openxiangda-devkit-core 2.0.0-alpha.70 → 2.0.0-alpha.71

package/dist/compiler/config.js

@@ -6,6 +6,7 @@ import { supportsFilter, supportsSearch, supportsSort, } from './field-query-pla
 import { physicalPlanForField } from './field-physical-plan.js';
 import { SEMANTIC_FIELD_PATH_PATTERN, semanticFieldPathRoot, validateAuthzSemanticBindings, } from './field-policy-path.js';
 import { compatibleWidgets, isCompatibleFieldWidget, resolveDataFieldSurfaceWidget, } from './field-surface.js';
+import { DATA_POLICY_EXPRESSION_MAX_DEPTH, DATA_POLICY_EXPRESSION_MAX_GROUP_ITEMS, DATA_POLICY_EXPRESSION_MAX_LEAVES, dataPolicyExpressionToCnf, } from './data-policy-expression.js';
 // The compiler owns the application source contract. Devkit and every adapter
 // re-export this module instead of maintaining separate configuration models.
 import { validateWorkflowBinding, validateWorkflowDefinition, } from '../internal/workflow.js';
@@ -412,6 +413,55 @@ function object(value) {
 function string(value) {
     return typeof value === 'string' ? value.trim() : '';
 }
+function policyRuleNodes(policy, policyPath, diagnostics) {
+    const baseRules = (Array.isArray(policy.rules) ? policy.rules : []).map((rule, index) => ({
+        rule: object(rule),
+        path: `${policyPath}.rules[${index}]`,
+    }));
+    if (policy.readExpression === undefined)
+        return baseRules;
+    const leaves = [];
+    let structuralError = false;
+    const visit = (value, path, depth) => {
+        if (depth > DATA_POLICY_EXPRESSION_MAX_DEPTH) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_EXPRESSION_DEPTH_EXCEEDED', `策略表达式深度不能超过 ${DATA_POLICY_EXPRESSION_MAX_DEPTH}`, path));
+            structuralError = true;
+            return;
+        }
+        const node = object(value);
+        const groupKeys = ['allOf', 'anyOf'].filter(key => key in node);
+        if (groupKeys.length === 0) {
+            leaves.push({ rule: node, path });
+            return;
+        }
+        const key = groupKeys[0];
+        const children = Array.isArray(node[key]) ? node[key] : [];
+        if (groupKeys.length !== 1 ||
+            Object.keys(node).length !== 1 ||
+            !Array.isArray(node[key]) ||
+            children.length < 1 ||
+            children.length > DATA_POLICY_EXPRESSION_MAX_GROUP_ITEMS) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_EXPRESSION_GROUP_INVALID', `表达式节点只能声明一个 allOf/anyOf，且包含 1 到 ${DATA_POLICY_EXPRESSION_MAX_GROUP_ITEMS} 个子项`, path));
+            structuralError = true;
+            return;
+        }
+        children.forEach((child, index) => visit(child, `${path}.${key}[${index}]`, depth + 1));
+    };
+    visit(policy.readExpression, `${policyPath}.readExpression`, 1);
+    if (leaves.length > DATA_POLICY_EXPRESSION_MAX_LEAVES) {
+        diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_EXPRESSION_LEAVES_EXCEEDED', `策略表达式最多包含 ${DATA_POLICY_EXPRESSION_MAX_LEAVES} 个规则叶子`, `${policyPath}.readExpression`));
+        structuralError = true;
+    }
+    if (!structuralError && leaves.length > 0) {
+        try {
+            dataPolicyExpressionToCnf(policy.readExpression);
+        }
+        catch {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_EXPRESSION_EXPANSION_EXCEEDED', '策略表达式规范化后超过 50 个 CNF 子句或 100 个规则实例', `${policyPath}.readExpression`));
+        }
+    }
+    return [...baseRules, ...leaves];
+}
 function eventSchemaDeclaresPath(schema, path) {
     let current = schema;
     for (const segment of path.split('.')) {
@@ -1034,14 +1084,49 @@ export function validateAppConfig(value) {
         const policyCodes = new Set();
         policies.forEach((raw, index) => {
             const policy = object(raw);
+            const policyPath = `authz.dataPolicies[${index}]`;
+            const unknownPolicyKeys = Object.keys(policy).filter(key => ![
+                'code',
+                'name',
+                'resourceCode',
+                'unrestrictedRoleCodes',
+                'operations',
+                'matchMode',
+                'rules',
+                'readExpression',
+                'writeBoundary',
+            ].includes(key));
+            if (unknownPolicyKeys.length > 0) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_KEYS_INVALID', 'data policy 包含未声明字段', policyPath));
+            }
             const code = string(policy.code);
             const rules = Array.isArray(policy.rules) ? policy.rules : [];
