openxiangda-nest 2.0.0-alpha.12

package/README.md

@@ -0,0 +1,25 @@
+# `openxiangda-nest`
+
+Official NestJS backend boundary for OpenXiangda 2.0 applications.
+
+It verifies the platform-issued user and active RoleSession, enforces declared
+capabilities through the platform AuthZ service, forwards the verified context
+to Data API v2, and installs the standard health/readiness/version endpoints.
+Application code never receives PostgreSQL credentials and must not construct a
+Principal from browser-supplied fields.
+
+`OpenXiangdaApplicationCredentials` implements OAuth2 client credentials for
+requestless Worker/Scheduler work. It single-flights token exchange, caches only
+short-lived access tokens, refreshes before expiry and retries once after a 401.
+`OpenXiangdaApplicationDataApiService` uses that identity with a null
+RoleSession; inject it instead of the request-scoped Data API from background
+jobs. Client id and secret must come from platform-managed runtime Secrets.
+
+`OpenXiangdaEventReceiver` verifies structured CloudEvents HTTP pushes with the
+subscription HMAC, timestamp window, application identity and a pluggable
+idempotency receipt store. The module defaults to the platform-owned durable
+receipt store; the explicit in-memory implementation is only for local tests.
+Idempotent completion/release commands use bounded exponential retry (three
+attempts by default). Once the business handler succeeds, an acknowledgement
+failure never releases the receipt, avoiding an immediate duplicate execution;
+external side effects must still use the CloudEvent id as their idempotency key.

package/dist/application-credentials.d.ts

@@ -0,0 +1,19 @@
+import type { OpenXiangdaModuleOptions } from "./types.js";
+export declare class OpenXiangdaApplicationCredentials {
+    private readonly options;
+    private readonly baseUrl;
+    private readonly fetch;
+    private cached;
+    private inFlight;
+    constructor(options: OpenXiangdaModuleOptions);
+    configured(): boolean;
+    getAuthorizationHeader(): Promise<string>;
+    invalidate(expectedAccessToken?: string): void;
+    withAuthorization<T>(operation: (authorization: string) => Promise<T>): Promise<T>;
+    private token;
+    private exchange;
+    private normalizedScopes;
+    private oauthErrorCode;
+    private isUnauthorized;
+}
+//# sourceMappingURL=application-credentials.d.ts.map

package/dist/application-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-credentials.d.ts","sourceRoot":"","sources":["../src/application-credentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAmB3D,qBACa,iCAAiC;IAQ1C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiD;IACvE,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,QAAQ,CAA8C;gBAI3C,OAAO,EAAE,wBAAwB;IAMpD,UAAU,IAAI,OAAO;IAOf,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI/C,UAAU,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI;IAUxC,iBAAiB,CAAC,CAAC,EACvB,SAAS,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/C,OAAO,CAAC,CAAC,CAAC;YAYC,KAAK;YAcL,QAAQ;IAsGtB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,cAAc;CAOvB"}

