openxiangda 1.0.136 → 1.0.138

package/lib/cli.js

@@ -93,6 +93,7 @@ async function main(argv) {
   if (command === 'workflow') return workflow(rest);
   if (command === 'automation') return automation(rest);
   if (command === 'data-view') return dataView(rest);
+  if (command === 'scope') return scope(rest);
   if (command === 'route') return route(rest);
   if (command === 'public-access') return publicAccess(rest);
   if (command === 'auth-config') return authConfig(rest);
@@ -162,6 +163,7 @@ Usage:
   openxiangda automation diagnose <automationCode|automationId> [--redact] [--json]
   openxiangda automation publish|enable|disable <automationCode|automationId>
   openxiangda data-view list|get|create|update|upsert|delete|status|refresh|query|stats <dataViewCode> [--profile name] [--json]
+  openxiangda scope dimension-list|dimension-upsert|grant-source-list|grant-source-upsert|policy-list|policy-upsert|sync|explain [code] [--json-file file]
   openxiangda route list|get|create|update|upsert|delete [--json-file file] [--dry-run] [--write-manifest]
   openxiangda public-access list|get|create|update|upsert|delete|ticket-create|session-test|grant-check [--json-file file]
   openxiangda auth-config list|get|create|update|upsert|delete|methods [--json-file file]
@@ -1860,6 +1862,9 @@ async function workspace(args) {
         connectors: {},
         dataViews: {},
         storageConfigs: {},
+        scopeDimensions: {},
+        scopeGrantSources: {},
+        dataScopePolicies: {},
         pagePermissionGroups: {},
         formPermissionGroups: {},
         formSettings: {},
@@ -3101,6 +3106,112 @@ async function dataView(args) {
   fail('用法: openxiangda data-view list|get|create|update|upsert|delete|status|refresh|query|stats');
 }
 
+async function scope(args) {
+  const { subcommand, rest } = parseSubcommandArgs(args);
+  const { flags, positional } = parseArgs(rest);
+  if (wantsSubcommandHelp(subcommand, flags)) {
+    print('用法: openxiangda scope dimension-list|dimension-upsert|grant-source-list|grant-source-upsert|policy-list|policy-upsert|sync|explain [code] [--json-file file] [--dry-run] [--write-manifest]');
+    return;
+  }
+  const config = loadConfig();
+  const target = getWorkspaceTarget(config, flags.profile || config.currentProfile, flags);
+  const basePath = `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope`;
+
+  if (subcommand === 'dimension-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${basePath}/dimensions`,
+    });
+  }
+
+  if (subcommand === 'dimension-upsert') {
+    return upsertScopeResource(config, target, flags, positional, {
+      commandName: 'scope dimension-upsert',
+      resourceType: 'scope-dimension',
+      path: `${basePath}/dimensions`,
+      normalizeBody: body => normalizeScopeDimensionManifest(body, target.bound),
+    });
+  }
+
+  if (subcommand === 'grant-source-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${basePath}/grant-sources`,
+    });
+  }
+
+  if (subcommand === 'grant-source-upsert') {
+    return upsertScopeResource(config, target, flags, positional, {
+      commandName: 'scope grant-source-upsert',
+      resourceType: 'scope-grant-source',
+      path: `${basePath}/grant-sources`,
+      normalizeBody: body => normalizeScopeGrantSourceManifest(body, target.bound),
+    });
+  }
+
+  if (subcommand === 'policy-list') {
+    return runDirectRequest(config, target, flags, {
+      method: 'GET',
+      path: `${basePath}/policies`,
+    });
+  }
+
+  if (subcommand === 'policy-upsert') {
+    return upsertScopeResource(config, target, flags, positional, {
+      commandName: 'scope policy-upsert',
+      resourceType: 'data-scope-policy',
+      path: `${basePath}/policies`,
+      normalizeBody: normalizeDataScopePolicyManifest,
+    });
+  }
+
+  if (subcommand === 'sync') {
+    const [code] = positional;
+    if (!code) fail('用法: openxiangda scope sync <grantSourceCode> [--dry-run] [--json]');
+    const body = {
+      ...readDirectJsonBody(flags, 'scope sync', { optional: true }),
+      ...(flags['dry-run'] ? { dryRun: true } : {}),
+    };
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${basePath}/grant-sources/${encodeURIComponent(code)}/sync`,
+      body,
+    });
+  }
+
+  if (subcommand === 'explain') {
+    const [code] = positional;
+    if (!code) fail('用法: openxiangda scope explain <policyCode> [--json-file file] [--json]');
+    const body = readDirectJsonBody(flags, 'scope explain', { optional: true });
+    return runDirectRequest(config, target, flags, {
+      method: 'POST',
+      path: `${basePath}/policies/${encodeURIComponent(code)}/explain`,
+      body,
+    });
+  }
+
+  fail('用法: openxiangda scope dimension-list|dimension-upsert|grant-source-list|grant-source-upsert|policy-list|policy-upsert|sync|explain');
+}
+
+async function upsertScopeResource(config, target, flags, positional, spec) {
+  const rawBody = readDirectJsonBody(flags, spec.commandName);
+  const explicitCode = positional[0] || flags.code;
+  if (explicitCode && !rawBody.code && !rawBody.resourceCode) rawBody.code = explicitCode;