+            const hasReadExpression = policy.readExpression !== undefined;
+            const operations = Array.isArray(policy.operations)
+                ? policy.operations.map(string)
+                : [];
+            const operationsValid = policy.operations === undefined ||
+                (Array.isArray(policy.operations) &&
+                    operations.length > 0 &&
+                    operations.length <= 4 &&
+                    new Set(operations).size === operations.length &&
+                    operations.every(operation => ['read', 'create', 'update', 'delete'].includes(operation)));
+            const capabilityOnlyBoundary = policy.writeBoundary === 'capability_only' &&
+                policy.matchMode === 'AND' &&
+                rules.length === 0 &&
+                hasReadExpression;
+            const scopedBoundary = rules.length > 0 && policy.writeBoundary === undefined;
+            const validPolicyForm = ['AND', 'OR'].includes(string(policy.matchMode)) &&
+                (scopedBoundary || capabilityOnlyBoundary) &&
+                (!hasReadExpression || policy.operations === undefined);
             if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(code) ||
                 policyCodes.has(code) ||
                 !string(policy.name) ||
-                !['AND', 'OR'].includes(string(policy.matchMode)) ||
-                rules.length === 0) {
-                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_INVALID', 'data policy 必须声明唯一 code、name、matchMode 和至少一条规则', `authz.dataPolicies[${index}]`));
+                !validPolicyForm) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_INVALID', 'data policy 必须声明基础 matchMode/rules；readExpression 只叠加到读取，空基础规则必须显式声明 writeBoundary=capability_only', policyPath));
+            }
+            if (!operationsValid) {
+                diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_OPERATIONS_INVALID', 'operations 必须是不重复的 read/create/update/delete 非空数组', `${policyPath}.operations`));
             }
             policyCodes.add(code);
             if (!/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(string(policy.resourceCode))) {
@@ -1064,20 +1149,71 @@ export function validateAppConfig(value) {
                     seenUnrestrictedRoleCodes.add(roleCode);
                 });
             }
-            rules.forEach((rawRule, ruleIndex) => {
-                const rule = object(rawRule);
-                const rulePath = `authz.dataPolicies[${index}].rules[${ruleIndex}]`;
+            const policyFields = resourceFieldTypes.get(string(policy.resourceCode));
+            policyRuleNodes(policy, policyPath, diagnostics).forEach(({ rule, path: rulePath }) => {
+                const unknownRuleKeys = Object.keys(rule).filter(key => ![
+                    'subject',
+                    'dimensionCode',
+                    'relationCode',
+                    'resourceCode',
+                    'field',
+                    'roleCodes',
+                    'operation',
+                    'valuePath',
+                    'emptyMatchesAll',
+                    'operator',
+                    'value',
+                    'operand',
+                ].includes(key));
+                if (unknownRuleKeys.length > 0) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_KEYS_INVALID', 'data policy 规则包含未声明字段', rulePath));
+                }
                 const subject = string(rule.subject);
                 const dimensionCode = string(rule.dimensionCode);
                 const relationCode = string(rule.relationCode);
-                const modes = [subject, dimensionCode, relationCode].filter(Boolean);
+                const operator = string(rule.operator);
+                const dbNow = rule.operand === 'db_now';
+                const nullPredicate = ['is_null', 'is_not_null'].includes(operator);
+                const constantPredicate = ['eq', 'not_eq', 'in', 'not_in'].includes(operator);
+                const modes = [
+                    subject,
+                    dimensionCode,
+                    relationCode,
+                    dbNow ? 'db_now' : '',
+                    constantPredicate || nullPredicate ? 'constant' : '',
+                ].filter(Boolean);
                 const validCurrentUser = subject === 'current_user';
                 const validDimension = Boolean(dimensionCode) && dimensionCodes.has(dimensionCode);
