node-resource-utils 0.0.0-stage → 1.1.7

package/resources/src/lib/graph-schema.ts

@@ -0,0 +1,475 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { prisma } from '@/lib/prisma';
+import ONTOLOGY from '@/lib/ontology';
+
+/**
+ * 图谱节点「字段元数据」—— 让右侧详情面板能按 schema 自动长出表单。
+ *
+ * ★ 为什么要这一层：
+ *   以前详情面板只会拼一个「名称」输入框（名字写死在页面上），
+ *   类型 / 附加 / 状态 / 职位 / 备注这些"人一眼能看到的字段"全是只读文本。
+ *   但图谱的本体是配置驱动的（换业务只改 ontology.ts），
+ *   所以表单**不能**在页面里写死字段，只能从 prisma/schema.prisma 反推：
+ *     字段名 / 中文标签 / 数据类型 → 渲染成 Input / Select / Switch / DatePicker。
+ *
+ * ★ 中文标签的来源（按优先级）：
+ *   1. ontology.ts 里显式声明的 fieldLabels
+ *   2. schema 里字段后面的行注释（`status Int @default(1) // 1 在职 0 离职`）
+ *   3. 内置常用字段词典（name/code/status/remark…）
+ *   4. 字段名原样
+ *
+ * ★ 选项（枚举）的来源：
+ *   1. ontology.ts 的 fieldOptions
+ *   2. prisma enum 声明
+ *   3. 注释里的 `a | b | c` 或 `1 在职 0 离职`（SQLite 没有 enum，这是唯一线索）
+ */
+
+export type FieldKind = 'text' | 'longtext' | 'number' | 'boolean' | 'datetime' | 'enum' | 'fk';
+
+export interface FieldOption {
+  label: string;
+  value: string | number;
+}
+
+export interface FieldMeta {
+  name: string;
+  label: string;
+  kind: FieldKind;
+  prismaType: string;
+  /** 必填且无默认值 —— 清空会被拒绝 */
+  required: boolean;
+  nullable: boolean;
+  /** 唯一约束（code / 账号这类，迁移本体时不能直接继承） */
+  unique: boolean;
+  /** 标题字段 / 附加字段，面板里排在最前面 */
+  primary?: boolean;
+  options?: FieldOption[];
+  /** 外键指向的 Prisma 模型 */
+  refModel?: string;
+  /** 注释里的说明（当 placeholder / 提示用） */
+  hint?: string;
+}
+
+const SCALARS = new Set([
+  'String', 'Int', 'BigInt', 'Float', 'Decimal', 'Boolean', 'DateTime', 'Json', 'Bytes',
+]);
+
+/** 永远不给前端看的字段：主键 / 审计列 */
+const READONLY = new Set(['id', 'createdAt', 'updatedAt', 'deletedAt']);
+
+/** 敏感字段：哪怕是本体里声明的模型，也不允许把这个接口当后门改密码 */
+const SENSITIVE = /(password|passwd|pwd|salt|hash|secret|token|apikey|credential)/i;
+
+/** 长文本字段：用 TextArea，别让备注挤在一个单行框里 */
+const LONGTEXT = /(remark|desc|detail|note|content|reason|address|summary|intro|comment|reply|body|message|memo)/i;
+
+/** 常用字段的中文名（schema 没写注释时兜底） */
+const LABELS: Record<string, string> = {
+  name: '名称',
+  title: '标题',
+  code: '编码',
+  no: '编号',
+  jobNo: '工号',
+  status: '状态',
+  type: '类型',
+  sort: '排序',
+  remark: '备注',
+  description: '描述',
+  detail: '明细',
+  phone: '手机号',
+  mobile: '手机号',
+  email: '邮箱',
+  gender: '性别',
+  position: '职位',
+  post: '岗位',
+  hireDate: '入职日期',
+  salary: '月薪',
+  amount: '金额',
+  quantity: '数量',
+  price: '价格',
+  deptId: '所属部门',
+  parentId: '上级',
+  userId: '关联账号',
+  roleId: '关联角色',
+  date: '日期',
+  startTime: '开始时间',
+  endTime: '结束时间',
+  startDate: '开始日期',
+  endDate: '结束日期',
+  address: '地址',
+  contact: '联系方式',
+  reply: '回复',
+  score: '得分',
+  level: '等级',
+  batchId: '所属批次',
+  hidden: '是否隐藏',
+};
+
+/* ------------------------------ schema 解析 ------------------------------ */
+
+let schemaCache: string | null | undefined;
+
+function schemaText(): string | null {
+  if (schemaCache !== undefined) return schemaCache;
+  try {
+    schemaCache = readFileSync(join(process.cwd(), 'prisma', 'schema.prisma'), 'utf8');
+  } catch {
+    schemaCache = null;
+  }
+  return schemaCache;
+}
+
+function parseEnums(src: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  for (const m of src.matchAll(/enum\s+(\w+)\s*\{([\s\S]*?)\n\}/g)) {
+    const vals = m[2]
+      .split('\n')
+      .map((s) => s.trim())
+      .filter((s) => s && !s.startsWith('//') && !s.startsWith('@@'))
+      .map((s) => s.split(/\s+/)[0]);
+    if (vals.length) out.set(m[1], vals);
+  }
+  return out;
+}
+
+/** 把 schema 里的行注释拆出来（`///` 文档注释同样处理） */
+function splitComment(line: string): { decl: string; comment: string } {
