openxiangda 1.0.40 → 1.0.41

package/lib/cli.js

@@ -2310,7 +2310,7 @@ async function permission(args) {
     const target = getWorkspaceTarget(config, profileName, flags);
     const formUuid = flags['form-uuid'] || resolveOptionalFormUuid(target.bound, flags['form-code']);
     if (!groupCode || !name || !formUuid) {
-      fail('用法: openxiangda permission form-group-create <groupCode> --form-code <formCode>|--form-uuid <FORM_XXX> --name <text> --type <submit|view>');
+      fail('用法: openxiangda permission form-group-create <groupCode> --form-code <formCode>|--form-uuid <FORM_XXX> --name <text> --type <submit|view> [--field-access-policy-json <file|json>]');
     }
     const data = await requestWithAuth(
       config,
@@ -2334,6 +2334,14 @@ async function permission(args) {
                 ),
               }
             : {}),
+          ...(flags['field-access-policy-json']
+            ? {
+                fieldAccessPolicy: readJsonArg(
+                  flags['field-access-policy-json'],
+                  'field-access-policy-json'
+                ),
+              }
+            : {}),
           ...(flags['data-permission-json']
             ? {
                 dataPermission: readJsonArg(

package/openxiangda-skills/references/openxiangda-api.md

@@ -458,10 +458,17 @@ Body:
   "dataScope": [{ "type": "self" }],
   "operations": ["view"],
   "fieldPermissions": [],
+  "fieldAccessPolicy": {
+    "defaultAccess": "edit",
+    "fields": [{ "fieldId": "internalRemark", "access": "readonly" }]
+  },
   "dataPermission": null
 }
 ```
 
+`fieldPermissions` is only the frontend display-default state. Use
+`fieldAccessPolicy` for backend-enforced field access.
+
 ### GET `/apps/:appType/forms/:formUuid/permission-groups/:groupId`
 
 Requires Bearer token. Returns form permission group detail.

package/openxiangda-skills/references/permissions-settings.md

@@ -86,20 +86,43 @@ View group:
   "fieldPermissions": [
     {
       "componentName": "Text",
-      "fieldName": "客户名称",
-      "label": "customerName",
+      "fieldName": "customerName",
+      "label": "客户名称",
       "value": "FORM_FILED_VIEW"
     }
-  ]
+  ],
+  "fieldAccessPolicy": {
+    "defaultAccess": "edit",
+    "fields": [
+      { "fieldId": "internalRemark", "access": "readonly" },
+      { "fieldId": "marginAmount", "access": "hidden" }
+    ]
+  }
 }
 ```
 
-Field permission values:
+`fieldPermissions` remains a frontend display-default setting. Do not treat it as real data
+read/write permission. Real backend field access is controlled by `fieldAccessPolicy`.
+
+Frontend display-default field permission values:
 
 - `FORM_FILED_EDIT`
 - `FORM_FILED_VIEW`
 - `FORM_FILED_HIDDEN`
 
+Real field access policy:
+
+- `defaultAccess`: one of `edit`, `readonly`, `hidden`; omitted/null policies are equivalent
+  to `{ "defaultAccess": "edit", "fields": [] }`.
+- `fields`: exception list keyed by schema field ID, such as `textField_xxx`; only store
+  fields whose access differs from `defaultAccess`.
+- `edit` means visible and editable.
+- `readonly` means visible but not editable.
+- `hidden` means not visible and not editable.
+- If multiple matched view groups apply to the same user, field access merges by
+  `edit > readonly > hidden`.
+- App administrators bypass `fieldAccessPolicy`.
+
 Common data scopes:
 
