create-windy 0.6.21 → 0.7.0

package/template/apps/server/src/system/resource-routes.ts

@@ -1,3 +1,7 @@
+import {
+  identityMutationResponse,
+  validateWritableFields,
+} from "./identity-write-validation.js";
 import { recordMutationAudit } from "../audit/policy.js";
 import { searchAuditEvent } from "../audit/search-summary.js";
 import type { createServerRuntime } from "../runtime.js";
@@ -60,7 +64,12 @@ export function registerResourceRoutes<T extends ManagedEntity>(
             searchAuditEvent(guardContext, config.path, search, result.total),
           );
         }
-        return { ...result, items: projectEntities(config, result.items) };
+        return {
+          ...result,
+          items: config.projectReadResponses
+            ? await config.projectReadResponses(result.items, guardContext)
+            : projectEntities(config, result.items),
+        };
       },
     );
   });
@@ -86,7 +95,9 @@ export function registerResourceRoutes<T extends ManagedEntity>(
         );
         if (item instanceof Response) return item;
         return item
-          ? projectEntity(config, item)
+          ? config.projectReadResponses
+            ? (await config.projectReadResponses([item], guardContext))[0]
+            : projectEntity(config, item)
           : notFound(config.path, requiredId(params));
       },
     );
@@ -152,25 +163,35 @@ export function registerResourceRoutes<T extends ManagedEntity>(
       "manage",
       config.feature,
       async () =>
-        runResourceMutation(config, async () => {
-          const input = asPartial<T>(body);
-          const validationError = await config.validateInput?.(input);
-          if (validationError) return invalidResource(validationError);
-          const policyError = await config.beforeCreate?.(input);
-          if (policyError) return resourceConflict(policyError);
-          const item = await accessCall(() =>
-            config.dataAccess.mode === "request"
-              ? config.dataAccess.access.create(input, guardContext.actor)
-              : config.repository.create(input, guardContext.actor),
-          );
-          if (item instanceof Response) return item;
-          await recordMutationAudit(
-            runtime,
-            config.path,
-            resourceEvent(guardContext, "crud.create", config.path, item.id),
-          );
-          return projectEntity(config, item);
-        }),
+        identityMutationResponse(() =>
+          runResourceMutation(config, async () => {
+            const fieldError =
+              config.writableFields &&
+              validateWritableFields(body, config.writableFields);
+            if (fieldError) return invalidResource(fieldError);
+            const input = asPartial<T>(body);
+            const validationError = await config.validateInput?.(
+              input,
+              undefined,
+              guardContext.actor,
+            );
+            if (validationError) return invalidResource(validationError);
+            const policyError = await config.beforeCreate?.(input);
+            if (policyError) return resourceConflict(policyError);
+            const item = await accessCall(() =>
+              config.dataAccess.mode === "request"
+                ? config.dataAccess.access.create(input, guardContext.actor)
+                : config.repository.create(input, guardContext.actor),
+            );
+            if (item instanceof Response) return item;
+            await recordMutationAudit(
+              runtime,
+              config.path,
+              resourceEvent(guardContext, "crud.create", config.path, item.id),
+            );
+            return projectEntity(config, item);
+          }),
+        ),
     );
   });
 
@@ -184,33 +205,47 @@ export function registerResourceRoutes<T extends ManagedEntity>(
       "manage",
       config.feature,
       async () =>
-        runResourceMutation(config, async () => {
-          const id = requiredId(params);
-          const input = asPartial<T>(body);
-          const current = await readAccessible(config, id, guardContext.actor);
-          if (current instanceof Response) return current;
-          if (!current) return notFound(config.path, id);
-          const validationError = await config.validateInput?.(input, current);
-          if (validationError) return invalidResource(validationError);
-          const policyError = await config.beforeUpdate?.(current, input);
-          if (policyError) return resourceConflict(policyError);
-          const item = await accessCall(() =>
-            config.dataAccess.mode === "request"
-              ? config.dataAccess.access.update(id, input, guardContext.actor)
-              : config.repository.update(id, input, guardContext.actor),
-          );
-          if (item instanceof Response) return item;
-          if (!item) {
-            return notFound(config.path, id);
-          }
-          await config.afterUpdate?.(current, item, guardContext.actor);
-          await recordMutationAudit(
-            runtime,
-            config.path,
-            resourceEvent(guardContext, "crud.update", config.path, id),
-          );
-          return projectEntity(config, item);
-        }),
+        identityMutationResponse(() =>
+          runResourceMutation(config, async () => {
+            const id = requiredId(params);
+            const fieldError =
+              config.writableFields &&
+              validateWritableFields(body, config.writableFields);
+            if (fieldError) return invalidResource(fieldError);
+            const input = asPartial<T>(body);
+            const current = await readAccessible(
+              config,
+              id,
+              guardContext.actor,
+            );
+            if (current instanceof Response) return current;
+            if (!current) return notFound(config.path, id);
+            const validationError = await config.validateInput?.(
+              input,
+              current,
+              guardContext.actor,
+            );
+            if (validationError) return invalidResource(validationError);
+            const policyError = await config.beforeUpdate?.(current, input);
+            if (policyError) return resourceConflict(policyError);
+            const item = await accessCall(() =>
+              config.dataAccess.mode === "request"
+                ? config.dataAccess.access.update(id, input, guardContext.actor)
+                : config.repository.update(id, input, guardContext.actor),
+            );
+            if (item instanceof Response) return item;
+            if (!item) {
+              return notFound(config.path, id);
+            }
+            await config.afterUpdate?.(current, item, guardContext.actor);
+            await recordMutationAudit(
+              runtime,
+              config.path,
+              resourceEvent(guardContext, "crud.update", config.path, id),
+            );
+            return projectEntity(config, item);
+          }),
+        ),
     );
   });
 
