create-windy 0.6.21 → 0.8.0

package/README.md

@@ -176,8 +176,13 @@ Apache-2.0 基座而自动开源客户业务代码。
 
 ## 模块生命周期
 
+新生成项目的数据库镜像为 `pgvector/pgvector:pg18`，使用 PG18 默认数据目录和新的
+`postgres18-data` 卷。镜像预装 pgvector，平台默认不启用 `vector` 扩展，也不创建
+业务向量表；需要向量检索时由业务模块的迁移声明。PG18 正式发布证据需在新候选上取得，
+历史 PG17 证据不变。
+
 创建期模块物理组合已达到 H2：默认、纯核心、全模块和无 Oxc 组合持续执行真实安装、
-类型检查、测试和构建，模块组合还在 PostgreSQL 17 上验证首次/重复迁移与 Server
+类型检查、测试和构建，模块组合还在 PostgreSQL 18 上验证首次/重复迁移与 Server
 启动。部署期使用同一个项目内 CLI：
 
 ```bash

package/dist/cli.js

@@ -745,7 +745,7 @@ var platformModules = [
       {
         sourceName: "@southwind-ai/license",
         name: "@southwind-ai/license",
-        version: "^0.1.9"
+        version: "^0.1.10"
       },
       {
         sourceName: "qrcode",
@@ -777,7 +777,8 @@ var platformModules = [
     ],
     schemaFiles: [
       "packages/database/src/schema/license-legacy.ts",
-      "packages/database/src/schema/license-v1.ts"
+      "packages/database/src/schema/license-v1.ts",
+      "packages/database/src/schema/license-issuance-requests.ts"
     ],
     databaseTables: [
       "license_operators",
@@ -793,6 +794,7 @@ var platformModules = [
       "licenses",
       "license_replacements",
       "license_events",
+      "license_issuance_requests",
       "legacy_license_projects",
       "legacy_license_issue_records",
       "legacy_licenses"
@@ -3273,7 +3275,7 @@ function optionalComposeVolumes(includeAgent, includeSearch, includeStorage) {
 // src/runtime-profile-files.ts
 var starterComposeBase = `services:
   postgres:
-    image: postgres:17-alpine
+    image: pgvector/pgvector:pg18
     environment:
       POSTGRES_DB: windy
       POSTGRES_USER: windy
@@ -3281,7 +3283,7 @@ var starterComposeBase = `services:
     ports:
       - "15432:5432"
     volumes:
-      - postgres-data:/var/lib/postgresql/data
+      - postgres18-data:/var/lib/postgresql
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U windy -d windy"]
       interval: 10s
@@ -3372,7 +3374,7 @@ __OPENSEARCH_SERVICE__
       - server
 
 volumes:
-  postgres-data:
+  postgres18-data:
   server-audit-data:
 __OPTIONAL_VOLUMES__
 `;
@@ -3710,7 +3712,7 @@ ${includeOfflineLicense ? "- License \u6D88\u8D39\u7AEF\uFF1A[\u79BB\u7EBF\u6FC0
 - \u8FD0\u7EF4\uFF1A[\u53EF\u89C2\u6D4B\u6027](./operations/observability.md)${includeOperations ? " \u4E0E [\u8FD0\u7EF4\u603B\u89C8](./platform/operations-overview.md)" : ""}\u3002
 - \u4EA4\u4ED8\uFF1A[\u6309 registry digest \u4E0E OCI blob \u5DEE\u91CF\u53D1\u5E03](./operations/incremental-delivery.md)\u3002
 ${includeAgent ? "- Agent\u3001\u591A\u6A21\u6001 Runtime \u4E0E MCP\uFF1A[Agent Harness](./architecture/agent-harness.md)\u3001[Agent Runtime \u63A5\u5165](./platform/agent-runtime.md)\u3001[Session/Memory \u8FD0\u7EF4](./operations/agent-session-memory.md)\u3001[Session \u6545\u969C\u901F\u67E5](./operations/agent-session-troubleshooting.md)\u3001[Agent Workflow](./architecture/agent-workflow.md)\u3001[Workflow \u6062\u590D\u8FD0\u7EF4](./operations/agent-workflow-recovery.md)\u3001[Document AI Runtime](./platform/document-ai-runtime.md)\u3001[Speech AI Runtime](./platform/speech-ai-runtime.md)\u3001[\u53D7\u63A7\u5DE5\u5177](./platform/agent-tools.md)\u4E0E[MCP \u4E1A\u52A1\u80FD\u529B](./architecture/mcp-business-capabilities.md)\u3002" : ""}
-- \u517C\u5BB9\uFF1A[RuoYi-Vue Adapter](./adapters/ruoyi-vue-compatibility.md)\u3002
+- \u6570\u636E\u8FC1\u79FB\uFF1A[\u65E7\u7CFB\u7EDF\u6570\u636E\u8FC1\u79FB\u7B56\u7565](./operations/legacy-data-migration.md)\u3002
