openxiangda-devkit-core 2.0.0-alpha.68 → 2.0.0-alpha.70

package/dist/compiler/config.js

@@ -18,6 +18,112 @@ const DATE_TRIGGER_RESERVED_DATA_FIELDS = new Set([
     'dueAt',
 ]);
 const APP_DATA_FIELD_TYPES = new Set(DATA_FIELD_TYPES);
+const authorizationProjectionFieldPathSchema = {
+    type: 'string',
+    pattern: '^[A-Za-z_][A-Za-z0-9_]{0,127}(?:\\.(?:value|snapshot\\.[A-Za-z_][A-Za-z0-9_]{0,127}))?$',
+};
+const authorizationProjectionControlProperties = {
+    enabledField: {
+        type: 'string',
+        pattern: '^[A-Za-z_][A-Za-z0-9_]{0,127}$',
+    },
+    effectiveFromField: {
+        type: 'string',
+        pattern: '^[A-Za-z_][A-Za-z0-9_]{0,127}$',
+    },
+    effectiveToField: {
+        type: 'string',
+        pattern: '^[A-Za-z_][A-Za-z0-9_]{0,127}$',
+    },
+    failureMode: { const: 'strict' },
+};
+const roleMembershipSourceInputSchema = {
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'code',
+        'name',
+        'resourceCode',
+        'userIdField',
+        'roleCode',
+        'failureMode',
+    ],
+    properties: {
+        code: {
+            type: 'string',
+            pattern: '^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$',
+            maxLength: 100,
+        },
+        name: { type: 'string', minLength: 1, maxLength: 255 },
+        resourceCode: { type: 'string' },
+        userIdField: authorizationProjectionFieldPathSchema,
+        roleCode: { type: 'string' },
+        ...authorizationProjectionControlProperties,
+    },
+};
+const relationshipGrantSourceInputSchema = {
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'code',
+        'name',
+        'resourceCode',
+        'subject',
+        'relationCode',
+        'targetResourceCode',
+        'resourceIdField',
+        'operations',
+        'failureMode',
+    ],
+    properties: {
+        code: {
+            type: 'string',
+            pattern: '^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$',
+            maxLength: 100,
+        },
+        name: { type: 'string', minLength: 1, maxLength: 255 },
+        resourceCode: { type: 'string' },
+        subject: {
+            oneOf: [
+                {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['type', 'userIdField'],
+                    properties: {
+                        type: { const: 'user' },
+                        userIdField: authorizationProjectionFieldPathSchema,
+                    },
+                },
+                {
+                    type: 'object',
+                    additionalProperties: false,
+                    required: ['type', 'userIdField', 'roleCode'],
+                    properties: {
+                        type: { const: 'role_membership' },
+                        userIdField: authorizationProjectionFieldPathSchema,
+                        roleCode: { type: 'string' },
+                    },
+                },
+            ],
+        },
+        relationCode: { type: 'string', minLength: 1, maxLength: 128 },
+        targetResourceCode: { type: 'string' },
+        resourceIdField: authorizationProjectionFieldPathSchema,
+        operations: {
+            type: 'array',
+            minItems: 1,
+            maxItems: 20,
+            uniqueItems: true,
+            items: {
+                type: 'string',
+                minLength: 1,
+                maxLength: 64,
+                pattern: '^[A-Za-z0-9][A-Za-z0-9:._*-]{0,63}$',
+            },
+        },
+        ...authorizationProjectionControlProperties,
+    },
+};
 export const openXiangdaAppConfigSchema = {
     $id: 'openxiangda.app-config/v3',
     type: 'object',
@@ -172,6 +278,16 @@ export const openXiangdaAppConfigSchema = {
                     maxItems: 100,
                     items: { type: 'object' },
                 },
+                roleMembershipSources: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: roleMembershipSourceInputSchema,
+                },
+                relationshipGrantSources: {
+                    type: 'array',
+                    maxItems: 100,
+                    items: relationshipGrantSourceInputSchema,
+                },
                 dataPolicies: {
                     type: 'array',
                     maxItems: 100,
@@ -637,6 +753,8 @@ export function validateAppConfig(value) {
         for (const [name, values] of [
             ['scopeDimensions', authz.scopeDimensions],
             ['scopeSources', authz.scopeSources],
+            ['roleMembershipSources', authz.roleMembershipSources],