@@ -224,30 +259,39 @@ export function registerResourceRoutes<T extends ManagedEntity>(
       "manage",
       config.feature,
       async () =>
-        runResourceMutation(config, async () => {
-          const id = requiredId(params);
-          const current = await readAccessible(config, id, guardContext.actor);
-          if (current instanceof Response) return current;
-          if (!current) return notFound(config.path, id);
-          const policyError = await config.beforeDelete?.(current);
-          if (policyError) return resourceConflict(policyError);
-          const item = await accessCall(() =>
-            config.dataAccess.mode === "request"
-              ? config.dataAccess.access.softDelete(id, guardContext.actor)
-              : config.repository.softDelete(id, guardContext.actor),
-          );
-          if (item instanceof Response) return item;
-          if (!item) {
-            return notFound(config.path, id);
-          }
-          await config.afterDelete?.(item, guardContext.actor);
-          await recordMutationAudit(
-            runtime,
-            config.path,
-            resourceEvent(guardContext, "crud.delete", config.path, id),
-          );
-          return projectEntity(config, item);
-        }),
+        identityMutationResponse(() =>
+          runResourceMutation(config, async () => {
+            const id = requiredId(params);
+            const current = await readAccessible(
+              config,
+              id,
+              guardContext.actor,
+            );
+            if (current instanceof Response) return current;
+            if (!current) return notFound(config.path, id);
+            const policyError = await config.beforeDelete?.(
+              current,
+              guardContext.actor,
+            );
+            if (policyError) return resourceConflict(policyError);
+            const item = await accessCall(() =>
+              config.dataAccess.mode === "request"
+                ? config.dataAccess.access.softDelete(id, guardContext.actor)
+                : config.repository.softDelete(id, guardContext.actor),
+            );
+            if (item instanceof Response) return item;
+            if (!item) {
+              return notFound(config.path, id);
+            }
+            await config.afterDelete?.(item, guardContext.actor);
+            await recordMutationAudit(
+              runtime,
+              config.path,
+              resourceEvent(guardContext, "crud.delete", config.path, id),
+            );
+            return projectEntity(config, item);
+          }),
+        ),
     );
   });
 }

