openxiangda-devkit-core 2.0.0-alpha.78 → 2.0.0-alpha.80

package/dist/compiler/config.js

@@ -344,7 +344,20 @@ export const openXiangdaAppConfigSchema = {
             type: 'object',
             additionalProperties: false,
             required: ['root'],
-            properties: { root: { type: 'string', minLength: 1 } },
+            properties: {
+                root: { type: 'string', minLength: 1 },
+                requiredCapabilities: {
+                    type: 'array',
+                    maxItems: 64,
+                    uniqueItems: true,
+                    items: {
+                        type: 'string',
+                        minLength: 1,
+                        maxLength: 128,
+                        pattern: '^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$',
+                    },
+                },
+            },
         },
         perspectives: {
             type: 'array',
@@ -724,6 +737,16 @@ export function validateAppConfig(value) {
     if (!string(app.name)) {
         diagnostics.push(diagnostic('APP_CONFIG_NAME_REQUIRED', 'app.name 必须是非空字符串', 'app.name'));
     }
+    const requiredCapabilities = object(config.platform).requiredCapabilities;
+    if (requiredCapabilities !== undefined &&
+        (!Array.isArray(requiredCapabilities) ||
+            requiredCapabilities.length > 64 ||
+            new Set(requiredCapabilities).size !== requiredCapabilities.length ||
+            requiredCapabilities.some(capability => typeof capability !== 'string' ||
+                capability.length > 128 ||
+                !/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/.test(capability)))) {
+        diagnostics.push(diagnostic('APP_CONFIG_PLATFORM_CAPABILITIES_INVALID', 'platform.requiredCapabilities 必须是不重复的规范平台能力代码数组（最多 64 项）', 'platform.requiredCapabilities'));
+    }
     const frontend = object(config.frontend);
     const backend = object(config.backend);
     const platform = object(config.platform);
@@ -768,6 +791,7 @@ export function validateAppConfig(value) {
         !['light', 'standard'].includes(String(backend.resourceProfile))) {
         diagnostics.push(diagnostic('APP_CONFIG_BACKEND_RESOURCE_PROFILE_UNSUPPORTED', 'backend.resourceProfile 必须是 light 或 standard', 'backend.resourceProfile'));
     }
+    validateApplicationAuthentication(config, diagnostics);
     validateFrontendRoutes(config, diagnostics);
     validateAdminNavigation(config, diagnostics);
     validatePerspectives(config.perspectives, object(config.authz).roles, diagnostics);
@@ -2199,6 +2223,18 @@ function validateFrontendRoutes(config, diagnostics) {
     for (const claim of generatedPlatformRouteClaims(config)) {
         pathClaims.set(canonicalFrontendRouteShape(claim.path), claim);
     }
+    const authentication = object(frontend.authentication);
+    const authenticationSurfaces = object(authentication.surfaces);
+    for (const device of ['desktop', 'mobile']) {
+        const surface = object(authenticationSurfaces[device]);
+        const surfacePath = string(surface.path);
+        if (surfacePath) {
+            pathClaims.set(canonicalFrontendRouteShape(surfacePath), {
+                owner: `authentication:${device}`,
+                path: surfacePath,
+            });
+        }
+    }
     routes.forEach((raw, index) => {
         const route = object(raw);
         const code = string(route.code);
@@ -2297,6 +2333,124 @@ function validateFrontendRoutes(config, diagnostics) {
         }
     }
 }
+function validateApplicationAuthentication(config, diagnostics) {
+    const frontend = object(config.frontend);
+    if (frontend.authentication === undefined)
+        return;
+    const authentication = object(frontend.authentication);
+    const allowedRootKeys = new Set([
+        'accountMode',
+        'registration',
+        'methods',
+        'surfaces',
+    ]);
+    const registration = object(authentication.registration);
+    const surfaces = object(authentication.surfaces);
+    const methods = Array.isArray(authentication.methods)
+        ? authentication.methods
+        : [];
+    if (!frontend.authentication ||
+        typeof frontend.authentication !== 'object' ||
+        Array.isArray(frontend.authentication) ||
+        Object.keys(authentication).some(key => !allowedRootKeys.has(key)) ||
+        authentication.accountMode !== 'existing-platform-users-only' ||
+        Object.keys(registration).some(key => key !== 'mode') ||
+        registration.mode !== 'reject' ||
+        !Array.isArray(authentication.methods) ||
+        methods.length < 1 ||
+        methods.length > 8 ||
+        !authentication.surfaces ||
+        typeof authentication.surfaces !== 'object' ||
+        Array.isArray(authentication.surfaces) ||
