openxiangda-cli 2.0.0-alpha.79 → 2.0.0-alpha.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.79",
+  "version": "2.0.0-alpha.80",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.35",
-    "openxiangda-devkit-core": "2.0.0-alpha.46",
-    "openxiangda-mcp": "2.0.0-alpha.46"
+    "openxiangda-contracts": "2.0.0-alpha.36",
+    "openxiangda-devkit-core": "2.0.0-alpha.47",
+    "openxiangda-mcp": "2.0.0-alpha.47"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/AGENTS.md

@@ -2,14 +2,16 @@
 
 - Use only the workspace-pinned CLI: `pnpm openxiangda <command>`. Never invoke a bare global `openxiangda` inside a 2.0 task.
 - Use Vite, React Router, Refine Core and Ant Design. Do not add Umi, ProComponents or another admin shell.
-- Declare each resource once in `openxiangda.config.ts`. Resource codes are lower kebab-case. The same declaration owns storage, Surface metadata, permissions and generated AI Schema.
+- Declare each resource once in `openxiangda.config.ts` with only `code`, `name`, `fields` and optional list/layout/data-policy settings. Each field owns type, label, required state, Surface flags, reference/file metadata and access. Resource codes are lower kebab-case.
+- Never write resource-level `schemaVersion`, `appCode`, `schema`, `surface`, `capabilities`, `fieldPolicies` or `platform/data` modules. The compiler derives the strict DataResource, CRUD capabilities, Surface and AI Schema. The application manifest still starts with its one top-level `schemaVersion: 3`.
 - Ordinary list/get/create/update/delete, filters, export and batch operations use the platform Native Data API. Do not create Function CRUD or NestJS wrappers.
 - Add NestJS only for a named business action that needs a cross-resource transaction, an invariant or an external side effect.
 - A NestJS backend declares only `enabled`, `isolation: 'shared' | 'dedicated'` and `resourceProfile: 'light' | 'standard'`. Never put raw Kubernetes resources, replicas, ports or environment maps in application metadata; the platform owns capacity and scaling.
 - Use the current logged-in user and the union of application roles. Do not select RoleSession, persist platform Token or implement a second authorization path.
-- Declare restricted field read, create and update permissions explicitly. There is no `write` fallback; generated update permission is denied unless explicitly granted.
+- Fields inherit the resource read/create/update capabilities. Use field `access` only to tighten them; arrays are all-of and `false` is explicit deny. There is no `write` fallback.
 - Desktop and mobile pages share values, validation and authorization, but use separate renderers. Members, departments, resources and attachments use platform-owned selectors and stable IDs.
 - A single directory user reference uses a `string` field; a single department or same-app resource reference uses `uuid`; every `multiple: true` reference uses `json`. Roles that consume directory-backed fields explicitly include `app:<app-code>:directory:read`.
+- Derive role grants with `resourceCapabilityCodes(appCode, resourceCode)`. Declare current-user rows only with `currentUserDataPolicy(...)`; do not invent operators, values or alternate current-user spellings.
 - Do not add compatibility aliases, migration branches or silent fallbacks for an earlier 2.0 alpha contract. Replace an incorrect contract and regenerate the application.
 - Run `pnpm openxiangda check` after contract changes. Deploy with `pnpm openxiangda deploy`, inspect with `pnpm openxiangda status` and `pnpm openxiangda logs`, and use the platform rollback command rather than mutating K3s directly.
 - AI-native clients start the workspace protocol through the same pinned binary: `pnpm exec openxiangda --mcp-stdio --cwd <workspace>`. Read `openxiangda://workspace/contracts` or call `contract_describe`, and require its `aiCatalog` and `aiCatalogDigest` to match the normal compiler output. This is a stdio transport mode, not a ninth CLI command. Never write an application MCP server, Catalog file, preview store or second authorization path.

