openxiangda 1.0.13 → 1.0.15

package/lib/cli.js

@@ -1322,12 +1322,14 @@ async function permission(args) {
     const [groupCode] = positional;
     const name = flags.name || positional.slice(1).join(' ') || groupCode;
     if (!groupCode || !name) {
-      fail('用法: openxiangda permission page-group-create <groupCode> --name <text> [--menu-codes <menuCode...>|--page-codes <pageCode...>|--form-codes <formCode...>|--menu-ids <id...>]');
+      fail('用法: openxiangda permission page-group-create <groupCode> --name <text> [--menu-codes <menuCode...>|--page-codes <pageCode...>|--form-codes <formCode...>|--menu-ids <id...>] [--no-runtime-aliases]');
     }
     const target = getWorkspaceTarget(config, profileName, flags);
     const roles = splitList(flags.roles);
-    const menuFormUuids = resolvePagePermissionMenuTargets(target.bound, flags);
-    const runtimeAliasTargets = resolvePagePermissionRuntimeAliasTargets(target.bound, flags);
+    const editableTargets = resolvePagePermissionMenuTargets(target.bound, flags);
+    const runtimeAliasTargets = flags['no-runtime-aliases']
+      ? []
+      : resolvePagePermissionRuntimeAliasTargets(target.bound, flags);
     const data = await requestWithAuth(
       config,
       target.profileName,
@@ -1337,14 +1339,13 @@ async function permission(args) {
         body: {
           name,
           roles,
-          menuFormUuids,
+          menuFormUuids: editableTargets,
         },
       }
     );
     if (data?.id) savePagePermissionGroupResource(target, groupCode, data.id, { name });
     let runtimeAliasData = null;
     if (runtimeAliasTargets.length > 0) {
-      const runtimeAliasGroupCode = `${groupCode}__runtime_aliases`;
       const runtimeAliasName = `${name}（运行时别名）`;
       runtimeAliasData = await requestWithAuth(
         config,
@@ -1360,12 +1361,14 @@ async function permission(args) {
         }
       );
       if (runtimeAliasData?.id) {
-        savePagePermissionGroupResource(target, runtimeAliasGroupCode, runtimeAliasData.id, {
+        savePagePermissionGroupResource(target, `${groupCode}__runtime_aliases`, runtimeAliasData.id, {
           name: runtimeAliasName,
         });
       }
     }
-    const output = runtimeAliasData ? { ...data, runtimeAliasGroup: runtimeAliasData } : data;
+    const output = runtimeAliasData
+      ? { editableGroup: data, runtimeAliasGroup: runtimeAliasData }
+      : data;
     if (flags.json) return writeJson(output);
     print(JSON.stringify(output, null, 2));
     return;
@@ -1946,14 +1949,13 @@ function resolvePagePermissionMenuTargets(bound, flags = {}) {
 function resolveMenuPermissionTargets(bound, menuCode) {
   const menuEntry = bound.resources?.menus?.[menuCode];
   if (menuEntry?.formUuid) return [menuEntry.formUuid];
-  if (menuEntry?.pageId) return [menuEntry.pageId];
   return [resolveMenuId(bound, menuCode)];
 }
 
 function resolvePagePermissionTargets(bound, pageCode) {
   const menuEntry = findPagePermissionMenuEntry(bound, pageCode);
-  if (menuEntry?.pageId) {
-    return [menuEntry.pageId];
+  if (menuEntry?.menuId) {
+    return [menuEntry.menuId];
   }
   fail(`页面 ${pageCode} 未找到已绑定代码页菜单。请先发布/创建菜单，或直接传 --menu-form-uuids/--menu-ids。`);
 }
@@ -2001,7 +2003,7 @@ function resolveCodePagePermissionAliases(bound, menuEntry = {}, pageCode) {
   });
   return unique([
     pageCode,
-    menuEntry.menuId,
+    menuEntry.pageId,
     menuEntry.pageCode,
     menuEntry.routeKey,
     menuEntry.legacyFormUuid,

package/openxiangda-skills/references/openxiangda-api.md

@@ -369,11 +369,11 @@ Body:
 {
   "name": "销售可见页面",
   "roles": ["sales"],
-  "menuFormUuids": ["FORM_XXX", "PAGE_ID_FOR_CODE_PAGE"]
+  "menuFormUuids": ["FORM_XXX", "MENU_ID_FOR_CODE_PAGE"]
 }
 ```
 
-An empty `menuFormUuids` array means all menus/pages are visible to the matched roles. For form menus this field can contain form UUIDs. For custom code page menus, the user-facing permission group should contain the code page `pageId`, which is what the platform permission editor uses for tree check state. Because the current `/view` runtime guard also checks menu IDs, route keys, and legacy `PAGE_...` aliases, OpenXiangda CLI `--page-codes` / `--menu-codes` creates a companion `（运行时别名）` page permission group for those aliases instead of mixing them into the editable menu group.
+An empty `menuFormUuids` array means all menus/pages are visible to the matched roles. For form menus this field can contain form UUIDs. For custom code page menus, the editable permission group should contain the menu ID, which is what the platform permission editor uses for tree check state. OpenXiangda CLI resolves `--page-codes` / `--menu-codes` to an editable menu-ID group and creates a companion `（运行时别名）` group for required page ID, route key, and legacy `PAGE_...` runtime aliases by default. This keeps the main group editable while satisfying `/view` runtime guards. Use `--no-runtime-aliases` only for deployments whose runtime checks menu IDs directly.
 
 ### GET `/apps/:appType/page-permission-groups/:groupId`
 

package/openxiangda-skills/references/permissions-settings.md

@@ -19,26 +19,38 @@ Role IDs are platform-specific. Store them only in `.openxiangda/state.json` und
 ## Page Permission Groups
 
 Page permission groups map role codes to visible menu targets. Form menus use their `FORM_...`
-form UUIDs. Custom code page/display menus need split targets because current platform
-surfaces check different identifiers: the admin edit tree expects page IDs, while `/view`
-runtime checks menu IDs, route keys, and legacy `PAGE_...` aliases.
+form UUIDs. Custom code page/display menus should include menu IDs because the platform
+permission editor uses menu IDs for tree check state. Some `/view` runtime guards also require
+page ID, route key, and legacy `PAGE_...` aliases; keep those aliases in the same permission
+group so the platform tree can still round-trip the menu selection.
 
