create-windy 0.6.21 → 0.8.0

package/template/apps/server/src/system/department-routes.ts

@@ -1,3 +1,5 @@
+import { identityMutationResponse } from "./identity-write-validation.js";
+import { departmentWritableFields } from "./department-validation.js";
 import type { FeatureFlagDefinition } from "@southwind-ai/shared";
 import { recordMutationAudit } from "../audit/policy.js";
 import { evaluateRouteGuards } from "../route-guards.js";
@@ -36,6 +38,14 @@ export function registerDepartmentQuickCreateRoute(
     const parsed = parseDepartment(body);
     if (parsed instanceof Response) return parsed;
     const create = async () => {
+      const validationError = await policy?.validateInput(parsed);
+      if (validationError)
+        return Response.json(
+          typeof validationError === "string"
+            ? { message: validationError }
+            : validationError,
+          { status: 400 },
+        );
       const policyError = await policy?.beforeCreate(parsed);
       if (policyError) {
         return Response.json(policyError, { status: 409 });
@@ -50,13 +60,24 @@ export function registerDepartmentQuickCreateRoute(
       );
       return item;
     };
-    return mutationRunner ? mutationRunner.run(create) : create();
+    return identityMutationResponse(() =>
+      mutationRunner ? mutationRunner.run(create) : create(),
+    );
   });
 }
 
 function parseDepartment(body: unknown): Partial<ManagedDepartment> | Response {
   const value =
     body && typeof body === "object" ? (body as Record<string, unknown>) : {};
+  if (
+    Object.keys(value).some(
+      (key) => !departmentWritableFields.some((field) => field === key),
+    )
+  )
+    return Response.json(
+      { error: "INVALID_FIELDS", message: "包含不可写字段" },
+      { status: 400 },
+    );
   const code = typeof value.code === "string" ? value.code.trim() : "";
   const name = typeof value.name === "string" ? value.name.trim() : "";
   if (!/^[a-zA-Z][a-zA-Z0-9_-]{1,79}$/.test(code) || !name) {
@@ -85,10 +106,10 @@ function parseDepartment(body: unknown): Partial<ManagedDepartment> | Response {
     code,
     name,
     parentId,
-    order:
-      typeof value.order === "number" && Number.isFinite(value.order)
-        ? value.order
-        : 100,
+    ...(value.status === undefined
+      ? {}
+      : { status: value.status as ManagedDepartment["status"] }),
+    order: value.order === undefined ? 100 : (value.order as number),
   };
 }
 
@@ -112,35 +133,38 @@ export function registerDepartmentTransitionRoute(
     if (!decision.allowed) return forbidden(decision.reason);
     const parsed = parseTransition(body);
     if (parsed instanceof Response) return parsed;
-    return mutationRunner.run(async () => {
-      const result = await policy.transition(
-        String(params.id || ""),
-        parsed.action,
-        parsed.targetDepartmentId,
-        guardContext.actor,
-      );
-      if ("error" in result) {
-        return Response.json(result, { status: 409 });
-      }
-      await recordMutationAudit(
-        runtime,
-        "departments",
-        resourceEvent(
-          guardContext,
-          "organization.department.transition",
+    return identityMutationResponse(() =>
+      mutationRunner.run(async () => {
+        const result = await policy.transition(
+          String(params.id || ""),
+          parsed.action,
+          parsed.targetDepartmentId,
+          guardContext.actor,
+          parsed.updates,
+        );
+        if ("error" in result) {
+          return Response.json(result, { status: 409 });
+        }
+        await recordMutationAudit(
+          runtime,
           "departments",
-          result.department.id,
-          {
-            action: parsed.action,
-            targetDepartmentId: parsed.targetDepartmentId,
-            movedChildren: result.movedChildren,
-            movedUsers: result.movedUsers,
-            updatedRoles: result.updatedRoles,
-          },
-        ),
-      );
-      return result;
-    });
+          resourceEvent(
+            guardContext,
+            "organization.department.transition",
+            "departments",
+            result.department.id,
+            {
+              action: parsed.action,
+              targetDepartmentId: parsed.targetDepartmentId,
+              movedChildren: result.movedChildren,
+              movedUsers: result.movedUsers,
+              updatedRoles: result.updatedRoles,
+            },
+          ),
+        );
+        return result;
+      }),
+    );
   });
 }
 
