openxiangda-cli 2.0.0-alpha.84 → 2.0.0-alpha.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda-cli",
-  "version": "2.0.0-alpha.84",
+  "version": "2.0.0-alpha.85",
   "description": "Thin application-level CLI for OpenXiangda 2.0.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
   ],
   "dependencies": {
     "@oclif/core": "4.13.3",
-    "openxiangda-contracts": "2.0.0-alpha.38",
-    "openxiangda-devkit-core": "2.0.0-alpha.51",
-    "openxiangda-mcp": "2.0.0-alpha.51"
+    "openxiangda-contracts": "2.0.0-alpha.39",
+    "openxiangda-devkit-core": "2.0.0-alpha.52",
+    "openxiangda-mcp": "2.0.0-alpha.52"
   },
   "devDependencies": {
     "tsx": "4.23.12",

package/template/apps/server/package.json

@@ -15,7 +15,7 @@
     "@nestjs/common": "11.1.29",
     "@nestjs/core": "11.1.29",
     "@nestjs/platform-fastify": "11.1.29",
-    "openxiangda-nest": "2.0.0-alpha.47",
+    "openxiangda-nest": "2.0.0-alpha.48",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },

package/template/apps/web/package.json

@@ -16,7 +16,7 @@
     "antd": "6.4.3",
     "dayjs": "1.11.18",
     "docx-preview": "0.3.7",
-    "openxiangda-contracts": "2.0.0-alpha.38",
+    "openxiangda-contracts": "2.0.0-alpha.39",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "react-router-dom": "7.8.2",

package/template/apps/web/src/platform-client.ts

@@ -13,6 +13,7 @@ import {
   type DataTransactionResult,
   type DirectoryEntryPage,
   type DirectoryResolveRequest,
+  type CurrentUser,
 } from 'openxiangda-contracts/browser';
 import { applicationCode, runtimeMount } from './runtime-meta';
 import { useSyncExternalStore } from 'react';
@@ -85,6 +86,13 @@ export interface RuntimeIdentity {
   roleCodes: string[];
   capabilityCodes: string[];
   isAppSuperAdmin: boolean;
+  authorization?: {
+    mode: 'union' | 'focused_role';
+    focusedRoleCode: string | null;
+    availableRoles: Array<{ code: string; name: string }>;
+    hasAppSuperAdminGrant: boolean;
+    contextRevision: number;
+  };
   environment: {
     id: string;
     key: 'preproduction' | 'production';
@@ -101,12 +109,7 @@ interface ConnectedCurrent {
   principal: Pick<RuntimeIdentity, 'userId' | 'roleCodes' | 'capabilityCodes' | 'isAppSuperAdmin'>;
 }
 
-interface DeployedCurrent {
-  schemaVersion: 'openxiangda.current-user/v2';
-  appCode: string;
-  environment: RuntimeIdentity['environment'];
-  principal: { type: 'user' } & Pick<RuntimeIdentity, 'userId' | 'roleCodes' | 'capabilityCodes' | 'isAppSuperAdmin'>;
-}
+type DeployedCurrent = CurrentUser;
 
 let activeIdentity: RuntimeIdentity | undefined;
 
@@ -117,14 +120,18 @@ export async function loadCurrentIdentity(): Promise<RuntimeIdentity> {
       `${nativeBase()}/current-user?environmentKey=${encodeURIComponent(mount.environmentKey)}`
     );
     if (
-      current.schemaVersion !== 'openxiangda.current-user/v2' ||
+      current.schemaVersion !== SCHEMA_VERSIONS.currentUser ||
       current.appCode !== mount.appCode ||
       current.environment.key !== mount.environmentKey ||
       current.principal.type !== 'user'
     ) {
       throw new Error('OPENXIANGDA_DEPLOYED_CURRENT_USER_INVALID');
     }
-    activeIdentity = { ...current.principal, environment: current.environment };
+    activeIdentity = {
+      ...current.principal,
+      environment: current.environment,
+      authorization: current.authorization,
+    };
     return activeIdentity;
   }
   const current = await request<ConnectedCurrent>(`/service/openxiangda-api/v2/applications/${applicationCode()}/dev-sessions/current`);
@@ -132,6 +139,68 @@ export async function loadCurrentIdentity(): Promise<RuntimeIdentity> {
   return activeIdentity;
 }
 
