openxiangda-cli 2.0.0-alpha.85 → 2.0.0-alpha.86

package/template/apps/web/src/components/platform-fields/directory-value.ts

@@ -0,0 +1,53 @@
+import type {
+  DepartmentReferenceValue,
+  DirectoryEntry,
+  UserReferenceValue,
+} from 'openxiangda-contracts/browser';
+import type { DirectoryKind } from '../../platform-client';
+
+export type DirectoryStoredValue = UserReferenceValue | DepartmentReferenceValue;
+
+export function directoryStoredValues(
+  value?: DirectoryStoredValue | DirectoryStoredValue[]
+) {
+  return Array.isArray(value) ? value : value ? [value] : [];
+}
+
+export function directoryEntryFromStored(
+  kind: DirectoryKind,
+  value: DirectoryStoredValue
+): DirectoryEntry {
+  const description = kind === 'user'
+    ? [
+        (value as UserReferenceValue).employeeNo,
+        (value as UserReferenceValue).departments?.map(item => item.label).join(' / '),
+      ].filter(Boolean).join(' · ')
+    : (value as DepartmentReferenceValue).fullPath || '';
+  return {
+    kind,
+    id: value.value,
+    label: value.label,
+    snapshot: value,
+    ...(description ? { description } : {}),
+    ...(kind === 'department' && (value as DepartmentReferenceValue).parent
+      ? { parentId: (value as DepartmentReferenceValue).parent!.value }
+      : {}),
+    ...(kind === 'department' && (value as DepartmentReferenceValue).path?.length
+      ? {
+          path: (value as DepartmentReferenceValue).path!.map(item => ({
+            id: item.value,
+            label: item.label,
+          })),
+        }
+      : {}),
+    selectable: true,
+  };
+}
+
+export function directoryStoredValueFromEntries(
+  entries: DirectoryEntry[],
+  multiple: boolean
+) {
+  const snapshots = entries.map(entry => entry.snapshot);
+  return multiple ? snapshots : snapshots[0];
+}

package/template/apps/web/src/components/platform-fields/field-form-codec.ts

@@ -0,0 +1,98 @@
+import dayjs, { type Dayjs } from 'dayjs';
+import type { DataFieldSurface, DataResourceSurface } from 'openxiangda-contracts/browser';
+
+function dateTimeForForm(value: unknown) {
+  return value ? dayjs(String(value)) : undefined;
+}
+
+function timeForForm(value: unknown) {
+  return value ? dayjs(`2000-01-01T${String(value)}`) : undefined;
+}
+
+function rangeForForm(value: unknown, kind: 'date' | 'datetime') {
+  if (!value || typeof value !== 'object') return undefined;
+  const range = value as { start?: unknown; end?: unknown };
+  if (!range.start || !range.end) return undefined;
+  return kind === 'date'
+    ? [dayjs(String(range.start)), dayjs(String(range.end))]
+    : [dateTimeForForm(range.start), dateTimeForForm(range.end)];
+}
+
+function dayjsValue(value: unknown): Dayjs | undefined {
+  return value && typeof value === 'object' && 'format' in value
+    ? value as Dayjs
+    : undefined;
+}
+
+function rangeValue(value: unknown) {
+  return Array.isArray(value) && value.length === 2
+    ? [dayjsValue(value[0]), dayjsValue(value[1])] as const
+    : undefined;
+}
+
+export function fieldValueForForm(field: DataFieldSurface | undefined, value: unknown) {
+  switch (field?.type) {
+    case 'date':
+    case 'datetime':
+      return dateTimeForForm(value);
+    case 'time':
+      return timeForForm(value);
+    case 'date-range':
+      return rangeForForm(value, 'date');
+    case 'datetime-range':
+      return rangeForForm(value, 'datetime');
+    default:
+      return value;
+  }
+}
+
+export function fieldValueForData(field: DataFieldSurface | undefined, value: unknown) {
+  if (value === undefined || value === null) return value;
+  const scalar = dayjsValue(value);
+  switch (field?.type) {
+    case 'date':
+      return scalar?.format('YYYY-MM-DD') ?? value;
+    case 'time':
+      return scalar?.format(field.timePrecision === 'minute' ? 'HH:mm' : 'HH:mm:ss') ?? value;
+    case 'datetime':
+      return scalar?.toISOString() ?? value;
+    case 'date-range': {
+      const range = rangeValue(value);
+      return range?.[0] && range[1]
+        ? { start: range[0].format('YYYY-MM-DD'), end: range[1].format('YYYY-MM-DD') }
+        : value;
+    }
+    case 'datetime-range': {
+      const range = rangeValue(value);
+      return range?.[0] && range[1]
+        ? { start: range[0].toISOString(), end: range[1].toISOString() }
+        : value;
+    }
+    default:
+      return value;
+  }
+}
+
+export function normalizeRecordForForm(
+  record: Record<string, unknown>,
+  surface: DataResourceSurface
+) {
+  return Object.fromEntries(
+    Object.entries(record).map(([key, value]) => [
+      key,
+      fieldValueForForm(surface.fields[key], value),
+    ])
+  );
+}
+
+export function normalizeFormValues(
+  values: Record<string, unknown>,
+  surface: DataResourceSurface
+) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [
+      key,
+      fieldValueForData(surface.fields[key], value),
+    ])
+  );
+}

