openxiangda 1.0.129 → 1.0.131

package/README.md

@@ -108,6 +108,7 @@ openxiangda auth-config methods --json
 openxiangda function invoke submit_public_registration --body-json '{"input":{}}'
 openxiangda connector invoke sms.sendCode --body-json '{"body":{"phone":"13800000000"}}'
 openxiangda notification preview public_register_notice --body-json '{"payload":{"title":"测试"}}'
+openxiangda permission snapshot --form-codes customer,orders --json
 openxiangda permission audit --json
 ```
 

package/lib/cli.js

@@ -150,7 +150,7 @@ Usage:
   openxiangda function list|get|create|update|upsert|delete|invoke [--json-file file]
   openxiangda connector list|get|create|update|upsert|delete|invoke|download-test [--json-file file]
   openxiangda notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send
-  openxiangda permission role-list|role-create|role-update|role-delete|role-bind|audit
+  openxiangda permission role-list|role-create|role-update|role-delete|role-bind|snapshot|audit
   openxiangda permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind
   openxiangda permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind
   openxiangda settings get|save|indexes|indexes-save|data-management|data-management-save|public-access
@@ -3140,7 +3140,7 @@ async function permission(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print(
-      '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|audit'
+      '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|snapshot|audit'
     );
     return;
   }
@@ -3579,6 +3579,36 @@ async function permission(args) {
     return;
   }
 
+  if (subcommand === 'snapshot') {
+    const target = getWorkspaceTarget(config, profileName, flags);
+    const formUuids = resolvePermissionSnapshotFormUuids(target.bound, flags);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/permissions/snapshot`,
+      {
+        method: 'POST',
+        body: {
+          formUuids,
+          includeRoles: flags['no-roles'] ? false : undefined,
+          includePageGroups: flags['no-page-groups'] ? false : undefined,
+          includeFormGroups: flags['no-form-groups'] ? false : undefined,
+        },
+      }
+    );
+    if (flags.json) return writeJson(data);
+    const formGroups = data.formPermissionGroups || {};
+    print(
+      [
+        `Permission snapshot appType=${data.appType || target.appType}`,
+        `roles=${Array.isArray(data.roles) ? data.roles.length : 0}`,
+        `pageGroups=${Array.isArray(data.pagePermissionGroups) ? data.pagePermissionGroups.length : 0}`,
+        `formGroups=${Number(formGroups.total || 0)}`,
+      ].join(' ')
+    );
+    return;
+  }
+
   if (subcommand === 'audit') {
     const target = getWorkspaceTarget(config, profileName, flags);
     const result = await buildPermissionAudit(config, target, flags);
@@ -3589,7 +3619,7 @@ async function permission(args) {
   }
 
   fail(
-    '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|audit'
+    '用法: openxiangda permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind|form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions|snapshot|audit'
   );
 }
 
@@ -4526,7 +4556,7 @@ async function commands(args) {
       'function list|get|create|update|upsert|delete|invoke',
       'connector list|get|create|update|upsert|delete|invoke|download-test',
       'notification template-list|template-get|template-upsert|template-delete|type-list|type-get|type-upsert|type-delete|preview|send|batch-send',
-      'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|audit',
+      'permission role-list|role-create|role-update|role-delete|role-bind|role-users|role-add-users|snapshot|audit',
       'permission page-group-list|page-group-create|page-group-update|page-group-delete|page-group-bind',
       'permission form-group-list|form-group-create|form-group-update|form-group-delete|form-group-bind|form-summary|menu-permissions',
       'settings get|save|indexes|indexes-save|data-management|data-management-save|public-access|public-access-save|public-access-delete',
@@ -5075,10 +5105,21 @@ async function buildPermissionAudit(config, target, flags = {}) {
     warnings,
   };
   if (flags.live) {
-    result.live = {
-      roles: await requestWithAuth(config, target.profileName, `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/roles`),
-      pagePermissionGroups: await requestWithAuth(config, target.profileName, `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/page-permission-groups`),
-    };
+    result.live = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/permissions/snapshot`,
+      {
+        method: 'POST',
+        body: {
+          formUuids: unique(
+            (manifest.formPermissionGroups || [])
+              .map(group => resolveManifestFormUuid(target.bound, group))
+              .filter(Boolean)
+          ),
+        },
+      }
+    );
   }
   return result;
 }
@@ -5117,6 +5158,25 @@ function resolveOptionalFormUuid(bound, formCode) {
   return bound.resources?.forms?.[formCode]?.formUuid || formCode;
 }
 
+function resolvePermissionSnapshotFormUuids(bound, flags = {}) {
+  const directFormUuids = [
+    ...splitList(flags['form-uuids']),
+    ...splitList(flags['form-uuid']),
+  ];
+  const mappedFormUuids = [
+    ...splitList(flags['form-codes']),
+    ...splitList(flags['form-code']),
+  ]
+    .map(formCode => resolveOptionalFormUuid(bound, formCode))
+    .filter(Boolean);
+  const allFormUuids = flags['all-forms']
+    ? Object.values(bound.resources?.forms || {})
+        .map(item => item?.formUuid)
+        .filter(Boolean)
+    : [];
+  return unique([...directFormUuids, ...mappedFormUuids, ...allFormUuids]);
+}
+
 function resolveOptionalPageId(bound, pageCode) {
   if (!pageCode) return undefined;
   return bound.resources?.pages?.[pageCode]?.pageId || pageCode;

package/openxiangda-skills/references/pages/page-sdk.md

@@ -107,6 +107,10 @@ const result = await sdk.function.invoke("reservation_reminder_summary", {
 })
 ```
 