package/dist/application-credentials.js

@@ -0,0 +1,158 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { OpenXiangdaPlatformError } from "./platform-client.js";
+import { OPENXIANGDA_MODULE_OPTIONS } from "./tokens.js";
+let OpenXiangdaApplicationCredentials = class OpenXiangdaApplicationCredentials {
+    options;
+    baseUrl;
+    fetch;
+    cached;
+    inFlight;
+    constructor(options) {
+        this.options = options;
+        this.baseUrl = options.platformBaseUrl.replace(/\/+$/, "");
+        this.fetch = options.fetch || globalThis.fetch.bind(globalThis);
+    }
+    configured() {
+        return Boolean(this.options.oauthClient?.clientId &&
+            this.options.oauthClient?.clientSecret);
+    }
+    async getAuthorizationHeader() {
+        return (await this.token()).authorization;
+    }
+    invalidate(expectedAccessToken) {
+        if (expectedAccessToken &&
+            this.cached?.accessToken !== expectedAccessToken) {
+            return;
+        }
+        this.cached = undefined;
+    }
+    async withAuthorization(operation) {
+        const first = await this.token();
+        try {
+            return await operation(first.authorization);
+        }
+        catch (error) {
+            if (!this.isUnauthorized(error))
+                throw error;
+            this.invalidate(first.accessToken);
+            const refreshed = await this.token();
+            return await operation(refreshed.authorization);
+        }
+    }
+    async token() {
+        if (this.cached && Date.now() < this.cached.refreshAt)
+            return this.cached;
+        if (this.inFlight)
+            return await this.inFlight;
+        const pending = this.exchange();
+        this.inFlight = pending;
+        try {
+            const token = await pending;
+            this.cached = token;
+            return token;
+        }
+        finally {
+            if (this.inFlight === pending)
+                this.inFlight = undefined;
+        }
+    }
+    async exchange() {
+        const oauth = this.options.oauthClient;
+        if (!oauth?.clientId || !oauth.clientSecret) {
+            throw new OpenXiangdaPlatformError(503, "APPLICATION_OAUTH_NOT_CONFIGURED", "OpenXiangda 应用后端尚未配置 OAuth2 Client Credentials");
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.options.requestTimeoutMs || 5000);
+        try {
+            const body = new URLSearchParams({ grant_type: "client_credentials" });
+            const scopes = this.normalizedScopes(oauth.scopes);
+            if (scopes.length)
+                body.set("scope", scopes.join(" "));
+            const basic = Buffer.from(`${oauth.clientId}:${oauth.clientSecret}`, "utf8").toString("base64");
+            const response = await this.fetch(`${this.baseUrl}/openxiangda-api/v2/oauth2/token`, {
+                method: "POST",
+                signal: controller.signal,
+                headers: {
+                    Accept: "application/json",
+                    Authorization: `Basic ${basic}`,
+                    "Content-Type": "application/x-www-form-urlencoded",
+                },
+                body: body.toString(),
+            });
+            let payload;
+            try {
+                payload = (await response.json());
+            }
+            catch {
+                throw new OpenXiangdaPlatformError(response.status, "APPLICATION_OAUTH_RESPONSE_INVALID", "OAuth2 token endpoint 返回的不是有效 JSON");
+            }
+            if (!response.ok || payload.error) {
+                throw new OpenXiangdaPlatformError(response.status || 503, this.oauthErrorCode(payload.error), String(payload.error_description || "OAuth2 token 获取失败"));
+            }
+            const accessToken = String(payload.access_token || "").trim();
+            const tokenType = String(payload.token_type || "").trim();
+            const expiresIn = Math.floor(Number(payload.expires_in));
+            if (!accessToken ||
+                tokenType.toLowerCase() !== "bearer" ||
+                !Number.isFinite(expiresIn) ||
+                expiresIn < 1) {
+                throw new OpenXiangdaPlatformError(502, "APPLICATION_OAUTH_RESPONSE_INVALID", "OAuth2 token endpoint 返回了无效 token");
+            }
+            const now = Date.now();
+            const configuredSkew = Math.max(0, Math.floor(Number(oauth.refreshSkewSeconds ?? 30)));
+            const refreshWindow = Math.min(configuredSkew, Math.max(0, Math.floor(expiresIn / 2)));
+            return {
+                accessToken,
+                authorization: `Bearer ${accessToken}`,
+                scope: String(payload.scope || ""),
+                expiresAt: now + expiresIn * 1000,
+                refreshAt: now + Math.max(1, expiresIn - refreshWindow) * 1000,
+            };
+        }
+        catch (error) {
+            if (error instanceof OpenXiangdaPlatformError)
+                throw error;
+            if (error?.name === "AbortError") {
+                throw new OpenXiangdaPlatformError(504, "APPLICATION_OAUTH_TIMEOUT", "OAuth2 token 获取超时");
+            }
+            throw new OpenXiangdaPlatformError(503, "APPLICATION_OAUTH_UNAVAILABLE", error?.message || "OAuth2 token endpoint 不可用");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    normalizedScopes(scopes) {
+        return [...new Set((scopes || []).map((scope) => scope.trim()).filter(Boolean))];
+    }
+    oauthErrorCode(error) {
+        const normalized = String(error || "token_exchange_failed")
+            .toUpperCase()
+            .replace(/[^A-Z0-9_]/g, "_")
+            .slice(0, 80);
+        return `APPLICATION_OAUTH_${normalized || "TOKEN_EXCHANGE_FAILED"}`;
+    }
+    isUnauthorized(error) {
+        return ((error instanceof OpenXiangdaPlatformError && error.httpStatus === 401) ||
+            Number(error?.status) === 401 ||
+            Number(error?.statusCode) === 401);
+    }
+};
+OpenXiangdaApplicationCredentials = __decorate([
+    Injectable(),
+    __param(0, Inject(OPENXIANGDA_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], OpenXiangdaApplicationCredentials);
+export { OpenXiangdaApplicationCredentials };
+//# sourceMappingURL=application-credentials.js.map