package/template/README.md

@@ -8,11 +8,13 @@ pnpm openxiangda dev
 
 当前应用已经把 CLI 和全部 2.0 包精确锁定在 `package.json` 与 lockfile 中。创建另一个应用时使用当前安装的 OpenXiangda 2.0 Skill 给出的精确 CLI 版本，不使用 `latest`、`alpha` 或全局命令。
 
-在 `platform/data` 中声明 `DataResource` 和字段即可生成标准后台列表、筛选、表单、详情、审计、文件上传和独立移动端页面。成员、部门和资源关系分别使用 `reference: { kind: 'directory-user' }`、`directory-department`、`resource`，只保存稳定 ID，不复制目录数据。单选成员字段使用 `string`，单选部门和资源引用使用 `uuid`，多选引用统一使用 `json`。需要目录选择器的业务角色必须显式拥有 `app:<app-code>:directory:read` 能力。
+在 `openxiangda.config.ts` 的 `data.resources` 中只声明资源 `code`、`name`、`fields` 和可选列表/布局/数据策略。每个字段一次写完 type、label、required、列表/筛选标记、reference/file 与 access；不要再写 `schema`、`surface`、资源 capabilities、资源 fieldPolicies 或 `platform/data` 模块。编译器据此生成标准后台列表、筛选、表单、详情、审计、文件上传、独立移动端页面和 AI Schema。
+
+成员、部门和资源关系分别使用 `reference: { kind: 'directory-user' }`、`directory-department`、`resource`，只保存稳定 ID，不复制目录数据。单选成员字段使用 `string`，单选部门和资源引用使用 `uuid`，多选引用统一使用 `json`。需要目录选择器的业务角色必须显式拥有 `app:<app-code>:directory:read` 能力。用 `resourceCapabilityCodes` 生成资源 CRUD 权限，用 `currentUserDataPolicy` 声明唯一的当前用户行规则。
 
 所有 CRUD 位于 `apps/web/src/platform-client.ts` 的 Data API adapter；Nest 只在需要复杂事务或外部集成时增加 App API。选择器显式携带当前环境、使用同源 Cookie，浏览器不读取 Token，也不发送 RoleSession header。
 
-前端读取平台 current-user 的角色/能力并集进行展示保护，服务端始终权威。字段策略区分 create/update；无权字段在提交前从 payload 删除。
+前端读取平台 current-user 的角色/能力并集进行展示保护，服务端始终权威。字段默认继承资源 read/create/update；`access` 数组为 all-of，`false` 为明确拒绝，无权字段在提交前从 payload 删除。
 
 ```bash
 pnpm openxiangda check

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda-nest": "2.0.0-alpha.44",
+    "openxiangda-nest": "2.0.0-alpha.45",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/package.json

@@ -16,7 +16,7 @@
     "antd": "6.4.3",
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-contracts": "2.0.0-alpha.35",
+    "openxiangda-contracts": "2.0.0-alpha.36",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2",

package/template/apps/web/src/Shell.tsx

@@ -352,7 +352,7 @@ export function Shell({ children }: { children: ReactNode }) {
 export function EmptyApplicationPage() {
   return (
     <Shell>
-      <Empty description="还没有声明数据资源；请在 platform/data 中添加 DataResource" />
+      <Empty description="还没有声明数据资源；请在 openxiangda.config.ts 中添加资源和字段" />
     </Shell>
   );
 }

package/template/apps/web/src/components/resource/GeneratedResourceCrud.tsx

@@ -87,7 +87,16 @@ function definitionFor(resourceCode: string) {
 
 function fieldFor(surface: DataResourceSurface, key: string): SurfaceField {
   const field = surface.fields[key];
-  return field ? { key, ...field } : { key, label: key, widget: 'text' };
+  return field
+    ? { key, ...field }
+    : {
+        key,
+        label: key,
+        widget: 'text',
+        readCapabilities: [],
+        createCapabilities: [],
+        updateCapabilities: [],
+      };
 }
 
 function fieldsBySection(surface: DataResourceSurface) {
@@ -131,10 +140,13 @@ function normalizeFormValues(values: Record<string, unknown>, surface: DataResou
 }
 
 function fieldWritable(field: SurfaceField, mode: 'create' | 'edit', hasCapability: (code: string) => boolean, isAppSuperAdmin: boolean) {
-  const capability = mode === 'create' ? field.createCapability : field.updateCapability;
   if (isAppSuperAdmin) return true;
-  if (capability) return hasCapability(capability);
-  return mode === 'create';
+  const capabilities = mode === 'create' ? field.createCapabilities : field.updateCapabilities;
+  return capabilities.length > 0 && capabilities.every(hasCapability);
+}
+
+function fieldReadable(field: SurfaceField, hasCapability: (code: string) => boolean, isAppSuperAdmin: boolean) {