package/template/apps/web/src/components/platform-fields/location-value.ts

@@ -0,0 +1,87 @@
+import type { StableLocationValue } from 'openxiangda-contracts/browser';
+
+export interface BrowserCoordinateSnapshot {
+  longitude: unknown;
+  latitude: unknown;
+  accuracy?: unknown;
+  timestamp?: number;
+}
+
+export interface DingTalkCoordinateSnapshot {
+  longitude?: unknown;
+  latitude?: unknown;
+  accuracy?: unknown;
+  address?: unknown;
+  poiName?: unknown;
+  province?: unknown;
+  city?: unknown;
+  district?: unknown;
+}
+
+function coordinate(value: unknown, axis: 'longitude' | 'latitude') {
+  if (value === undefined || value === null || value === '') {
+    throw new Error(axis === 'longitude' ? '定位结果缺少有效经度' : '定位结果缺少有效纬度');
+  }
+  const parsed = typeof value === 'number' ? value : Number(String(value ?? '').trim());
+  const limit = axis === 'longitude' ? 180 : 90;
+  if (!Number.isFinite(parsed) || parsed < -limit || parsed > limit) {
+    throw new Error(axis === 'longitude' ? '定位结果缺少有效经度' : '定位结果缺少有效纬度');
+  }
+  return parsed;
+}
+
+function accuracy(value: unknown) {
+  if (value === undefined || value === null || value === '') return undefined;
+  const parsed = typeof value === 'number' ? value : Number(String(value).trim());
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
+}
+
+function optionalText(value: unknown) {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+function capturedAt(timestamp?: number) {
+  const date = new Date(
+    typeof timestamp === 'number' && Number.isFinite(timestamp) && timestamp > 0
+      ? timestamp
+      : Date.now()
+  );
+  return date.toISOString();
+}
+
+export function browserLocationValue(
+  snapshot: BrowserCoordinateSnapshot
+): StableLocationValue {
+  const capturedAccuracy = accuracy(snapshot.accuracy);
+  return {
+    source: 'browser',
+    longitude: coordinate(snapshot.longitude, 'longitude'),
+    latitude: coordinate(snapshot.latitude, 'latitude'),
+    ...(capturedAccuracy === undefined ? {} : { accuracy: capturedAccuracy }),
+    capturedAt: capturedAt(snapshot.timestamp),
+  };
+}
+
+export function dingTalkLocationValue(
+  snapshot: DingTalkCoordinateSnapshot,
+  timestamp = Date.now()
+): StableLocationValue {
+  const capturedAccuracy = accuracy(snapshot.accuracy);
+  const address = optionalText(snapshot.address);
+  const name = optionalText(snapshot.poiName);
+  const province = optionalText(snapshot.province);
+  const city = optionalText(snapshot.city);
+  const district = optionalText(snapshot.district);
+  return {
+    source: 'dingTalk',
+    longitude: coordinate(snapshot.longitude, 'longitude'),
+    latitude: coordinate(snapshot.latitude, 'latitude'),
+    ...(capturedAccuracy === undefined ? {} : { accuracy: capturedAccuracy }),
+    ...(address === undefined ? {} : { address }),
+    ...(name === undefined ? {} : { name }),
+    ...(province === undefined ? {} : { province }),
+    ...(city === undefined ? {} : { city }),
+    ...(district === undefined ? {} : { district }),
+    capturedAt: capturedAt(timestamp),
+  };
+}