package/dist/application-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-credentials.js","sourceRoot":"","sources":["../src/application-credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAqBlD,IAAM,iCAAiC,GAAvC,MAAM,iCAAiC;IAQzB;IAPF,OAAO,CAAS;IAChB,KAAK,CAAiD;IAC/D,MAAM,CAAqC;IAC3C,QAAQ,CAA8C;IAE9D,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAElD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,UAAU;QACR,OAAO,OAAO,CACZ,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ;YAChC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,UAAU,CAAC,mBAA4B;QACrC,IACE,mBAAmB;YACnB,IAAI,CAAC,MAAM,EAAE,WAAW,KAAK,mBAAmB,EAChD,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,SAAgD;QAEhD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,OAAO,MAAM,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC1E,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,kCAAkC,EAClC,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CACxB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CACtC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,EACzC,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,GAAG,IAAI,CAAC,OAAO,kCAAkC,EACjD;gBACE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;oBAC/B,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CACF,CAAC;YACF,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,MAAM,EACf,oCAAoC,EACpC,oCAAoC,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,wBAAwB,CAChC,QAAQ,CAAC,MAAM,IAAI,GAAG,EACtB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,mBAAmB,CAAC,CACzD,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YACzD,IACE,CAAC,WAAW;gBACZ,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ;gBACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC3B,SAAS,GAAG,CAAC,EACb,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,oCAAoC,EACpC,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAC7B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CACnD,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CACvC,CAAC;YACF,OAAO;gBACL,WAAW;gBACX,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,SAAS,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI;gBACjC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC,GAAG,IAAI;aAC/D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB;gBAAE,MAAM,KAAK,CAAC;YAC3D,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5C,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,2BAA2B,EAC3B,mBAAmB,CACpB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,GAAG,EACH,+BAA+B,EAC9B,KAAe,EAAE,OAAO,IAAI,2BAA2B,CACzD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAA4B;QACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC;aACxD,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,qBAAqB,UAAU,IAAI,uBAAuB,EAAE,CAAC;IACtE,CAAC;IAEO,cAAc,CAAC,KAAc;QACnC,OAAO,CACL,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC;YACvE,MAAM,CAAE,KAA8B,EAAE,MAAM,CAAC,KAAK,GAAG;YACvD,MAAM,CAAE,KAAkC,EAAE,UAAU,CAAC,KAAK,GAAG,CAChE,CAAC;IACJ,CAAC;CACF,CAAA;AAxLY,iCAAiC;IAD7C,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAP1B,iCAAiC,CAwL7C"}

package/dist/assignee-provider.d.ts

@@ -0,0 +1,34 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import type { WorkflowAssigneeRequest, WorkflowAssigneeResponse, WorkflowCandidatePrincipal } from 'openxiangda-contracts';
+import type { OpenXiangdaModuleOptions } from './types.js';
+export declare function WorkflowAssigneeProvider(code: string): ClassDecorator;
+export interface WorkflowAssigneeProviderHandler {
+    resolve(request: WorkflowAssigneeRequest): Promise<WorkflowCandidatePrincipal[]> | WorkflowCandidatePrincipal[];
+}
+export declare class OpenXiangdaAssigneeProviderRegistry implements OnModuleInit {
+    private readonly discovery;
+    private readonly reflector;
+    private readonly handlers;
+    constructor(discovery: DiscoveryService, reflector: Reflector);
+    onModuleInit(): void;
+    resolve(code: string, request: WorkflowAssigneeRequest): Promise<WorkflowCandidatePrincipal[]>;
+}
+export declare function normalizeWorkflowCandidates(value: unknown): WorkflowCandidatePrincipal[];
+export declare class OpenXiangdaAssigneeProviderReceiver {
+    private readonly options;
+    constructor(options: OpenXiangdaModuleOptions);
+    accept(providerCode: string, headers: Record<string, string | string[] | undefined>, rawBody: Buffer | string): WorkflowAssigneeRequest;
+    private assertTimestamp;
+    private assertSignature;
+    private header;
+}
+export declare class OpenXiangdaAssigneeProviderController {
+    private readonly receiver;
+    private readonly registry;
+    constructor(receiver: OpenXiangdaAssigneeProviderReceiver, registry: OpenXiangdaAssigneeProviderRegistry);
+    resolve(providerCode: string, headers: Record<string, string | string[] | undefined>, request: {
+        rawBody?: Buffer;
+    }, body: unknown): Promise<WorkflowAssigneeResponse>;
+}
+//# sourceMappingURL=assignee-provider.d.ts.map