+  const code = explicitCode || rawBody.code || rawBody.resourceCode;
+  if (!code) fail(`openxiangda ${spec.commandName} 缺少资源 code`);
+  const body = spec.normalizeBody(rawBody);
+  const data = await runDirectRequest(config, target, flags, {
+    method: 'POST',
+    path: `${spec.path}/${encodeURIComponent(code)}`,
+    body,
+  }, { returnData: true });
+  if (!flags['dry-run']) {
+    saveScopeResource(target, resourceTypeToBucket(spec.resourceType), code, data);
+    if (flags['write-manifest']) writeDirectManifest(spec.resourceType, code, { ...rawBody, code });
+  }
+  return outputDirectResult({ action: 'upsert', data }, flags);
+}
+
 async function route(args) {
   const { subcommand, rest } = parseSubcommandArgs(args);
   const { flags, positional } = parseArgs(rest);
@@ -5579,6 +5690,9 @@ function directManifestDir(resourceType) {
     role: path.join('src', 'resources', 'roles'),
     'page-permission-group': path.join('src', 'resources', 'permissions', 'page-groups'),
     'form-permission-group': path.join('src', 'resources', 'permissions', 'form-groups'),
+    'scope-dimension': path.join('src', 'resources', 'permissions', 'scope-dimensions'),
+    'scope-grant-source': path.join('src', 'resources', 'permissions', 'scope-grant-sources'),
+    'data-scope-policy': path.join('src', 'resources', 'permissions', 'data-scope-policies'),
   };
   return dirs[resourceType];
 }
@@ -5738,6 +5852,8 @@ async function buildPermissionAudit(config, target, flags = {}) {
   const manifest = loadWorkspaceResources();
   const validation = validateWorkspaceResources(manifest);
   const roleCodes = new Set((manifest.roles || []).map(item => item.code || item.resourceCode).filter(Boolean));
+  const policyCodes = new Set((manifest.dataScopePolicies || []).map(item => item.code || item.resourceCode).filter(Boolean));
+  const scopePolicyRefs = [];
   const warnings = [...validation.warnings];
   const errors = [...validation.errors];
   for (const group of manifest.pagePermissionGroups || []) {
@@ -5751,6 +5867,31 @@ async function buildPermissionAudit(config, target, flags = {}) {
     }
     const formUuid = resolveManifestFormUuid(target.bound, group);
     if (!formUuid) errors.push(`form permission group ${group.code} 缺少 formCode/formUuid`);
+    if (group.dataPermission?.type === 'scope_policy') {
+      const policyCode = getScopePolicyCode(group.dataPermission);
+      if (policyCode) scopePolicyRefs.push(policyCode);
+      if (policyCode && policyCodes.size > 0 && !policyCodes.has(policyCode)) {
+        warnings.push(`form permission group ${group.code} 引用未声明 data-scope-policy: ${policyCode}`);
+      }
+    }
+  }
+  for (const dataView of manifest.dataViews || []) {
+    for (const group of dataView.permissionGroups || []) {
+      for (const roleCode of group.roles || []) {
+        if (roleCodes.size > 0 && !roleCodes.has(roleCode)) {
+          warnings.push(`data view ${dataView.code} permission group ${group.code || group.name || '?'} 引用未声明角色: ${roleCode}`);
+        }
+      }
+      if (group.dataPermission?.type !== 'scope_policy') continue;
+      const policyCode = getScopePolicyCode(group.dataPermission);
+      if (policyCode) scopePolicyRefs.push(policyCode);
+      if (policyCode && policyCodes.size > 0 && !policyCodes.has(policyCode)) {
+        warnings.push(`data view ${dataView.code} permission group ${group.code || group.name || '?'} 引用未声明 data-scope-policy: ${policyCode}`);
+      }
+    }
+  }
+  if (scopePolicyRefs.length > 0 && (manifest.scopeGrantSources || []).length === 0) {
+    warnings.push('权限组已引用 scope_policy，但本工作区未声明 scopeGrantSources；请确认授权来源由其他工作区或平台后台维护');
   }
   for (const policy of manifest.publicAccessPolicies || []) {
     const grants = normalizePublicAccessPolicyManifest(target.bound, policy).grants || {};
@@ -5770,6 +5911,12 @@ async function buildPermissionAudit(config, target, flags = {}) {
     ),
     errors,
     warnings,
+    scope: {
+      dimensions: (manifest.scopeDimensions || []).length,
+      grantSources: (manifest.scopeGrantSources || []).length,
+      policies: (manifest.dataScopePolicies || []).length,
+      referencedPolicies: unique(scopePolicyRefs),
+    },
   };
   if (flags.live) {
     result.live = await requestWithAuth(
@@ -5806,6 +5953,9 @@ function ensureResourceBuckets(bound) {
   bound.resources.authConfigs = bound.resources.authConfigs || {};
   bound.resources.routes = bound.resources.routes || {};
   bound.resources.publicAccessPolicies = bound.resources.publicAccessPolicies || {};
+  bound.resources.scopeDimensions = bound.resources.scopeDimensions || {};
+  bound.resources.scopeGrantSources = bound.resources.scopeGrantSources || {};
+  bound.resources.dataScopePolicies = bound.resources.dataScopePolicies || {};
   bound.resources.notifications = bound.resources.notifications || {};
   bound.resources.notifications.templates = bound.resources.notifications.templates || {};
   bound.resources.notifications.typeConfigs = bound.resources.notifications.typeConfigs || {};