 `;
 }
 // src/project-files.ts
@@ -4089,7 +4091,7 @@ var templateDirectories = [
   "packages/storage"
 ];
 var templateDocumentationFiles = [
-  "docs/adapters/ruoyi-vue-compatibility.md",
+  "docs/operations/legacy-data-migration.md",
   "docs/adr/0003-agent-session-event-source.md",
   "docs/architecture/admin-surface-boundary.md",
   "docs/architecture/agent-harness.md",
@@ -8512,6 +8514,16 @@ var recipes = [
     id: "starter-0.6.20-to-0.6.21",
     from: "0.6.20",
     to: "0.6.21"
+  },
+  {
+    id: "starter-0.6.21-to-0.7.0",
+    from: "0.6.21",
+    to: "0.7.0"
+  },
+  {
+    id: "starter-0.7.0-to-0.8.0",
+    from: "0.7.0",
+    to: "0.8.0"
   }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-windy",
-  "version": "0.6.21",
+  "version": "0.8.0",
   "description": "创建单组织、单租户、私有部署优先的 Windy 企业 Dashboard Starter",
   "type": "module",
   "bin": {

package/template/.windy-template.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "templateCommit": "9a6e49f36589045d84d770f7522dc9481141ed7c",
-  "generatorVersion": "0.6.21",
+  "templateCommit": "20ddeda7267de315fb8fe115d64ad6b8c892ccb8",
+  "generatorVersion": "0.8.0",
   "modules": [
     {
       "name": "system",

package/template/AGENTS.md

@@ -20,7 +20,7 @@
 ## Server 与数据
 
 - Bun + Elysia 提供 HTTP 服务。
-- Drizzle ORM 负责数据访问和迁移，默认数据库为 PostgreSQL 17。
+- Drizzle ORM 负责数据访问和迁移，默认数据库为 PostgreSQL 18，镜像预装 pgvector，扩展由需要它的模块迁移按需启用。
 - 平台能力通过 Module Manifest 组合，并提供 Feature、RBAC、Audit 与可选 License
   边界。
 

package/template/apps/server/src/audit/policy.ts

@@ -3,7 +3,12 @@ import type { createServerRuntime } from "../runtime.js";
 
 type ServerRuntime = ReturnType<typeof createServerRuntime>;
 
-const CRITICAL_RESOURCE_PATHS = new Set(["users", "roles", "licenses"]);
+const CRITICAL_RESOURCE_PATHS = new Set([
+  "users",
+  "roles",
+  "departments",
+  "licenses",
+]);
 
 export async function recordMutationAudit(
   runtime: ServerRuntime,

package/template/apps/server/src/auth/bootstrap-admin.ts

@@ -1,3 +1,4 @@
+import { buildActorScopeContexts } from "../data-access/context.js";
 import type { AuthRepository } from "./repository.js";
 import type { AuthService } from "./service.js";
 import type { SystemRepositories } from "../system/seed.js";
@@ -25,8 +26,16 @@ export async function bootstrapAdminPassword(
       id: "system_bootstrap",
       type: "service",
       name: "平台初始化",
-      roleCodes: ["system"],
+      roleCodes: ["super-admin"],
       permissionKeys: ["system.user.manage"],
+      ...buildActorScopeContexts("system_bootstrap", undefined, [
+        {
+          id: "bootstrap",
+          code: "system",
+          dataScope: "all",
+          departmentIds: [],
+        },
+      ]),
     },
   );
   if (!result.ok) throw new Error(`初始化管理员密码失败：${result.code}`);

package/template/apps/server/src/auth/composition.ts

@@ -1,3 +1,5 @@
+import type { SystemRepositories } from "../system/seed.js";
+import { createUserCredentialAccess } from "./user-credential-access.js";
 import type { PlatformConfig } from "@southwind-ai/config";
 import type { ServerPersistence } from "../persistence.js";
 import type { createServerRuntime } from "../runtime.js";
@@ -5,6 +7,7 @@ import { createAuthRuntime } from "./runtime.js";
 
 export function createComposedAuthRuntime(input: {
   platformConfig: PlatformConfig;
+  repositories: SystemRepositories;
   persistence?: ServerPersistence;
   runtime: ReturnType<typeof createServerRuntime>;
 }) {