package/template/apps/web/src/components/platform-fields/resource-query.ts

@@ -0,0 +1,131 @@
+import type {
+  DataResourceSurface,
+  DataWhere,
+  ResourceReferenceValue,
+  StableAddressValue,
+} from 'openxiangda-contracts/browser';
+import {
+  cascadeTerminalValues,
+  type CascadeStoredValue,
+} from './cascade-value';
+import { deepestAddressPredicate } from './address-value';
+
+export interface GenericResourceQuery {
+  page: number;
+  pageSize: number;
+  keyword?: string;
+  searchField?: string;
+  filters?: Record<string, unknown>;
+  sort?: { field: string; order: 'asc' | 'desc' };
+}
+
+function stableValues(value: unknown) {
+  const values = Array.isArray(value) ? value : [value];
+  return values.map(item =>
+    item && typeof item === 'object' && 'value' in item
+      ? String((item as ResourceReferenceValue).value)
+      : item
+  );
+}
+
+export function buildResourceWhere(
+  resourceCode: string,
+  surface: DataResourceSurface,
+  query: GenericResourceQuery
+): DataWhere | undefined {
+  const declaredFields = new Set(Object.keys(surface.fields));
+  const assertField = (field: string) => {
+    if (!declaredFields.has(field)) {
+      throw new Error(
+        `OPENXIANGDA_RESOURCE_QUERY_FIELD_NOT_DECLARED:${resourceCode}:${field}`
+      );
+    }
+    return field;
+  };
+  const predicates: DataWhere[] = [];
+  if (query.keyword?.trim()) {
+    const searchable = surface.list?.searchableFields || [];
+    const field = searchable.includes(query.searchField || '')
+      ? query.searchField!
+      : searchable[0];
+    if (field) {
+      predicates.push({
+        field: assertField(field),
+        operator: 'contains',
+        value: query.keyword.trim(),
+      });
+    }
+  }
+  for (const [fieldCode, value] of Object.entries(query.filters || {})) {
+    if (
+      value === undefined ||
+      value === null ||
+      value === '' ||
+      (Array.isArray(value) && value.length === 0)
+    ) continue;
+    // A list state can outlive a resource route during client-side navigation.
+    if (!declaredFields.has(fieldCode)) continue;
+    const field = surface.fields[fieldCode];
+    if (!field) continue;
+    if (field.type === 'json') {
+      predicates.push({
+        field: fieldCode,
+        operator: 'jsonContains',
+        value,
+      });
+    } else if (field.type === 'address') {
+      const address = deepestAddressPredicate(value as StableAddressValue);
+      if (address) {
+        predicates.push({
+          field: fieldCode,
+          operator: 'jsonContains',
+          path: address.path,
+          value: address.value,
+        });
+      }
+    } else if (field.type === 'cascade.single' || field.type === 'cascade.multiple') {
+      const terminals = cascadeTerminalValues(
+        value as CascadeStoredValue,
+        field.type === 'cascade.multiple'
+      );
+      if (terminals.length) {
+        predicates.push({
+          field: fieldCode,
+          operator: field.type === 'cascade.multiple' ? 'hasAny' : 'has',
+          value: field.type === 'cascade.multiple' ? terminals : terminals[0],
+        });
+      }
+    } else if (
+      (field.type === 'date-range' || field.type === 'datetime-range') &&
+      typeof value === 'object'
+    ) {
+      predicates.push({ field: fieldCode, operator: 'overlaps', value });
+    } else if (
+      Array.isArray(value) &&
+      value.length === 2 &&
+      ['date', 'datetime', 'number', 'money', 'percent'].includes(field.widget)
+    ) {
+      if (value[0] !== undefined && value[0] !== null && value[0] !== '') {
+        predicates.push({ field: fieldCode, operator: 'gte', value: value[0] });
+      }
+      if (value[1] !== undefined && value[1] !== null && value[1] !== '') {
+        predicates.push({ field: fieldCode, operator: 'lte', value: value[1] });
+      }
+    } else if (
+      field.type === 'option.multiple' ||
+      field.type === 'user.multiple' ||
+      field.type === 'department.multiple' ||
+      field.type === 'resource-ref.multiple'
+    ) {
+      predicates.push({
+        field: fieldCode,
+        operator: 'hasAny',
+        value: stableValues(value),
+      });
+    } else {
+      const [stable] = stableValues(value);
+      predicates.push({ field: fieldCode, operator: 'eq', value: stable });
+    }
+  }
+  return predicates.length ? { and: predicates } : undefined;
+}