+App Function source should prefer `export default async function(ctx, input) {}`.
+The second argument is the `input` passed by `sdk.function.invoke`, and the
+same value is also available as `ctx.input` for compatibility.
+
 Use App Functions when the logic must run server-side and be reusable by pages, automations, or workflows. Runtime invocation requires app automation management permission by default. To let ordinary app users call a function from a page, declare the allowed current app roles in `definitionJson.runtimeInvoke.roleCodes`; keep sensitive admin-only functions without broad grants. Inside the function, authorize sensitive actions with trusted runtime context such as `ctx.operator.roleCodes`, `ctx.operator.currentRoleCode`, `ctx.operator.hasFullAccess`, `ctx.currentUser`, or `ctx.permissions`; do not trust role codes sent in the page input. When the function writes forms with `ctx.form.createOne/updateOne/updateById`, treat the write as a trusted backend operation over declared `resources.forms`; do not open direct submit permission on internal forms just for that page action.
 
 Work center:

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -127,8 +127,14 @@ for real backend read/write field access (`edit`, `readonly`, `hidden`) with
 ```bash
 openxiangda permission form-summary --form-code customer --profile dev --json
 openxiangda permission menu-permissions --profile dev --json
+openxiangda permission snapshot --profile dev --form-codes customer,orders --json
 ```
 
+When auditing many roles or permission groups, prefer `openxiangda permission
+snapshot` over looping `role-list`, `page-group-list`, or `form-group-list`.
+The snapshot command uses the platform batch endpoint and returns roles, page
+permission groups, and form permission groups in one request.
+
 ## Form Settings
 
 Use settings commands for form runtime settings, field indexes, data management pages, and public access:

package/openxiangda-skills/skills/openxiangda-workflow-automation/SKILL.md

@@ -103,7 +103,7 @@ Use `workflow pull` to inspect the live definition. Use `workflow list --json` a
 
 JS_CODE is the backend execution escape hatch for workflow and automation. Use it when the logic must run on the server after a backend trigger, such as a fixed cron schedule, a form date-field schedule, a form submit/update/delete/field-change event, or a workflow approval/process event. It is appropriate for cross-form data queries, create/update/batch update operations, process termination, platform API calls, external HTTP calls, and complex orchestration that the frontend cannot handle reliably.
 
