openxiangda-devkit-core 2.0.0-alpha.86 → 2.0.0-alpha.88

package/dist/compiler/config.js

@@ -335,6 +335,9 @@ export const openXiangdaAppConfigSchema = {
             properties: {
                 root: { type: 'string', minLength: 1 },
                 routes: { type: 'array', maxItems: 500, items: { type: 'object' } },
+                admin: { type: 'object' },
+                authentication: { type: 'object' },
+                publicAccess: { type: 'object' },
             },
         },
         backend: {
@@ -815,6 +818,7 @@ export function validateAppConfig(value) {
     }
     validateApplicationAuthentication(config, diagnostics);
     validateFrontendRoutes(config, diagnostics);
+    validateAnonymousPublicAccess(config, diagnostics);
     validateAdminNavigation(config, diagnostics);
     validatePerspectives(config.perspectives, object(config.authz).roles, diagnostics);
     const declaredResources = new Map((Array.isArray(object(config.data).resources)
@@ -2493,6 +2497,168 @@ function validateFrontendRoutes(config, diagnostics) {
         }
     }
 }
+const ANONYMOUS_PUBLIC_OPERATIONS = new Set([
+    'draft.read',
+    'draft.update',
+    'validate',
+    'create',
+    'own.list',
+    'own.read',
+]);
+function validateAnonymousPublicAccess(config, diagnostics) {
+    const frontend = object(config.frontend);
+    if (frontend.publicAccess === undefined)
+        return;
+    const publicAccess = object(frontend.publicAccess);
+    const policies = Array.isArray(publicAccess.policies)
+        ? publicAccess.policies
+        : [];
+    if (Object.keys(publicAccess).some(key => key !== 'policies') ||
+        !Array.isArray(publicAccess.policies) ||
+        policies.length < 1 ||
+        policies.length > 16) {
+        diagnostics.push(diagnostic('APP_CONFIG_ANONYMOUS_PUBLIC_ACCESS_INVALID', 'frontend.publicAccess 只接受 1 到 16 个 policies', 'frontend.publicAccess'));
+        return;
+    }
+    const routes = new Map((Array.isArray(frontend.routes) ? frontend.routes : []).map(raw => {
+        const route = object(raw);
+        return [string(route.code), route];
+    }));
+    const resourceMap = new Map((Array.isArray(object(config.data).resources)
+        ? object(config.data).resources
+        : []).map(raw => {
+        const resource = object(raw);
+        const fields = Array.isArray(object(resource.schema).fields)
+            ? object(resource.schema).fields
+            : [];
+        const fieldMap = new Map(fields.map(field => {
+            const declaration = object(field);
+            return [string(declaration.code), string(declaration.type)];
+        }));
+        const requiredCreateFields = new Set(fields
+            .map(object)
+            .filter(field => {
+            const type = string(field.type);
+            return (field.nullable === false &&
+                APP_DATA_FIELD_TYPES.has(type) &&
+                supportsGeneratedMutation({ type }));
+        })
+            .map(field => string(field.code)));
+        const surface = object(resource.surface);
+        const generated = object(surface.generated);
+        const nativeCreate = (string(surface.mutationOwner) || 'native') === 'native' &&
+            generated.create !== false;
+        return [
+            string(resource.code),
+            { fields: fieldMap, requiredCreateFields, nativeCreate },
+        ];
+    }));
+    const policyCodes = new Set();
+    const routeCodes = new Set();
+    policies.forEach((raw, index) => {
+        const policy = object(raw);
+        const path = `frontend.publicAccess.policies[${index}]`;
+        const code = string(policy.code);
+        const routeCode = string(policy.routeCode);
+        const resourceCode = string(policy.resourceCode);
+        const route = routes.get(routeCode);
+        const resource = resourceMap.get(resourceCode);
+        const resourceFields = resource?.fields;
+        const operations = Array.isArray(policy.operations)
+            ? policy.operations.map(string)
+            : [];
+        const fields = Array.isArray(policy.fields) ? policy.fields.map(string) : [];
+        const requiredFields = Array.isArray(policy.requiredFields)
+            ? policy.requiredFields.map(string)
+            : [];
+        const ownRecordFields = Array.isArray(policy.ownRecordFields)
+            ? policy.ownRecordFields.map(string)
+            : fields;
+        const draft = object(policy.draft);
+        const validations = Array.isArray(policy.validations)
+            ? policy.validations
+            : [];