+        Object.keys(surfaces).some(key => !['desktop', 'mobile'].includes(key)) ||
+        !surfaces.desktop ||
+        !surfaces.mobile) {
+        diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_INVALID', 'frontend.authentication 只支持现有平台用户、拒绝注册、1-8 个方法和独立 desktop/mobile surface', 'frontend.authentication'));
+    }
+    const methodCodes = new Set();
+    const methodTypes = new Set();
+    let primaryCount = 0;
+    methods.forEach((raw, index) => {
+        const method = object(raw);
+        const type = string(method.type);
+        const code = string(method.code);
+        const commonKeys = ['code', 'type', 'label', 'presentation', 'required'];
+        const allowedKeys = new Set(type === 'sso'
+            ? [...commonKeys, 'provider']
+            : type === 'dingtalk'
+                ? [...commonKeys, 'flow']
+                : commonKeys);
+        if (method.presentation === 'primary')
+            primaryCount += 1;
+        const invalid = Object.keys(method).some(key => !allowedKeys.has(key)) ||
+            !OPERATION_CODE_PATTERN.test(code) ||
+            methodCodes.has(code) ||
+            methodTypes.has(type) ||
+            !['sso', 'password', 'dingtalk'].includes(type) ||
+            !string(method.label) ||
+            !['primary', 'secondary'].includes(string(method.presentation)) ||
+            typeof method.required !== 'boolean' ||
+            (type === 'sso' && method.provider !== 'tenant-default') ||
+            (type === 'dingtalk' &&
+                !['auto', 'jsapi', 'oauth'].includes(string(method.flow)));
+        if (invalid) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_METHOD_INVALID', '登录方法必须使用唯一 code、受支持类型和不含 Secret 的有界公开描述', `frontend.authentication.methods[${index}]`));
+        }
+        methodCodes.add(code);
+        methodTypes.add(type);
+    });
+    if (methods.length > 0 && primaryCount !== 1) {
+        diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_PRIMARY_METHOD_INVALID', '登录方法必须且只能有一个 primary', 'frontend.authentication.methods'));
+    }
+    const routes = Array.isArray(frontend.routes) ? frontend.routes : [];
+    const routeByCode = new Map(routes.map(raw => {
+        const route = object(raw);
+        return [string(route.code), route];
+    }));
+    const routeCodes = new Set(routeByCode.keys());
+    const claimedShapes = new Map(generatedPlatformRouteClaims(config).map(claim => [
+        canonicalFrontendRouteShape(claim.path),
+        claim,
+    ]));
+    const surfaceCodes = new Set();
+    const surfaceShapes = new Set();
+    for (const device of ['desktop', 'mobile']) {
+        const surface = object(surfaces[device]);
+        const pointer = `frontend.authentication.surfaces.${device}`;
+        const routeCode = string(surface.routeCode);
+        const routePath = string(surface.path);
+        const defaultRouteCode = string(surface.defaultRouteCode);
+        const defaultRoute = routeByCode.get(defaultRouteCode);
+        const shape = canonicalFrontendRouteShape(routePath);
+        const expectedPath = device === 'mobile' ? '/m/login' : '/login';
+        const invalid = Object.keys(surface).some(key => !['routeCode', 'path', 'defaultRouteCode'].includes(key)) ||
+            !OPERATION_CODE_PATTERN.test(routeCode) ||
+            surfaceCodes.has(routeCode) ||
+            routeCodes.has(routeCode) ||
+            !validAppPath(routePath) ||
+            /[:*?#\\\\]/.test(routePath) ||
+            routePath !== expectedPath ||
+            surfaceShapes.has(shape) ||
+            /(?:^|\/)(?:auth|oauth)[^/]*callback(?:\/|$)/i.test(routePath);
+        if (invalid) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_SURFACE_INVALID', '登录 surface 必须使用独立静态 routeCode，desktop path=/login、mobile path=/m/login', pointer));
+        }
+        const generatedClaim = claimedShapes.get(shape);
+        if (routePath && generatedClaim) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_ROUTE_CONFLICT', `登录 surface path 与 ${generatedClaim.owner} 冲突: ${routePath}`, `${pointer}.path`));
+        }
+        if (!defaultRoute ||
+            defaultRoute.surface !== 'user' ||
+            (device === 'mobile'
+                ? !string(defaultRoute.path).startsWith('/m/')
+                : string(defaultRoute.path).startsWith('/m/')) ||
+            canonicalFrontendRouteShape(string(defaultRoute.path)) === shape) {
+            diagnostics.push(diagnostic('APP_CONFIG_AUTHENTICATION_DEFAULT_ROUTE_INVALID', 'defaultRouteCode 必须引用同设备的受保护 user route，且不能指回登录 surface', `${pointer}.defaultRouteCode`));
+        }
+        surfaceCodes.add(routeCode);
+        surfaceShapes.add(shape);
+    }
+}
 const ADMIN_NAVIGATION_ICONS = new Set([
     'overview',
     'database',