-App Function is the reusable backend execution model. Use it when the logic should be called by custom pages, multiple automations, workflows, or the runtime API. Source lives in `src/functions/<functionCode>/index.ts`; manifest lives in `src/resources/functions/<functionCode>.json`. Call it from pages with `sdk.function.invoke(code, { input })`, from graph definitions with `function_call`, or from the runtime endpoint `/:appType/v1/functions/:code/invoke.json` when the caller has app automation management permission. Current MVP exposes controlled helpers only and does not expose raw SQL or Redis. `ctx.form.createOne/updateOne/updateById` are trusted backend writes governed by declared `resources.forms` and function invocation authorization; keep internal forms closed to direct user submit unless the business explicitly needs raw form submission.
+App Function is the reusable backend execution model. Use it when the logic should be called by custom pages, multiple automations, workflows, or the runtime API. Source lives in `src/functions/<functionCode>/index.ts`; manifest lives in `src/resources/functions/<functionCode>.json`. Call it from pages with `sdk.function.invoke(code, { input })`, from graph definitions with `function_call`, or from the runtime endpoint `/:appType/v1/functions/:code/invoke.json` when the caller has app automation management permission. Prefer `export default async function(ctx, input) {}` for App Function source; the second argument is the invoke input and the same value is available as `ctx.input`. Current MVP exposes controlled helpers only and does not expose raw SQL or Redis. `ctx.form.createOne/updateOne/updateById` are trusted backend writes governed by declared `resources.forms` and function invocation authorization; keep internal forms closed to direct user submit unless the business explicitly needs raw form submission.
 
 For new AI-authored automations, prefer code-first `automation_code_ts` resources instead of visual v3 graph definitions. Put the source in `src/automations/<resourceCode>/index.ts`, define `definition.code.json` with `kind: "automation_code_ts"`, and provide `preview.json` for read-only frontend display. Use `ctx.logger.debug/info/warn/error(message, data?)` at every important step; OpenXiangda can inspect logs with `automation executions`, `automation logs`, and `automation diagnose`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.129",
+  "version": "1.0.131",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -67,6 +67,7 @@
     "test:resource-plan": "node scripts/resource-plan-smoke.mjs",
     "test:design-gates": "node scripts/design-gates-smoke.mjs",
     "test:resource-cli": "node scripts/resource-cli-smoke.mjs",
+    "test:permission-snapshot": "node scripts/permission-snapshot-smoke.mjs",
     "test:sdk-bundle": "node scripts/sdk-browser-bundle-smoke.mjs",
     "test:api-contract": "node scripts/openxiangda-api-contract-smoke.mjs",
     "test:help-no-side-effects": "node scripts/help-no-side-effects-smoke.mjs",

