openxiangda-cli 2.0.0-alpha.56 → 2.0.0-alpha.58

package/template/apps/web/test/contracts.test.ts

@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
 import test from 'node:test';
 import {
   instrumentFieldAllowed,
@@ -6,8 +7,14 @@ import {
 } from '../src/InstrumentForm';
 import { instrumentFields } from '../src/fields';
 import {
+  browseDepartmentTree,
+  browseDepartmentUsers,
   instrumentDataApi,
   loadCurrentIdentity,
+  resolveCollegeScope,
+  resolveDirectory,
+  searchCollegeScope,
+  searchDirectory,
 } from '../src/platform-client';
 import {
   applicationApiPath,
@@ -16,6 +23,9 @@ import {
   resolveApplicationBasename,
 } from '../src/runtime-meta';
 
+const collegeId = '11111111-1111-4111-8111-111111111111';
+const userId = '22222222-2222-4222-8222-222222222222';
+
 test('the golden module exposes exactly 30 fields and five restricted fields', () => {
   assert.equal(instrumentFields.length, 30);
   assert.deepEqual(
@@ -36,6 +46,87 @@ test('the golden module exposes exactly 30 fields and five restricted fields', (
   );
 });
 
+test('application shell and instrument surfaces match the approved navigation model', () => {
+  const shell = readFileSync(new URL('../src/Shell.tsx', import.meta.url), 'utf8');
+  const list = readFileSync(
+    new URL('../src/InstrumentListPage.tsx', import.meta.url),
+    'utf8'
+  );
+  const routes = readFileSync(new URL('../src/main.tsx', import.meta.url), 'utf8');
+  const form = readFileSync(
+    new URL('../src/InstrumentForm.tsx', import.meta.url),
+    'utf8'
+  );
+  const colleges = readFileSync(
+    new URL('../src/CollegePage.tsx', import.meta.url),
+    'utf8'
+  );
+  const directory = readFileSync(
+    new URL('../src/components/platform-fields/PlatformDirectoryPicker.tsx', import.meta.url),
+    'utf8'
+  );
+  for (const marker of [
+    '仪器资源管理',
+    '工作台',
+    '仪器管理',
+    '仪器资源',
+    '开放记录',
+    '基础数据',
+    '学院字典',
+    '系统设置',
+    '应用管理员',
+    '收起侧边栏',
+  ]) {
+    assert.match(shell, new RegExp(marker));
+  }
+  assert.doesNotMatch(shell, /<span>\{identity\.userId\}<\/span>/);
+  assert.doesNotMatch(shell, /验证本地 Nest|roleCodes\.join|environment\.key/);
+  assert.doesNotMatch(list, /<Drawer|surface="drawer"/);
+  assert.match(routes, /path="\/instruments\/new"[\s\S]*<InstrumentFormPage mode="create"/);
+  assert.match(colleges, /<Drawer/);
+  assert.match(colleges, /size=\{520\}/);
+  assert.match(directory, /width=\{kind === 'user' \? 980 : 760\}/);
+  assert.match(directory, /browseDepartmentTree|browseDepartmentUsers/);
+  assert.match(directory, /选择成员|选择部门|组织架构|已选/);