@@ -6056,6 +6206,24 @@ function saveStorageConfigResource(target, storageCode, storageConfigId, extra =
   }, keys);
 }
 
+function saveScopeResource(target, bucket, code, data = {}) {
+  if (!bucket || !code) return;
+  const keys = ['id', 'resourceCode', 'name', 'updatedAt'];
+  saveStateResource(target, bucket, code, {
+    id: data?.id,
+    resourceCode: data?.resourceCode || data?.code || code,
+    name: data?.name,
+  }, keys);
+}
+
+function resourceTypeToBucket(resourceType) {
+  return {
+    'scope-dimension': 'scopeDimensions',
+    'scope-grant-source': 'scopeGrantSources',
+    'data-scope-policy': 'dataScopePolicies',
+  }[resourceType];
+}
+
 function saveRouteResource(target, routeCode, routeId, extra = {}) {
   const keys = ['routeId', 'pathPattern', 'publicAccess', 'publicPolicyCode'];
   saveStateResource(target, 'routes', routeCode, {
@@ -6208,6 +6376,24 @@ const RESOURCE_SPECS = [
     topFiles: [path.join('permissions', 'form-groups.json')],
     pluralKeys: ['formPermissionGroups', 'formGroups'],
   },
+  {
+    key: 'scopeDimensions',
+    dir: path.join('permissions', 'scope-dimensions'),
+    topFiles: [path.join('permissions', 'scope-dimensions.json')],
+    pluralKeys: ['scopeDimensions', 'dimensions'],
+  },
+  {
+    key: 'scopeGrantSources',
+    dir: path.join('permissions', 'scope-grant-sources'),
+    topFiles: [path.join('permissions', 'scope-grant-sources.json')],
+    pluralKeys: ['scopeGrantSources', 'grantSources', 'sources'],
+  },
+  {
+    key: 'dataScopePolicies',
+    dir: path.join('permissions', 'data-scope-policies'),
+    topFiles: [path.join('permissions', 'data-scope-policies.json')],
+    pluralKeys: ['dataScopePolicies', 'scopePolicies', 'policies'],
+  },
   {
     key: 'formSettings',
     dir: path.join('settings', 'forms'),
@@ -6274,6 +6460,20 @@ const RESOURCE_TYPE_ALIASES = new Map([
   ['form-groups', 'formPermissionGroups'],
   ['formpermissiongroup', 'formPermissionGroups'],
   ['formpermissiongroups', 'formPermissionGroups'],
+  ['scope-dimension', 'scopeDimensions'],
+  ['scope-dimensions', 'scopeDimensions'],
+  ['scopedimension', 'scopeDimensions'],
+  ['scopedimensions', 'scopeDimensions'],
+  ['scope-grant-source', 'scopeGrantSources'],
+  ['scope-grant-sources', 'scopeGrantSources'],
+  ['scopegrantsource', 'scopeGrantSources'],
+  ['scopegrantsources', 'scopeGrantSources'],
+  ['data-scope-policy', 'dataScopePolicies'],
+  ['data-scope-policies', 'dataScopePolicies'],
+  ['scope-policy', 'dataScopePolicies'],
+  ['scope-policies', 'dataScopePolicies'],
+  ['datascopepolicy', 'dataScopePolicies'],
+  ['datascopepolicies', 'dataScopePolicies'],
   ['form-setting', 'formSettings'],
   ['form-settings', 'formSettings'],
   ['settings-form', 'formSettings'],
@@ -6283,8 +6483,8 @@ const RESOURCE_TYPE_ALIASES = new Map([
 ]);
 
 const RESOURCE_TYPE_ALIAS_GROUPS = new Map([
-  ['permission', ['pagePermissionGroups', 'formPermissionGroups']],
-  ['permissions', ['pagePermissionGroups', 'formPermissionGroups']],
+  ['permission', ['pagePermissionGroups', 'formPermissionGroups', 'scopeDimensions', 'scopeGrantSources', 'dataScopePolicies']],
+  ['permissions', ['pagePermissionGroups', 'formPermissionGroups', 'scopeDimensions', 'scopeGrantSources', 'dataScopePolicies']],
 ]);
 
 function getResourceTypeFilters(positional = [], flags = {}) {
@@ -6313,7 +6513,7 @@ function getResourceTypeFilters(positional = [], flags = {}) {
     if (!key) {
       fail(
         `未知资源类型: ${rawType}。常用类型包括 workflow, notification, route, menu, role, ` +
-          `storage, page-permission-group, form-permission-group, public-access。`
+          `storage, page-permission-group, form-permission-group, scope-policy, public-access。`
       );
     }
     filters.add(key);
@@ -6523,6 +6723,7 @@ function validateWorkspaceResources(manifest) {
     }
   }
   validateNotificationReferences(manifest.notifications || [], errors);
+  validateScopePermissionResources(manifest, errors, warnings);
   return {
     valid: errors.length === 0,
     errors,
@@ -6610,6 +6811,9 @@ function generateResourceTypes(manifest, outputFile) {
   const storageConfigCodes = unique((manifest.storageConfigs || []).map(item => item.code).filter(Boolean));
   const authConfigCodes = unique((manifest.authConfigs || []).map(item => item.code).filter(Boolean));
   const publicAccessPolicyCodes = unique((manifest.publicAccessPolicies || []).map(item => item.code).filter(Boolean));
+  const scopeDimensionCodes = unique((manifest.scopeDimensions || []).map(item => item.code).filter(Boolean));
+  const scopeGrantSourceCodes = unique((manifest.scopeGrantSources || []).map(item => item.code).filter(Boolean));
+  const dataScopePolicyCodes = unique((manifest.dataScopePolicies || []).map(item => item.code).filter(Boolean));
   const content = [
     '/* eslint-disable */',
     '// Generated by openxiangda resource typegen. Do not edit manually.',
@@ -6638,6 +6842,15 @@ function generateResourceTypes(manifest, outputFile) {
     `export const publicAccessPolicyCodes = ${JSON.stringify(publicAccessPolicyCodes, null, 2)} as const`,