package/template/apps/web/src/components/platform-fields/rich-text-value.ts

@@ -0,0 +1,59 @@
+const ALLOWED_TAGS = new Set([
+  'p', 'br', 'strong', 'b', 'em', 'i', 'u', 's', 'blockquote', 'pre', 'code',
+  'ul', 'ol', 'li', 'a', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'table',
+  'thead', 'tbody', 'tr', 'th', 'td', 'img',
+]);
+
+const ALLOWED_ATTRIBUTES: Record<string, Set<string>> = {
+  a: new Set(['href', 'target', 'rel']),
+  img: new Set(['src', 'alt', 'title', 'width', 'height']),
+  th: new Set(['colspan', 'rowspan']),
+  td: new Set(['colspan', 'rowspan']),
+};
+
+const MANAGED_IMAGE =
+  /^\/service\/openxiangda-api\/v2\/applications\/[^/?#]+\/native\/data\/[^/?#]+\/files\/[0-9a-f-]+\/content\?disposition=inline$/i;
+
+function safeLink(value: string) {
+  return /^(?:https?:|mailto:|tel:)/i.test(value.trim());
+}
+
+/** Browser-side defense in depth. The platform repeats this allowlist on write. */
+export function sanitizeRichText(value: string) {
+  if (typeof DOMParser === 'undefined') return value;
+  const document = new DOMParser().parseFromString(value, 'text/html');
+  for (const element of [...document.body.querySelectorAll('*')]) {
+    const tag = element.tagName.toLowerCase();
+    if (!ALLOWED_TAGS.has(tag)) {
+      if (tag === 'script' || tag === 'style') element.remove();
+      else element.replaceWith(...element.childNodes);
+      continue;
+    }
+    const attributes = ALLOWED_ATTRIBUTES[tag] || new Set<string>();
+    for (const attribute of [...element.attributes]) {
+      if (!attributes.has(attribute.name.toLowerCase())) {
+        element.removeAttribute(attribute.name);
+      }
+    }
+    if (tag === 'a') {
+      const href = element.getAttribute('href');
+      if (href && !safeLink(href)) element.removeAttribute('href');
+      element.setAttribute('rel', 'noopener noreferrer');
+    }
+    if (tag === 'img') {
+      const source = element.getAttribute('src') || '';
+      if (!MANAGED_IMAGE.test(source)) element.remove();
+    }
+  }
+  return document.body.innerHTML;
+}
+
+export function richTextPlainText(value: string) {
+  if (typeof DOMParser === 'undefined') {
+    return value.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
+  }
+  return new DOMParser()
+    .parseFromString(value, 'text/html')
+    .body.textContent?.replace(/\s+/g, ' ')
+    .trim() || '';
+}