+  assert.match(form, /oxa-form-full/);
+  assert.match(form, /PlatformDirectoryPicker/);
+  assert.match(form, /oxa-file-dropzone/);
+  assert.match(form, /oxa-detail-layout/);
+  assert.doesNotMatch(
+    `${form}\n${directory}`,
+    /FormContext|tools\/openxiangda|RoleSession/
+  );
+});
+
+test('college, user, and department selectors have authoritative owners only', () => {
+  const appConfig = readFileSync(
+    new URL('../../../openxiangda.config.ts', import.meta.url),
+    'utf8'
+  );
+  const colleges = readFileSync(
+    new URL('../../../platform/data/colleges.ts', import.meta.url),
+    'utf8'
+  );
+  const fields = readFileSync(new URL('../src/fields.ts', import.meta.url), 'utf8');
+  assert.match(appConfig, /valueType:\s*'uuid'/);
+  assert.match(appConfig, /kind:\s*'native_resource'/);
+  assert.match(appConfig, /resourceCode:\s*'colleges'/);
+  assert.match(appConfig, /data:\s*\{\s*resources:\s*\[colleges, instruments\]/);
+  assert.match(colleges, /code:\s*'name'.*type:\s*'string'/s);
+  assert.match(colleges, /code:\s*'enabled'.*type:\s*'boolean'/s);
+  assert.match(fields, /kind:\s*'scope'/);
+  assert.match(fields, /kind:\s*'directory-user'/);
+  assert.match(fields, /kind:\s*'directory-department'/);
+  for (const marker of [
+    ['college', 'am'].join('-'),
+    ['user', 'wang'].join('-'),
+    ['dept', 'am-test'].join('-'),
+  ]) {
+    assert.equal(appConfig.includes(marker), false);
+    assert.equal(fields.includes(marker), false);
+  }
+});
+
 test('college create restores five fields while update omits college reassignment', () => {
   const protectedFields = instrumentFields.filter(
     field => field.createCapability && field.updateCapability
@@ -53,8 +144,8 @@ test('college create restores five fields while update omits college reassignmen
     chineseName: '电子显微镜',
     assetCode: 'ASSET-001',
     assetValue: 100,
-    collegeId: 'college-am',
-    instrumentAdminIds: ['user-wang'],
+    collegeId,
+    instrumentAdminIds: [userId],
     revision: 7,
   };
   assert.equal(
@@ -78,15 +169,15 @@ test('college create restores five fields while update omits college reassignmen
     chineseName: '电子显微镜',
     assetCode: 'ASSET-001',
     assetValue: 100,
-    collegeId: 'college-am',
-    instrumentAdminIds: ['user-wang'],
+    collegeId,
+    instrumentAdminIds: [userId],
   });
   assert.deepEqual(sanitizeInstrumentValues(values, 'edit', hasCapability), {
     instrumentCode: 'INS-001',
     chineseName: '电子显微镜',
     assetCode: 'ASSET-001',
     assetValue: 100,
-    instrumentAdminIds: ['user-wang'],
+    instrumentAdminIds: [userId],
   });
 });
 
