManagedUser } from "./entities.js";
+
+async function fixture() {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  const runtime = createRouteTestRuntime(snapshot, {
+    WINDY_DEV_ADMIN_TOKEN: "organization-security",
+  });
+  const app = new FakeRouteApp();
+  registerSystemRoutes(app, repositories, runtime, snapshot.features);
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/departments", {
+      headers: { authorization: "Bearer organization-security" },
+    }),
+  );
+  return {
+    repositories,
+    app,
+    context: { guardContext, query: {}, params: {} },
+  };
+}
+
+describe("organization read and identity filters", () => {
+  test("组织快照超过100条仍完整，数字排序稳定，叶节点子级数为零", async () => {
+    const { repositories, app, context } = await fixture();
+    for (let index = 0; index < 121; index++)
+      await repositories.departments.create(
+        {
+          id: `department-${index}`,
+          code: `department-${index}`,
+          name: `部门 ${index}`,
+          parentId: "dept_platform",
+          order: index,
+        },
+        context.guardContext.actor,
+      );
+    const response = (await app.invoke(
+      "GET",
+      "/system/departments/organization",
+      context,
+    )) as {
+      total: number;
+      items: Array<{ id: string; order: number; childDepartmentCount: number }>;
+    };
+    expect(response.total).toBe((await repositories.departments.all()).length);
+    expect(response.total).toBeGreaterThan(100);
+    expect(
+      response.items.find((item) => item.id === "department-120")
+        ?.childDepartmentCount,
+    ).toBe(0);
+    const subset = response.items.filter((item) =>
+      item.id.startsWith("department-"),
+    );
+    expect(subset.map((item) => item.order)).toEqual(
+      Array.from({ length: 121 }, (_, index) => index),
+    );
+  });
+
+  test("缺用户读取权限不投影成员数量，缺部门读取权限不能读取组织快照", async () => {
+    const { app, context } = await fixture();
+    const guardContext = {
+      ...context.guardContext,
+      actor: {
+        ...context.guardContext.actor,
+        roleCodes: ["reader"],
+        permissionKeys: ["system.department.read"],
+      },
+    };
+    const response = (await app.invoke(
+      "GET",
+      "/system/departments/organization",
+      { ...context, guardContext },
+    )) as { items: Record<string, unknown>[] };
+    expect(response.items.length).toBeGreaterThan(0);
+    expect(response.items.every((item) => !("userCount" in item))).toBe(true);
+    const forbidden = (await app.invoke(
+      "GET",
+      "/system/departments/organization",
+      {
+        ...context,
+        guardContext: {
+          ...guardContext,
+          actor: { ...guardContext.actor, permissionKeys: [] },
+        },
+      },
+    )) as Response;
+    expect(forbidden.status).toBe(403);
+  });
+
+  test("影响预览只允许部门管理权限，统计包含直接子部门、成员和角色范围", async () => {
+    const { repositories, app, context } = await fixture();
+    await repositories.departments.create(
+      {
+        id: "preview",
+        code: "preview",
+        name: "待预览",
+        parentId: "dept_platform",
+      },
+      context.guardContext.actor,
+    );
+    await repositories.departments.create(
+      {
+        id: "preview-child",
+        code: "preview-child",
+        name: "下级",
+        parentId: "preview",
+      },
+      context.guardContext.actor,
+    );
+    await repositories.users.create(
+      {
+        username: "preview-user",
+        displayName: "成员",
+        departmentId: "preview",
+        roleIds: ["role_user"],
+      },
+      context.guardContext.actor,
+    );
+    await repositories.roles.create(
+      {
+        code: "preview-role",
+        name: "范围角色",
+        dataScope: "custom",
+        departmentIds: ["preview"],
+        permissionKeys: [],
+        menuKeys: [],
+      },
+      context.guardContext.actor,
+    );
+    const params = { id: "preview" };
+    expect(
+      await app.invoke("GET", "/system/departments/:id/transition-preview", {
+        ...context,
+        params,
+      }),
+    ).toEqual({ childDepartmentCount: 1, userCount: 1, roleCount: 1 });
+    const forbidden = (await app.invoke(
+      "GET",
+      "/system/departments/:id/transition-preview",
+      {
+        ...context,
+        params,
+        guardContext: {
+          ...context.guardContext,
+          actor: {
+            ...context.guardContext.actor,
+            roleCodes: ["reader"],
+            permissionKeys: ["system.department.read"],
+          },
+        },
+      },
+    )) as Response;
+    expect(forbidden.status).toBe(403);
+  });
+
+  test("账户部门、角色、关键字筛选与scope共同影响分页总数，读取投影不旁路名称权限", async () => {
+    const { repositories, app, context } = await fixture();
+    for (const [id, departmentId, roleIds] of [
+      ["match-1", "dept_platform", ["role_user"]],
+      ["match-2", "dept_platform", ["role_user"]],
+      ["wrong-role", "dept_platform", ["role_developer"]],
+      ["outside", "other", ["role_user"]],
+    ] as const)
+      await repositories.users.create(
+        {
+          id,
+          username: id,
+          displayName: `匹配${id}`,
+          departmentId,
+          roleIds: [...roleIds],
+        },
+        context.guardContext.actor,
+      );
+    const actor = {
+      ...context.guardContext.actor,
+      roleCodes: ["reader"],
+      permissionKeys: ["system.user.read"],
+      ...buildActorScopeContexts("reader", "dept_platform", [
+        {
+          id: "read-role",
+          code: "reader",
+          dataScope: "department",
+          departmentIds: [],
+        },
+      ]),
+    };
+    const result = (await app.invoke("GET", "/system/users", {
+      ...context,
+      guardContext: { ...context.guardContext, actor },
+      query: {
+        departmentId: "dept_platform",
+        roleId: "role_user",
+        q: "匹配",
+        page: "1",
+        pageSize: "1",
+      },
+    })) as {
+      total: number;
+      items: Array<
+        ManagedUser & { departmentName?: string; roleNames?: string[] }
+      >;
+    };
+    expect(result.total).toBe(2);
+    expect(result.items).toHaveLength(1);
+    expect(result.items[0]?.departmentName).toBeUndefined();
+    expect(result.items[0]?.roleNames).toBeUndefined();
+    const outside = (await app.invoke("GET", "/system/users", {
+      ...context,
+      guardContext: { ...context.guardContext, actor },
+      query: { departmentId: "other", roleId: "role_user" },
+    })) as { total: number };
+    expect(outside.total).toBe(0);
+  });
+});