+            ['relationshipGrantSources', authz.relationshipGrantSources],
             ['dataPolicies', authz.dataPolicies],
         ]) {
             if (values !== undefined && !Array.isArray(values)) {
@@ -660,12 +778,25 @@ export function validateAppConfig(value) {
             resourceCode,
             new Set(fields.keys()),
         ]));
+        const resourceFieldDeclarations = new Map(dataResources.map(rawResource => {
+            const resource = object(rawResource);
+            const fields = Array.isArray(object(resource.schema).fields)
+                ? object(resource.schema).fields
+                : [];
+            return [
+                string(resource.code),
+                new Map(fields.map(rawField => {
+                    const field = object(rawField);
+                    return [string(field.code), field];
+                })),
+            ];
+        }));
         const dimensionCodes = new Set();
         dimensions.forEach((raw, index) => {
             const dimension = object(raw);
             const code = string(dimension.code);
             const dimensionPath = `authz.scopeDimensions[${index}]`;
-            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+            if (!/^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/.test(code) ||
                 dimensionCodes.has(code) ||
                 !string(dimension.name) ||
                 (dimension.valueType !== undefined &&
@@ -724,10 +855,10 @@ export function validateAppConfig(value) {
             const roleCode = string(subject.roleCode);
             const resourceCode = string(source.resourceCode);
             const declaredFields = resourceFields.get(resourceCode);
-            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+            if (!/^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/.test(code) ||
                 sourceCodes.has(code) ||
                 !string(source.name) ||
-                !/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(resourceCode) ||
+                !/^[a-z][a-z0-9]*(?:[-_.][a-z0-9]+)*$/.test(resourceCode) ||
                 !['user', 'role_membership'].includes(subjectType) ||
                 !SEMANTIC_FIELD_PATH_PATTERN.test(string(subject.userIdField)) ||
                 (subjectType === 'role_membership' && !roleCodes.has(roleCode)) ||
@@ -786,6 +917,120 @@ export function validateAppConfig(value) {
             }
             sourceCodes.add(code);
         });
+        const projectionSourceCodes = new Set();
+        const roleMembershipSources = Array.isArray(authz.roleMembershipSources)
+            ? authz.roleMembershipSources
+            : [];
+        const relationshipGrantSources = Array.isArray(authz.relationshipGrantSources)
+            ? authz.relationshipGrantSources
+            : [];
+        const projectionUserPathValid = (path, fields) => {
+            const root = semanticFieldPathRoot(path);
+            return (SEMANTIC_FIELD_PATH_PATTERN.test(path) &&
+                path === `${root}.value` &&
+                string(fields?.get(root)?.type) === 'user.single');
+        };
+        const projectionControlFieldsValid = (source, fields) => source.failureMode === 'strict' &&
+            (source.enabledField === undefined ||
+                string(fields?.get(string(source.enabledField))?.type) === 'boolean') &&
+            (source.effectiveFromField === undefined ||
+                ['date', 'datetime'].includes(string(fields?.get(string(source.effectiveFromField))?.type))) &&
+            (source.effectiveToField === undefined ||
+                ['date', 'datetime'].includes(string(fields?.get(string(source.effectiveToField))?.type)));
+        roleMembershipSources.forEach((raw, index) => {
+            const source = object(raw);
+            const sourcePath = `authz.roleMembershipSources[${index}]`;
+            const unknownKeys = Object.keys(source).filter(key => ![
+                'code',
+                'name',
+                'resourceCode',
+                'userIdField',
+                'roleCode',
+                'enabledField',
+                'effectiveFromField',
+                'effectiveToField',
+                'failureMode',
+            ].includes(key));
+            if (unknownKeys.length > 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_SCHEMA_INVALID', `role membership source 包含未知属性 ${unknownKeys.join(', ')}`, sourcePath));
+            }
+            const code = string(source.code);