@@ -206,29 +297,297 @@ test('list uses the native Data API with server paging, filters, and sorting', a
     await instrumentDataApi.list({
       page: 2,
       pageSize: 20,
-      collegeId: 'college-am',
-      instrumentAdminId: 'user-wang',
+      collegeId,
+      instrumentAdminId: userId,
       sort: { field: 'assetValue', order: 'asc' },
     });
+    await instrumentDataApi.list({ page: 1, pageSize: 20 });
   } finally {
     globalThis.fetch = originalFetch;
   }
-  assert.equal(calls.length, 2);
+  assert.equal(calls.length, 3);
   assert.match(
     calls[1]!.path,
     /\/native\/data\/instruments\/query$/
   );
   const body = JSON.parse(String(calls[1]!.init?.body));
+  const resourceSource = readFileSync(
+    new URL('../../../platform/data/instruments.ts', import.meta.url),
+    'utf8'
+  );
+  const declaredFields = new Set(
+    [...resourceSource.matchAll(/\{\s*code:\s*'([^']+)'/g)].map(
+      match => match[1]!
+    )
+  );
+  assert.deepEqual(
+    [...declaredFields],
+    instrumentFields.filter(field => !field.system).map(field => field.key)
+  );
   assert.equal(body.environmentKey, 'preproduction');
   assert.equal(body.limit, 20);
   assert.equal(body.offset, 20);
   assert.deepEqual(body.order, [{ field: 'assetValue', direction: 'asc' }]);
+  assert.equal(
+    [...body.filters, ...body.order].every(item =>
+      declaredFields.has(item.field)
+    ),
+    true
+  );
   assert.deepEqual(body.filters, [
-    { field: 'collegeId', operator: 'eq', value: 'college-am' },
+    { field: 'collegeId', operator: 'eq', value: collegeId },
     {
       field: 'instrumentAdminIds',
       operator: 'cs',
-      value: ['user-wang'],
+      value: [userId],
     },
   ]);
+  const defaultBody = JSON.parse(String(calls[2]!.init?.body));
+  assert.deepEqual(defaultBody.order, [
+    { field: 'instrumentCode', direction: 'asc' },
+  ]);
+  assert.equal(
+    [...defaultBody.filters, ...defaultBody.order].every(item =>
+      declaredFields.has(item.field)
+    ),
+    true
+  );
+});
+
+test('list rejects an undeclared sorter before issuing a Data API request', async () => {
+  let requests = 0;
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () => {
+    requests += 1;
+    throw new Error('unexpected fetch');
+  };
+  try {
+    await assert.rejects(
+      instrumentDataApi.list({
+        page: 1,
+        pageSize: 20,
+        sort: { field: 'updatedAt', order: 'desc' },
+      }),
+      /OPENXIANGDA_INSTRUMENT_QUERY_FIELD_NOT_DECLARED:updatedAt/
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+  assert.equal(requests, 0);
+});
+
+test('authoritative selectors page, resolve exact IDs, and never send RoleSession', async () => {
+  const calls: Array<{ path: string; init?: RequestInit }> = [];
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    const path = String(input);
+    calls.push({ path, init });
+    if (path.endsWith('/dev-sessions/current')) {
+      return Response.json({
+        code: 200,
+        data: {
+          environment: {
+            id: 'test-id',
+            key: 'preproduction',
+            activeAppVersionId: 'version-1',
+            headRevision: 2,
+            authzRevisionId: 'authz-1',
+            authzVersion: 3,
+            scopeDataVersion: 'scope-1',
+          },
+          principal: {
+            userId,
+            roleCodes: ['school_admin'],
+            capabilityCodes: [],
+            isAppSuperAdmin: false,
+          },
+        },
+      });
+    }
+    if (path.includes('/directory/users?')) {
+      return Response.json({
+        code: 200,
+        data: {
+          schemaVersion: 'openxiangda.directory-entry-page/v2',
+          kind: 'user',
+          items: [
+            { kind: 'user', id: userId, label: '王老师', selectable: true },
+          ],
+          nextCursor: 'next-user-page',
+        },
+      });
+    }
+    if (path.includes('/directory/departments/tree?')) {
+      return Response.json({
+        code: 200,
+        data: {
+          schemaVersion: 'openxiangda.directory-entry-page/v2',
+          kind: 'department',
+          items: [
+            {
+              kind: 'department',
+              id: 'department-root',
+              label: '材料学院',
+              hasChildren: true,
+              selectable: true,
+            },
+          ],
+          nextCursor: null,
+        },
+      });
+    }
+    if (path.includes('/directory/departments/department-root/users?')) {
+      return Response.json({
+        code: 200,
+        data: {
+          schemaVersion: 'openxiangda.directory-entry-page/v2',
+          kind: 'user',
+          items: [