package/template/apps/server/src/system/route-audit.test.ts

@@ -0,0 +1,117 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createServerRuntime, type AuditEventWriter } from "../runtime.js";
+import { FakeRouteApp } from "./route-test-app.js";
+import { registerSystemRoutes } from "./routes.js";
+import { createSystemRepositories } from "./seed.js";
+
+async function routeFixture(auditWriter: AuditEventWriter) {
+  const snapshot = createFoundationSnapshot();
+  const runtime = createServerRuntime(
+    { WINDY_DEV_ADMIN_TOKEN: "token_1" },
+    { auditWriter, featureCatalog: snapshot.features },
+  );
+  const app = new FakeRouteApp();
+  registerSystemRoutes(
+    app,
+    createSystemRepositories(snapshot),
+    runtime,
+    snapshot.features,
+  );
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/users", {
+      headers: { authorization: "Bearer token_1" },
+    }),
+  );
+  return { app, runtime, guardContext };
+}
+
+describe("system mutation audit policies", () => {
+  test("角色与部门变更使用关键策略，字典变更保持普通策略", async () => {
+    const policies: string[] = [];
+    const { app, guardContext } = await routeFixture({
+      write: async (_event, policy) => void policies.push(policy || "ordinary"),
+    });
+
+    await app.invoke("POST", "/system/roles", {
+      guardContext,
+      params: {},
+      query: {},
+      body: {
+        code: "security",
+        name: "安全角色",
+        dataScope: "self",
+        permissionKeys: [],
+        menuKeys: [],
+      },
+    });
+    await app.invoke("POST", "/system/departments", {
+      guardContext,
+      params: {},
+      query: {},
+      body: {
+        code: "dept-security",
+        name: "安全部",
+        parentId: "dept_platform",
+      },
+    });
+
+    await app.invoke("POST", "/system/dictionaries", {
+      guardContext,
+      params: {},
+      query: {},
+      body: { code: "audit-dict", name: "审计字典", items: [] },
+    });
+    expect(policies).toEqual(["critical", "critical", "ordinary"]);
+  });
+
+  test("关键资源审计失败会拒绝请求，普通资源仍完成并报告降级", async () => {
+    const { app, runtime, guardContext } = await routeFixture({
+      write: async () => {
+        throw new Error("audit persistence unavailable");
+      },
+    });
+
+    await expect(
+      app.invoke("POST", "/system/users", {
+        guardContext,
+        params: {},
+        query: {},
+        body: {
+          username: "security-user",
+          displayName: "安全用户",
+          roleIds: ["role_user"],
+          departmentId: "dept_platform",
+        },
+      }),
+    ).rejects.toThrow("audit persistence unavailable");
+
+    await expect(
+      app.invoke("POST", "/system/departments", {
+        guardContext,
+        params: {},
+        query: {},
+        body: {
+          code: "dept-available",
+          name: "可用部门",
+          parentId: "dept_platform",
+        },
+      }),
+    ).rejects.toThrow("audit persistence unavailable");
+    await expect(
+      app.invoke("POST", "/system/dictionaries", {
+        guardContext,
+        params: {},
+        query: {},
+        body: { code: "available-dict", name: "可用字典", items: [] },
+      }),
+    ).resolves.toMatchObject({ code: "available-dict" });
+    await Bun.sleep(0);
+
+    expect(runtime.auditSink.status()).toMatchObject({
+      state: "degraded",
+      failedAttempts: 3,
+      dropped: 3,
+    });
+  });
+});

package/template/apps/server/src/system/route-helpers.ts

@@ -16,10 +16,24 @@ export type RouteContext = {
 export function parseListQuery(query: RouteContext["query"]) {
   const pagination = parsePagination(query);
   if (pagination instanceof Response) return pagination;
+  if (
+    (query.status &&
+      !["draft", "active", "disabled", "archived"].includes(query.status)) ||
+    [query.departmentId, query.roleId].some(
+      (id) => id !== undefined && (!id.trim() || id.length > 64),
+    )
+  ) {
+    return Response.json(
+      { error: "INVALID_QUERY", message: "状态或组织筛选条件不合法" },
+      { status: 400 },
+    );
+  }
   return {
     ...pagination,
     q: query.q,
     status: query.status as LifecycleStatus | undefined,
+    departmentId: query.departmentId,
+    roleId: query.roleId,
     includeDeleted: query.includeDeleted === "true",
     sort: query.sort
       ? query.sort.split(",").map((field) => ({

package/template/apps/server/src/system/route-types.ts

@@ -2,7 +2,7 @@ import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import type { ManagedEntity } from "./entities.js";
 import type { EntityRepository, MaybePromise } from "./repository.js";
 import type { ScopedResourceAccess } from "../data-access/scoped-resource.js";
-import type { RequestActor } from "../guards.js";
+import type { RequestActor, RequestGuardContext } from "../guards.js";
 import type { MutationRunner } from "./mutation-runner.js";
 
 export interface ResourcePolicyError {
@@ -42,20 +42,29 @@ export interface ResourceRouteConfig<T extends ManagedEntity> {
   importable?: boolean;
   backupExport?: boolean;
   mutationRunner?: MutationRunner;
+  writableFields?: readonly (keyof T)[];
   validateInput?: (
     input: Partial<T>,
     current?: T,
+    actor?: RequestActor,
   ) => MaybePromise<ResourcePolicyResult>;
   dataAccess:
     | { readonly mode: "platform" }
     | { readonly mode: "request"; readonly access: ScopedResourceAccess<T> };
+  projectReadResponses?: (
+    entities: T[],
+    context: RequestGuardContext,
+  ) => MaybePromise<Record<string, unknown>[]>;
   projectResponse?: (entity: T) => Record<string, unknown>;
   beforeCreate?: (input: Partial<T>) => MaybePromise<ResourcePolicyResult>;
   beforeUpdate?: (
     current: T,
     input: Partial<T>,
   ) => MaybePromise<ResourcePolicyResult>;
-  beforeDelete?: (current: T) => MaybePromise<ResourcePolicyResult>;
+  beforeDelete?: (
+    current: T,
+    actor?: RequestActor,
+  ) => MaybePromise<ResourcePolicyResult>;
   afterUpdate?: (
     current: T,
     updated: T,