+  const i = line.indexOf('//');
+  if (i < 0) return { decl: line, comment: '' };
+  return {
+    decl: line.slice(0, i),
+    comment: line.slice(i).replace(/^\/+\s*/, '').trim(),
+  };
+}
+
+/** 注释 → 中文标签（注释常用于写取值说明，这种就不要当标签） */
+function labelFromComment(comment: string, type: string): string | null {
+  if (!comment) return null;
+  if (comment.includes('|')) return null;
+  if (/^\d+\s/.test(comment)) return null; // "1 启用 0 停用"
+  const cut = comment.split(/[（(：:，,。;；]/)[0].trim();
+  if (!cut || cut.length > 12) return null;
+  if (type === 'Int' && /\d/.test(cut)) return null;
+  return cut;
+}
+
+/** 注释 → 选项（SQLite 没有 enum，只能从注释里认） */
+function optionsFromComment(comment: string, type: string): FieldOption[] | undefined {
+  if (!comment) return undefined;
+  if (type === 'String' && comment.includes('|')) {
+    const vals = comment.split('|').map((s) => s.trim()).filter(Boolean);
+    if (vals.length >= 2) return vals.map((v) => ({ label: v, value: v }));
+  }
+  if (type === 'Int') {
+    const hits = [...comment.matchAll(/(\d+)\s*([\u4e00-\u9fa5A-Za-z][\u4e00-\u9fa5A-Za-z0-9]*)/g)];
+    if (hits.length >= 2 && hits.length <= 6) {
+      return hits.map((h) => ({ label: h[2], value: Number(h[1]) }));
+    }
+  }
+  return undefined;
+}
+
+interface ModelMeta {
+  /** 可编辑字段（已剔除主键 / 审计列 / 敏感列） */
+  fields: FieldMeta[];
+  byName: Map<string, FieldMeta>;
+  fk: Map<string, string>;
+  soft: boolean;
+}
+
+let modelCache: Map<string, ModelMeta> | undefined;
+
+function parseModels(): Map<string, ModelMeta> {
+  const out = new Map<string, ModelMeta>();
+  const src = schemaText();
+  if (!src) return out;
+  const enums = parseEnums(src);
+
+  for (const block of src.matchAll(/model\s+(\w+)\s*\{([\s\S]*?)\n\}/g)) {
+    const model = block[1];
+    const body = block[2];
+
+    // 第一遍：外键（@relation(fields: [deptId], references: [id]) → deptId → Department）
+    const fk = new Map<string, string>();
+    for (const line of body.split('\n')) {
+      const m = line.match(
+        /^\s*(\w+)\s+([A-Za-z_]\w*)(\[\])?(\?)?\s+@relation\(([^)]*)\)/
+      );
+      if (!m) continue;
+      const fields = m[5].match(/fields:\s*\[(\w+)\]/);
+      if (fields) fk.set(fields[1], m[2]);
+    }
+
+    const fields: FieldMeta[] = [];
+    const byName = new Map<string, FieldMeta>();
+    let soft = false;
+
+    for (const raw of body.split('\n')) {
+      const trimmed = raw.trim();
+      if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('@@')) continue;
+      const { decl, comment } = splitComment(trimmed);
+
+      const m = decl.match(/^(\w+)\s+([A-Za-z_]\w*)(\[\])?(\?)?\s*(.*)$/);
+      if (!m) continue;
+      const [, name, type, list, opt, attrs] = m;
+      if (name === 'deletedAt') soft = true;
+      if (list) continue; // 关系数组（users / children / logs）不是字段
+      if (!SCALARS.has(type) && !enums.has(type)) continue; // 关系对象字段，跳过
+      if (READONLY.has(name) || SENSITIVE.test(name)) continue;
+      if (attrs.includes('@id')) continue;
+
+      const nullable = opt === '?';
+      const hasDefault = /@default|@updatedAt/.test(attrs);
+      const refModel = fk.get(name);
+      const kind = kindOf(name, type, comment, enums, refModel);
+      const options =
+        kind === 'enum'
+          ? enumOptions(type, enums) ?? optionsFromComment(comment, type)
+          : undefined;
+      const label =
+        labelFromComment(comment, type) ?? LABELS[name] ?? name;
+
+      const meta: FieldMeta = {
+        name,
+        label,
+        kind,
+        prismaType: type,
+        required: !nullable && !hasDefault,