+        const exactRootKeys = [
+            'code',
+            'routeCode',
+            'mode',
+            'resourceCode',
+            'operations',
+            'fields',
+            'requiredFields',
+            'ownRecordFields',
+            'draft',
+            'validations',
+        ];
+        const invalid = Object.keys(policy).some(key => !exactRootKeys.includes(key)) ||
+            !OPERATION_CODE_PATTERN.test(code) ||
+            policyCodes.has(code) ||
+            routeCodes.has(routeCode) ||
+            policy.mode !== 'anonymous' ||
+            !route ||
+            route.surface !== 'user' ||
+            route.capability !== undefined ||
+            route.access !== undefined ||
+            /[:*]/.test(string(route.path)) ||
+            !resourceFields ||
+            operations.length < 1 ||
+            operations.length > ANONYMOUS_PUBLIC_OPERATIONS.size ||
+            new Set(operations).size !== operations.length ||
+            operations.some(operation => !ANONYMOUS_PUBLIC_OPERATIONS.has(operation)) ||
+            fields.length < 1 ||
+            fields.length > 64 ||
+            new Set(fields).size !== fields.length ||
+            fields.some(field => !resourceFields?.has(field)) ||
+            new Set(requiredFields).size !== requiredFields.length ||
+            requiredFields.some(field => !fields.includes(field)) ||
+            (operations.includes('create') &&
+                (!resource?.nativeCreate ||
+                    [...(resource?.requiredCreateFields || [])].some(field => !fields.includes(field) || !requiredFields.includes(field)))) ||
+            new Set(ownRecordFields).size !== ownRecordFields.length ||
+            ownRecordFields.some(field => !fields.includes(field)) ||
+            (operations.includes('draft.read') !== operations.includes('draft.update')) ||
+            (operations.some(operation => operation.startsWith('draft.')) &&
+                (policy.draft === undefined || draft.enabled !== true)) ||
+            (policy.draft !== undefined &&
+                (Object.keys(draft).some(key => !['enabled', 'inactivityTtlSeconds', 'maxBytes'].includes(key)) ||
+                    draft.enabled !== true ||
+                    (draft.inactivityTtlSeconds !== undefined &&
+                        (!Number.isSafeInteger(draft.inactivityTtlSeconds) ||
+                            Number(draft.inactivityTtlSeconds) < 3600 ||
+                            Number(draft.inactivityTtlSeconds) > 7_776_000)) ||
+                    (draft.maxBytes !== undefined &&
+                        (!Number.isSafeInteger(draft.maxBytes) ||
+                            Number(draft.maxBytes) < 4096 ||
+                            Number(draft.maxBytes) > 262_144)))) ||
+            validations.length > 16;
+        if (invalid) {
+            diagnostics.push(diagnostic('APP_CONFIG_ANONYMOUS_PUBLIC_POLICY_INVALID', '匿名公开策略必须绑定唯一静态 user route、已声明资源/字段和有界操作', path));
+        }
+        const validationCodes = new Set();
+        validations.forEach((rawValidation, validationIndex) => {
+            const validation = object(rawValidation);
+            const validationCode = string(validation.code);
+            const validationFields = Array.isArray(validation.fields)
+                ? validation.fields.map(string)
+                : [];
+            if (Object.keys(validation).some(key => !['code', 'kind', 'fields', 'result'].includes(key)) ||
+                !OPERATION_CODE_PATTERN.test(validationCode) ||
+                validationCodes.has(validationCode) ||
+                validation.kind !== 'duplicate' ||
+                validation.result !== 'availability' ||
+                validationFields.length < 1 ||
+                validationFields.length > 8 ||
+                new Set(validationFields).size !== validationFields.length ||
+                validationFields.some(field => !fields.includes(field)) ||
+                validationFields.some(field => ['file', 'subtable'].includes(resourceFields?.get(field) || ''))) {
+                diagnostics.push(diagnostic('APP_CONFIG_ANONYMOUS_PUBLIC_VALIDATION_INVALID', '匿名公开校验必须是只使用已授权字段的有界 duplicate availability 校验', `${path}.validations[${validationIndex}]`));
+            }
+            validationCodes.add(validationCode);
+        });
+        policyCodes.add(code);
+        routeCodes.add(routeCode);
+    });
+}
 function validateApplicationAuthentication(config, diagnostics) {
     const frontend = object(config.frontend);
     if (frontend.authentication === undefined)