openxiangda-devkit-core 2.55.0 → 2.57.1

package/dist/compiler/config.js

@@ -1,3 +1,4 @@
+import { parseNativeParentReadPolicy, validateNativeParentReadPolicies, NativeParentReadPolicyError, NativeDataPolicyExpressionV2Error } from 'openxiangda-contracts/native-compiler';
 import { assertWorkflowNativeStagePolicy } from 'openxiangda-contracts';
 import { WORKFLOW_LAUNCH_MAX_INPUTS } from 'openxiangda-contracts';
 import { validateAuthenticatedPublicRead, AuthenticatedPublicReadContractError } from 'openxiangda-contracts/native-compiler';
@@ -1557,6 +1558,7 @@ export function validateAppConfig(value) {
             const policyFields = resourceFieldTypes.get(string(policy.resourceCode));
             policyRuleNodes(policy, policyPath, diagnostics).forEach(({ rule, path: rulePath }) => {
                 const unknownRuleKeys = Object.keys(rule).filter(key => ![
+                    'parentRead',
                     'subject',
                     'dimensionCode',
                     'relationCode',
@@ -1585,8 +1587,17 @@ export function validateAppConfig(value) {
                     dimensionCode,
                     relationCode,
                     dbNow ? 'db_now' : '',
+                    rule.parentRead !== undefined ? 'parent_read' : '',
                     constantPredicate || nullPredicate ? 'constant' : '',
                 ].filter(Boolean);
+                let validParentRead = false;
+                if (rule.parentRead !== undefined) {
+                    try {
+                        parseNativeParentReadPolicy(rule.parentRead, `${rulePath}.parentRead`);
+                        validParentRead = true;
+                    }
+                    catch { /* The shared cross-resource validator reports the exact failure. */ }
+                }
                 const validCurrentUser = subject === 'current_user';
                 const validDimension = Boolean(dimensionCode) && dimensionCodes.has(dimensionCode);
                 const validRelationship = Boolean(relationCode) && Boolean(string(rule.resourceCode));
@@ -1607,15 +1618,16 @@ export function validateAppConfig(value) {
                     ['lt', 'lte', 'gt', 'gte'].includes(operator) &&
                     rule.value === undefined &&
                     policyFields?.get(string(rule.field)) === 'datetime';
-                if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field)) ||
+                if ((!validParentRead && !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(string(rule.field))) ||
                     modes.length !== 1 ||
                     (!validCurrentUser &&
                         !validDimension &&
                         !validRelationship &&
                         !validConstant &&
                         !validNull &&
-                        !validDbNow)) {
-                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、dimension、relationship、constant/null 或 datetime db_now 中的一种', rulePath));
+                        !validDbNow &&
+                        !validParentRead)) {
+                    diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_RULE_INVALID', '策略规则必须且只能声明 current_user、dimension、relationship、constant/null、datetime db_now 或只读 parentRead 中的一种', rulePath));
                 }
                 if (dbNow && !validDbNow) {
                     diagnostics.push(diagnostic('APP_CONFIG_AUTHZ_POLICY_DB_NOW_FIELD_INVALID', 'db_now 只支持 datetime 字段及 lt/lte/gt/gte 操作符', `${rulePath}.field`));
@@ -1640,6 +1652,17 @@ export function validateAppConfig(value) {
                 }
             });
         });
+        try {
+            validateNativeParentReadPolicies(dataResources.map(object), policies.map(object), 'authz.dataPolicies');
+        }
+        catch (error) {
+            if (error instanceof NativeParentReadPolicyError) {
+                diagnostics.push(diagnostic(error.code, 'parentRead 必须绑定唯一的真实父子表关系且只用于读取', error.pointer));
+            }
+            else if (!(error instanceof NativeDataPolicyExpressionV2Error))
+                throw error;
+            // Malformed expressions were already reported by policyRuleNodes.
+        }
         scopeSources.forEach((rawSource, sourceIndex) => {
             const source = object(rawSource);
             if (string(source.failureMode) !== 'last_known_good')
@@ -1898,8 +1921,8 @@ export function validateAppConfig(value) {
                             targetFields.length > 16 ||
                             new Set(sourceFields).size !== sourceFields.length ||
                             new Set(targetFields).size !== targetFields.length ||
-                            sourceFields.some(field => !['file', 'image'].includes(source?.get(field) || '')) ||
-                            targetFields.some(field => !['file', 'image'].includes(target?.get(field) || '')) ||
+                            sourceFields.some(field => !['file', 'image', 'text.rich'].includes(source?.get(field) || '')) ||
+                            targetFields.some(field => !['file', 'image', 'text.rich'].includes(target?.get(field) || '')) ||
                             sourceFields.length !== targetFields.length ||
                             sourceFields.some((field, i) => source?.get(field) !== target?.get(targetFields[i] || '')) ||
                             Object.keys(copy).some(key => ![
@@ -2823,6 +2846,7 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
             const access = object(operation.platformAccess);
             const allowedAccessKeys = new Set([
                 'directory',
+                'selectedDepartments',
                 'managedFiles',
                 'managedFileCopies',
                 'notification',
@@ -2896,6 +2920,11 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                         fields.some(field => !allowedFields.has(string(field))) ||
                         Object.keys(directory).some(key => !['mode', 'fields'].includes(key));
             }
+            if (access.selectedDepartments !== undefined) {
+                const departments = object(access.selectedDepartments);
+                const fields = Array.isArray(departments.fields) ? departments.fields : [];
+                invalid ||= !isRecord(access.selectedDepartments) || !fields.includes('name') || fields.length > 4 || new Set(fields).size !== fields.length || fields.some(field => !['name', 'path', 'parent', 'fullPath'].includes(string(field))) || !Number.isSafeInteger(departments.maxIds) || Number(departments.maxIds) < 1 || Number(departments.maxIds) > 50 || Object.keys(departments).some(key => !['fields', 'maxIds'].includes(key));
+            }
             if (access.managedFiles !== undefined) {
                 const managedFiles = Array.isArray(access.managedFiles)
                     ? access.managedFiles
@@ -2955,8 +2984,8 @@ function validateBackendOperations(rawOperations, declaredResources, declaredRes
                             targetFields.length > 16 ||
                             new Set(sourceFields).size !== sourceFields.length ||
                             new Set(targetFields).size !== targetFields.length ||
-                            sourceFields.some(field => !['file', 'image'].includes(source?.get(field) || '')) ||
-                            targetFields.some(field => !['file', 'image'].includes(target?.get(field) || '')) ||
+                            sourceFields.some(field => !['file', 'image', 'text.rich'].includes(source?.get(field) || '')) ||
+                            targetFields.some(field => !['file', 'image', 'text.rich'].includes(target?.get(field) || '')) ||
                             sourceFields.length !== targetFields.length ||
                             sourceFields.some((field, i) => source?.get(field) !== target?.get(targetFields[i] || '')) ||
                             Object.keys(copy).some(key => ![
@@ -4511,6 +4540,10 @@ export function currentUserDataPolicy(input) {
     };
 }
 export const dataPolicyExpression = {
+    parentRead: (input) => ({
+        parentRead: { resourceCode: input.resourceCode, subtableFieldCode: input.subtableFieldCode },
+        ...(input.roleCodes ? { roleCodes: [...input.roleCodes] } : {}),
+    }),
     allOf: (...values) => ({ allOf: values }),
     anyOf: (...values) => ({ anyOf: values }),
     constant: (input) => ({ ...input }),