@@ -12,6 +15,8 @@ export function createComposedAuthRuntime(input: {
     undefined;
   const auth = createAuthRuntime({
     repository: input.persistence?.authRepository,
+    canManageUser: createUserCredentialAccess(input.repositories),
+    credentialMutationRunner: input.repositories.organizationMutationRunner,
     sessionTtlSeconds: () => input.platformConfig.security.sessionTtlSeconds,
     passwordPolicy: () => ({
       minLength: input.platformConfig.security.passwordMinLength,

package/template/apps/server/src/auth/credential-authorization.test.ts

@@ -0,0 +1,257 @@
+import { describe, expect, test } from "bun:test";
+import type { AuditEvent } from "@southwind-ai/shared";
+import { buildActorScopeContexts } from "../data-access/context.js";
+import type { RequestActor } from "../guards.js";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createSystemRepositories } from "../system/seed.js";
+import { CredentialService } from "./credential-service.js";
+import { InMemoryAuthRepository, type AuthUserRecord } from "./repository.js";
+import { createUserCredentialAccess } from "./user-credential-access.js";
+
+const now = new Date("2026-09-10T00:00:00Z");
+const user = (id: string, departmentId: string): AuthUserRecord => ({
+  id,
+  username: id,
+  displayName: id,
+  departmentId,
+  status: "active",
+  credentialState: "active",
+  passwordHash: "old-hash",
+  roleCodes: [],
+  permissionKeys: [],
+});
+const actor: RequestActor = {
+  id: "manager",
+  type: "user",
+  name: "部门管理员",
+  roleCodes: ["manager"],
+  permissionKeys: ["system.user.manage"],
+  ...buildActorScopeContexts("manager", "dept_platform", [
+    {
+      id: "manager-role",
+      code: "manager",
+      dataScope: "department",
+      departmentIds: [],
+    },
+  ]),
+};
+
+async function fixture(
+  beforeHash?: (
+    system: ReturnType<typeof createSystemRepositories>,
+  ) => Promise<void>,
+) {
+  const system = createSystemRepositories(createFoundationSnapshot());
+  await system.roles.create(
+    {
+      id: "manager-role",
+      code: "manager",
+      name: "管理员",
+      dataScope: "department",
+      permissionKeys: ["system.user.manage"],
+      menuKeys: [],
+    },
+    actor,
+  );
+  const users = [user("local", "dept_platform"), user("outside", "other")];
+  for (const item of users)
+    await system.users.create(
+      {
+        id: item.id,
+        username: item.username,
+        displayName: item.displayName,
+        departmentId: item.departmentId,
+        status: "active",
+        roleIds: ["manager-role"],
+      },
+      actor,
+    );
+  const repository = new InMemoryAuthRepository(users);
+  await repository.createSession({
+    id: "session",
+    userId: "outside",
+    tokenHash: "outside-token",
+    status: "active",
+    issuedAt: now,
+    expiresAt: new Date(now.getTime() + 10000),
+  });
+  const events: AuditEvent[] = [];
+  const service = new CredentialService(
+    repository,
+    {
+      hash: async () => {
+        await beforeHash?.(system);
+        return "new-hash";
+      },
+      verify: async (hash, password) => hash === password,
+    },
+    {
+      write: (event) => {
+        events.push(event);
+      },
+    },
+    () => now,
+    createUserCredentialAccess(system),
+    system.organizationMutationRunner,
+  );
+  return { repository, service, events, system };
+}
+
+describe("credential target authorization", () => {
+  test("范围外请求不计算密码hash，hash期间目标迁移或提权后锁内复核拒绝", async () => {
