openxiangda 1.0.128 → 1.0.130

package/README.md

@@ -108,6 +108,7 @@ openxiangda auth-config methods --json
 openxiangda function invoke submit_public_registration --body-json '{"input":{}}'
 openxiangda connector invoke sms.sendCode --body-json '{"body":{"phone":"13800000000"}}'
 openxiangda notification preview public_register_notice --body-json '{"payload":{"title":"测试"}}'
+openxiangda permission snapshot --form-codes customer,orders --json
 openxiangda permission audit --json
 ```
 

package/lib/cli.js

@@ -150,12 +150,12 @@ Usage:
   openxiangda function list|get|create|update|upsert|delete|invoke [--json-file file]
   openxiangda connector list|get|create|update|upsert|delete|invoke|download-test [--json-file file]
   openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send
-  openxiangda permission role-list|role-create|role-update|role-delete|role-bind|audit
+  openxiangda permission role-list|role-create|role-update|role-delete|role-bind|snapshot|audit
   openxiangda permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind
   openxiangda permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind
   openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
   openxiangda resource validate|plan|publish|pull|typegen|explain [--profile name] [--json] [--dry-run]
-  openxiangda runtime deploy [--profile name] [--dist dist] [--build-id id] [--upload-mode staged|legacy-json] [--upload-timeout-ms ms] [--no-build] [--no-activate] [--json]
+  openxiangda runtime deploy [--profile name] [--dist dist] [--build-id id] [--upload-mode auto|staged|oss-direct|legacy-json] [--upload-timeout-ms ms] [--no-build] [--no-activate] [--json]
   openxiangda runtime releases [--profile name] [--json]
   openxiangda runtime activate <releaseId> [--profile name] [--json]
   openxiangda inspect app|form|workflow|automation|permissions
@@ -3140,7 +3140,7 @@ async function permission(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print(
-      '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|audit'
+      '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|snapshot|audit'
     );
     return;
   }
@@ -3579,6 +3579,36 @@ async function permission(args) {
     return;
   }
 
+  if (subcommand === 'snapshot') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuids = resolvePermissionSnapshotFormUuids(target.bound, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/permissions/snapshot`,
+      {
+        method: 'POST',
+        body: {
+          formUuids,
+          includeRoles: flags['no-roles'] ? false : undefined,
+          includePageGroups: flags['no-page-groups'] ? false : undefined,
+          includeFormGroups: flags['no-form-groups'] ? false : undefined,
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    const formGroups = data.formPermissionGroups || {};
+    print(
+      [
+        `Permission snapshot appType=${data.appType || target.appType}`,
+        `roles=${Array.isArray(data.roles) ? data.roles.length : 0}`,
+        `pageGroups=${Array.isArray(data.pagePermissionGroups) ? data.pagePermissionGroups.length : 0}`,
+        `formGroups=${Number(formGroups.total || 0)}`,
+      ].join(' ')
+    );
+    return;
+  }
+
   if (subcommand === 'audit') {
     const target = getWorkspaceTarget(config, profileName, flags);
     const result = await buildPermissionAudit(config, target, flags);
@@ -3589,7 +3619,7 @@ async function permission(args) {
   }
 
   fail(
-    '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|audit'
+    '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|snapshot|audit'
   );
 }
 
@@ -3902,10 +3932,42 @@ async function runtime(args) {
   if (subcommand === 'deploy') {
     const buildId = normalizeRuntimeBuildId(flags['build-id'] || createRuntimeBuildId());
     const distDir = path.resolve(process.cwd(), flags.dist || 'dist');
-    const assetBaseUrl = buildRuntimeAssetBaseUrl(target.appType, buildId);