     'export type PublicAccessPolicyCode = typeof publicAccessPolicyCodes[number]',
     '',
+    `export const scopeDimensionCodes = ${JSON.stringify(scopeDimensionCodes, null, 2)} as const`,
+    'export type ScopeDimensionCode = typeof scopeDimensionCodes[number]',
+    '',
+    `export const scopeGrantSourceCodes = ${JSON.stringify(scopeGrantSourceCodes, null, 2)} as const`,
+    'export type ScopeGrantSourceCode = typeof scopeGrantSourceCodes[number]',
+    '',
+    `export const dataScopePolicyCodes = ${JSON.stringify(dataScopePolicyCodes, null, 2)} as const`,
+    'export type DataScopePolicyCode = typeof dataScopePolicyCodes[number]',
+    '',
     `export const runtimeMenus = ${JSON.stringify(menus, null, 2)} as const`,
     '',
     `export const runtimeRoutes = ${JSON.stringify(routes, null, 2)} as const`,
@@ -6657,6 +6870,9 @@ function generateResourceTypes(manifest, outputFile) {
     functions: functionCodes.length,
     authConfigs: authConfigCodes.length,
     publicAccessPolicies: publicAccessPolicyCodes.length,
+    scopeDimensions: scopeDimensionCodes.length,
+    scopeGrantSources: scopeGrantSourceCodes.length,
+    dataScopePolicies: dataScopePolicyCodes.length,
   };
 }
 
@@ -6747,6 +6963,21 @@ function validateResourceItem(kind, item, errors, warnings) {
     } else {
       errors.push(`${label}: 不支持的 viewType: ${definition.viewType}`);
     }
+    for (const [index, group] of (item.permissionGroups || []).entries()) {
+      const actions = group.actions || group.operations;
+      if (actions !== undefined) {
+        if (!Array.isArray(actions)) {
+          errors.push(`${label}.permissionGroups[${index}]: actions/operations 必须是数组`);
+        } else {
+          for (const action of actions) {
+            const normalizedAction = normalizePermissionActionValue(action);
+            if (!DATA_VIEW_PERMISSION_ACTIONS.has(normalizedAction)) {
+              errors.push(`${label}.permissionGroups[${index}]: 不支持的数据视图 action "${action}"`);
+            }
+          }
+        }
+      }
+    }
     validateDataViewPerformance(label, definition, errors, warnings, storageMode);
   }
   if (kind === 'storageConfigs') {
@@ -6836,10 +7067,74 @@ function validateResourceItem(kind, item, errors, warnings) {
       errors.push(`${label}: externalRoleCodes 必须是数组`);
     }
   }
+  if (kind === 'scopeDimensions') {
+    if (!item.name) warnings.push(`${label}: 未声明 name，将使用 code`);
+    if (item.hierarchyMode && !['flat', 'self_parent'].includes(String(item.hierarchyMode))) {
+      errors.push(`${label}: hierarchyMode 只能是 flat 或 self_parent`);
+    }
+    if ((item.sourceFormUuid || item.formUuid) && !item.sourceValueField && !item.valueField) {
+      errors.push(`${label}: 使用表单维护维度时缺少 sourceValueField`);
+    }
+  }
+  if (kind === 'scopeGrantSources') {
+    if (!item.name) warnings.push(`${label}: 未声明 name，将使用 code`);
+    if (!item.sourceFormUuid && !item.formUuid) errors.push(`${label}: 缺少 sourceFormUuid`);
+    const subjectMappings = item.subjectMappings || item.subjects;
+    const dimensionMappings = item.dimensionMappings || item.dimensions;
+    if (!Array.isArray(subjectMappings) || subjectMappings.length === 0) {
+      errors.push(`${label}: 缺少 subjectMappings`);
+    }
+    if (!Array.isArray(dimensionMappings) || dimensionMappings.length === 0) {
+      errors.push(`${label}: 缺少 dimensionMappings`);
+    }
+  }
+  if (kind === 'dataScopePolicies') {
+    if (!item.name) warnings.push(`${label}: 未声明 name，将使用 code`);
+    const rules = item.rules || item.dimensions;
+    if (!Array.isArray(rules) || rules.length === 0) {
+      errors.push(`${label}: 缺少 rules`);
+    } else {
+      rules.forEach((rule, index) => {
+        const ruleLabel = `${label}.rules[${index}]`;
+        const dimensionCode = rule.dimensionCode || rule.dimension;
+        const targetField = rule.field || rule.targetField;
+        if (!dimensionCode) errors.push(`${ruleLabel}: 缺少 dimensionCode`);
+        if (!targetField) errors.push(`${ruleLabel}: 缺少 field/targetField`);
+        if (rule.valuePath && !isSafeScopePolicyValuePath(rule.valuePath)) {
+          errors.push(`${ruleLabel}: valuePath 只能包含字母、数字、下划线、中划线、点或 >`);
+        }
+        if (isScopePolicyMultiValueComponent(rule.componentType)) {
+          warnings.push(`${ruleLabel}: 多值选择/人员/部门字段不适合直接作为 scope_policy 目标字段，建议派生隐藏 scalar key 字段`);
+        } else if (
+          !rule.valuePath &&
+          !rule.componentType &&
+          looksLikeJsonScopeTargetField(targetField)
+        ) {
+          warnings.push(`${ruleLabel}: 目标字段看起来可能是选择/人员/部门类字段；若底层是 JSONB，请声明 valuePath:"value" 或 componentType，优先使用隐藏 scalar key`);
+        }
+      });
+    }
+  }
   if (kind === 'pagePermissionGroups' && !item.name) errors.push(`${label}: 缺少 name`);
   if (kind === 'formPermissionGroups') {
     if (!item.name) errors.push(`${label}: 缺少 name`);
     if (!item.formCode && !item.formUuid) errors.push(`${label}: 缺少 formCode 或 formUuid`);
+    const actions = item.actions || item.operations;
+    if (actions !== undefined) {
+      if (!Array.isArray(actions)) {