package/dist/assignee-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-provider.d.ts","sourceRoot":"","sources":["../src/assignee-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,YAAY,EAMb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,KAAK,EACV,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAI3D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAMrE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CACL,OAAO,EAAE,uBAAuB,GAE9B,OAAO,CAAC,0BAA0B,EAAE,CAAC,GACrC,0BAA0B,EAAE,CAAC;CAClC;AAED,qBACa,mCAAoC,YAAW,YAAY;IAIpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;gBAG5D,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,SAAS;IAGvC,YAAY;IAgBN,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB;CAQ7D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,gCAoCzD;AAED,qBACa,mCAAmC;IAG5C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAGpD,MAAM,CACJ,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,OAAO,EAAE,MAAM,GAAG,MAAM,GACvB,uBAAuB;IAuC1B,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,eAAe;IA+BvB,OAAO,CAAC,MAAM;CAWf;AAED,qBACa,qCAAqC;IAE9C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,QAAQ,EAAE,mCAAmC,EAC7C,QAAQ,EAAE,mCAAmC;IAI1D,OAAO,CACY,YAAY,EAAE,MAAM,EAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EAC1D,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5B,IAAI,EAAE,OAAO,GACpB,OAAO,CAAC,wBAAwB,CAAC;CAUrC"}

package/dist/assignee-provider.js

@@ -0,0 +1,216 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { BadRequestException, Body, Controller, Headers, Inject, Injectable, Param, Post, Req, SetMetadata, UnauthorizedException, } from '@nestjs/common';
+import { DiscoveryService, Reflector } from '@nestjs/core';
+import { SCHEMA_VERSIONS } from 'openxiangda-contracts';
+import { OPENXIANGDA_MODULE_OPTIONS } from './tokens.js';
+const WORKFLOW_ASSIGNEE_PROVIDER = Symbol('OPENXIANGDA_WORKFLOW_ASSIGNEE_PROVIDER');
+export function WorkflowAssigneeProvider(code) {
+    const normalized = String(code || '').trim();
+    if (!/^[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*$/.test(normalized)) {
+        throw new Error('WorkflowAssigneeProvider code 不合法');
+    }
+    return SetMetadata(WORKFLOW_ASSIGNEE_PROVIDER, normalized);
+}
+let OpenXiangdaAssigneeProviderRegistry = class OpenXiangdaAssigneeProviderRegistry {
+    discovery;
+    reflector;
+    handlers = new Map();
+    constructor(discovery, reflector) {
+        this.discovery = discovery;
+        this.reflector = reflector;
+    }
+    onModuleInit() {
+        for (const wrapper of this.discovery.getProviders()) {
+            const code = wrapper.metatype
+                ? this.reflector.get(WORKFLOW_ASSIGNEE_PROVIDER, wrapper.metatype)
+                : undefined;
+            if (!code || !wrapper.instance)
+                continue;
+            if (typeof wrapper.instance.resolve !== 'function') {
+                throw new Error(`Workflow Assignee Provider ${code} 缺少 resolve()`);
+            }
+            if (this.handlers.has(code)) {
+                throw new Error(`Workflow Assignee Provider 重复: ${code}`);
+            }
+            this.handlers.set(code, wrapper.instance);
+        }
+    }
+    async resolve(code, request) {
+        const handler = this.handlers.get(code);
+        if (!handler) {
+            throw new BadRequestException(`Workflow Assignee Provider 未注册: ${code}`);
+        }
+        const candidates = await handler.resolve(request);
+        return normalizeWorkflowCandidates(candidates);
+    }
+};
+OpenXiangdaAssigneeProviderRegistry = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [DiscoveryService,
+        Reflector])
+], OpenXiangdaAssigneeProviderRegistry);
+export { OpenXiangdaAssigneeProviderRegistry };
+export function normalizeWorkflowCandidates(value) {
+    if (!Array.isArray(value) || value.length > 200) {
+        throw new BadRequestException('Workflow Assignee Provider 返回值不合法');
+    }
+    const unique = new Map();
+    for (const item of value) {
+        if (!item || typeof item !== 'object' || Array.isArray(item)) {
+            throw new BadRequestException('Workflow Assignee Provider 候选人不合法');
+        }
+        const source = item;
+        const userId = String(source.userId || '').trim();
+        const candidateSource = String(source.source || '').trim();
+        if (!userId || !candidateSource) {
+            throw new BadRequestException('Workflow Assignee Provider 候选人不合法');
+        }
+        const candidate = {
+            userId,
+            source: candidateSource,
+            ...(source.roleAssignmentId
+                ? { roleAssignmentId: String(source.roleAssignmentId).trim() }
+                : {}),
+            ...(source.roleCode
+                ? { roleCode: String(source.roleCode).trim() }
+                : {}),
+            ...(source.displayName
+                ? { displayName: String(source.displayName).trim() }
+                : {}),
+        };
+        unique.set([candidate.userId, candidate.roleAssignmentId || '', candidate.roleCode || ''].join('\u0000'), candidate);
+    }
+    return [...unique.values()];