+            const resourceCode = string(source.resourceCode);
+            const fields = resourceFieldDeclarations.get(resourceCode);
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                code.length > 100 ||
+                projectionSourceCodes.has(code) ||
+                !string(source.name) ||
+                !fields ||
+                !projectionUserPathValid(string(source.userIdField), fields) ||
+                !roleCodes.has(string(source.roleCode)) ||
+                !projectionControlFieldsValid(source, fields)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_ROLE_MEMBERSHIP_SOURCE_INVALID', 'role membership source 必须声明唯一来源、user.single.value、已声明 package role 与严格控制字段', sourcePath));
+            }
+            projectionSourceCodes.add(code);
+        });
+        relationshipGrantSources.forEach((raw, index) => {
+            const source = object(raw);
+            const sourcePath = `authz.relationshipGrantSources[${index}]`;
+            const unknownKeys = Object.keys(source).filter(key => ![
+                'code',
+                'name',
+                'resourceCode',
+                'subject',
+                'relationCode',
+                'targetResourceCode',
+                'resourceIdField',
+                'operations',
+                'enabledField',
+                'effectiveFromField',
+                'effectiveToField',
+                'failureMode',
+            ].includes(key));
+            if (unknownKeys.length > 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_SCHEMA_INVALID', `relationship grant source 包含未知属性 ${unknownKeys.join(', ')}`, sourcePath));
+            }
+            const code = string(source.code);
+            const resourceCode = string(source.resourceCode);
+            const targetResourceCode = string(source.targetResourceCode);
+            const fields = resourceFieldDeclarations.get(resourceCode);
+            const subject = object(source.subject);
+            const subjectType = string(subject.type);
+            const subjectUnknownKeys = Object.keys(subject).filter(key => !['type', 'userIdField', 'roleCode'].includes(key));
+            if (subjectUnknownKeys.length > 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_SCHEMA_INVALID', `relationship grant subject 包含未知属性 ${subjectUnknownKeys.join(', ')}`, `${sourcePath}.subject`));
+            }
+            const resourceIdPath = string(source.resourceIdField);
+            const resourceIdRoot = semanticFieldPathRoot(resourceIdPath);
+            const resourceIdField = fields?.get(resourceIdRoot);
+            const resourceReference = object(resourceIdField?.source);
+            const resourceIdValid = (resourceIdPath === 'id' && targetResourceCode === resourceCode) ||
+                (resourceIdPath === `${resourceIdRoot}.value` &&
+                    string(resourceIdField?.type) === 'resource-ref.single' &&
+                    string(resourceReference.resourceCode) === targetResourceCode);
+            const operations = Array.isArray(source.operations)
+                ? source.operations.map(string)
+                : [];
+            if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
+                code.length > 100 ||
+                projectionSourceCodes.has(code) ||
+                !string(source.name) ||
+                !fields ||
+                !resourceFieldDeclarations.has(targetResourceCode) ||
+                !['user', 'role_membership'].includes(subjectType) ||
+                !projectionUserPathValid(string(subject.userIdField), fields) ||
+                (subjectType === 'role_membership' &&
+                    !roleCodes.has(string(subject.roleCode))) ||
+                !/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(string(source.relationCode)) ||
+                !resourceIdValid ||
+                operations.length === 0 ||
+                operations.length > 20 ||
+                new Set(operations).size !== operations.length ||
+                operations.some(operation => !/^[A-Za-z0-9][A-Za-z0-9:._*-]{0,63}$/.test(operation)) ||
+                !projectionControlFieldsValid(source, fields)) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_RELATIONSHIP_GRANT_SOURCE_INVALID', 'relationship grant source 必须声明唯一来源、有效主体/目标关系、常量操作与严格控制字段', sourcePath));
+            }
+            projectionSourceCodes.add(code);
+        });
         const policyCodes = new Set();
         policies.forEach((raw, index) => {
             const policy = object(raw);