+        errors.push(`${label}: actions/operations 必须是数组`);
+      } else {
+        for (const action of actions) {
+          const normalizedAction = normalizePermissionActionValue(action);
+          if (!FORM_PERMISSION_ACTIONS.has(normalizedAction)) {
+            errors.push(`${label}: 不支持的表单 action "${action}"`);
+          }
+        }
+      }
+    }
+    if (item.dataPermission?.type === 'scope_policy' && !getScopePolicyCode(item.dataPermission)) {
+      errors.push(`${label}: dataPermission.type=scope_policy 时必须声明 policyCode`);
+    }
   }
   if (kind === 'formSettings') {
     if (!item.formCode && !item.formUuid && !item.code) {
@@ -6856,6 +7151,129 @@ function validateResourceItem(kind, item, errors, warnings) {
   }
 }
 
+function validateScopePermissionResources(manifest, errors, warnings) {
+  const policyCodes = new Set(
+    (manifest.dataScopePolicies || [])
+      .map(item => item.code || item.resourceCode)
+      .filter(Boolean)
+      .map(String)
+  );
+  const scopePolicyRefs = [];
+  const inspectPermissionGroup = (kind, item) => {
+    const groups = kind === 'dataViews'
+      ? (Array.isArray(item.permissionGroups) ? item.permissionGroups : [])
+      : [item];
+    for (const group of groups) {
+      const actions = kind === 'dataViews'
+        ? normalizeDataViewPermissionGroupActions(group)
+        : normalizeFormPermissionGroupActions(group);
+      const dataPermission = group?.dataPermission;
+      if (
+        kind === 'formPermissionGroups' &&
+        actions.includes('create') &&
+        (!dataPermission || dataPermission.type !== 'scope_policy')
+      ) {
+        warnings.push(`${resourceLabel(kind, item)}: 声明了 create，但未声明 create 对应的 scope_policy；若新增数据必须落在用户业务范围内，请补充 dataPermission.type=scope_policy`);
+      }
+      if (!dataPermission) continue;
+      if (dataPermission.type === 'scope_policy') {
+        if (kind === 'formPermissionGroups') {
+          const missing = ['view', 'edit', 'delete', 'export']
+            .filter(action => !actions.includes(action));
+          if (missing.length) {
+            warnings.push(`${resourceLabel(kind, item)}: 使用 scope_policy 但 action 覆盖不完整，缺少 ${missing.join(', ')}；请确认每个角色的 action matrix`);
+          }
+        }
+        if (kind === 'dataViews') {
+          const missing = ['query', 'stats', 'export']
+            .filter(action => !actions.includes(action));
+          if (missing.length) {
+            warnings.push(`${resourceLabel(kind, item)}: Data View 使用 scope_policy 但 action 覆盖不完整，缺少 ${missing.join(', ')}`);
+          }
+        }
+        const policyCode = getScopePolicyCode(dataPermission);
+        if (!policyCode) {
+          errors.push(`${resourceLabel(kind, item)}: scope_policy 缺少 policyCode`);
+          continue;
+        }
+        scopePolicyRefs.push(policyCode);
+        if (policyCodes.size > 0 && !policyCodes.has(policyCode)) {
+          warnings.push(`${resourceLabel(kind, item)}: scope_policy 引用 ${policyCode}，但 src/resources 中未声明同名 data-scope-policy`);
+        }
+      } else if (containsBusinessScopeLikeField(dataPermission)) {
+        warnings.push(`${resourceLabel(kind, item)}: 检测到疑似业务范围字段条件，业务对象数量超过少量枚举时优先改为 dataPermission.type=scope_policy`);
+      }
+    }
+  };
+  for (const group of manifest.formPermissionGroups || []) {
+    inspectPermissionGroup('formPermissionGroups', group);
+  }
+  for (const view of manifest.dataViews || []) {
+    inspectPermissionGroup('dataViews', view);
+  }
+  const formGroupCount = (manifest.formPermissionGroups || []).length;
+  const pageGroupCount = (manifest.pagePermissionGroups || []).length;
+  if (formGroupCount >= 30) {
+    warnings.push(`formPermissionGroups 当前 ${formGroupCount} 个；如这些组按客户/项目/区域/学院/班级/门店拆分，建议收敛为业务授权表 + scope_policy`);
+  }
+  if (pageGroupCount >= 30) {
+    warnings.push(`pagePermissionGroups 当前 ${pageGroupCount} 个；如这些组按业务对象拆分，建议只保留入口角色，数据范围交给 scope_policy`);
+  }
+  if (scopePolicyRefs.length > 0 && (manifest.scopeGrantSources || []).length === 0) {
+    warnings.push('已引用 scope_policy，但未声明 scopeGrantSources；请确认授权来源由平台后台或其他工作区维护');
+  }
+}
+
+function getScopePolicyCode(dataPermission = {}) {
+  return String(
+    dataPermission.policyCode ||
+      dataPermission.scopePolicyCode ||
+      dataPermission.code ||
+      ''
+  ).trim();
+}
+
+function isSafeScopePolicyValuePath(value) {
+  return /^[A-Za-z0-9_.>-]+$/.test(String(value || ''));
+}
+
+function isScopePolicyMultiValueComponent(componentType) {
+  const normalized = String(componentType || '').trim().toLowerCase();
+  return [
+    'multiselect',
+    'multiselectfield',
+    'checkbox',
+    'checkboxfield',
+    'cascadeselect',
+    'cascadeselectfield',
+  ].includes(normalized);
+}
+
+function looksLikeJsonScopeTargetField(field) {
+  return /(select|option|user|employee|member|dept|department|linked|association|人员|用户|部门|选择)/i.test(String(field || ''));
+}
+
+function containsBusinessScopeLikeField(value) {
+  const fields = [];
+  const visit = item => {
+    if (!item || typeof item !== 'object') return;