+}
+let OpenXiangdaAssigneeProviderReceiver = class OpenXiangdaAssigneeProviderReceiver {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    accept(providerCode, headers, rawBody) {
+        const body = Buffer.isBuffer(rawBody)
+            ? rawBody.toString('utf8')
+            : String(rawBody || '');
+        if (!body)
+            throw new BadRequestException('Provider raw body 不能为空');
+        const headerProvider = this.header(headers, 'x-openxiangda-workflow-provider');
+        const timestamp = this.header(headers, 'x-openxiangda-timestamp');
+        const signature = this.header(headers, 'x-openxiangda-signature');
+        this.header(headers, 'x-openxiangda-request-id');
+        if (headerProvider !== providerCode) {
+            throw new UnauthorizedException('Provider code 与请求路径不一致');
+        }
+        this.assertTimestamp(timestamp);
+        this.assertSignature(providerCode, timestamp, signature, body);
+        let value;
+        try {
+            value = JSON.parse(body);
+        }
+        catch {
+            throw new BadRequestException('Provider body 不是有效 JSON');
+        }
+        const request = value;
+        if (request.schemaVersion !== SCHEMA_VERSIONS.workflowAssigneeRequest ||
+            request.providerCode !== providerCode ||
+            request.appCode !== this.options.appCode ||
+            !String(request.requestId || '').trim() ||
+            !String(request.workflowCode || '').trim() ||
+            !String(request.nodeId || '').trim() ||
+            !request.facts ||
+            typeof request.facts !== 'object') {
+            throw new BadRequestException('Provider 请求不符合 v2 协议');
+        }
+        return request;
+    }
+    assertTimestamp(value) {
+        const timestamp = Number(value);
+        const maxAgeSeconds = Math.max(30, this.options.workflowAssigneeProviderMaxAgeSeconds || 300);
+        if (!Number.isSafeInteger(timestamp) ||
+            Math.abs(Math.floor(Date.now() / 1000) - timestamp) > maxAgeSeconds) {
+            throw new UnauthorizedException('Provider 签名时间戳无效或已过期');
+        }
+    }
+    assertSignature(providerCode, timestamp, value, body) {
+        const configured = this.options.workflowAssigneeProviderSecrets?.[providerCode];
+        const secrets = (Array.isArray(configured) ? configured : [configured])
+            .map(secret => String(secret || '').trim())
+            .filter(Boolean);
+        if (!secrets.length) {
+            throw new UnauthorizedException('Provider 签名密钥未配置');
+        }
+        const actual = value.startsWith('v1=') ? value.slice(3) : '';
+        const actualBuffer = Buffer.from(actual, 'hex');
+        const valid = secrets.some(secret => {
+            const expected = createHmac('sha256', secret)
+                .update(`${timestamp}.${body}`)
+                .digest('hex');
+            const expectedBuffer = Buffer.from(expected, 'hex');
+            return (actualBuffer.length === expectedBuffer.length &&
+                timingSafeEqual(actualBuffer, expectedBuffer));
+        });
+        if (!valid) {
+            throw new UnauthorizedException('Provider 签名无效');
+        }
+    }
+    header(headers, name) {
+        const value = headers[name] ?? headers[name.toLowerCase()];
+        const normalized = Array.isArray(value) ? value[0] : value;
+        if (!String(normalized || '').trim()) {
+            throw new UnauthorizedException(`缺少 Provider 请求头 ${name}`);
+        }
+        return String(normalized).trim();
+    }
+};
+OpenXiangdaAssigneeProviderReceiver = __decorate([
+    Injectable(),
+    __param(0, Inject(OPENXIANGDA_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], OpenXiangdaAssigneeProviderReceiver);
+export { OpenXiangdaAssigneeProviderReceiver };
+let OpenXiangdaAssigneeProviderController = class OpenXiangdaAssigneeProviderController {
+    receiver;
+    registry;
+    constructor(receiver, registry) {
+        this.receiver = receiver;
+        this.registry = registry;
+    }
+    async resolve(providerCode, headers, request, body) {
+        const rawBody = request.rawBody || Buffer.from(JSON.stringify(body));
+        const input = this.receiver.accept(providerCode, headers, rawBody);
+        const candidates = await this.registry.resolve(providerCode, input);
+        return {
+            schemaVersion: SCHEMA_VERSIONS.workflowAssigneeResponse,
+            requestId: input.requestId,
+            candidates,
+        };
+    }
+};
+__decorate([
+    Post('/:providerCode'),
+    __param(0, Param('providerCode')),
+    __param(1, Headers()),
+    __param(2, Req()),
+    __param(3, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], OpenXiangdaAssigneeProviderController.prototype, "resolve", null);
+OpenXiangdaAssigneeProviderController = __decorate([
+    Controller('/openxiangda/workflow/assignee-providers'),
+    __metadata("design:paramtypes", [OpenXiangdaAssigneeProviderReceiver,
+        OpenXiangdaAssigneeProviderRegistry])
+], OpenXiangdaAssigneeProviderController);
+export { OpenXiangdaAssigneeProviderController };
+//# sourceMappingURL=assignee-provider.js.map