     const uploadMode = normalizeRuntimeUploadMode(flags['upload-mode']);
     const uploadTimeoutMs = normalizeRuntimeUploadTimeoutMs(flags['upload-timeout-ms']);
     const traceId = createRuntimeTraceId();
+    const gatewayAssetBaseUrl = buildRuntimeAssetBaseUrl(target.appType, buildId);
+    let assetBaseUrl = gatewayAssetBaseUrl;
+    let effectiveUploadMode = uploadMode;
+    if (uploadMode === 'auto' || uploadMode === 'oss-direct') {
+      try {
+        const plan = await createRuntimeOssUploadBasePlan({
+          config,
+          profileName: target.profileName,
+          appType: target.appType,
+          buildId,
+          traceId,
+          timeoutMs: uploadTimeoutMs,
+        });
+        if (plan?.assetBaseUrl) {
+          assetBaseUrl = plan.assetBaseUrl;
+          if (uploadMode === 'auto') {
+            effectiveUploadMode = 'oss-direct';
+            printRuntimeProgress(
+              `runtime builtin OSS available; using OSS direct upload traceId=${traceId}`
+            );
+          }
+        }
+      } catch (error) {
+        if (uploadMode === 'oss-direct') {
+          throw error;
+        }
+        effectiveUploadMode = 'auto';
+        assetBaseUrl = gatewayAssetBaseUrl;
+        printRuntimeProgress(
+          `runtime builtin OSS preflight unavailable; using staged upload first traceId=${traceId}`
+        );
+      }
+    }
     if (!flags['no-build']) {
       runRuntimeBuild({
         buildId,
@@ -3920,9 +3982,8 @@ async function runtime(args) {
     });
     const totalBytes = files.reduce((sum, file) => sum + file.size, 0);
     printRuntimeProgress(
-      `runtime release upload: mode=${uploadMode} traceId=${traceId} files=${files.length} size=${formatBytes(totalBytes)} timeout=${uploadTimeoutMs}ms`
+      `runtime release upload: mode=${effectiveUploadMode} traceId=${traceId} files=${files.length} size=${formatBytes(totalBytes)} timeout=${uploadTimeoutMs}ms`
     );
-    let effectiveUploadMode = uploadMode;
     let releaseFiles;
     if (uploadMode === 'legacy-json') {
       releaseFiles = files.map(file => ({
@@ -3932,7 +3993,8 @@ async function runtime(args) {
         contentType: file.contentType,
         contentBase64: file.buffer.toString('base64'),
       }));
-    } else if (uploadMode === 'oss-direct') {
+      effectiveUploadMode = 'legacy-json';
+    } else if (effectiveUploadMode === 'oss-direct') {
       releaseFiles = await uploadRuntimeDistFilesOssDirect({
         config,
         profileName: target.profileName,
@@ -3990,6 +4052,7 @@ async function runtime(args) {
       }
     );
     saveRuntimeReleaseState(target, data);
+    const releaseAssetBaseUrl = data?.assetBaseUrl || assetBaseUrl;
     const result = {
       appType: target.appType,
       buildId,
@@ -3997,7 +4060,7 @@ async function runtime(args) {
       distDir,
       fileCount: files.length,
       totalBytes,
-      assetBaseUrl,
+      assetBaseUrl: releaseAssetBaseUrl,
       activated: !flags['no-activate'],
       uploadMode: effectiveUploadMode,
       traceId,
@@ -4010,7 +4073,7 @@ async function runtime(args) {
         `files: ${files.length} (${formatBytes(totalBytes)})`,
         `upload: ${effectiveUploadMode}`,
         `traceId: ${traceId}`,
-        `assetBase: ${assetBaseUrl}`,
+        `assetBase: ${releaseAssetBaseUrl}`,
         `active: ${result.activated ? 'yes' : 'no'}`,
       ].join('\n')
     );
@@ -4020,6 +4083,24 @@ async function runtime(args) {
   fail('用法: openxiangda runtime deploy|releases|activate [--profile name]');
 }
 
+async function createRuntimeOssUploadBasePlan(options) {
+  return await requestWithAuth(
+    options.config,
+    options.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(options.appType)}/runtime/releases/oss-upload-plan`,
+    {
+      method: 'POST',
+      timeoutMs: options.timeoutMs,
+      headers: { 'x-openxiangda-trace-id': options.traceId },
+      body: {
+        buildId: options.buildId,