+            { kind: 'user', id: userId, label: '王老师', selectable: true },
+          ],
+          nextCursor: null,
+        },
+      });
+    }
+    if (path.includes('/directory/resolve?')) {
+      const body = JSON.parse(String(init?.body));
+      return Response.json({
+        code: 200,
+        data: {
+          schemaVersion: 'openxiangda.directory-entry-page/v2',
+          kind: body.kind,
+          items: body.ids.map((id: string) => ({
+            kind: body.kind,
+            id,
+            label: '精确解析',
+            selectable: false,
+          })),
+          nextCursor: null,
+        },
+      });
+    }
+    if (path.includes('/scope-values/resolve?')) {
+      const body = JSON.parse(String(init?.body));
+      return Response.json({
+        code: 200,
+        data: scopePage(
+          body.operation,
+          body.values.map((value: string) => ({
+            value,
+            label: '先进材料学院',
+            selectable: false,
+          }))
+        ),
+      });
+    }
+    if (path.includes('/scope-values?')) {
+      return Response.json({
+        code: 200,
+        data: scopePage('create', [
+          { value: collegeId, label: '先进材料学院', selectable: true },
+        ]),
+      });
+    }
+    return Response.json({ code: 404, message: 'not mocked' }, { status: 404 });
+  };
+  try {
+    await loadCurrentIdentity();
+    const users = await searchDirectory('user', {
+      keyword: '王老',
+      cursor: 'cursor-1',
+    });
+    assert.equal(users.nextCursor, 'next-user-page');
+    assert.equal((await resolveDirectory('department', [userId])).items[0]?.selectable, false);
+    assert.equal(
+      (await browseDepartmentTree({ parentId: 'department-parent' })).items[0]
+        ?.id,
+      'department-root'
+    );
+    assert.equal(
+      (await browseDepartmentUsers('department-root', 2)).items[0]?.id,
+      userId
+    );
+    assert.equal(
+      (await searchCollegeScope('create', { keyword: '', cursor: 'scope-1' }))
+        .items[0]?.value,
+      collegeId
+    );
+    assert.equal(
+      (await resolveCollegeScope('update', [collegeId])).items[0]?.selectable,
+      false
+    );
+    await assert.rejects(
+      resolveDirectory('user', []),
+      /OPENXIANGDA_DIRECTORY_RESOLVE_IDS_REQUIRED/
+    );
+    await assert.rejects(
+      resolveCollegeScope('update', []),
+      /OPENXIANGDA_SCOPE_RESOLVE_VALUES_REQUIRED/
+    );
+    await assert.rejects(
+      resolveDirectory(
+        'user',
+        Array.from({ length: 51 }, (_, index) => `user-${index}`)
+      ),
+      /OPENXIANGDA_DIRECTORY_RESOLVE_IDS_EXCEEDED/
+    );
+    await assert.rejects(
+      resolveCollegeScope(
+        'update',
+        Array.from({ length: 51 }, (_, index) =>
+          `${String(index).padStart(8, '0')}-0000-4000-8000-000000000000`
+        )
+      ),
+      /OPENXIANGDA_SCOPE_RESOLVE_VALUES_EXCEEDED/
+    );
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+  const userSearch = calls.find(call => call.path.includes('/directory/users?'))!;
+  const treeBrowse = calls.find(call => call.path.includes('/directory/departments/tree?'))!;
+  const memberBrowse = calls.find(call => call.path.includes('/directory/departments/department-root/users?'))!;
+  const scopeSearch = calls.find(call => call.path.includes('/scope-values?'))!;
+  assert.match(userSearch.path, /keyword=%E7%8E%8B%E8%80%81/);
+  assert.match(userSearch.path, /cursor=cursor-1/);
+  assert.match(treeBrowse.path, /parentId=department-parent/);
+  assert.match(memberBrowse.path, /page=2/);
+  assert.match(scopeSearch.path, /environmentKey=preproduction/);
+  assert.match(
+    scopeSearch.path,
+    /\/native\/data-resources\/instruments\/fields\/collegeId\/scope-values\?/
+  );
+  assert.match(scopeSearch.path, /operation=create/);
+  assert.match(scopeSearch.path, /cursor=scope-1/);
+  assert.equal(
+    calls.some(call =>
+      Object.keys(call.init?.headers || {}).some(header =>
+        header.toLowerCase().includes('role-session')
+      )
+    ),
+    false
+  );
 });
+
+function scopePage(
+  operation: 'create' | 'update',
+  items: Array<{ value: string; label: string; selectable: boolean }>
+) {
+  return {
+    schemaVersion: 'openxiangda.native-scope-value-page/v2',
+    environment: {
+      id: 'test-id',
+      key: 'preproduction',
+      activeAppVersionId: 'version-1',
+      headRevision: 2,
+      authzRevisionId: 'authz-1',
+      authzVersion: 3,
+      scopeDataVersion: 'scope-1',
+    },
+    resourceCode: 'instruments',
+    fieldCode: 'collegeId',
+    dimensionCode: 'college',
+    operation,
+    items,
+    nextCursor: null,
+  };
+}