@@ -148,6 +172,7 @@ function parseTransition(body: unknown):
   | {
       action: DepartmentTransitionAction;
       targetDepartmentId?: string;
+      updates?: Partial<ManagedDepartment>;
     }
   | Response {
   const value =
@@ -161,8 +186,45 @@ function parseTransition(body: unknown):
       { status: 400 },
     );
   }
+  if (
+    Object.keys(value).some(
+      (key) => !["action", "targetDepartmentId", "updates"].includes(key),
+    ) ||
+    (value.targetDepartmentId !== undefined &&
+      typeof value.targetDepartmentId !== "string")
+  )
+    return Response.json(
+      { error: "INVALID_DEPARTMENT_TRANSITION", message: "部门处置字段不合法" },
+      { status: 400 },
+    );
+  if (
+    value.updates !== undefined &&
+    (!value.updates ||
+      typeof value.updates !== "object" ||
+      Array.isArray(value.updates) ||
+      Object.keys(value.updates).some(
+        (key) => !["name", "code", "order", "parentId"].includes(key),
+      ))
+  )
+    return Response.json(
+      { error: "INVALID_DEPARTMENT_TRANSITION", message: "部门编辑字段不合法" },
+      { status: 400 },
+    );
+  if (
+    value.action === "delete" &&
+    value.updates !== undefined &&
+    Object.keys(value.updates as object).length
+  )
+    return Response.json(
+      {
+        error: "INVALID_DEPARTMENT_TRANSITION",
+        message: "删除部门时不能同时修改资料",
+      },
+      { status: 400 },
+    );
   return {
     action: value.action,
+    updates: value.updates as Partial<ManagedDepartment> | undefined,
     targetDepartmentId:
       typeof value.targetDepartmentId === "string" && value.targetDepartmentId
         ? value.targetDepartmentId

package/template/apps/server/src/system/department-transition-safety.test.ts

@@ -0,0 +1,148 @@
+import { describe, expect, test } from "bun:test";
+import { createFoundationSnapshot } from "../foundation.js";
+import { createSystemRepositories } from "./seed.js";
+import { createRouteTestRuntime } from "./route-test-runtime.js";
+import { registerSystemRoutes } from "./routes.js";
+import { FakeRouteApp } from "./route-test-app.js";
+
+async function fixture() {
+  const snapshot = createFoundationSnapshot();
+  const repositories = createSystemRepositories(snapshot);
+  const runtime = createRouteTestRuntime(snapshot, {
+    WINDY_DEV_ADMIN_TOKEN: "transition-security",
+  });
+  const app = new FakeRouteApp();
+  registerSystemRoutes(app, repositories, runtime, snapshot.features);
+  const guardContext = await runtime.createGuardContext(
+    new Request("http://localhost/api/system/departments", {
+      headers: { authorization: "Bearer transition-security" },
+    }),
+  );
+  await repositories.departments.create(
+    {
+      id: "source",
+      code: "source",
+      name: "原名称",
+      order: 1,
+      parentId: "dept_platform",
+    },
+    guardContext.actor,
+  );
+  await repositories.departments.create(
+    { id: "child", code: "child", name: "下级", order: 1, parentId: "source" },
+    guardContext.actor,
+  );
+  await repositories.users.create(
+    {
+      id: "member",
+      username: "member",
+      displayName: "成员",
+      departmentId: "source",
+      roleIds: ["role_user"],
+    },
+    guardContext.actor,
+  );
+  return {
+    repositories,
+    app,
+    context: { guardContext, query: {}, params: { id: "source" } },
+  };
+}
+
+describe("department mutation validation", () => {
+  test("资料编辑和停用合并请求在迁移校验失败时不保存任何部分", async () => {
+    const { app, repositories, context } = await fixture();
+    const before = {
+      departments: await repositories.departments.all(),
+      users: await repositories.users.all(),
+    };
+    const response = (await app.invoke(
+      "POST",
+      "/system/departments/:id/transition",
+      {
+        ...context,
+        body: {
+          action: "disable",
+          targetDepartmentId: "child",
+          updates: { name: "新名称", order: 5 },
+        },
+      },
+    )) as Response;
+    expect(response.status).toBe(409);
+    expect(await repositories.departments.all()).toEqual(before.departments);
+    expect(await repositories.users.all()).toEqual(before.users);
+    const succeeded = (await app.invoke(
+      "POST",
+      "/system/departments/:id/transition",
+      {
+        ...context,
+        body: {
+          action: "disable",
+          targetDepartmentId: "dept_platform",
+          updates: { name: "新名称", order: 5 },
+        },
+      },
+    )) as { department: { status: string; name: string; order: number } };
+    expect(succeeded.department).toMatchObject({
+      status: "disabled",
+      name: "新名称",
+      order: 5,
+    });
+    expect((await repositories.users.get("member"))?.departmentId).toBe(
+      "dept_platform",
+    );
+  });
+
+  test("快捷创建、通用编辑和处置updates拒绝审计字段注入", async () => {
+    const { app, repositories, context } = await fixture();
+    const current = await repositories.departments.get("source");
+    for (const [method, path, body] of [
+      [
+        "POST",
+        "/system/departments/quick",
+        {
+          code: "injected",
+          name: "注入",
+          parentId: "dept_platform",
+          deletedAt: "2026-09-10T00:00:00Z",
+        },
+      ],
+      ["PUT", "/system/departments/:id", { createdBy: "spoofed" }],
+      [
+        "POST",
+        "/system/departments/:id/transition",
+        {
+          action: "disable",
+          targetDepartmentId: "dept_platform",
+          updates: { deletedAt: "2026-09-10T00:00:00Z" },
+        },
+      ],
+      [
+        "POST",
+        "/system/departments/:id/transition",
+        {
+          action: "delete",
+          targetDepartmentId: "dept_platform",
+          updates: { name: "不能静默丢弃" },
+        },
+      ],
+    ] as const) {
+      const response = (await app.invoke(method, path, {
+        ...context,
+        body,
+      })) as Response;
+      expect(response.status).toBe(400);
+      expect(await repositories.departments.get("source")).toEqual(current);
+    }
+  });
+
+  test("部门排序超出PostgreSQL整数上限在写入前被拒绝", async () => {
+    const { app, repositories, context } = await fixture();
+    const response = (await app.invoke("PUT", "/system/departments/:id", {
+      ...context,
+      body: { order: 2147483648 },
+    })) as Response;
+    expect(response.status).toBe(400);
+    expect((await repositories.departments.get("source"))?.order).toBe(1);
+  });
+});