package/template/apps/server/src/system/routes.test.ts

@@ -214,74 +214,6 @@ describe("system routes", () => {
     ]);
   });
 
-  test("用户与角色变更使用关键策略，普通资源变更保持降级可用", async () => {
-    const policies: string[] = [];
-    const { app, guardContext } = await routeFixture(undefined, {
-      write: async (_event, policy) => void policies.push(policy || "ordinary"),
-    });
-
-    await app.invoke("POST", "/system/roles", {
-      guardContext,
-      params: {},
-      query: {},
-      body: { code: "security", name: "安全角色" },
-    });
-    await app.invoke("POST", "/system/departments", {
-      guardContext,
-      params: {},
-      query: {},
-      body: {
-        code: "dept-security",
-        name: "安全部",
-        parentId: "dept_platform",
-      },
-    });
-
-    expect(policies).toEqual(["critical", "ordinary"]);
-  });
-
-  test("关键资源审计失败会拒绝请求，普通资源仍完成并报告降级", async () => {
-    const { app, runtime, guardContext } = await routeFixture(undefined, {
-      write: async () => {
-        throw new Error("audit persistence unavailable");
-      },
-    });
-
-    await expect(
-      app.invoke("POST", "/system/users", {
-        guardContext,
-        params: {},
-        query: {},
-        body: {
-          username: "security-user",
-          displayName: "安全用户",
-          roleIds: ["role_user"],
-          departmentId: "dept_platform",
-        },
-      }),
-    ).rejects.toThrow("audit persistence unavailable");
-
-    await expect(
-      app.invoke("POST", "/system/departments", {
-        guardContext,
-        params: {},
-        query: {},
-        body: {
-          code: "dept-available",
-          name: "可用部门",
-          parentId: "dept_platform",
-        },
-      }),
-    ).resolves.toMatchObject({ code: "dept-available" });
-    await Bun.sleep(0);
-
-    expect(runtime.auditSink.status()).toMatchObject({
-      state: "degraded",
-      failedAttempts: 2,
-      dropped: 2,
-    });
-  });
-
   test("Feature API 只允许修改状态并让下一请求读取新运行态", async () => {
     const snapshot = createFoundationSnapshot();
     const repositories = createSystemRepositories(snapshot);

package/template/apps/server/src/system/routes.ts

@@ -1,3 +1,6 @@
+import { identityReadModel } from "./identity-read-model.js";
+import { registerDepartmentReadRoutes } from "./department-read-routes.js";
+import { departmentWritableFields } from "./department-validation.js";
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import { registerFeatureFlagRoutes } from "../feature/routes.js";
 import { findSystemFeature } from "../route-guards.js";
@@ -30,7 +33,8 @@ export function registerSystemRoutes(
   runtime: ReturnType<typeof createServerRuntime>,
   features: FeatureFlagDefinition[],
   options: {
-    authRepository?: Pick<AuthRepository, "revokeUserSessions">;
+    authRepository?: Pick<AuthRepository, "revokeUserSessions"> &
+      Partial<Pick<AuthRepository, "findUserByReference">>;
     authorizationRevocations?: AuthorizationRevocationPublisher;
   } = {},
 ) {
@@ -40,7 +44,27 @@ export function registerSystemRoutes(
     options.authRepository,
     options.authorizationRevocations,
   );
-  const departmentPolicy = new DepartmentOrganizationPolicy(repositories);
+  const departmentPolicy = new DepartmentOrganizationPolicy(
+    repositories,
+    async (actors, occurredAt) => {
+      for (const previousActor of actors)
+        await options.authorizationRevocations?.publish({
+          previousActor,
+          occurredAt,
+          eventId: `system-organization-authorization:${previousActor.id}:${occurredAt}`,
+        });
+    },
+  );
+  const readModel = identityReadModel(repositories, runtime, features);
+  identity.users.projectReadResponses = readModel.users;
+  registerDepartmentReadRoutes(
+    app,
+    departmentPolicy,
+    readModel,
+    runtime,
+    features,
+    repositories.organizationMutationRunner,
+  );
   // @windy-module system.data-governance begin
   registerUserPlaintextRoutes(app, identity.users, runtime);
   // @windy-module system.data-governance end
@@ -73,6 +97,7 @@ export function registerSystemRoutes(
         { mode: "platform" },
       ),
       importable: false,
+      writableFields: departmentWritableFields,
       mutationRunner: repositories.organizationMutationRunner,
       validateInput: (input, current) =>
         departmentPolicy.validateInput(input, current),
@@ -80,6 +105,8 @@ export function registerSystemRoutes(
       beforeUpdate: (current, input) =>
         departmentPolicy.beforeUpdate(current, input),
       beforeDelete: (current) => departmentPolicy.beforeDelete(current),
+      afterUpdate: (current, updated) =>
+        departmentPolicy.afterUpdate(current, updated),
     },
     runtime,
   );