package/template/openxiangda.config.ts

@@ -3,12 +3,17 @@ import {
   instruments,
   protectedFieldCapabilities,
 } from './platform/data/instruments.js';
+import { colleges } from './platform/data/colleges.js';
 
 const read = 'app:instrument-center:data:instruments:read';
 const create = 'app:instrument-center:data:instruments:create';
 const update = 'app:instrument-center:data:instruments:update';
 const remove = 'app:instrument-center:data:instruments:delete';
 const inspectContext = 'app:instrument-center:instrument:context:read';
+const directoryRead = 'app:instrument-center:directory:read';
+const collegeRead = 'app:instrument-center:data:colleges:read';
+const collegeCreate = 'app:instrument-center:data:colleges:create';
+const collegeUpdate = 'app:instrument-center:data:colleges:update';
 const allProtectedFieldCapabilities = Object.values(
   protectedFieldCapabilities
 ).flatMap(capabilities => [capabilities.create, capabilities.update]);
@@ -26,6 +31,7 @@ export default defineOpenXiangdaApp({
     root: 'apps/web',
     routes: [
       { code: 'instruments', path: '/instruments', label: '仪器资源', surface: 'admin', navigation: 'menu', capability: read },
+      { code: 'colleges', path: '/colleges', label: '学院字典', surface: 'admin', navigation: 'menu', capability: collegeRead },
       { code: 'instrument-create', path: '/instruments/new', label: '新增仪器', surface: 'admin', navigation: 'hidden', parentCode: 'instruments', capability: create },
       { code: 'instrument-edit', path: '/instruments/:id/edit', label: '编辑仪器', surface: 'admin', navigation: 'hidden', parentCode: 'instruments', capability: update },
       { code: 'instrument-detail', path: '/instruments/:id', label: '仪器详情', surface: 'admin', navigation: 'hidden', parentCode: 'instruments', capability: read },
@@ -54,11 +60,24 @@ export default defineOpenXiangdaApp({
       { code: inspectContext, kind: 'backend', name: '查看当前应用身份摘要' },
     ],
     roles: [
-      { code: 'school_admin', name: '学校管理员', capabilities: [read, create, update, remove, ...allProtectedFieldCapabilities, inspectContext] },
-      { code: 'college_admin', name: '学院管理员', capabilities: [read, create, update, remove, ...collegeCreateCapabilities, ...collegeUpdateCapabilities, inspectContext] },
-      { code: 'instrument_admin', name: '仪器管理员', capabilities: [read, update, inspectContext] },
+      { code: 'school_admin', name: '学校管理员', capabilities: [read, create, update, remove, collegeRead, collegeCreate, collegeUpdate, directoryRead, ...allProtectedFieldCapabilities, inspectContext] },
+      { code: 'college_admin', name: '学院管理员', capabilities: [read, create, update, remove, directoryRead, ...collegeCreateCapabilities, ...collegeUpdateCapabilities, inspectContext] },
+      { code: 'instrument_admin', name: '仪器管理员', capabilities: [read, update, directoryRead, inspectContext] },
+    ],
+    scopeDimensions: [
+      {
+        code: 'college',
+        name: '学院',
+        valueType: 'uuid',
+        hierarchyMode: 'flat',
+        valueSource: {
+          kind: 'native_resource',
+          resourceCode: 'colleges',
+          labelField: 'name',
+          enabledField: 'enabled',
+        },
+      },
     ],
-    scopeDimensions: [{ code: 'college', name: '学院', valueType: 'string', hierarchyMode: 'flat' }],
     dataPolicies: [
       {
         code: 'instrument-access',
@@ -73,5 +92,5 @@ export default defineOpenXiangdaApp({
       },
     ],
   },
-  data: { resources: [instruments] },
+  data: { resources: [colleges, instruments] },
 });

package/template/package.json

@@ -21,9 +21,9 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda-cli": "2.0.0-alpha.56",
-    "openxiangda-contracts": "2.0.0-alpha.26",
-    "openxiangda-devkit-core": "2.0.0-alpha.33",
+    "openxiangda-cli": "2.0.0-alpha.58",
+    "openxiangda-contracts": "2.0.0-alpha.27",
+    "openxiangda-devkit-core": "2.0.0-alpha.34",
     "typescript": "5.9.3"
   }
 }