 - `all`

package/openxiangda-skills/skills/openxiangda-permission-settings/SKILL.md

@@ -82,10 +82,15 @@ openxiangda permission form-group-create sales_limited \
   --roles sales \
   --data-scope-json data-scope.json \
   --field-permissions-json fields.json \
+  --field-access-policy-json field-access-policy.json \
   --data-permission-json data-permission.json \
   --profile dev
 ```
 
+`fieldPermissions` is the frontend display-default state. Use `fieldAccessPolicy`
+for real backend read/write field access (`edit`, `readonly`, `hidden`) with
+`defaultAccess` plus field-ID exceptions.
+
 ## Inspection
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.40",
+  "version": "1.0.41",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/packages/sdk/dist/runtime/index.d.mts

@@ -10,6 +10,15 @@ interface FieldPermissionDto {
     label: string;
     value: "FORM_FILED_EDIT" | "FORM_FILED_VIEW" | "FORM_FILED_HIDDEN";
 }
+type FieldAccessLevel = "edit" | "readonly" | "hidden";
+interface FieldAccessPolicyItemDto {
+    fieldId: string;
+    access: FieldAccessLevel;
+}
+interface FieldAccessPolicyDto {
+    defaultAccess: FieldAccessLevel;
+    fields?: FieldAccessPolicyItemDto[];
+}
 type ViewFieldPermissionValue = "FORM_FILED_EDIT" | "FORM_FILED_VIEW" | "FORM_FILED_HIDDEN";
 interface DataPermissionRuleDto {
     field: string;
@@ -535,6 +544,7 @@ interface FormPermissionGroup {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
     createdAt?: string;
     updatedAt?: string;
@@ -553,6 +563,7 @@ interface CreateFormPermissionGroupDto {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
 }
 interface UpdateFormPermissionGroupDto {
@@ -564,6 +575,7 @@ interface UpdateFormPermissionGroupDto {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
 }
 interface QueryFormPermissionGroupDto {
@@ -965,4 +977,4 @@ declare const usePageRoute: () => PageRouteInfo;
 
 declare const usePageSdk: () => PageSdk;
 
-export { type ApiPermissionListParams, type ApproveTaskParams, type AssignPermissionsParams, type AssignRolesParams, type AuthLogoutRedirectOptions, type BatchAddUsersToRoleParams, type BatchSendNotificationByTypeParams, type ChangeUserRoleParams, type ConnectorCallParams, type ConnectorInvokeParams, type ConnectorInvokeResult, type ConnectorRequestBodyType, type ConnectorResponseType, type CreateApiPermissionParams, type CreateFormPermissionGroupDto, type CreatePagePermissionGroupDto, type CreateRoleParams, type CreateUiPermissionParams, type CreateUserParams, type CurrentUserDepartmentParents, type CustomPageEntryConfig, type CustomPageEntryMode, type DataManagementConfigParams, type DataManagementFilterState, type DataPermissionConditionDto, type DataPermissionDto, type DataPermissionRuleDto, type DataViewQueryParams, type DataViewQueryResult, type DataViewStatsParams, type FieldPermissionDto, type FindNotificationConfigParams, type FormAdvancedSearchParams, type FormChangeRecordParams, type FormCreateParams, type FormExportParams, type FormGetDetailParams, type FormImportParams, type FormPermissionGroup, type FormRemoveParams, type FormSearchParams, type FormUpdateParams, type GetParentDepartmentsOptions, type GetProcessInstanceParams, type GetUserRolesParams, type ImportExportRecordDownloadParams, type ImportExportRecordQuery, type InstanceStatus, type NotificationChannel, type NotificationChannelConfig, type NotificationChannelsConfig, type NotificationConfigLevel, type NotificationMessageRecord, type NotificationTemplate, type NotificationTemplatePreview, type NotificationTypeConfig, type PageApiPermissionRecord, type PageApiResponse, type PageAppInfo, type PageBinaryResponse, type PageBridgeApi, type PageContext, type PageDataManagementConfig, type PageDataSourceDescriptor, type PageDepartmentInfo, type PageDepartmentRecord, type PageHttpMethod, type PageInfo, type PageListResult, type PageMessageApi, type PageModalApi, type PageNavigationApi, type PageOffsetListResult, type PagePermissionGroup, type PagePermissionInfo, PageProvider, type PageQueryValue, type PageRequestOptions, type