                 const validRelationship = Boolean(relationCode) && Boolean(string(rule.resourceCode));
+                const validConstant = constantPredicate &&
+                    (['in', 'not_in'].includes(operator)
+                        ? Array.isArray(rule.value) &&
+                            rule.value.length > 0 &&
+                            rule.value.length <= 100 &&
+                            rule.value.every(value => typeof value === 'string' && value.length <= 2048) &&
+                            new Set(rule.value).size === rule.value.length
+                        : typeof rule.value === 'string' &&
+                            rule.value.length > 0 &&
+                            rule.value.length <= 2048);
+                const validNull = nullPredicate &&
+                    rule.value === undefined &&
+                    rule.operand === undefined;
+                const validDbNow = dbNow &&
+                    ['lt', 'lte', 'gt', 'gte'].includes(operator) &&
+                    rule.value === undefined &&
+                    policyFields?.get(string(rule.field)) === 'datetime';
                 if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field)) ||
                     modes.length !== 1 ||
-                    (!validCurrentUser && !validDimension && !validRelationship)) {
-                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、已声明 dimension 或 relationship 中的一种', rulePath));
+                    (!validCurrentUser &&
+                        !validDimension &&
+                        !validRelationship &&
+                        !validConstant &&
+                        !validNull &&
+                        !validDbNow)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、dimension、relationship、constant/null 或 datetime db_now 中的一种', rulePath));
+                }
+                if (dbNow && !validDbNow) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_DB_NOW_FIELD_INVALID', 'db_now 只支持 datetime 字段及 lt/lte/gt/gte 操作符', `${rulePath}.field`));
                 }
                 if (rule.roleCodes !== undefined) {
                     const scopedRoleCodes = Array.isArray(rule.roleCodes)
@@ -1105,8 +1241,7 @@ export function validateAppConfig(value) {
                 return;
             const sourceDimensions = new Set((Array.isArray(source.grants) ? source.grants : []).map(rawGrant => string(object(rawGrant).dimensionCode)));
             const matchingRules = policies.flatMap(rawPolicy => {
-                const rules = object(rawPolicy).rules;
-                return (Array.isArray(rules) ? rules : []).filter(rawRule => sourceDimensions.has(string(object(rawRule).dimensionCode)));
+                return policyRuleNodes(object(rawPolicy), 'authz.dataPolicies', []).map(entry => entry.rule).filter(rawRule => sourceDimensions.has(string(rawRule.dimensionCode)));
             });
             if (matchingRules.length === 0 ||
                 matchingRules.some(rawRule => string(object(rawRule).operation) !== 'read')) {
@@ -1990,6 +2125,40 @@ export function currentUserDataPolicy(input) {
         ],
     };
 }
+export const dataPolicyExpression = {
+    allOf: (...values) => ({ allOf: values }),
+    anyOf: (...values) => ({ anyOf: values }),
+    constant: (input) => ({ ...input }),
+    null: (input) => ({ ...input }),
+    databaseNow: (input) => ({ ...input, operand: 'db_now' }),
+    currentUser: (input) => ({ ...input, subject: 'current_user' }),
+    dimension: (input) => ({ ...input }),
+    relation: (input) => ({ ...input }),
+};
+export function resourceReadPolicy(input) {
+    const common = {
+        code: input.code,
+        name: input.name,
+        resourceCode: input.resourceCode,
+        ...(input.unrestrictedRoleCodes
+            ? { unrestrictedRoleCodes: [...input.unrestrictedRoleCodes] }
+            : {}),
+        readExpression: input.expression,
+    };
+    if (input.writeBoundary === 'capability_only') {
+        return {
+            ...common,
+            matchMode: 'AND',
+            rules: [],
+            writeBoundary: 'capability_only',
+        };
+    }
+    return {
+        ...common,
+        matchMode: input.matchMode,
+        rules: input.rules,
+    };
+}
 export function materializeDataResource(appCode, declaration) {
     const capabilities = resourceCapabilityCodes(appCode, declaration.code);
     const fields = declaration.fields.map(field => {