+        nullable,
+        unique: /@unique/.test(attrs),
+        options,
+        refModel,
+        hint: comment || undefined,
+      };
+      fields.push(meta);
+      byName.set(name, meta);
+    }
+
+    out.set(model, { fields, byName, fk, soft });
+  }
+  return out;
+}
+
+function kindOf(
+  name: string,
+  type: string,
+  comment: string,
+  enums: Map<string, string[]>,
+  refModel?: string
+): FieldKind {
+  if (refModel) return 'fk';
+  if (enums.has(type)) return 'enum';
+  if (type === 'DateTime') return 'datetime';
+  if (type === 'Boolean') return 'boolean';
+  if (['Int', 'BigInt', 'Float', 'Decimal'].includes(type)) {
+    return optionsFromComment(comment, type) ? 'enum' : 'number';
+  }
+  if (type === 'Json') return 'longtext';
+  // String 也可能是枚举（SQLite 没有 enum，注释里写了 `male | female` 就认）
+  if (type === 'String' && (optionsFromComment(comment, type)?.length ?? 0) >= 2) return 'enum';
+  return LONGTEXT.test(name) ? 'longtext' : 'text';
+}
+
+function enumOptions(type: string, enums: Map<string, string[]>): FieldOption[] | undefined {
+  const vals = enums.get(type);
+  if (!vals?.length) return undefined;
+  return vals.map((v) => ({ label: v, value: v }));
+}
+
+function models(): Map<string, ModelMeta> {
+  if (!modelCache) modelCache = parseModels();
+  return modelCache;
+}
+
+function modelMeta(model: string): ModelMeta {
+  return models().get(model) ?? { fields: [], byName: new Map(), fk: new Map(), soft: false };
+}
+
+/* ------------------------------ 对外接口 ------------------------------ */
+
+export function isSensitive(name: string) {
+  return SENSITIVE.test(name);
+}
+
+/** 该模型所有可编辑字段（schema 顺序） */
+export function fieldsOfModel(model: string): FieldMeta[] {
+  return modelMeta(model).fields;
+}
+
+export function fieldOf(model: string, name: string): FieldMeta | undefined {
+  return modelMeta(model).byName.get(name);
+}
+
+export function fkMapOf(model: string): Map<string, string> {
+  return modelMeta(model).fk;
+}
+
+export function hasSoftDelete(model: string): boolean {
+  return modelMeta(model).soft;
+}
+
+/**
+ * 某个本体在详情面板里要展示的字段：
+ * 标题字段 → 附加字段 → 其余字段。标签 / 选项可被 ontology.ts 覆盖。
+ */
+export function fieldsForEntity(entityId: string): FieldMeta[] {
+  const ent = ONTOLOGY.entities.find((e) => e.id === entityId);
+  if (!ent) return [];
+  const all = fieldsOfModel(ent.model);
+  const labels = ONTOLOGY.fieldLabels?.[entityId] ?? ONTOLOGY.fieldLabels?.[ent.model] ?? {};
+  const opts = ONTOLOGY.fieldOptions?.[entityId] ?? ONTOLOGY.fieldOptions?.[ent.model] ?? {};
+
+  const decorated = all.map((f) => ({
+    ...f,
+    label: labels[f.name] ?? f.label,
+    options: opts[f.name]?.length ? opts[f.name] : f.options,
+    primary: f.name === ent.titleField || (ent.subtitleFields ?? []).includes(f.name),
+  }));
+
+  const order = [ent.titleField, ...(ent.subtitleFields ?? [])];
+  const rank = (n: string) => {
+    const i = order.indexOf(n);
+    return i < 0 ? order.length + 1 : i;
+  };
+  // 稳定排序：主字段按 titleField → subtitleFields 的顺序排，其余保持 schema 顺序
+  return decorated
+    .map((f, i) => ({ f, i }))
+    .sort((a, b) => rank(a.f.name) - rank(b.f.name) || a.i - b.i)
+    .map((x) => x.f);
+}
+
+/** 外键下拉选项（取标题字段做 label） */
+export async function optionsOf(refModel: string): Promise<FieldOption[]> {
+  const delegate = (prisma as unknown as Record<string, unknown>)[refModel] as
+    | { findMany?: (a: unknown) => Promise<Record<string, unknown>[]> }
+    | undefined;
+  if (!delegate?.findMany) return [];
+
+  const ent = ONTOLOGY.entities.find((e) => e.model === refModel);
+  const titleField =
+    ent?.titleField ??
