openxiangda 1.0.261 → 1.0.263

package/packages/sdk/dist/runtime/react.d.mts

@@ -115,6 +115,8 @@ interface AppFunctionOperatorInfo {
     email?: string | null;
     tenantId?: string;
     roleCodes?: string[];
+    /** Platform identity codes maintained by organization sync. */
+    platformRoleCodes?: string[];
     currentRoleCode?: string | null;
     currentRoleName?: string | null;
     hasFullAccess?: boolean;
@@ -126,10 +128,13 @@ interface AppFunctionOperatorInfo {
 interface PagePermissionInfo {
     canView: boolean;
     hasFullAccess: boolean;
+    /** Platform identity codes are additive to app role codes. */
+    platformRoleCodes?: string[];
     [key: string]: unknown;
 }
 interface AppFunctionPermissionContext {
     roleCodes?: string[];
+    platformRoleCodes?: string[];
     currentRoleCode?: string | null;
     currentRoleName?: string | null;
     hasFullAccess?: boolean;
@@ -1142,6 +1147,7 @@ interface FormPermissionGroup {
     name: string;
     type: "submit" | "view";
     roles: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     actions?: string[];
@@ -1168,6 +1174,7 @@ interface CreateFormPermissionGroupDto {
     name: string;
     type: "submit" | "view";
     roles: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     actions?: string[];
@@ -1181,6 +1188,7 @@ interface UpdateFormPermissionGroupDto {
     name?: string;
     type?: "submit" | "view";
     roles?: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
@@ -1200,6 +1208,7 @@ interface PagePermissionGroup {
     appType: string;
     name: string;
     roles: string[];
+    platformRoleCodes?: string[];
     menuFormUuids: string[];
     createdAt?: string;
     updatedAt?: string;
@@ -1208,12 +1217,14 @@ interface CreatePagePermissionGroupDto {
     appType: string;
     name: string;
     roles: string[];
+    platformRoleCodes?: string[];
     menuFormUuids: string[];
 }
 interface UpdatePagePermissionGroupDto {
     appType?: string;
     name?: string;
     roles?: string[];
+    platformRoleCodes?: string[];
     menuFormUuids?: string[];
 }
 interface QueryPagePermissionGroupDto {
@@ -1226,6 +1237,7 @@ interface UserMenuPermissionsResponse {
     appType: string;
     menuFormUuids: string[];
     hasFullAccess: boolean;
+    platformRoleCodes?: string[];
 }
 type NotificationChannel = "inapp" | "email" | "dingding" | "wechat" | "thirdparty_todo";
 interface SendNotificationByTypeParams {
@@ -2687,6 +2699,7 @@ interface RuntimePagePermissions {
     appType: string;
     hasFullAccess: boolean;
     roleCodes: string[];
+    platformRoleCodes?: string[];
     roleSource?: string;
     menuFormUuids: string[];
     menuCodes: string[];

package/packages/sdk/dist/runtime/react.d.ts

@@ -115,6 +115,8 @@ interface AppFunctionOperatorInfo {
     email?: string | null;
     tenantId?: string;
     roleCodes?: string[];
+    /** Platform identity codes maintained by organization sync. */
+    platformRoleCodes?: string[];
     currentRoleCode?: string | null;
     currentRoleName?: string | null;
     hasFullAccess?: boolean;
@@ -126,10 +128,13 @@ interface AppFunctionOperatorInfo {
 interface PagePermissionInfo {
     canView: boolean;
     hasFullAccess: boolean;
+    /** Platform identity codes are additive to app role codes. */
+    platformRoleCodes?: string[];
     [key: string]: unknown;
 }
 interface AppFunctionPermissionContext {
     roleCodes?: string[];
+    platformRoleCodes?: string[];
     currentRoleCode?: string | null;
     currentRoleName?: string | null;
     hasFullAccess?: boolean;
@@ -1142,6 +1147,7 @@ interface FormPermissionGroup {
     name: string;
     type: "submit" | "view";
     roles: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     actions?: string[];
@@ -1168,6 +1174,7 @@ interface CreateFormPermissionGroupDto {
     name: string;
     type: "submit" | "view";
     roles: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     actions?: string[];
@@ -1181,6 +1188,7 @@ interface UpdateFormPermissionGroupDto {
     name?: string;
     type?: "submit" | "view";
     roles?: string[];
+    platformRoleCodes?: string[];
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
@@ -1200,6 +1208,7 @@ interface PagePermissionGroup {
     appType: string;
     name: string;
     roles: string[];
+    platformRoleCodes?: string[];
     menuFormUuids: string[];
     createdAt?: string;
     updatedAt?: string;
@@ -1208,12 +1217,14 @@ interface CreatePagePermissionGroupDto {
     appType: string;
     name: string;
     roles: string[];
+    platformRoleCodes?: string[];
     menuFormUuids: string[];
 }
 interface UpdatePagePermissionGroupDto {
     appType?: string;
     name?: string;
     roles?: string[];
+    platformRoleCodes?: string[];
     menuFormUuids?: string[];
 }
 interface QueryPagePermissionGroupDto {
@@ -1226,6 +1237,7 @@ interface UserMenuPermissionsResponse {
     appType: string;
     menuFormUuids: string[];
     hasFullAccess: boolean;
+    platformRoleCodes?: string[];
 }
 type NotificationChannel = "inapp" | "email" | "dingding" | "wechat" | "thirdparty_todo";
 interface SendNotificationByTypeParams {
@@ -2687,6 +2699,7 @@ interface RuntimePagePermissions {
     appType: string;
     hasFullAccess: boolean;
     roleCodes: string[];
+    platformRoleCodes?: string[];
     roleSource?: string;
     menuFormUuids: string[];
     menuCodes: string[];