 ```json
 {
   "name": "销售页面",
   "roles": ["sales"],
-  "menuFormUuids": ["FORM_CUSTOMER", "FORM_ORDER", "PAGE_ID_FOR_CODE_PAGE"]
+  "menuFormUuids": ["FORM_CUSTOMER", "FORM_ORDER", "MENU_ID_FOR_CODE_PAGE"]
 }
 ```
 
-For custom code pages, keep the user-facing group editable by storing only page IDs, then add a
-companion runtime alias group with the same roles:
+For custom code pages, keep the editable menu tree targets separate from runtime aliases. The
+platform permission editor only reliably checks real menu IDs, while `/view` runtime guards on
+some private deployments still check the code page id, route key, or legacy `PAGE_...` id. When
+`--page-codes` or `--menu-codes` is used, OpenXiangda creates an editable group plus a companion
+runtime alias group:
+
+```json
+{
+  "name": "销售页面",
+  "roles": ["sales"],
+  "menuFormUuids": ["MENU_ID_FOR_CODE_PAGE"]
+}
+```
 
 ```json
 {
   "name": "销售页面（运行时别名）",
   "roles": ["sales"],
-  "menuFormUuids": ["MENU_ID_FOR_CODE_PAGE", "CODE_PAGE_ROUTE_KEY", "PAGE_LEGACY_FORM_UUID"]
+  "menuFormUuids": ["PAGE_ID_FOR_CODE_PAGE", "CODE_PAGE_ROUTE_KEY", "PAGE_LEGACY_FORM_UUID"]
 }
 ```
 
@@ -47,7 +59,7 @@ Rules:
 - `roles: []` means all roles can match.
 - `menuFormUuids: []` means all menus/pages are visible to matched roles.
 - Prefer `--form-codes` in CLI for form menus so each profile resolves its own form UUIDs.
-- Prefer `--page-codes` or `--menu-codes` in CLI for custom code page menus. The CLI writes page IDs to the editable group and creates the companion `（运行时别名）` group automatically.
+- Prefer `--page-codes` or `--menu-codes` in CLI for custom code page menus. The primary group remains editable because it contains only menu IDs. Pass `--no-runtime-aliases` only after confirming the target platform checks menu IDs directly at runtime.
 
 ## Form Permission Groups
 

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -43,7 +43,7 @@ openxiangda permission page-group-create sales_pages --name "销售页面" --rol
 openxiangda permission page-group-create portal_pages --name "门户页面" --page-codes portal_pc,portal_mobile --profile dev
 ```
 
-Use `--page-codes` or `--menu-codes` for custom code page menus; the CLI resolves the editable permission group to the published code page `pageId`, and creates a companion `（运行时别名）` group for the menu ID, route key, and legacy `PAGE_...` alias required by the platform's current `/view` guard and custom-page bootstrap checks. Use `--form-codes` for form menus; the CLI resolves forms to profile-local form UUIDs. Empty target lists mean all menus/pages are visible to matched roles.
+Use `--page-codes` or `--menu-codes` for custom code page menus; the CLI resolves the permission group to the published menu ID and keeps required page ID, route key, and legacy `PAGE_...` runtime aliases in the same group so the platform editor can still round-trip the selection. Use `--form-codes` for form menus; the CLI resolves forms to profile-local form UUIDs. Empty target lists mean all menus/pages are visible to matched roles. Only pass `--no-runtime-aliases` after confirming the target platform checks menu IDs directly at runtime.
 
 ## Form Permission Groups
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {
@@ -107,13 +107,17 @@
     "react-dom": ">=18"
   },
   "devDependencies": {
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.18",
     "@types/react-dom": "^18.3.5",
+    "jsdom": "^29.1.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "tsup": "^8.3.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.7"
   },
   "engines": {
     "node": ">=18"

package/packages/sdk/dist/components/index.cjs

@@ -1091,10 +1091,11 @@ function FieldWrapper({
     }
   ) : void 0;
   const errorNode = error ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "sy-field-error", role: "alert", "data-testid": `error-${fieldId}`, children: error }) : void 0;
+  const requiredMark = required4 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "sy-field-required", "aria-hidden": "true", children: "*" }) : null;
   if (!AntFormItem) {
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: cn("sy-field-wrapper", className), "data-field-id": fieldId, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: cn("sy-field-label", labelClassName), children: [
-        required4 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "sy-field-required", children: "*" }),
+        requiredMark,
         label
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "sy-field-control", children }),
@@ -1106,8 +1107,11 @@ function FieldWrapper({
     AntFormItem,
     {
       name: fieldId,
-      label: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: labelClassName, children: label }),
-      required: required4,
+      label: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: cn("sy-field-label", labelClassName), children: [
+        requiredMark,
+        label
+      ] }),
+      required: false,
       validateStatus: error ? "error" : void 0,
       help: errorNode,
       extra,