+    for (const change of [
+      { departmentId: "other" },
+      { roleIds: ["role_super_admin"] },
+    ]) {
+      let hashes = 0;
+      const { service, repository, events } = await fixture(async (system) => {
+        hashes++;
+        await system.organizationMutationRunner.run(async () => {
+          await system.users.update("local", change, actor);
+        });
+      });
+      expect(
+        await service.resetPassword("outside", "new-password", actor, {}),
+      ).toEqual({ ok: false, code: "FORBIDDEN" });
+      expect(hashes).toBe(0);
+      expect(
+        await service.resetPassword("local", "new-password", actor, {}),
+      ).toEqual({ ok: false, code: "FORBIDDEN" });
+      expect(hashes).toBe(1);
+      expect(
+        (await repository.findUserByReference("local"))?.passwordHash,
+      ).toBe("old-hash");
+      expect(events.at(-1)?.outcome).toBe("denied");
+    }
+  });
+
+  test("密码写入返回false时管理员重置和本人改密都不误报成功或撤销会话", async () => {
+    const { service, repository, events } = await fixture();
+    await repository.createSession({
+      id: "local-session",
+      userId: "local",
+      tokenHash: "local-token",
+      status: "active",
+      issuedAt: now,
+      expiresAt: new Date(now.getTime() + 10000),
+    });
+    repository.updateUserPassword = async () => false;
+    expect(
+      await service.resetPassword("local", "new-password", actor, {}),
+    ).toEqual({ ok: false, code: "USER_NOT_FOUND" });
+    expect(
+      await service.changeOwnPassword(
+        "old-hash",
+        "new-password",
+        { ...actor, id: "local" },
+        {},
+      ),
+    ).toEqual({ ok: false, code: "USER_NOT_FOUND" });
+    expect((await repository.findSessionById("local-session"))?.status).toBe(
+      "active",
+    );
+    expect(events.every((event) => event.outcome !== "success")).toBe(true);
+  });
+
+  test("密码写入持有组织操作锁，管理变更在写入完成后继续", async () => {
+    const { service, repository, system } = await fixture();
+    let started!: () => void;
+    let release!: () => void;
+    const writing = new Promise<void>((resolve) => {
+      started = resolve;
+    });
+    const resume = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const original = repository.updateUserPassword.bind(repository);
+    repository.updateUserPassword = async (...args) => {
+      started();
+      await resume;
+      return original(...args);
+    };
+    const reset = service.resetPassword("local", "new-password", actor, {});
+    await writing;
+    let managementStarted = false;
+    const management = system.organizationMutationRunner.run(async () => {
+      managementStarted = true;
+    });
+    await Promise.resolve();
+    expect(managementStarted).toBe(false);
+    release();
+    expect(await reset).toEqual({ ok: true, userId: "local" });
+    await management;
+    expect(managementStarted).toBe(true);
+  });
+
+  test("部门管理员按用户名重置范围外用户被拒绝，密码与会话保持原样", async () => {
+    const { repository, service, events } = await fixture();
+    expect(
+      await service.resetPassword("outside", "new-password", actor, {}),
+    ).toEqual({ ok: false, code: "FORBIDDEN" });
+    expect(
+      (await repository.findUserByReference("outside"))?.passwordHash,
+    ).toBe("old-hash");
+    expect((await repository.findSessionById("session"))?.status).toBe(
+      "active",
+    );
+    expect(events.at(-1)?.metadata).toEqual({ reason: "data-scope-denied" });
+  });
+
+  test("同部门高权账户不能被委派管理员通过重置密码接管", async () => {