package/template/apps/server/src/system/user-account-policy.test.ts

@@ -113,7 +113,9 @@ function fixture(users: ManagedUser[], auth = new InMemoryAuthRepository()) {
   return {
     roles,
     users: userRepository,
-    policy: new UserAccountPolicy(userRepository, roles, auth),
+    policy: new UserAccountPolicy(userRepository, roles, {
+      revokeUserSessions: auth.revokeUserSessions.bind(auth),
+    }),
   };
 }
 

package/template/apps/server/src/system/user-account-policy.ts

@@ -16,7 +16,8 @@ export class UserAccountPolicy {
   constructor(
     private readonly users: EntityRepository<ManagedUser>,
     private readonly roles: EntityRepository<ManagedRole>,
-    private readonly auth?: Pick<AuthRepository, "revokeUserSessions">,
+    private readonly auth?: Pick<AuthRepository, "revokeUserSessions"> &
+      Partial<Pick<AuthRepository, "findUserByReference">>,
     private readonly authorizationRevocations?: AuthorizationRevocationPublisher,
   ) {}
 
@@ -77,16 +78,22 @@ export class UserAccountPolicy {
       }
     }
     void actor;
-    if (current.status === "active" && updated.status !== "active") {
+    if (
+      current.status === "active" &&
+      (updated.status !== "active" || Boolean(updated.deletedAt))
+    ) {
       await this.auth?.revokeUserSessions(updated.id, new Date());
     }
   }
 
   async afterDelete(deleted: ManagedUser): Promise<void> {
-    const previousActor = await resolveSystemActorForUser({ roles: this.roles }, {
-      ...deleted,
-      status: "active",
-    });
+    const previousActor = await resolveSystemActorForUser(
+      { roles: this.roles },
+      {
+        ...deleted,
+        status: "active",
+      },
+    );
     if (previousActor) {
       await this.authorizationRevocations?.publish({
         previousActor,
@@ -141,7 +148,12 @@ export class UserAccountPolicy {
   }
 
   private async isRecoverableAdmin(user: ManagedUser): Promise<boolean> {
-    if (user.status !== "active") return false;
+    if (user.status !== "active" || user.deletedAt) return false;
+    if (
+      this.auth?.findUserByReference &&
+      !(await this.auth.findUserByReference(user.id))?.passwordHash
+    )
+      return false;
     const roles = await Promise.all(
       user.roleIds.map((id) => this.roles.get(id)),
     );
@@ -175,6 +187,7 @@ export class UserAccountPolicy {
 function userAuthorizationChanged(left: ManagedUser, right: ManagedUser) {
   return (
     left.status !== right.status ||
+    left.deletedAt !== right.deletedAt ||
     left.departmentId !== right.departmentId ||
     stableStrings(left.roleIds) !== stableStrings(right.roleIds)
   );
@@ -183,9 +196,13 @@ function userAuthorizationChanged(left: ManagedUser, right: ManagedUser) {
 function roleAuthorizationChanged(left: ManagedRole, right: ManagedRole) {
   return (
     left.status !== right.status ||
+    left.deletedAt !== right.deletedAt ||
+    left.code !== right.code ||
     left.dataScope !== right.dataScope ||
-    stableStrings(left.permissionKeys) !== stableStrings(right.permissionKeys) ||
-    stableStrings(left.departmentIds ?? []) !== stableStrings(right.departmentIds ?? [])
+    stableStrings(left.permissionKeys) !==
+      stableStrings(right.permissionKeys) ||
+    stableStrings(left.departmentIds ?? []) !==
+      stableStrings(right.departmentIds ?? [])
   );
 }