package/template/apps/server/src/system/redis-health.test.ts

@@ -15,7 +15,7 @@ describe("Redis health probe", () => {
     });
   });
 
-  test("RuoYi 旧 Redis 配置不会进入平台探活", async () => {
+  test("退役旧库变量不能替代平台 REDIS_URL", async () => {
     const snapshot = await createRedisHealthProbeFromEnv({
       RUOYI_REDIS_URL: "redis://legacy-cache:6379/0",
     })();

package/template/apps/server/src/system/repository.ts

@@ -1,5 +1,9 @@
 import { randomUUIDv7 } from "bun";
-import type { LifecycleStatus, PageResult, SortRule } from "@southwind-ai/shared";
+import type {
+  LifecycleStatus,
+  PageResult,
+  SortRule,
+} from "@southwind-ai/shared";
 import type { RequestActor } from "../guards.js";
 import type { ManagedEntity } from "./entities.js";
 
@@ -8,6 +12,8 @@ export interface EntityListQuery {
   pageSize?: number;
   q?: string;
   status?: LifecycleStatus;
+  departmentId?: string;
+  roleId?: string;
   includeDeleted?: boolean;
   sort?: SortRule[];
 }
@@ -79,6 +85,7 @@ export class InMemoryEntityRepository<
       if (query.status && item.status !== query.status) {
         return false;
       }
+      if (!matchesIdentityFilters(item, query)) return false;
       return normalizedKeyword
         ? matchesKeyword(item, searchFields, normalizedKeyword)
         : true;
@@ -103,6 +110,7 @@ export class InMemoryEntityRepository<
       if (query.status && item.status !== query.status) {
         return false;
       }
+      if (!matchesIdentityFilters(item, query)) return false;
       return normalizedKeyword
         ? matchesKeyword(item, searchFields, normalizedKeyword)
         : true;
@@ -201,6 +209,20 @@ export class InMemoryEntityRepository<
   }
 }
 
+function matchesIdentityFilters(
+  item: ManagedEntity,
+  query: EntityListQuery,
+): boolean {
+  const identity = item as ManagedEntity & {
+    departmentId?: string;
+    roleIds?: string[];
+  };
+  return (
+    (!query.departmentId || identity.departmentId === query.departmentId) &&
+    (!query.roleId || Boolean(identity.roleIds?.includes(query.roleId)))
+  );
+}
+
 function matchesKeyword<T extends ManagedEntity>(
   item: T,
   fields: Array<keyof T>,
@@ -224,7 +246,12 @@ function sortItems<T extends ManagedEntity>(
     for (const rule of rules) {
       const leftValue = String(left[rule.field as keyof T] || "");
       const rightValue = String(right[rule.field as keyof T] || "");
-      const comparison = leftValue.localeCompare(rightValue);
+      const comparison =
+        typeof left[rule.field as keyof T] === "number" &&
+        typeof right[rule.field as keyof T] === "number"
+          ? Number(left[rule.field as keyof T]) -
+            Number(right[rule.field as keyof T])
+          : leftValue.localeCompare(rightValue);
       if (comparison !== 0) {
         return rule.order === "asc" ? comparison : -comparison;
       }