+const AUTHORIZATION_CHANNEL = 'openxiangda.authorization-context/v2';
+const AUTHORIZATION_STORAGE_KEY =
+  'openxiangda.authorization-context-invalidated/v2';
+
+type AuthorizationInvalidation = {
+  type: 'authorization-context-invalidated';
+  appCode: string;
+  environmentKey: 'preproduction' | 'production';
+  contextRevision: number;
+  recordedAt: number;
+};
+
+function validAuthorizationInvalidation(
+  value: unknown
+): value is AuthorizationInvalidation {
+  if (!value || typeof value !== 'object') return false;
+  const candidate = value as Partial<AuthorizationInvalidation>;
+  return (
+    candidate.type === 'authorization-context-invalidated' &&
+    typeof candidate.appCode === 'string' &&
+    (candidate.environmentKey === 'preproduction' ||
+      candidate.environmentKey === 'production') &&
+    Number.isSafeInteger(candidate.contextRevision) &&
+    typeof candidate.recordedAt === 'number'
+  );
+}
+
+export function subscribeAuthorizationInvalidation(listener: () => void) {
+  const mount = runtimeMount();
+  if (!mount || typeof window === 'undefined') return () => undefined;
+  const receive = (value: unknown) => {
+    if (
+      validAuthorizationInvalidation(value) &&
+      value.appCode === mount.appCode &&
+      value.environmentKey === mount.environmentKey
+    ) {
+      activeIdentity = undefined;
+      listener();
+    }
+  };
+  let channel: BroadcastChannel | undefined;
+  try {
+    channel = new BroadcastChannel(AUTHORIZATION_CHANNEL);
+    channel.onmessage = event => receive(event.data);
+  } catch {
+    channel = undefined;
+  }
+  const onStorage = (event: StorageEvent) => {
+    if (event.key !== AUTHORIZATION_STORAGE_KEY || !event.newValue) return;
+    try {
+      receive(JSON.parse(event.newValue));
+    } catch {
+      // Invalid browser signals never alter the server-owned identity.
+    }
+  };
+  window.addEventListener('storage', onStorage);
+  return () => {
+    channel?.close();
+    window.removeEventListener('storage', onStorage);
+  };
+}
+
 export async function logoutCurrentUser() {
   await request<null>('/api/auth/logout', {
     method: 'POST',

package/template/apps/web/src/runtime.tsx

@@ -1,6 +1,10 @@
 import { Alert, Button, Result, Spin } from 'antd';
 import { createContext, useContext, useEffect, useMemo, useState } from 'react';
-import { loadCurrentIdentity, type RuntimeIdentity } from './platform-client';
+import {
+  loadCurrentIdentity,
+  subscribeAuthorizationInvalidation,
+  type RuntimeIdentity,
+} from './platform-client';
 import { runtimeMount } from './runtime-meta';
 
 interface RuntimeValue {
@@ -14,6 +18,15 @@ export function RuntimeBoundary({ children }: { children: React.ReactNode }) {
   const [identity, setIdentity] = useState<RuntimeIdentity>();
   const [error, setError] = useState<Error>();
   const [attempt, setAttempt] = useState(0);
+  useEffect(
+    () =>
+      subscribeAuthorizationInvalidation(() => {
+        setIdentity(undefined);
+        setError(undefined);
+        setAttempt(value => value + 1);
+      }),
+    []
+  );
   useEffect(() => {
     let active = true;
     setError(undefined);

package/template/package.json

@@ -22,9 +22,9 @@
     "build": "pnpm --recursive build"
   },
   "devDependencies": {
-    "openxiangda-cli": "2.0.0-alpha.84",
-    "openxiangda-contracts": "2.0.0-alpha.38",
-    "openxiangda-devkit-core": "2.0.0-alpha.51",
+    "openxiangda-cli": "2.0.0-alpha.85",
+    "openxiangda-contracts": "2.0.0-alpha.39",
+    "openxiangda-devkit-core": "2.0.0-alpha.52",
     "typescript": "5.9.3"
   }
 }