package/packages/sdk/dist/components/index.cjs

@@ -7026,7 +7026,42 @@ var modeDepth = (mode) => {
   return 3;
 };
 var activeLevels = (mode) => LEVELS.slice(0, modeDepth(mode));
-var valueToPath = (value) => LEVELS.map((level) => value?.[level]?.value).filter(Boolean);
+var stringifyValue = (value) => {
+  if (value === void 0 || value === null || value === "") return void 0;
+  return String(value);
+};
+var normalizeAddressPart = (part) => {
+  if (part === void 0 || part === null || part === "") return void 0;
+  if (typeof part === "object") {
+    const value2 = stringifyValue(part.value ?? part.adcode ?? part.code ?? part.id ?? part.label);
+    if (!value2) return void 0;
+    const label = stringifyValue(part.label ?? part.name ?? part.title) ?? "";
+    return { label, value: value2 };
+  }
+  const value = stringifyValue(part);
+  return value ? { label: "", value } : void 0;
+};
+var normalizeAddressValue = (raw) => {
+  if (!raw || typeof raw !== "object") return void 0;
+  const next = {};
+  LEVELS.forEach((level) => {
+    const part = normalizeAddressPart(raw[level]);
+    if (part) next[level] = part;
+  });
+  if (raw.detail !== void 0 && raw.detail !== null) {
+    next.detail = String(raw.detail);
+  }
+  if (typeof raw.fullAddress === "string" && raw.fullAddress) {
+    next.fullAddress = raw.fullAddress;
+  }
+  return Object.keys(next).length > 0 ? next : void 0;
+};
+var getDisplayLabel = (part) => {
+  const label = part?.label?.trim();
+  if (!label) return void 0;
+  return label === part?.value ? void 0 : label;
+};
+var valueToPath = (value, levels) => levels.map((level) => value?.[level]?.value).filter(Boolean);
 var normalizeDivision = (item, level, depth, index) => ({
   label: String(item.name || item.label || item.adcode || item.value),
   value: String(item.adcode || item.value || item.id),
@@ -7035,7 +7070,66 @@ var normalizeDivision = (item, level, depth, index) => ({
 });
 var composeFullAddress = (value, levels = LEVELS) => {
   if (!value) return "";
-  return [...levels.map((level) => value[level]?.label), value.detail].filter(Boolean).join("");
+  return [...levels.map((level) => getDisplayLabel(value[level])), value.detail].filter(Boolean).join("");
+};
+var mergeValuePathIntoOptions = (source, value, levels, depth) => {
+  if (!value) return source;
+  const mergeAt = (items, index) => {
+    const level = levels[index];
+    const part = level ? value[level] : void 0;
+    if (!level || !part?.value) return items;
+    let matched = false;
+    const nextItems = items.map((item) => {
+      if (String(item.value) !== part.value) return item;
+      matched = true;
+      const label = getDisplayLabel(part) ?? getDisplayLabel(item) ?? "\u5730\u5740\u52A0\u8F7D\u4E2D";
+      const hasNextPath = Boolean(levels[index + 1] && value[levels[index + 1]]?.value);
+      return {
+        ...item,
+        label,
+        level: item.level ?? level,
+        isLeaf: index + 1 >= depth || !hasNextPath && item.isLeaf === true,
+        children: hasNextPath ? mergeAt(item.children ?? [], index + 1) : item.children
+      };
+    });
+    if (!matched) {
+      const hasNextPath = Boolean(levels[index + 1] && value[levels[index + 1]]?.value);
+      const option = {
+        label: getDisplayLabel(part) ?? "\u5730\u5740\u52A0\u8F7D\u4E2D",
+        value: part.value,
+        level,
+        isLeaf: index + 1 >= depth
+      };
+      if (hasNextPath) option.children = mergeAt([], index + 1);
+      nextItems.push(option);
+    }
+    return nextItems;
+  };
+  return mergeAt(source, 0);
+};
+var setNestedChildren = (source, selectedOptions, children) => {
+  const [current, ...rest] = selectedOptions;
+  if (!current) return source;
+  const currentValue = String(current.value);
+  let matched = false;
+  const next = source.map((item) => {
+    if (String(item.value) !== currentValue) return item;
+    matched = true;
+    return {
+      ...item,
+      children: rest.length ? setNestedChildren(item.children ?? [], rest, children) : children
+    };
+  });
+  if (!matched) {
+    next.push({
+      label: String(current.label || current.value),
+      value: currentValue,
+      level: current.level,
+      isLeaf: false,
+      children: rest.length ? setNestedChildren([], rest, children) : children
+    });
+  }
+  return next;
 };
 function AddressField(props) {
   const {
@@ -7057,7 +7151,8 @@ function AddressField(props) {
   const { formData, fieldBehaviors, setFieldValue, registerField, unregisterField, api } = useFormContext();
   const { isMobile } = useDeviceDetect();
   const behavior = propBehavior ?? fieldBehaviors[fieldId] ?? "NORMAL";
-  const value = formData[fieldId];
+  const rawValue = formData[fieldId];
+  const value = (0, import_react42.useMemo)(() => normalizeAddressValue(rawValue), [rawValue]);
   const [options, setOptions] = (0, import_react42.useState)([]);
   const [loadingRoots, setLoadingRoots] = (0, import_react42.useState)(false);
   const [mobileOpen, setMobileOpen] = (0, import_react42.useState)(false);
@@ -7067,24 +7162,78 @@ function AddressField(props) {
   const [tempValue, setTempValue] = (0, import_react42.useState)();
   const depth = modeDepth(mode);