package/dist/assignee-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignee-provider.js","sourceRoot":"","sources":["../src/assignee-provider.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,mBAAmB,EACnB,IAAI,EACJ,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAEV,KAAK,EACL,IAAI,EACJ,GAAG,EACH,WAAW,EACX,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAGzD,MAAM,0BAA0B,GAAG,MAAM,CAAC,wCAAwC,CAAC,CAAC;AAEpF,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,WAAW,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAWM,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAI3B;IACA;IAJF,QAAQ,GAAG,IAAI,GAAG,EAA2C,CAAC;IAE/E,YACmB,SAA2B,EAC3B,SAAoB;QADpB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,YAAY;QACV,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ;gBAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAS,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,SAAS;YACzC,IAAI,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAA2C,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AAhCY,mCAAmC;IAD/C,UAAU,EAAE;qCAKmB,gBAAgB;QAChB,SAAS;GAL5B,mCAAmC,CAgC/C;;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,IAA2C,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,SAAS,GAA+B;YAC5C,MAAM;YACN,MAAM,EAAE,eAAe;YACvB,GAAG,CAAC,MAAM,CAAC,gBAAgB;gBACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,WAAW;gBACpB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,CAAC,GAAG,CACR,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,IAAI,EAAE,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACjF,QAAQ,CACT,EACD,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAGM,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAG3B;IAFnB,YAEmB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;IAEJ,MAAM,CACJ,YAAoB,EACpB,OAAsD,EACtD,OAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACnC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAChC,OAAO,EACP,iCAAiC,CAClC,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;QACjD,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,KAAyC,CAAC;QAC1D,IACE,OAAO,CAAC,aAAa,KAAK,eAAe,CAAC,uBAAuB;YACjE,OAAO,CAAC,YAAY,KAAK,YAAY;YACrC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;YACxC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACvC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC1C,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACpC,CAAC,OAAO,CAAC,KAAK;YACd,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EACjC,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAEO,eAAe,CAAC,KAAa;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,EAAE,EACF,IAAI,CAAC,OAAO,CAAC,qCAAqC,IAAI,GAAG,CAC1D,CAAC;QACF,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,aAAa,EACnE,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,YAAoB,EACpB,SAAiB,EACjB,KAAa,EACb,IAAY;QAEZ,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACpE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;iBAC1C,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;iBAC9B,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CACL,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;gBAC7C,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,MAAM,CACZ,OAAsD,EACtD,IAAY;QAEZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;CACF,CAAA;AAzGY,mCAAmC;IAD/C,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAF1B,mCAAmC,CAyG/C;;AAGM,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAE7B;IACA;IAFnB,YACmB,QAA6C,EAC7C,QAA6C;QAD7C,aAAQ,GAAR,QAAQ,CAAqC;QAC7C,aAAQ,GAAR,QAAQ,CAAqC;IAC7D,CAAC;IAGE,AAAN,KAAK,CAAC,OAAO,CACY,YAAoB,EAChC,OAAsD,EAC1D,OAA6B,EAC5B,IAAa;QAErB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO;YACL,aAAa,EAAE,eAAe,CAAC,wBAAwB;YACvD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;SACX,CAAC;IACJ,CAAC;CACF,CAAA;AAfO;IADL,IAAI,CAAC,gBAAgB,CAAC;IAEpB,WAAA,KAAK,CAAC,cAAc,CAAC,CAAA;IACrB,WAAA,OAAO,EAAE,CAAA;IACT,WAAA,GAAG,EAAE,CAAA;IACL,WAAA,IAAI,EAAE,CAAA;;;;oEAUR;AArBU,qCAAqC;IADjD,UAAU,CAAC,0CAA0C,CAAC;qCAGxB,mCAAmC;QACnC,mCAAmC;GAHrD,qCAAqC,CAsBjD"}