+  return isAppSuperAdmin || (field.readCapabilities.length > 0 && field.readCapabilities.every(hasCapability));
 }
 
 function auditOperationLabel(operation: DataAuditEntry['operation']) {
@@ -179,11 +191,11 @@ async function exportResourceRows(
   code: string,
   name: string,
   surface: DataResourceSurface,
+  fields: SurfaceField[],
   query: Partial<GenericResourceQuery>,
   sort: { field: string; order: 'asc' | 'desc' }
 ) {
   const client = createNativeResourceClient(code, surface);
-  const fields = listSurfaceFields(surface.fields);
   const rows: ResourceRecord[] = [];
   const pageSize = 500;
   let page = 1;
@@ -215,8 +227,8 @@ async function exportResourceRows(
   return { count: rows.length, truncated: rows.length < total };
 }
 
-function AuditEntry({ entry, surface }: { entry: DataAuditEntry; surface: DataResourceSurface }) {
-  const fields = auditChangeFields(entry, surface);
+function AuditEntry({ entry, surface, readable }: { entry: DataAuditEntry; surface: DataResourceSurface; readable: (field: SurfaceField) => boolean }) {
+  const fields = auditChangeFields(entry, surface).filter(readable);
   const changes = entry.changes || entry.record || entry.before || {};
   return (
     <div className="oxa-audit-entry">
@@ -261,14 +273,21 @@ function AuditEntry({ entry, surface }: { entry: DataAuditEntry; surface: DataRe
   );
 }
 
-function useGeneratedList(definition: GeneratedDefinition) {
+function useGeneratedList(definition: GeneratedDefinition, readableFieldCodes: Set<string>) {
   const { code, surface } = definition;
-  const defaultSortField = surface.list?.defaultSort?.field || Object.keys(surface.fields)[0] || 'id';
+  const declaredDefaultSort = surface.list?.defaultSort?.field;
+  const defaultSortField =
+    (declaredDefaultSort && readableFieldCodes.has(declaredDefaultSort)
+      ? declaredDefaultSort
+      : Object.keys(surface.fields).find((field) => readableFieldCodes.has(field))) || 'id';
   const defaultSortOrder = surface.list?.defaultSort?.order || 'asc';
   const defaultPageSize = surface.list?.defaultPageSize || 20;
+  const defaultSearchField = (surface.list?.searchableFields || []).find((field) =>
+    readableFieldCodes.has(field)
+  );
   const [page, setPage] = useState(1);
   const [pageSize, setPageSize] = useState(defaultPageSize);
-  const [draft, setDraft] = useState<Partial<GenericResourceQuery>>({});
+  const [draft, setDraft] = useState<Partial<GenericResourceQuery>>({ searchField: defaultSearchField });
   const [query, setQuery] = useState<Partial<GenericResourceQuery>>({});
   const [sort, setSort] = useState({
     field: defaultSortField,
@@ -277,13 +296,13 @@ function useGeneratedList(definition: GeneratedDefinition) {
   useEffect(() => {
     setPage(1);
     setPageSize(defaultPageSize);
-    setDraft({});
+    setDraft({ searchField: defaultSearchField });
     setQuery({});
     setSort({
       field: defaultSortField,
       order: defaultSortOrder as 'asc' | 'desc',
     });
-  }, [code, defaultPageSize, defaultSortField, defaultSortOrder]);
+  }, [code, defaultPageSize, defaultSearchField, defaultSortField, defaultSortOrder]);
   const list = useList<ResourceRecord>({
     resource: code,
     pagination: { currentPage: page, pageSize },
@@ -332,9 +351,16 @@ function GeneratedDesktopList({ definition }: { definition: GeneratedDefinition
   const navigate = useNavigate();
   const { message } = App.useApp();
   const { hasCapability, identity } = useRuntime();
-  const state = useGeneratedList(definition);
   const { code, name, surface, capabilities } = definition;