   const levels = (0, import_react42.useMemo)(() => activeLevels(mode), [mode]);
+  const valuePath = (0, import_react42.useMemo)(() => valueToPath(value, levels), [levels, value]);
+  const displayOptions = (0, import_react42.useMemo)(
+    () => mergeValuePathIntoOptions(options, value, levels, depth),
+    [depth, levels, options, value]
+  );
   const detailEnabled = mode === "province-city-district-street-detail";
   const disabled = behavior === "DISABLED";
   const MobilePopup = getMobileComponent3("Popup");
   (0, import_react42.useEffect)(() => {
     registerField(fieldId);
-    if (defaultValue !== void 0 && formData[fieldId] === void 0) {
+    return () => unregisterField(fieldId);
+  }, [fieldId, registerField, unregisterField]);
+  (0, import_react42.useEffect)(() => {
+    if (defaultValue !== void 0 && rawValue === void 0) {
       setFieldValue(fieldId, defaultValue);
     }
-    return () => unregisterField(fieldId);
-  }, [fieldId]);
-  const loadDivisions = async (parentAdcode, level, index) => {
-    const list = await api.getChinaDivisions(parentAdcode);
-    return list.map((item) => normalizeDivision(item, level, depth, index));
-  };
+  }, [defaultValue, fieldId, rawValue, setFieldValue]);
+  const loadDivisions = (0, import_react42.useCallback)(
+    async (parentAdcode, level, index) => {
+      const list = await api.getChinaDivisions(parentAdcode);
+      return list.map((item) => normalizeDivision(item, level, depth, index));
+    },
+    [api, depth]
+  );
   (0, import_react42.useEffect)(() => {
+    let mounted = true;
     setLoadingRoots(true);
-    loadDivisions(void 0, "province", 0).then(setOptions).finally(() => setLoadingRoots(false));
-  }, [api, depth]);
+    loadDivisions(void 0, "province", 0).then((nextOptions) => {
+      if (mounted) setOptions(nextOptions);
+    }).finally(() => {
+      if (mounted) setLoadingRoots(false);
+    });
+    return () => {
+      mounted = false;
+    };
+  }, [loadDivisions]);
+  (0, import_react42.useEffect)(() => {
+    if (!value) return;
+    let cancelled = false;
+    const hydrateMissingLabels = async () => {
+      let nextValue = { ...value };
+      let changed = false;
+      let parentAdcode;
+      for (let index = 0; index < levels.length; index += 1) {
+        const level = levels[index];
+        const part = nextValue[level];
+        if (!part?.value) break;
+        if (!getDisplayLabel(part)) {
+          const divisions = await loadDivisions(parentAdcode, level, index);
+          const matched = divisions.find((option) => option.value === part.value);
+          if (matched) {
+            nextValue = { ...nextValue, [level]: { label: matched.label, value: matched.value } };
+            changed = true;
+          }
+        }
+        parentAdcode = part.value;
+      }
+      const fullAddress = composeFullAddress(nextValue, levels);
+      if (fullAddress && nextValue.fullAddress !== fullAddress) {
+        nextValue = { ...nextValue, fullAddress };
+        changed = true;
+      }
+      if (!cancelled && changed) {
+        setFieldValue(fieldId, nextValue);
+      }
+    };
+    hydrateMissingLabels().catch(() => {
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [fieldId, levels, loadDivisions, setFieldValue, value]);
   (0, import_react42.useEffect)(() => {
     if (!mobileOpen) return;
     const level = levels[mobileLevelIndex] || "province";
@@ -7092,7 +7241,7 @@ function AddressField(props) {
     const parentAdcode = parentLevel ? tempValue?.[parentLevel]?.value : void 0;
     setMobileLoading(true);
     loadDivisions(parentAdcode, level, mobileLevelIndex).then(setMobileOptions).finally(() => setMobileLoading(false));
-  }, [mobileOpen, mobileLevelIndex, tempValue, levels]);
+  }, [loadDivisions, mobileOpen, mobileLevelIndex, tempValue, levels]);
   if (behavior === "HIDDEN") return null;
   const setAddressValue = (next) => {
     const normalized = next ? { ...next, fullAddress: composeFullAddress(next, levels) } : void 0;
@@ -7228,18 +7377,20 @@ function AddressField(props) {
           import_antd18.Cascader,
           {
             style: { width: "100%" },
-            options,
+            options: displayOptions,
             allowClear,
             disabled,
-            value: valueToPath(value),
+            value: valuePath,
             placeholder: props.placeholder || "\u8BF7\u9009\u62E9\u5730\u5740",
             loading: loadingRoots,
+            displayRender: (labels) => labels.filter(Boolean).join(" / ") || (valuePath.length ? "\u5730\u5740\u52A0\u8F7D\u4E2D" : ""),
             loadData: async (selectedOptions) => {
               const target = selectedOptions[selectedOptions.length - 1];
               const nextLevel = levels[selectedOptions.length] ?? "street";
               const children = await loadDivisions(target.value, nextLevel, selectedOptions.length);
-              target.children = children;
-              setOptions([...options]);
+              setOptions(
+                (currentOptions) => setNestedChildren(currentOptions, selectedOptions, children)
+              );
             },
             onChange: (_path, selectedOptions) => {
               if (!selectedOptions?.length) {