package/template/apps/server/src/system/department-validation.ts

@@ -0,0 +1,79 @@
+import type { LifecycleStatus } from "@southwind-ai/shared";
+import type { ManagedDepartment } from "./entities.js";
+import type {
+  ResourcePolicyResult,
+  ResourcePolicyError,
+} from "./route-types.js";
+export const departmentWritableFields = [
+  "parentId",
+  "name",
+  "code",
+  "order",
+  "status",
+] as const;
+export async function validateDepartmentInput(
+  input: Partial<ManagedDepartment>,
+  current?: ManagedDepartment,
+): Promise<ResourcePolicyResult> {
+  if (
+    input.code !== undefined &&
+    (typeof input.code !== "string" ||
+      !/^[a-zA-Z][a-zA-Z0-9_-]{1,79}$/.test(input.code.trim()))
+  ) {
+    return invalid(
+      "INVALID_DEPARTMENT_CODE",
+      "部门编码需以字母开头且至少 2 位",
+    );
+  }
+  if (
+    input.name !== undefined &&
+    (typeof input.name !== "string" ||
+      !input.name.trim() ||
+      input.name.trim().length > 120)
+  ) {
+    return invalid("INVALID_DEPARTMENT_NAME", "部门名称不能为空");
+  }
+  if (
+    input.order !== undefined &&
+    (!Number.isSafeInteger(input.order) ||
+      input.order < 0 ||
+      input.order > 2147483647)
+  ) {
+    return invalid(
+      "INVALID_DEPARTMENT_ORDER",
+      "部门排序必须是 0 到 2147483647 之间的整数",
+    );
+  }
+  if (input.status !== undefined && !isLifecycleStatus(input.status)) {
+    return invalid("INVALID_DEPARTMENT_STATUS", "部门状态不合法");
+  }
+  if (
+    !current &&
+    (typeof input.code !== "string" ||
+      typeof input.name !== "string" ||
+      typeof input.parentId !== "string" ||
+      !input.parentId)
+  ) {
+    return invalid(
+      "DEPARTMENT_PARENT_REQUIRED",
+      "平台只允许一个根组织，新部门必须选择上级部门",
+    );
+  }
+  if (typeof input.name === "string") input.name = input.name.trim();
+  if (typeof input.code === "string") input.code = input.code.trim();
+  if (
+    input.parentId !== undefined &&
+    (typeof input.parentId !== "string" ||
+      !input.parentId.trim() ||
+      input.parentId.length > 64)
+  )
+    return invalid("INVALID_DEPARTMENT_PARENT", "上级部门不合法");
+  return undefined;
+}
+
+function invalid(error: string, message: string): ResourcePolicyError {
+  return { error, message };
+}
+function isLifecycleStatus(value: unknown): value is LifecycleStatus {
+  return ["draft", "active", "disabled", "archived"].includes(String(value));
+}