-  const fields = listSurfaceFields(surface.fields);
+  const fields = listSurfaceFields(surface.fields).filter((field) =>
+    fieldReadable(field, hasCapability, identity.isAppSuperAdmin)
+  );
+  const readableFieldCodes = new Set(
+    Object.entries(surface.fields)
+      .filter(([, field]) => fieldReadable({ key: '', ...field }, hasCapability, identity.isAppSuperAdmin))
+      .map(([key]) => key)
+  );
+  const state = useGeneratedList(definition, readableFieldCodes);
   const [exporting, setExporting] = useState(false);
   const [filtersExpanded, setFiltersExpanded] = useState(false);
   const [density, setDensity] = useState<'small' | 'middle' | 'large'>('middle');
@@ -447,7 +473,7 @@ function GeneratedDesktopList({ definition }: { definition: GeneratedDefinition
   const handleExport = async () => {
     setExporting(true);
     try {
-      const result = await exportResourceRows(code, name, surface, state.query, state.sort);
+      const result = await exportResourceRows(code, name, surface, fields, state.query, state.sort);
       message.success(result.truncated ? `已导出 ${result.count} 条（最多导出 10000 条）` : `已导出 ${result.count} 条`);
     } catch (error) {
       message.error(error instanceof Error ? error.message : '导出失败');
@@ -455,7 +481,12 @@ function GeneratedDesktopList({ definition }: { definition: GeneratedDefinition
       setExporting(false);
     }
   };
-  const filterFields = surface.list?.filterFields || [];
+  const filterFields = (surface.list?.filterFields || []).filter((field) =>
+    readableFieldCodes.has(field)
+  );
+  const searchableFields = (surface.list?.searchableFields || []).filter((field) =>
+    readableFieldCodes.has(field)
+  );
   const hasMoreFilters = filterFields.length > 2;
   const columnMenu: MenuProps = {
     items: fields.map((field) => ({ key: field.key, label: field.label })),
@@ -505,7 +536,7 @@ function GeneratedDesktopList({ definition }: { definition: GeneratedDefinition
           <div className="oxa-filter-item">
             <Select
               allowClear
-              options={(surface.list?.searchableFields || []).map((key) => ({
+              options={searchableFields.map((key) => ({
                 label: fieldFor(surface, key).label,
                 value: key,
               }))}
@@ -679,17 +710,24 @@ function GeneratedDesktopList({ definition }: { definition: GeneratedDefinition
 
 function GeneratedMobileList({ definition }: { definition: GeneratedDefinition }) {
   const navigate = useNavigate();
-  const { hasCapability } = useRuntime();
+  const { hasCapability, identity } = useRuntime();
   const { message } = App.useApp();
   const { code, name, surface, capabilities } = definition;
-  const state = useGeneratedList(definition);
+  const readableFieldCodes = new Set(
+    Object.entries(surface.fields)
+      .filter(([, field]) => fieldReadable({ key: '', ...field }, hasCapability, identity.isAppSuperAdmin))
+      .map(([key]) => key)
+  );
+  const state = useGeneratedList(definition, readableFieldCodes);
   const [exporting, setExporting] = useState(false);
   const rows = (state.list.result.data || []) as unknown as ResourceRecord[];
-  const fields = listSurfaceFields(surface.fields).slice(0, 4);
+  const fields = listSurfaceFields(surface.fields)
+    .filter((field) => fieldReadable(field, hasCapability, identity.isAppSuperAdmin))
+    .slice(0, 4);
   const handleExport = async () => {
     setExporting(true);
     try {
-      const result = await exportResourceRows(code, name, surface, state.query, state.sort);