package/templates/openxiangda-react-spa/AGENTS.md

@@ -17,7 +17,7 @@
 - 调查预算默认为一次覆盖完整调用链的 CodeGraph 查询，只有明确缺失符号时再补一次精确查询；普通任务只加载一个领域技能。租约、构建或部署状态未变化时不重复输出相同进度，使用 `openxiangda task status --watch` 等待状态变化。
 - 账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权需求必须先运行 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，输出权限矩阵后再实现。
 - 应用角色只读查询组织账号时声明 `app:organization:read`；创建、修改账号/部门或重置密码时声明 `app:organization:manage`。创建角色、分配成员或维护权限组也必须在角色资源的 `apiPermissionCodes` 声明对应的 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`。
-- 家校关系页面声明 `app:organization:school-contact:read` 并调用 `sdk.organization.schoolContact.*`；默认范围是当前租户全部关系。只有明确需要本人或任教班级限制时才改用 `:self:read` / `:class:read`。
+- 家校关系页面调用 `sdk.organization.schoolContact.*`；已登录非游客用户无需绑定应用角色权限，默认范围是当前租户全部关系。只有明确需要本人或任教班级限制时才声明 `:self:read` / `:class:read`。
 - 默认用户界面保持克制：左侧应用导航、顶部账号信息、首页内容区域。
 - 不在默认可见页面展示 SDK、Runtime、Cookie、Proxy、Playwright、AI 验证、调试上下文、构建号等开发语言。
 - 使用 React Router 管理路由，路由定义在 `src/app/router.tsx`。

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -51,7 +51,7 @@ Delivery V2 自动从期望状态按资源指纹计算精确范围，使用 CLI
 - ✅ L2/L3 保留 context → propose → 用户确认 → approve；默认只创建 change/coverage/release，完整文档由 `sdd render` 按需生成。approval、coverage 与实际发布范围为硬门禁，未完成的任务/证据/规格文案只告警。需要严格文档门禁时显式配置 `strictDocumentation: true`。
 - ✅ 涉及账号、角色、权限、数据范围、组织账号、RBAC、查询参数授权时，先跑 `openxiangda design gates --topic permissions --json`，选择 `managed-platform-account` / `existing-platform-user-assignment` / `static-role-permission` / `query-param-context`，并输出权限矩阵后再改资源。
 - ✅ 某个应用角色如果要查询组织账号，声明 `app:organization:read`；如需创建、修改账号/部门或重置密码，再声明 `app:organization:manage`。角色设置、页面/表单权限组等能力同样通过 `src/resources/roles/<code>.json` 的 `apiPermissionCodes` 显式授权，例如 `app:role:manage`、`app:page-permission-group:manage`、`app:form-permission-group:manage`。
-- ✅ 查询家校通讯录的家长、学生、教师身份和监护关系时声明 `app:organization:school-contact:read`，并使用 `sdk.organization.schoolContact.*` / `ctx.organization.schoolContact.*`。该权限默认查询当前租户全部关系；只有明确要求时才改用 `:self:read` 或 `:class:read` 收紧。
+- ✅ 查询家校通讯录的家长、学生、教师身份和监护关系时使用 `sdk.organization.schoolContact.*` / `ctx.organization.schoolContact.*`。已登录非游客用户无需绑定应用角色权限，默认查询当前租户全部关系；只有明确要求时才声明 `:self:read` 或 `:class:read` 收紧。
 - ✅ 单文件改动默认按 change 和逻辑资源增量发布：`workspace plan --profile <name> --change <change> --changed`，再 `workspace publish --profile <name> --change <change> --only pages/a,forms/b --dry-run` → 正式发布。
 - ✅ 用户 token 在 `~/.openxiangda/profiles.json`；项目 state 在 `.openxiangda/state.json`（只存 ID）。
 - ✅ 共享环境（`APP_OSS_*`、反馈机器人等）在 `~/.openxiangda/.env`，项目 `.env` 仅做 per-workspace override。