package/template/packages/contracts/src/generated.ts

@@ -2,9 +2,14 @@
 export const compilerContractVersion = "native-2" as const;
 export const appCode = "instrument-center" as const;
 export const resourceCodes = [
+  "colleges",
   "instruments"
 ] as const;
 export const capabilities = [
+  "app:instrument-center:data:colleges:create",
+  "app:instrument-center:data:colleges:delete",
+  "app:instrument-center:data:colleges:read",
+  "app:instrument-center:data:colleges:update",
   "app:instrument-center:data:instruments:create",
   "app:instrument-center:data:instruments:delete",
   "app:instrument-center:data:instruments:read",
@@ -39,6 +44,16 @@ export const appOperations = {
   }
 } as const;
 export const appRoutes = {
+  colleges: {
+    "code": "colleges",
+    "path": "/colleges",
+    "label": "学院字典",
+    "surface": "admin",
+    "navigation": "menu",
+    "capability": "app:instrument-center:data:colleges:read",
+    "tabPersistence": "session",
+    "keepAlive": "none"
+  },
   instrumentCreate: {
     "code": "instrument-create",
     "path": "/instruments/new",
@@ -95,6 +110,13 @@ export type EventType = (typeof eventTypes)[number];
 export type EventSubscriptionCode = (typeof eventSubscriptionCodes)[number];
 export type WorkflowCode = (typeof workflowCodes)[number];
 
+export interface CollegesRecord {
+  id: string;
+  revision: number;
+  name: string;
+  enabled: boolean;
+}
+
 export interface InstrumentsRecord {
   id: string;
   revision: number;

package/template/platform/data/colleges.ts

@@ -0,0 +1,21 @@
+import { SCHEMA_VERSIONS, type DataResource } from 'openxiangda-contracts';
+
+export const colleges: DataResource = {
+  schemaVersion: SCHEMA_VERSIONS.dataResource,
+  appCode: 'instrument-center',
+  code: 'colleges',
+  name: '学院',
+  schema: {
+    fields: [
+      { code: 'name', type: 'string', nullable: false, indexed: true },
+      { code: 'enabled', type: 'boolean', nullable: false, indexed: true },
+    ],
+  },
+  capabilities: {
+    read: 'app:instrument-center:data:colleges:read',
+    create: 'app:instrument-center:data:colleges:create',
+    update: 'app:instrument-center:data:colleges:update',
+    delete: 'app:instrument-center:data:colleges:delete',
+  },
+  fieldPolicies: {},
+};

package/template/platform/data/instruments.ts

@@ -49,7 +49,7 @@ export const instruments: DataResource = {
       { code: 'openToOutside', type: 'boolean', nullable: false },
       { code: 'subjectAreas', type: 'json' },
       { code: 'platformProperty', type: 'string' },
-      { code: 'collegeId', type: 'string', nullable: false, indexed: true },
+      { code: 'collegeId', type: 'uuid', nullable: false, indexed: true },
       { code: 'manageDepartmentId', type: 'string', nullable: false },
       { code: 'useDepartmentId', type: 'string', nullable: false },
       { code: 'instrumentAdminIds', type: 'json', nullable: false, indexed: true },

package/template/scripts/verify-template-budget.mjs

@@ -31,7 +31,7 @@ const productionFiles = files.filter(file => {
   );
 });
 const source = productionFiles.map(file => readFileSync(file, 'utf8')).join('\n');
-for (const marker of ['@umijs/', 'openxiangda-' + 'admin', 'openxiangda-' + 'user', 'instrument_query', 'instrument_save', 'function.invoke', 'departmentScopeKey', 'instrumentScopeKey', 'adminUserIds']) {
+for (const marker of ['@umijs/', 'openxiangda-' + 'admin', 'openxiangda-' + 'user', 'instrument_query', 'instrument_save', 'function.invoke', 'departmentScopeKey', 'instrumentScopeKey', 'adminUserIds', 'college-' + 'am', 'user-' + 'wang', 'dept-' + 'am-test']) {
   if (source.includes(marker)) throw new Error(`TEMPLATE_FORBIDDEN_MARKER:${marker}`);
 }
 process.stdout.write(`Verified compact template: ${files.length} source files, ${bytes} bytes.\n`);