openxiangda-devkit-core 2.53.1 → 2.56.0

package/dist/compiler/config.js

@@ -1,4 +1,6 @@
+import { parseNativeParentReadPolicy, validateNativeParentReadPolicies, NativeParentReadPolicyError, NativeDataPolicyExpressionV2Error } from 'openxiangda-contracts/native-compiler';
 import { assertWorkflowNativeStagePolicy } from 'openxiangda-contracts';
+import { WORKFLOW_LAUNCH_MAX_INPUTS } from 'openxiangda-contracts';
 import { validateAuthenticatedPublicRead, AuthenticatedPublicReadContractError } from 'openxiangda-contracts/native-compiler';
 import { DATE_EVENT_RESERVED_DATA_FIELDS_V2, dateEventProjectionFieldsV2, dateEventProjectionEnvelopeSchemaV2 } from 'openxiangda-contracts/native-compiler';
 import { validateUserCandidateReferences, validateWorkflowUserCandidateBindings, UserCandidateContractError } from 'openxiangda-contracts';
@@ -1556,6 +1558,7 @@ export function validateAppConfig(value) {
             const policyFields = resourceFieldTypes.get(string(policy.resourceCode));
             policyRuleNodes(policy, policyPath, diagnostics).forEach(({ rule, path: rulePath }) => {
                 const unknownRuleKeys = Object.keys(rule).filter(key => ![
+                    'parentRead',
                     'subject',
                     'dimensionCode',
                     'relationCode',
@@ -1584,8 +1587,17 @@ export function validateAppConfig(value) {
                     dimensionCode,
                     relationCode,
                     dbNow ? 'db_now' : '',
+                    rule.parentRead !== undefined ? 'parent_read' : '',
                     constantPredicate || nullPredicate ? 'constant' : '',
                 ].filter(Boolean);
+                let validParentRead = false;
+                if (rule.parentRead !== undefined) {
+                    try {
+                        parseNativeParentReadPolicy(rule.parentRead, `${rulePath}.parentRead`);
+                        validParentRead = true;
+                    }
+                    catch { /* The shared cross-resource validator reports the exact failure. */ }
+                }
                 const validCurrentUser = subject === 'current_user';
                 const validDimension = Boolean(dimensionCode) && dimensionCodes.has(dimensionCode);
                 const validRelationship = Boolean(relationCode) && Boolean(string(rule.resourceCode));
@@ -1606,15 +1618,16 @@ export function validateAppConfig(value) {
                     ['lt', 'lte', 'gt', 'gte'].includes(operator) &&
                     rule.value === undefined &&
                     policyFields?.get(string(rule.field)) === 'datetime';
-                if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field)) ||
+                if ((!validParentRead && !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field))) ||
                     modes.length !== 1 ||
                     (!validCurrentUser &&
                         !validDimension &&
                         !validRelationship &&
                         !validConstant &&
                         !validNull &&
-                        !validDbNow)) {
-                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、dimension、relationship、constant/null 或 datetime db_now 中的一种', rulePath));
+                        !validDbNow &&
+                        !validParentRead)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、dimension、relationship、constant/null、datetime db_now 或只读 parentRead 中的一种', rulePath));
                 }
                 if (dbNow && !validDbNow) {
                     diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_DB_NOW_FIELD_INVALID', 'db_now 只支持 datetime 字段及 lt/lte/gt/gte 操作符', `${rulePath}.field`));
@@ -1639,6 +1652,17 @@ export function validateAppConfig(value) {
                 }
             });
         });
+        try {
+            validateNativeParentReadPolicies(dataResources.map(object), policies.map(object), 'authz.dataPolicies');
+        }
+        catch (error) {
+            if (error instanceof NativeParentReadPolicyError) {
+                diagnostics.push(diagnostic(error.code, 'parentRead 必须绑定唯一的真实父子表关系且只用于读取', error.pointer));
+            }
+            else if (!(error instanceof NativeDataPolicyExpressionV2Error))
+                throw error;
+            // Malformed expressions were already reported by policyRuleNodes.
+        }
         scopeSources.forEach((rawSource, sourceIndex) => {
             const source = object(rawSource);
             if (string(source.failureMode) !== 'last_known_good')
@@ -2177,7 +2201,7 @@ export function validateAppConfig(value) {
             const sourceCounts = new Map();
             let inputsInvalid = !isRecord(intent.inputs) ||
                 inputEntries.length === 0 ||
-                inputEntries.length > 64;
+                inputEntries.length > WORKFLOW_LAUNCH_MAX_INPUTS;
             for (const [inputCode, rawBinding] of inputEntries) {
                 const binding = object(rawBinding);
                 const source = string(binding.source);
@@ -4510,6 +4534,10 @@ export function currentUserDataPolicy(input) {
     };
 }
 export const dataPolicyExpression = {
+    parentRead: (input) => ({
+        parentRead: { resourceCode: input.resourceCode, subtableFieldCode: input.subtableFieldCode },
+        ...(input.roleCodes ? { roleCodes: [...input.roleCodes] } : {}),
+    }),
     allOf: (...values) => ({ allOf: values }),
     anyOf: (...values) => ({ anyOf: values }),
     constant: (input) => ({ ...input }),