+      const result = await exportResourceRows(code, name, surface, fields, state.query, state.sort);
       message.success(result.truncated ? `已导出 ${result.count} 条（最多导出 10000 条）` : `已导出 ${result.count} 条`);
     } catch (error) {
       message.error(error instanceof Error ? error.message : '导出失败');
@@ -833,7 +871,7 @@ function GeneratedResourceFormPage({
       Object.fromEntries(
         Object.entries(values).filter(([key]) =>
           fieldWritable(
-            surface.fields[key] ? { key, ...surface.fields[key] } : { key, label: key, widget: 'text' },
+            fieldFor(surface, key),
             mode,
             hasCapability,
             identity.isAppSuperAdmin
@@ -878,7 +916,13 @@ function GeneratedResourceFormPage({
         onFinish={(values) => void submit(values as Record<string, unknown>)}
       >
         <div className="oxa-sections">
-          {fieldsBySection(surface).map((group) => (
+          {fieldsBySection(surface).map((group) => ({
+            ...group,
+            fields: group.fields.filter((field) =>
+              fieldReadable(field, hasCapability, identity.isAppSuperAdmin) ||
+              fieldWritable(field, mode, hasCapability, identity.isAppSuperAdmin)
+            ),
+          })).filter((group) => group.fields.length > 0).map((group) => (
             <Card className="oxa-section-card" key={group.section} title={group.section === 'default' ? '基本信息' : group.section}>
               <div className="oxa-grid">
                 {group.fields.map((field) => (
@@ -911,6 +955,7 @@ function GeneratedResourceFormPage({
 function GeneratedResourceDetailPage({ definition, variant }: { definition: GeneratedDefinition; variant: 'desktop' | 'mobile' }) {
   const { id = '' } = useParams();
   const navigate = useNavigate();
+  const { hasCapability, identity } = useRuntime();
   const query = useOne<ResourceRecord>({
     resource: definition.code,
     id,
@@ -970,14 +1015,26 @@ function GeneratedResourceDetailPage({ definition, variant }: { definition: Gene
       <Spin size="small" /> 正在读取操作记录
     </div>
   ) : auditEntries.length ? (
-    auditEntries.slice(0, 5).map((entry) => <AuditEntry entry={entry} key={entry.id} surface={definition.surface} />)
+    auditEntries.slice(0, 5).map((entry) => (
+      <AuditEntry
+        entry={entry}
+        key={entry.id}
+        readable={(field) => fieldReadable(field, hasCapability, identity.isAppSuperAdmin)}
+        surface={definition.surface}
+      />
+    ))
   ) : (
     <Typography.Text type="secondary">暂无变更记录</Typography.Text>
   );
   const content = record ? (
     <div className="oxa-detail-layout">
       <div className="oxa-detail-main">
-        {fieldsBySection(definition.surface).map((group) => (
+        {fieldsBySection(definition.surface).map((group) => ({
+          ...group,
+          fields: group.fields.filter((field) =>
+            fieldReadable(field, hasCapability, identity.isAppSuperAdmin)
+          ),
+        })).filter((group) => group.fields.length > 0).map((group) => (
           <Card className="oxa-section-card" key={group.section} title={group.section === 'default' ? '基本信息' : group.section}>
             <Descriptions
               column={{ xs: 1, sm: 2, lg: 3 }}

package/template/package.json

@@ -22,9 +22,9 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda-cli": "2.0.0-alpha.79",
-    "openxiangda-contracts": "2.0.0-alpha.35",
-    "openxiangda-devkit-core": "2.0.0-alpha.46",
+    "openxiangda-cli": "2.0.0-alpha.80",
+    "openxiangda-contracts": "2.0.0-alpha.36",
+    "openxiangda-devkit-core": "2.0.0-alpha.47",
     "typescript": "5.9.3"
   }
 }