+    if (Array.isArray(item)) {
+      item.forEach(visit);
+      return;
+    }
+    if (item.field || item.key || item.targetField) {
+      fields.push(String(item.field || item.key || item.targetField));
+    }
+    visit(item.condition);
+    visit(item.conditions);
+    visit(item.rules);
+  };
+  visit(value);
+  return fields.some(field =>
+    /(scope|customer|client|project|region|area|store|shop|campus|college|school|class|班级|学院|校区|区域|门店|客户|项目)/i.test(field)
+  );
+}
+
 function validateDataViewPerformance(label, definition, errors, warnings, storageMode = 'materialized') {
   const viewType = String(definition.viewType || 'row').toLowerCase();
   if (viewType !== 'row' && viewType !== 'aggregate') return;
@@ -7306,6 +7724,9 @@ async function buildResourcePlan(config, target, manifest) {
   await addAutomationPlanActions(config, target, actions, manifest.automations, existing.automations);
   addPlanActions(actions, 'dataView', manifest.dataViews, existing.dataViews, (item, current) => dataViewEquals(target.bound, item, current));
   addPlanActions(actions, 'storageConfig', manifest.storageConfigs, existing.storageConfigs, (item, current) => storageConfigEquals(item, current));
+  addPlanActions(actions, 'scopeDimension', manifest.scopeDimensions, existing.scopeDimensions, (item, current) => scopeDimensionEquals(target.bound, item, current));
+  addPlanActions(actions, 'scopeGrantSource', manifest.scopeGrantSources, existing.scopeGrantSources, (item, current) => scopeGrantSourceEquals(target.bound, item, current));
+  addPlanActions(actions, 'dataScopePolicy', manifest.dataScopePolicies, existing.dataScopePolicies, dataScopePolicyEquals);
   addPlanActions(actions, 'pagePermissionGroup', manifest.pagePermissionGroups, existing.pagePermissionGroups, (item, current) => pagePermissionGroupEquals(target.bound, item, current));
   addPlanActions(actions, 'formPermissionGroup', manifest.formPermissionGroups, existing.formPermissionGroups, (item, current) => formPermissionGroupEquals(target.bound, item, current));
   for (const item of manifest.formSettings || []) {
@@ -7378,6 +7799,9 @@ async function publishResourceManifest(config, target, manifest, options = {}) {
   await publishAuthConfigResources(config, target, manifest.authConfigs || [], result, publishOptions);
   await publishRouteResources(config, target, manifest.routes || [], result, publishOptions);
   await publishAutomationResources(config, target, manifest.automations || [], result, publishOptions);
+  await publishScopeDimensionResources(config, target, manifest.scopeDimensions || [], result, publishOptions);
+  await publishScopeGrantSourceResources(config, target, manifest.scopeGrantSources || [], result, publishOptions);
+  await publishDataScopePolicyResources(config, target, manifest.dataScopePolicies || [], result, publishOptions);
   await publishDataViewResources(config, target, manifest.dataViews || [], result, publishOptions);
   await publishStorageConfigResources(config, target, manifest.storageConfigs || [], result, publishOptions);
   await publishPublicAccessPolicyResources(config, target, manifest.publicAccessPolicies || [], result, publishOptions);
@@ -7408,6 +7832,9 @@ async function fetchExistingResourceMaps(config, target, manifest) {
     automations: new Map(),
     dataViews: new Map(),
     storageConfigs: new Map(),
+    scopeDimensions: new Map(),
+    scopeGrantSources: new Map(),
+    dataScopePolicies: new Map(),
     pagePermissionGroups: new Map(),
     formPermissionGroups: new Map(),
   };
@@ -7620,6 +8047,30 @@ async function fetchExistingResourceMaps(config, target, manifest) {
       });
     }
   }
+  if ((manifest.scopeDimensions || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/dimensions`
+    );
+    indexByCode(maps.scopeDimensions, normalizeItems(data), item => item.code || item.resourceCode);
+  }
+  if ((manifest.scopeGrantSources || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/grant-sources`
+    );
+    indexByCode(maps.scopeGrantSources, normalizeItems(data), item => item.code || item.resourceCode);
+  }
+  if ((manifest.dataScopePolicies || []).length > 0) {
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/policies`
+    );
+    indexByCode(maps.dataScopePolicies, normalizeItems(data), item => item.code || item.resourceCode);
+  }
   if ((manifest.pagePermissionGroups || []).length > 0) {
     const data = await requestWithAuth(
       config,
@@ -8454,6 +8905,102 @@ async function publishAuthConfigResources(config, target, authConfigs, result, o
   }
 }
 
+async function publishScopeDimensionResources(config, target, dimensions, result, options = {}) {
+  for (const item of dimensions) {
+    const code = item.code || item.resourceCode;
+    if (shouldSkipNoopResource(options, 'scopeDimension', code)) {
+      recordNoopResource(result, 'scopeDimension', code, options);
+      continue;
+    }
+    const existing = await findExistingScopeResource(config, target, 'dimensions', code);
+    const body = normalizeScopeDimensionManifest(item, target.bound);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/dimensions/${encodeURIComponent(code)}`,