package/dist/authz.d.ts

@@ -0,0 +1,17 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { OpenXiangdaPlatformClient } from "./platform-client.js";
+import { OPENXIANGDA_REQUIRED_CAPABILITY } from "./tokens.js";
+export declare const RequireCapability: (capability: string) => import("@nestjs/common").CustomDecorator<typeof OPENXIANGDA_REQUIRED_CAPABILITY>;
+export declare const CurrentPrincipal: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentRoleSession: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentApplicationPrincipal: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare const CurrentOpenXiangdaContext: (...dataOrPipes: unknown[]) => ParameterDecorator;
+export declare class OpenXiangdaAuthzGuard implements CanActivate {
+    private readonly platform;
+    private readonly reflector;
+    constructor(platform: OpenXiangdaPlatformClient, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private servicePrincipal;
+}
+//# sourceMappingURL=authz.d.ts.map

package/dist/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAO9D,eAAO,MAAM,iBAAiB,GAAI,YAAY,MAAM,qFACM,CAAC;AAE3D,eAAO,MAAM,gBAAgB,mDAG5B,CAAC;AAEF,eAAO,MAAM,kBAAkB,mDAQ9B,CAAC;AAEF,eAAO,MAAM,2BAA2B,mDAUvC,CAAC;AAEF,eAAO,MAAM,yBAAyB,mDAGrC,CAAC;AAEF,qBACa,qBAAsB,YAAW,WAAW;IAErD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,SAAS;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqE9D,OAAO,CAAC,gBAAgB;CA6BzB"}