+    fieldsOfModel(refModel).find((f) => f.kind === 'text' && f.required)?.name ??
+    fieldsOfModel(refModel).find((f) => f.kind === 'text')?.name ??
+    'id';
+  const secondary = fieldsOfModel(refModel).find(
+    (f) => f.kind === 'text' && f.name !== titleField
+  )?.name;
+
+  try {
+    const rows = await delegate.findMany({
+      where: hasSoftDelete(refModel) ? { deletedAt: null } : {},
+      select: { id: true, [titleField]: true, ...(secondary ? { [secondary]: true } : {}) },
+      take: 200,
+      orderBy: { [titleField]: 'asc' },
+    });
+    return rows.map((r) => {
+      const main = String(r[titleField] ?? r.id);
+      const extra = secondary ? String(r[secondary] ?? '') : '';
+      return {
+        label: extra ? `${main}（${extra}）` : main,
+        value: String(r.id),
+      };
+    });
+  } catch {
+    // 标题字段取错时不要让整个面板挂掉，退化成"显示 id"
+    return [];
+  }
+}
+
+/** 任意值 → 该字段可写库的值；undefined 表示"这次别动这个字段" */
+export function coerceValue(field: FieldMeta, v: unknown): unknown {
+  if (v === null) return field.nullable ? null : undefined;
+  if (v === undefined) return undefined;
+  if (typeof v === 'string' && v.trim() === '') return field.nullable ? null : '';
+
+  switch (field.kind) {
+    case 'number': {
+      const n = Number(v);
+      if (!Number.isFinite(n)) return undefined;
+      return field.prismaType === 'Float' || field.prismaType === 'Decimal' ? n : Math.trunc(n);
+    }
+    case 'boolean':
+      if (typeof v === 'string') return v === 'true' || v === '1';
+      return Boolean(v);
+    case 'datetime': {
+      const d = v instanceof Date ? v : new Date(String(v));
+      return Number.isNaN(d.getTime()) ? undefined : d;
+    }
+    case 'enum': {
+      const hit = field.options?.find((o) => String(o.value) === String(v));
+      return hit ? hit.value : String(v);
+    }
+    case 'fk':
+      return String(v);
+    default:
+      return typeof v === 'string' ? v : String(v);
+  }
+}
+
+/** 清洗 + 类型转换：只留真实存在、可编辑、非敏感的字段 */
+export function coercePayload(model: string, data: Record<string, unknown>): Record<string, unknown> {
+  const meta = modelMeta(model);
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(data ?? {})) {
+    const f = meta.byName.get(k);
+    if (!f) continue;
+    const cv = coerceValue(f, v);
+    if (cv === undefined) continue;
+    out[k] = cv;
+  }
+  return out;
+}
+
+/** 必填字段占位值（仅用于图谱里"快速新增"） */
+function placeholderOf(f: FieldMeta): unknown {
+  const n = f.name.toLowerCase();
+  const uniq = Date.now().toString(36).toUpperCase();
+  if (f.kind === 'number') return 0;
+  if (f.kind === 'boolean') return false;
+  if (f.kind === 'datetime') return new Date();
+  if (f.kind === 'enum') return f.options?.[0]?.value ?? '1';
+  if (/code|no$|number|sn$/.test(n)) return `A${uniq}`;
+  if (n.includes('email')) return `demo${Date.now()}@example.com`;
+  if (n.includes('phone') || n.includes('mobile') || n.includes('tel')) return '13800000000';
+  if (n.includes('username') || n.includes('account') || n.includes('login')) return `demo_${uniq}`;
+  return `演示-${uniq}`;
+}
+
+/**
+ * 补必填字段：新增节点 / 迁移本体时用。
+ * 必填外键挂到目标表已存在的第一条记录上，否则一定撞外键约束。
+ */
+export async function fillRequired(model: string, data: Record<string, unknown>) {
+  const meta = modelMeta(model);
+  for (const f of meta.fields) {