+      { method: 'POST', body }
+    );
+    saveScopeResource(target, 'scopeDimensions', code, data);
+    result.published.push({
+      kind: 'scopeDimension',
+      code,
+      action: existing ? 'update' : 'create',
+      id: data?.id,
+    });
+  }
+}
+
+async function publishScopeGrantSourceResources(config, target, sources, result, options = {}) {
+  for (const item of sources) {
+    const code = item.code || item.resourceCode;
+    if (shouldSkipNoopResource(options, 'scopeGrantSource', code)) {
+      recordNoopResource(result, 'scopeGrantSource', code, options);
+      continue;
+    }
+    const existing = await findExistingScopeResource(config, target, 'grant-sources', code);
+    const body = normalizeScopeGrantSourceManifest(item, target.bound);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/grant-sources/${encodeURIComponent(code)}`,
+      { method: 'POST', body }
+    );
+    saveScopeResource(target, 'scopeGrantSources', code, data);
+    const published = {
+      kind: 'scopeGrantSource',
+      code,
+      action: existing ? 'update' : 'create',
+      id: data?.id,
+    };
+    if (item.sync === true) {
+      published.sync = await requestWithAuth(
+        config,
+        target.profileName,
+        `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/grant-sources/${encodeURIComponent(code)}/sync`,
+        { method: 'POST', body: { dryRun: false } }
+      );
+    }
+    result.published.push(published);
+  }
+}
+
+async function publishDataScopePolicyResources(config, target, policies, result, options = {}) {
+  for (const item of policies) {
+    const code = item.code || item.resourceCode;
+    if (shouldSkipNoopResource(options, 'dataScopePolicy', code)) {
+      recordNoopResource(result, 'dataScopePolicy', code, options);
+      continue;
+    }
+    const existing = await findExistingScopeResource(config, target, 'policies', code);
+    const body = normalizeDataScopePolicyManifest(item);
+    const data = await requestWithAuth(
+      config,
+      target.profileName,
+      `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/policies/${encodeURIComponent(code)}`,
+      { method: 'POST', body }
+    );
+    saveScopeResource(target, 'dataScopePolicies', code, data);
+    result.published.push({
+      kind: 'dataScopePolicy',
+      code,
+      action: existing ? 'update' : 'create',
+      id: data?.id,
+    });
+  }
+}
+
+async function findExistingScopeResource(config, target, segment, code) {
+  if (!code) return null;
+  const data = await requestWithAuth(
+    config,
+    target.profileName,
+    `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/scope/${segment}`
+  );
+  return normalizeItems(data).find(item =>
+    String(item.code || item.resourceCode || '') === String(code)
+  );
+}
+
 async function publishDataViewResources(config, target, dataViews, result, options = {}) {
   for (const dataViewItem of dataViews) {
     if (shouldSkipNoopResource(options, 'dataView', dataViewItem.code)) {
@@ -9977,11 +10524,20 @@ function normalizeDataViewManifest(bound, dataView) {
     definition: normalizedDefinition,
     refreshConfig: dataView.refreshConfig || dataView.refresh || normalizedDefinition.refresh,
     permissionGroups: Array.isArray(dataView.permissionGroups)
-      ? dataView.permissionGroups.map(group => stripUndefinedValues(withoutResourceMeta(group)))
+      ? dataView.permissionGroups.map(group => normalizeDataViewPermissionGroupManifest(group))
       : undefined,
   });
 }
 
+function normalizeDataViewPermissionGroupManifest(group = {}) {
+  const body = stripUndefinedValues({
+    ...withoutResourceMeta(group),
+    operations: normalizeDataViewPermissionGroupActions(group),
+  });
+  delete body.actions;
+  return body;
+}
+
 function normalizeRouteManifest(route) {
   const code = route.code || route.resourceCode;
   return stripUndefinedValues({
@@ -10016,6 +10572,60 @@ function normalizePublicAccessPolicyManifest(bound, policy) {
   });
 }
 
+function normalizeScopeDimensionManifest(dimension, bound) {
+  const code = dimension.code || dimension.resourceCode;
+  const sourceFormUuid =
+    dimension.sourceFormUuid ||
+    dimension.formUuid ||
+    resolveOptionalFormUuid(bound, dimension.sourceFormCode || dimension.formCode);
+  return stripUndefinedValues({
+    code,
+    name: dimension.name || dimension.title || code,
+    valueType: dimension.valueType || 'string',
+    hierarchyMode: dimension.hierarchyMode || 'flat',
+    sourceFormUuid,
+    sourceValueField: dimension.sourceValueField || dimension.valueField,
+    sourceLabelField: dimension.sourceLabelField || dimension.labelField,
+    sourceParentField: dimension.sourceParentField || dimension.parentField,
+    enabledField: dimension.enabledField,
+    enabled: dimension.enabled !== false,
+    configJson: dimension.configJson || dimension.config,
+  });
+}
+
+function normalizeScopeGrantSourceManifest(source, bound) {
+  const code = source.code || source.resourceCode;