+    const { repository, service, system } = await fixture();
+    await system.users.update(
+      "local",
+      { roleIds: ["role_super_admin"] },
+      actor,
+    );
+    expect(
+      await service.resetPassword("local", "new-password", actor, {}),
+    ).toEqual({ ok: false, code: "FORBIDDEN" });
+    expect((await repository.findUserByReference("local"))?.passwordHash).toBe(
+      "old-hash",
+    );
+  });
+
+  test("同部门授权目标可重置，缺少服务端scope与授权port时拒绝", async () => {
+    const { repository, service } = await fixture();
+    expect(
+      await service.resetPassword("local", "new-password", actor, {}),
+    ).toEqual({ ok: true, userId: "local" });
+    expect(
+      await service.resetPassword(
+        "local",
+        "new-password",
+        { ...actor, scopeContext: undefined },
+        {},
+      ),
+    ).toEqual({ ok: false, code: "FORBIDDEN" });
+    const missing = new CredentialService(
+      repository,
+      { hash: async () => "hash", verify: async () => true },
+      { write: () => undefined },
+      () => now,
+    );
+    expect(
+      await missing.resetPassword("local", "new-password", actor, {}),
+    ).toEqual({ ok: false, code: "FORBIDDEN" });
+  });
+
+  test("已软删除但仍active的身份不能登录查询、重新认证或解析旧会话", async () => {
+    const repository = new InMemoryAuthRepository([
+      { ...user("deleted", "dept_platform"), deletedAt: now },
+    ]);
+    await repository.createSession({
+      id: "deleted-session",
+      userId: "deleted",
+      tokenHash: "deleted-token",
+      status: "active",
+      issuedAt: now,
+      expiresAt: new Date(now.getTime() + 10000),
+    });
+    expect(await repository.findUserByUsername("deleted")).toBeUndefined();
+    expect(await repository.findUserByReference("deleted")).toBeUndefined();
+    expect(
+      await repository.resolveSessionActor("deleted-token", now),
+    ).toBeUndefined();
+  });
+});

package/template/apps/server/src/auth/credential-routes.test.ts

@@ -121,6 +121,7 @@ function createFixture() {
   const resolver = new RepositoryActorResolver(repository);
   const runtime = createServerRuntime({}, { actorResolver: resolver });
   const service = new AuthService(repository, {
+    canManageUser: async () => true,
     auditWriter: { write: () => undefined },
   });
   const app = new Elysia({ prefix: "/api" })

package/template/apps/server/src/auth/credential-service.ts

@@ -30,6 +30,8 @@ export class CredentialService {
     private readonly passwordHasher: PasswordHasher,
     private readonly auditWriter: AuditEventWriter,
     private readonly now: () => Date,
+    private readonly canManageUser?: import("./user-credential-access.js").UserCredentialAccess,
+    private readonly mutationRunner?: import("../system/mutation-runner.js").MutationRunner,
   ) {}
 
   async resetPassword(
@@ -47,27 +49,56 @@ export class CredentialService {
       await this.record(actor, userId, "failure", "user-not-found", request);
       return { ok: false, code: "USER_NOT_FOUND" };
     }
+    if (!(await this.canManageUser?.(user.id, actor))) {
+      await this.record(actor, userId, "denied", "data-scope-denied", request);
+      return { ok: false, code: "FORBIDDEN" };
+    }
     const passwordHash = await this.hashPassword(password);
     if (!passwordHash) {
       await this.record(actor, userId, "failure", "invalid-password", request);
       return { ok: false, code: "INVALID_PASSWORD" };
     }
+    // Hash outside the organization lock, then recheck against the locked target.