package/dist/authz.js

@@ -0,0 +1,129 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ForbiddenException, Injectable, SetMetadata, UnauthorizedException, createParamDecorator, } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { SCHEMA_VERSIONS } from "openxiangda-contracts";
+import { OpenXiangdaPlatformClient } from "./platform-client.js";
+import { OPENXIANGDA_REQUIRED_CAPABILITY } from "./tokens.js";
+export const RequireCapability = (capability) => SetMetadata(OPENXIANGDA_REQUIRED_CAPABILITY, capability);
+export const CurrentPrincipal = createParamDecorator((_data, context) => requireContext(context).principal);
+export const CurrentRoleSession = createParamDecorator((_data, context) => {
+    const roleSession = requireContext(context).roleSession;
+    if (!roleSession) {
+        throw new UnauthorizedException("OPENXIANGDA_USER_ROLE_SESSION_REQUIRED");
+    }
+    return roleSession;
+});
+export const CurrentApplicationPrincipal = createParamDecorator((_data, context) => {
+    const principal = requireContext(context).principal;
+    if (principal.principalType !== "service") {
+        throw new UnauthorizedException("OPENXIANGDA_APPLICATION_PRINCIPAL_REQUIRED");
+    }
+    return principal;
+});
+export const CurrentOpenXiangdaContext = createParamDecorator((_data, context) => requireContext(context));
+let OpenXiangdaAuthzGuard = class OpenXiangdaAuthzGuard {
+    platform;
+    reflector;
+    constructor(platform, reflector) {
+        this.platform = platform;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const authorization = header(request, "authorization");
+        if (!/^Bearer\s+\S+$/i.test(authorization)) {
+            throw new UnauthorizedException("OPENXIANGDA_BEARER_TOKEN_REQUIRED");
+        }
+        const roleSessionId = header(request, "x-openxiangda-role-session-id").trim();
+        const capability = this.reflector.getAllAndOverride(OPENXIANGDA_REQUIRED_CAPABILITY, [context.getHandler(), context.getClass()]);
+        if (!roleSessionId) {
+            const application = await this.platform.verifyApplicationPrincipal(authorization);
+            if (!application.scopes.includes("app:invoke")) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_APPLICATION_INVOKE_DENIED",
+                });
+            }
+            if (!capability) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_SERVICE_CAPABILITY_REQUIRED",
+                });
+            }
+            if (!application.scopes.includes(capability)) {
+                throw new ForbiddenException({
+                    code: "OPENXIANGDA_CAPABILITY_DENIED",
+                    capability,
+                });
+            }
+            request.openxiangda = {
+                principal: this.servicePrincipal(application),
+                roleSession: null,
+                authorization,
+                roleSessionId: null,
+            };
+            return true;
+        }
+        const verified = await this.platform.verifyPrincipal(authorization, roleSessionId);
+        request.openxiangda = {
+            ...verified,
+            authorization,
+            roleSessionId,
+        };
+        if (!capability)
+            return true;
+        const decision = await this.platform.authorize(authorization, roleSessionId, { capability });
+        if (!decision.allowed) {
+            throw new ForbiddenException({
+                code: "OPENXIANGDA_CAPABILITY_DENIED",
+                capability,
+                explainId: decision.explainId,
+                decisions: decision.decisions,
+            });
+        }
+        return true;
+    }
+    servicePrincipal(input) {
+        return {
+            schemaVersion: SCHEMA_VERSIONS.principal,
+            tenantId: input.tenantId,
+            appCode: input.appCode,
+            environmentId: input.environmentKey,
+            environmentKey: input.environmentKey,
+            principalType: "service",
+            subjectId: input.clientId,
+            clientRecordId: input.clientRecordId,
+            clientId: input.clientId,
+            credentialVersion: input.credentialVersion,
+            scopes: input.scopes,
+            rateLimitPerMinute: input.rateLimitPerMinute,
+            tokenId: input.tokenId,
+            authzVersion: input.credentialVersion,
+            isAppSuperAdmin: false,
+        };
+    }
+};
+OpenXiangdaAuthzGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [OpenXiangdaPlatformClient,
+        Reflector])
+], OpenXiangdaAuthzGuard);
+export { OpenXiangdaAuthzGuard };
+function requireContext(context) {
+    const request = context.switchToHttp().getRequest();
+    if (!request.openxiangda) {
+        throw new UnauthorizedException("OPENXIANGDA_CONTEXT_NOT_VERIFIED");
+    }
+    return request.openxiangda;
+}
+function header(request, name) {
+    const value = request.headers[name] || request.headers[name.toLowerCase()];
+    return Array.isArray(value) ? String(value[0] || "") : String(value || "");
+}
+//# sourceMappingURL=authz.js.map