+    if (!f.required || data[f.name] !== undefined) continue;
+
+    if (f.refModel) {
+      const ref = (prisma as unknown as Record<string, { findFirst?: (a: unknown) => Promise<{ id: string } | null> }>)[
+        f.refModel
+      ];
+      const row = ref?.findFirst
+        ? await ref.findFirst({ where: hasSoftDelete(f.refModel) ? { deletedAt: null } : {} })
+        : null;
+      if (row) data[f.name] = row.id;
+      continue; // 找不到就留空，让 Prisma 明确报出缺哪个字段
+    }
+
+    const v = placeholderOf(f);
+    if (v !== undefined) data[f.name] = v;
+  }
+  return data;
+}
+
+/** 两个模型之间同名字段的交集（迁移本体时"能带过去的字段"） */
+export function sharedFields(fromModel: string, toModel: string): string[] {
+  const to = modelMeta(toModel).byName;
+  return modelMeta(fromModel).fields
+    .filter((f) => {
+      const t = to.get(f.name);
+      // 唯一列不继承：两个表各有 @unique 的 code，复制过去一定撞约束
+      return !!t && t.kind === f.kind && !t.unique && !f.unique;
+    })
+    .map((f) => f.name);
+}

package/resources/src/lib/graph-scope.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/api', () => ({
+  BizError: class BizError extends Error {},
+  CODE: { FORBIDDEN: 40300 },
+}));
+
+import { graphWhereOf } from './graph-scope';
+
+const user = (patch: Record<string, unknown> = {}) =>
+  ({
+    id: 'u1',
+    username: 'zhangsan',
+    name: '张三',
+    isSuper: false,
+    permCodes: ['demo:employee:list'],
+    roleCodes: ['staff'],
+    deptId: 'd1',
+    deptIds: ['d1', 'd2'],
+    dataScope: 2,
+    ...patch,
+  }) as never;
+
+describe('graphWhereOf', () => {
+  it('超管只做软删过滤，不加任何范围条件', () => {
+    expect(graphWhereOf('Employee', user({ isSuper: true, dataScope: 1 }))).toEqual({
+      deletedAt: null,
+    });
+  });
+
+  it('有 deptId 的表套 deptScope', () => {
+    expect(graphWhereOf('Employee', user())).toEqual({
+      deletedAt: null,
+      deptId: { in: ['d1', 'd2'] },
+    });
+  });
+
+  it('Department 自己按 id 收口，否则整棵组织树都看得见', () => {
+    expect(graphWhereOf('Department', user())).toEqual({ id: { in: ['d1', 'd2'] } });
+  });
+
+  it('没有 deptId 的字典表（OperationLog / Menu / Role）只做软删', () => {
+    expect(graphWhereOf('OperationLog', user())).toEqual({});
+    expect(graphWhereOf('Menu', user())).toEqual({});
+  });
+});

package/resources/src/lib/graph-scope.ts

@@ -0,0 +1,28 @@
+import { DATA_SCOPE, deptScope, effectiveDataScope, type ScopeUser } from '@/lib/rbac';
+import { fieldsOfModel, hasSoftDelete } from '@/lib/graph-schema';
+
+/**
+ * 图谱相关接口共用的 where 构造：软删过滤 + 数据范围。
+ *
+ * ★ 为什么单独一个文件：图谱有四个入口都在读业务行
+ *   （/api/graph 列表与展开、/api/graph/focus 取关联簇、
+ *    /api/graph/node 的详情面板与删除影响预览），
+ *   漏一个就等于给行级权限开了后门。放在这里，四个入口共用一份实现。
+ *
+ * 规则：
+ *   - 有 deptId 的表 → 套 deptScope（部门子树收口）
+ *   - Department 自己 → 按 id 收口，否则整棵组织树连人带姓全都看得见
+ *   - 其余字典 / 配置 / 关联表 → 不涉个人数据，只做软删过滤
+ */
+export function graphWhereOf(model: string, user?: ScopeUser | null): Record<string, unknown> {
+  const base: Record<string, unknown> = hasSoftDelete(model) ? { deletedAt: null } : {};
+  if (!user) return base;
+  if (effectiveDataScope(user) === DATA_SCOPE.ALL) return base;
+  if (fieldsOfModel(model).some((f) => f.name === 'deptId')) {
+    return { ...base, ...deptScope(user) };
+  }
+  if (model === 'Department' && user.deptIds?.length) {
+    return { ...base, id: { in: user.deptIds } };
+  }
+  return base;
+}