+    const update = async (): Promise<PasswordUpdateResult> => {
+      if (!(await this.repository.findUserByReference(user.id))) {
+        await this.record(actor, user.id, "failure", "user-not-found", request);
+        return { ok: false, code: "USER_NOT_FOUND" };
+      }
+      if (!(await this.canManageUser?.(user.id, actor))) {
+        await this.record(
+          actor,
+          user.id,
+          "denied",
+          "data-scope-denied",
+          request,
+        );
+        return { ok: false, code: "FORBIDDEN" };
+      }
+      return this.applyReset(user.id, passwordHash, actor, request);
+    };
+    return this.mutationRunner ? this.mutationRunner.run(update) : update();
+  }
+
+  private async applyReset(
+    userId: string,
+    passwordHash: string,
+    actor: RequestActor,
+    request: AuthRequestMetadata,
+  ): Promise<PasswordUpdateResult> {
     const changedAt = this.now();
-    await this.repository.updateUserPassword(
-      user.id,
+    const updated = await this.repository.updateUserPassword(
+      userId,
       { passwordHash, credentialState: "must-change-password" },
       changedAt,
       actor.id,
     );
-    await this.repository.revokeUserSessions(user.id, changedAt);
-    await this.record(
-      actor,
-      user.id,
-      "success",
-      "administrator-reset",
-      request,
-    );
-    return { ok: true, userId: user.id };
+    if (!updated) {
+      await this.record(actor, userId, "failure", "user-not-found", request);
+      return { ok: false, code: "USER_NOT_FOUND" };
+    }
+    await this.repository.revokeUserSessions(userId, changedAt);
+    await this.record(actor, userId, "success", "administrator-reset", request);
+    return { ok: true, userId };
   }
 
   async changeOwnPassword(
@@ -111,12 +142,16 @@ export class CredentialService {
       return { ok: false, code: "INVALID_PASSWORD" };
     }
     const changedAt = this.now();
-    await this.repository.updateUserPassword(
+    const updated = await this.repository.updateUserPassword(
       user.id,
       { passwordHash, credentialState: "active", passwordChangedAt: changedAt },
       changedAt,
       actor.id,
     );
+    if (!updated) {
+      await this.record(actor, user.id, "failure", "user-not-found", request);
+      return { ok: false, code: "USER_NOT_FOUND" };
+    }
     const revokedSessions = await this.repository.revokeUserSessions(
       user.id,
       changedAt,

package/template/apps/server/src/auth/drizzle-repository.ts

@@ -38,7 +38,7 @@ export class DrizzleAuthRepository implements AuthRepository {
     const [user] = await this.db
       .select()
       .from(users)
-      .where(eq(users.username, username))
+      .where(and(eq(users.username, username), isNull(users.deletedAt)))
       .limit(1);
     if (!user) {
       return undefined;
@@ -68,7 +68,12 @@ export class DrizzleAuthRepository implements AuthRepository {
     const [user] = await this.db
       .select()
       .from(users)
-      .where(or(eq(users.id, reference), eq(users.username, reference)))
+      .where(
+        and(
+          or(eq(users.id, reference), eq(users.username, reference)),
+          isNull(users.deletedAt),
+        ),
+      )
       .limit(1);
     if (!user) {
       return undefined;
@@ -142,6 +147,7 @@ export class DrizzleAuthRepository implements AuthRepository {
           isNull(serverSessions.revokedAt),
           gt(serverSessions.expiresAt, now),
           eq(users.status, "active"),
+          isNull(users.deletedAt),
         ),
       )
       .limit(1);
@@ -190,7 +196,7 @@ export class DrizzleAuthRepository implements AuthRepository {
         updatedAt,
         updatedBy,
       })
-      .where(eq(users.id, userId))
+      .where(and(eq(users.id, userId), isNull(users.deletedAt)))
       .returning({ id: users.id });
     return rows.length > 0;
   }
@@ -210,7 +216,7 @@ export class DrizzleAuthRepository implements AuthRepository {
         updatedAt,
         updatedBy,
       })
-      .where(eq(users.id, userId))
+      .where(and(eq(users.id, userId), isNull(users.deletedAt)))
       .returning({ id: users.id });
     return rows.length > 0 ? this.findUserByReference(userId) : undefined;
   }
@@ -264,7 +270,9 @@ export class DrizzleAuthRepository implements AuthRepository {
       .select()
       .from(roles)
       .where(inArray(roles.id, roleIds));
-    const activeRoles = roleRows.filter((role) => role.status === "active");
+    const activeRoles = roleRows.filter(
+      (role) => role.status === "active" && !role.deletedAt,
+    );
     const compatibilityPermissionRoleIds = activeRoles
       .filter((role) => !Array.isArray(role.permissionKeys))
       .map((role) => role.id);

package/template/apps/server/src/auth/drizzle-session-operations.ts

@@ -16,6 +16,7 @@ export async function listActiveSessions(
       and(
         ...activeSessionClauses(now),
         eq(users.status, "active"),
+        isNull(users.deletedAt),
         or(
           gte(serverSessions.lastSeenAt, activeSince),
           and(