package/template/apps/server/src/system/drizzle-repository.ts

@@ -240,6 +240,20 @@ export class DrizzleEntityRepository<
     if (!query.includeDeleted && deletedAt) clauses.push(isNull(deletedAt));
     const status = this.column("status");
     if (query.status && status) clauses.push(eq(status, query.status));
+    if (query.departmentId) {
+      const department = this.column("departmentId");
+      clauses.push(
+        department ? eq(department, query.departmentId) : sql`false`,
+      );
+    }
+    if (query.roleId) {
+      const roles = this.column("roleIds");
+      clauses.push(
+        roles
+          ? sql`${roles} @> ${JSON.stringify([query.roleId])}::jsonb`
+          : sql`false`,
+      );
+    }
     const keyword = query.q?.trim();
     const search = keyword
       ? searchFields.map((field) => this.column(String(field))).filter(Boolean)

package/template/apps/server/src/system/drizzle-system-configs.ts

@@ -87,6 +87,8 @@ export function userConfig(
         "postIds",
         "status",
       ]),
+      phone: item.phone || null,
+      email: item.email || null,
     }),
     toEntity: (row) =>
       ({

package/template/apps/server/src/system/identity-read-model.ts

@@ -0,0 +1,105 @@
+import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import type { RequestGuardContext } from "../guards.js";
+import { evaluateRouteGuards, findSystemFeature } from "../route-guards.js";
+import type { createServerRuntime } from "../runtime.js";
+import type { ManagedUser } from "./entities.js";
+import { departmentDescendantResolver } from "../data-access/department-tree.js";
+import { DataScopedResourceService } from "../data-access/scoped-resource.js";
+import type { SystemRepositories } from "./seed.js";
+import { projectMaskedUser } from "./user-projection.js";
+
+type Runtime = ReturnType<typeof createServerRuntime>;
+export function identityReadModel(
+  repositories: SystemRepositories,
+  runtime: Runtime,
+  features: FeatureFlagDefinition[],
+) {
+  const canRead = async (
+    resource: "department" | "role" | "user",
+    context: RequestGuardContext,
+  ) =>
+    (
+      await evaluateRouteGuards(
+        runtime,
+        context,
+        {
+          permission: {
+            method: "GET",
+            path: `/api/system/${resource === "department" ? "departments" : resource === "role" ? "roles" : "users"}`,
+            permissionKey: `system.${resource}.read`,
+          },
+          feature: findSystemFeature(features, resource),
+        },
+        { record: false },
+      )
+    ).allowed;
+  return {
+    async users(users: ManagedUser[], context: RequestGuardContext) {
+      const [readDepartments, readRoles] = await Promise.all([
+        canRead("department", context),
+        canRead("role", context),
+      ]);
+      const [departments, roles] = await Promise.all([
+        readDepartments ? repositories.departments.all() : [],
+        readRoles ? repositories.roles.all() : [],
+      ]);
+      const departmentNames = new Map(
+        departments.map((item) => [item.id, item.name]),
+      );
+      const roleNames = new Map(roles.map((item) => [item.id, item.name]));
+      return users.map((user) => ({
+        ...projectMaskedUser(user),
+        ...(readDepartments
+          ? {
+              departmentName:
+                departmentNames.get(user.departmentId ?? "") ?? "未分配部门",
+            }
+          : {}),
+        ...(readRoles
+          ? {
+              roleNames: user.roleIds.map(
+                (id) => roleNames.get(id) ?? "已删除角色",
+              ),
+            }
+          : {}),
+      }));
+    },
+    async organization(context: RequestGuardContext) {
+      return repositories.organizationMutationRunner.run(async () => {
+        const departments = await repositories.departments.all({
+          sort: [
+            { field: "order", order: "asc" },
+            { field: "name", order: "asc" },
+            { field: "id", order: "asc" },
+          ],
+        });
+        const readUsers = await canRead("user", context);
+        const users = readUsers
+          ? await new DataScopedResourceService(
+              repositories.users,
+              departmentDescendantResolver(repositories.departments),
+            ).all({}, [], context.actor)
+          : [];
+        const children = new Map<string, number>();
+        const members = new Map<string, number>();
+        for (const item of departments)
+          if (item.parentId)
+            children.set(item.parentId, (children.get(item.parentId) ?? 0) + 1);
+        for (const user of users)
+          if (user.departmentId)
+            members.set(
+              user.departmentId,
+              (members.get(user.departmentId) ?? 0) + 1,
+            );
+        return {
+          items: departments.map((item) => ({
+            ...item,
+            childDepartmentCount: children.get(item.id) ?? 0,
+            ...(readUsers ? { userCount: members.get(item.id) ?? 0 } : {}),
+          })),
+          total: departments.length,
+        };
+      });
+    },
+  };
+}