+        planOnly: true,
+        files: [],
+      },
+    }
+  );
+}
+
 function runRuntimeBuild(options) {
   const command = options.command || defaultRuntimeBuildCommand();
   if (options.jsonOutput) {
@@ -4475,7 +4556,7 @@ async function commands(args) {
       'function list|get|create|update|upsert|delete|invoke',
       'connector list|get|create|update|upsert|delete|invoke|download-test',
       'notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
-      'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|audit',
+      'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|snapshot|audit',
       'permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind',
       'permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions',
       'settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete',
@@ -5024,10 +5105,21 @@ async function buildPermissionAudit(config, target, flags = {}) {
     warnings,
   };
   if (flags.live) {
-    result.live = {
-      roles: await requestWithAuth(config, target.profileName, `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`),
-      pagePermissionGroups: await requestWithAuth(config, target.profileName, `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`),
-    };
+    result.live = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/permissions/snapshot`,
+      {
+        method: 'POST',
+        body: {
+          formUuids: unique(
+            (manifest.formPermissionGroups || [])
+              .map(group => resolveManifestFormUuid(target.bound, group))
+              .filter(Boolean)
+          ),
+        },
+      }
+    );
   }
   return result;
 }
@@ -5066,6 +5158,25 @@ function resolveOptionalFormUuid(bound, formCode) {
   return bound.resources?.forms?.[formCode]?.formUuid || formCode;
 }
 
+function resolvePermissionSnapshotFormUuids(bound, flags = {}) {
+  const directFormUuids = [
+    ...splitList(flags['form-uuids']),
+    ...splitList(flags['form-uuid']),
+  ];
+  const mappedFormUuids = [
+    ...splitList(flags['form-codes']),
+    ...splitList(flags['form-code']),
+  ]
+    .map(formCode => resolveOptionalFormUuid(bound, formCode))
+    .filter(Boolean);
+  const allFormUuids = flags['all-forms']
+    ? Object.values(bound.resources?.forms || {})
+        .map(item => item?.formUuid)
+        .filter(Boolean)
+    : [];
+  return unique([...directFormUuids, ...mappedFormUuids, ...allFormUuids]);
+}
+
 function resolveOptionalPageId(bound, pageCode) {
   if (!pageCode) return undefined;
   return bound.resources?.pages?.[pageCode]?.pageId || pageCode;

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -127,8 +127,14 @@ for real backend read/write field access (`edit`, `readonly`, `hidden`) with
 ```bash
 openxiangda permission form-summary --form-code customer --profile dev --json
 openxiangda permission menu-permissions --profile dev --json
+openxiangda permission snapshot --profile dev --form-codes customer,orders --json
 ```
 
+When auditing many roles or permission groups, prefer `openxiangda permission
+snapshot` over looping `role-list`, `page-group-list`, or `form-group-list`.
+The snapshot command uses the platform batch endpoint and returns roles, page
+permission groups, and form permission groups in one request.
+
 ## Form Settings
 
 Use settings commands for form runtime settings, field indexes, data management pages, and public access:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -67,6 +67,7 @@
     "test:resource-plan": "node scripts/resource-plan-smoke.mjs",
     "test:design-gates": "node scripts/design-gates-smoke.mjs",
     "test:resource-cli": "node scripts/resource-cli-smoke.mjs",
+    "test:permission-snapshot": "node scripts/permission-snapshot-smoke.mjs",
     "test:sdk-bundle": "node scripts/sdk-browser-bundle-smoke.mjs",
     "test:api-contract": "node scripts/openxiangda-api-contract-smoke.mjs",
     "test:help-no-side-effects": "node scripts/help-no-side-effects-smoke.mjs",