+  const sourceFormUuid =
+    source.sourceFormUuid ||
+    source.formUuid ||
+    resolveOptionalFormUuid(bound, source.sourceFormCode || source.formCode);
+  return stripUndefinedValues({
+    code,
+    name: source.name || source.title || code,
+    sourceFormUuid,
+    subjectMappings: source.subjectMappings || source.subjects || [],
+    dimensionMappings: source.dimensionMappings || source.dimensions || [],
+    operationField: source.operationField,
+    enabledField: source.enabledField,
+    effectiveFromField: source.effectiveFromField,
+    effectiveToField: source.effectiveToField,
+    filterJson: source.filterJson || source.filter,
+    enabled: source.enabled !== false,
+  });
+}
+
+function normalizeDataScopePolicyManifest(policy) {
+  const code = policy.code || policy.resourceCode;
+  return stripUndefinedValues({
+    code,
+    name: policy.name || policy.title || code,
+    matchMode: policy.matchMode === 'OR' ? 'OR' : 'AND',
+    rules: policy.rules || policy.dimensions || [],
+    configJson: policy.configJson || policy.config,
+    enabled: policy.enabled !== false,
+  });
+}
+
 function normalizePublicAccessGrants(bound, grants = {}) {
   const formEntries = [
     ...normalizePermissionCodeArray(grants.forms),
@@ -10579,6 +11189,30 @@ function formPermissionGroupEquals(bound, desired, existing) {
   return stableStringifyForPlan(current, process.cwd()) === stableStringifyForPlan(expected, desired.__dir || process.cwd());
 }
 
+function scopeDimensionEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const expected = normalizeScopeDimensionManifest(desired, bound);
+  return scopeResourceEquals(expected, existing, desired.__dir);
+}
+
+function scopeGrantSourceEquals(bound, desired, existing) {
+  if (!existing) return false;
+  const expected = normalizeScopeGrantSourceManifest(desired, bound);
+  return scopeResourceEquals(expected, existing, desired.__dir);
+}
+
+function dataScopePolicyEquals(desired, existing) {
+  if (!existing) return false;
+  const expected = normalizeDataScopePolicyManifest(desired);
+  return scopeResourceEquals(expected, existing, desired.__dir);
+}
+
+function scopeResourceEquals(expected, existing, baseDir) {
+  const current = pickObjectKeys(existing, Object.keys(expected));
+  return stableStringifyForPlan(current, process.cwd()) ===
+    stableStringifyForPlan(expected, baseDir || process.cwd());
+}
+
 function normalizeFormPermissionGroupManifest(bound, group) {
   const formUuid = resolveManifestFormUuid(bound, group);
   const body = {
@@ -10588,10 +11222,12 @@ function normalizeFormPermissionGroupManifest(bound, group) {
     name: group.name || group.code,
     type: group.type || 'view',
     roles: group.roles || [],
+    operations: normalizeFormPermissionGroupActions(group),
   };
   delete body.code;
   delete body.formCode;
   delete body.form;
+  delete body.actions;
   return stripUndefinedValues(body);
 }
 
@@ -10613,6 +11249,52 @@ function sortStringValues(value = []) {
   return [...(value || [])].map(item => String(item)).sort();
 }
 
+const FORM_PERMISSION_ACTIONS = new Set([
+  'view',
+  'create',
+  'edit',
+  'delete',
+  'export',
+  'import',
+  'change_records',
+  'workflow',
+]);
+
+const DATA_VIEW_PERMISSION_ACTIONS = new Set([
+  'query',
+  'stats',
+  'export',
+  'refresh',
+]);
+
+function normalizePermissionActionValue(action) {
+  const value = String(action || '').trim();
+  if (!value) return '';
+  if (value === 'submit') return 'create';
+  return value;
+}
+
+function normalizePermissionActionArray(value, allowed, fallback = []) {
+  const source = Array.isArray(value) ? value : fallback;
+  return unique(source.map(normalizePermissionActionValue).filter(action => allowed.has(action)));
+}
+
+function normalizeFormPermissionGroupActions(group = {}) {
+  if (group.actions !== undefined || group.operations !== undefined) {
+    return normalizePermissionActionArray(group.actions || group.operations, FORM_PERMISSION_ACTIONS);
+  }
+  return group.type === 'submit'
+    ? ['create']
+    : ['view', 'edit', 'delete', 'change_records', 'workflow'];
+}
+
+function normalizeDataViewPermissionGroupActions(group = {}) {
+  if (group.actions !== undefined || group.operations !== undefined) {
+    return normalizePermissionActionArray(group.actions || group.operations, DATA_VIEW_PERMISSION_ACTIONS);
+  }
+  return ['query'];
+}
+
 function pickObjectKeys(source = {}, keys = []) {
   return keys.reduce((acc, key) => {
     acc[key] = source[key];
@@ -10834,7 +11516,7 @@ function normalizeDataViewPermissionGroupsForPlan(groups = []) {
         code,
         name: group.name || code || '默认权限组',
         roles: Array.isArray(group.roles) ? sortStringValues(group.roles) : [],
-        operations: Array.isArray(group.operations) ? sortStringValues(group.operations) : ['query'],
+        operations: sortStringValues(normalizeDataViewPermissionGroupActions(group)),
         fieldPermissions: normalizeFieldPermissionsForPlan(group.fieldPermissions),
         dataPermission: group.dataPermission || undefined,
       });