package/template/apps/web/src/components/platform-fields/subtable-value.ts

@@ -0,0 +1,187 @@
+import type {
+  DataFieldSurface,
+  DataResourceSurface,
+  DataTransactionOperation,
+  DataTransactionOperationReference,
+} from 'openxiangda-contracts/browser';
+import { normalizeFormValues } from './field-form-codec';
+
+export type SubtableDraftState = 'created' | 'persisted' | 'deleted';
+
+export interface SubtableDraftRow {
+  key: string;
+  state: SubtableDraftState;
+  id?: string;
+  revision?: number;
+  data: Record<string, unknown>;
+  originalData?: Record<string, unknown>;
+  snapshot?: Record<string, unknown>;
+  originalOrder?: number;
+}
+
+export interface SubtableOperationPlanInput {
+  rows: SubtableDraftRow[];
+  childResourceCode: string;
+  childSurface: DataResourceSurface;
+  foreignKey: string;
+  orderField: string;
+  maxRows?: number;
+  parent:
+    | { operation: 'create'; operationIndex: number }
+    | { operation: 'update'; id: string };
+  canWrite: (
+    fieldCode: string,
+    field: DataFieldSurface,
+    operation: 'create' | 'update'
+  ) => boolean;
+  canDelete: boolean;
+}
+
+export function buildSubtableOperations(
+  input: SubtableOperationPlanInput
+): DataTransactionOperation[] {
+  const visibleRows = input.rows.filter(row => row.state !== 'deleted');
+  const maximum = input.maxRows ?? 20;
+  if (visibleRows.length > maximum || maximum < 1 || maximum > 49) {
+    throw new Error('OPENXIANGDA_SUBTABLE_MAX_ROWS_EXCEEDED');
+  }
+  const operations: DataTransactionOperation[] = [];
+  for (const row of input.rows.filter(item => item.state === 'deleted')) {
+    if (!input.canDelete) {
+      throw new Error('OPENXIANGDA_SUBTABLE_DELETE_FORBIDDEN');
+    }
+    if (!row.id || !Number.isSafeInteger(row.revision) || Number(row.revision) < 1) {
+      throw new Error('OPENXIANGDA_SUBTABLE_DELETED_ROW_INVALID');
+    }
+    operations.push({
+      operation: 'delete',
+      resourceCode: input.childResourceCode,
+      id: row.id,
+      expectedRevision: row.revision!,
+    });
+  }
+  visibleRows.forEach((row, order) => {
+    const operation = row.state === 'created' ? 'create' : 'update';
+    const current = writableData(input, row.data, operation);
+    if (operation === 'create') {
+      assertLinkFieldsWritable(input, 'create');
+      const parentValue: string | DataTransactionOperationReference =
+        input.parent.operation === 'create'
+          ? { operationIndex: input.parent.operationIndex, field: 'id' }
+          : input.parent.id;
+      operations.push({
+        operation: 'create',
+        resourceCode: input.childResourceCode,
+        data: {
+          ...current,
+          [input.foreignKey]: parentValue,
+          [input.orderField]: order,
+        },
+      });
+      return;
+    }
+    if (!row.id || !Number.isSafeInteger(row.revision) || Number(row.revision) < 1) {
+      throw new Error('OPENXIANGDA_SUBTABLE_PERSISTED_ROW_INVALID');
+    }
+    const original = writableData(
+      input,
+      row.originalData || {},
+      'update'
+    );
+    const changes = changedValues(original, current);
+    if (row.originalOrder !== order) {
+      assertLinkFieldsWritable(input, 'update');
+      changes[input.orderField] = order;
+    }
+    if (Object.keys(changes).length === 0) return;
+    operations.push({
+      operation: 'update',
+      resourceCode: input.childResourceCode,
+      id: row.id,
+      expectedRevision: row.revision!,
+      data: changes,
+    });
+  });
+  return operations;
+}
+
+function assertLinkFieldsWritable(
+  input: SubtableOperationPlanInput,
+  operation: 'create' | 'update'
+) {
+  for (const fieldCode of operation === 'create'
+    ? [input.foreignKey, input.orderField]
+    : [input.orderField]) {
+    const field = input.childSurface.fields[fieldCode];
+    if (!field || !input.canWrite(fieldCode, field, operation)) {
+      throw new Error(`OPENXIANGDA_SUBTABLE_LINK_FIELD_FORBIDDEN:${fieldCode}`);
+    }
+  }
+}
+
+function writableData(
+  input: SubtableOperationPlanInput,
+  values: Record<string, unknown>,
+  operation: 'create' | 'update'
+) {
+  const normalized = normalizeFormValues(values, input.childSurface);
+  return Object.fromEntries(
+    Object.entries(normalized)
+      .filter(([fieldCode]) => {
+        if (fieldCode === input.foreignKey || fieldCode === input.orderField) {
+          return false;
+        }
+        const field = input.childSurface.fields[fieldCode];
+        return Boolean(
+          field &&
+            !field.system &&
+            field.type !== 'subtable' &&
+            field.widget !== 'readonly' &&
+            input.canWrite(fieldCode, field, operation)
+        );
+      })
+      .map(([fieldCode, value]) => [
+        fieldCode,
+        value === undefined
+          ? emptyValue(input.childSurface.fields[fieldCode])
+          : value,
+      ])
+  );
+}
+
+function emptyValue(field: DataFieldSurface | undefined) {
+  return field && isMultiField(field.type) ? [] : null;
+}
+
+function isMultiField(type: string) {
+  return (
+    type.endsWith('.multiple') ||
+    type === 'file' ||
+    type === 'image' ||
+    type === 'subtable'
+  );
+}
+
+function changedValues(
+  original: Record<string, unknown>,
+  current: Record<string, unknown>
+) {
+  return Object.fromEntries(
+    Object.keys(current)
+      .filter(key => canonicalJson(current[key]) !== canonicalJson(original[key]))
+      .map(key => [key, current[key]])
+  );
+}
+
+function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    return `{${Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(value);
+}