PageRoleRecord, type PageRouteInfo, type PageScope, type PageSdk, type PageSdkError, type PageSdkMeta, type PageTransportDownloadPayload, type PageTransportRequestPayload, type PageUiPermissionRecord, type PageUiPermissionType, type PageUserInfo, type PageUserRecord, type PageUserType, type PreviewNotificationTemplateParams, type ProcessApproveAction, type QueryFormPermissionGroupDto, type QueryPagePermissionGroupDto, type RoleListParams, type RoleUsersParams, type SaveDataManagementConfigParams, type SearchComponentName, type SearchExpression, type SearchFieldKey, type SearchGroup, type SearchLogic, type SearchOperator, type SearchRule, type SearchSortItem, type SearchSystemField, type SendNotificationByTypeParams, type SendNotificationResult, type SubFormRule, type SwitchAppRoleParams, type SwitchPlatformRoleParams, type TerminateProcessInstanceParams, type TriggerCallbackTaskParams, type UiPermissionListParams, type UpdateApiPermissionParams, type UpdateFormPermissionGroupDto, type UpdatePagePermissionGroupDto, type UpdateRoleParams, type UpdateUiPermissionParams, type UpdateUserParams, type UserListParams, type UserMenuPermissionsResponse, type ValidateUserParams, type ViewFieldPermissionValue, type ViewOperationPermission, type ViewPermissionSummary, createPageSdk, createReactPage, useCurrentUser, useDataSource, useFormViewPermissions, useMessage, useModal, useNavigation, usePageContext, usePageProps, usePageRoute, usePageSdk };
+export { type ApiPermissionListParams, type ApproveTaskParams, type AssignPermissionsParams, type AssignRolesParams, type AuthLogoutRedirectOptions, type BatchAddUsersToRoleParams, type BatchSendNotificationByTypeParams, type ChangeUserRoleParams, type ConnectorCallParams, type ConnectorInvokeParams, type ConnectorInvokeResult, type ConnectorRequestBodyType, type ConnectorResponseType, type CreateApiPermissionParams, type CreateFormPermissionGroupDto, type CreatePagePermissionGroupDto, type CreateRoleParams, type CreateUiPermissionParams, type CreateUserParams, type CurrentUserDepartmentParents, type CustomPageEntryConfig, type CustomPageEntryMode, type DataManagementConfigParams, type DataManagementFilterState, type DataPermissionConditionDto, type DataPermissionDto, type DataPermissionRuleDto, type DataViewQueryParams, type DataViewQueryResult, type DataViewStatsParams, type FieldAccessLevel, type FieldAccessPolicyDto, type FieldAccessPolicyItemDto, type FieldPermissionDto, type FindNotificationConfigParams, type FormAdvancedSearchParams, type FormChangeRecordParams, type FormCreateParams, type FormExportParams, type FormGetDetailParams, type FormImportParams, type FormPermissionGroup, type FormRemoveParams, type FormSearchParams, type FormUpdateParams, type GetParentDepartmentsOptions, type GetProcessInstanceParams, type GetUserRolesParams, type ImportExportRecordDownloadParams, type ImportExportRecordQuery, type InstanceStatus, type NotificationChannel, type NotificationChannelConfig, type NotificationChannelsConfig, type NotificationConfigLevel, type NotificationMessageRecord, type NotificationTemplate, type NotificationTemplatePreview, type NotificationTypeConfig, type PageApiPermissionRecord, type PageApiResponse, type PageAppInfo, type PageBinaryResponse, type PageBridgeApi, type PageContext, type PageDataManagementConfig, type PageDataSourceDescriptor, type PageDepartmentInfo, type PageDepartmentRecord, type PageHttpMethod, type PageInfo, type PageListResult, type PageMessageApi, type PageModalApi, type PageNavigationApi, type PageOffsetListResult, type PagePermissionGroup, type PagePermissionInfo, PageProvider, type PageQueryValue, type PageRequestOptions, type PageRoleRecord, type PageRouteInfo, type PageScope, type PageSdk, type PageSdkError, type PageSdkMeta, type PageTransportDownloadPayload, type PageTransportRequestPayload, type PageUiPermissionRecord, type PageUiPermissionType, type PageUserInfo, type PageUserRecord, type PageUserType, type PreviewNotificationTemplateParams, type ProcessApproveAction, type QueryFormPermissionGroupDto, type QueryPagePermissionGroupDto, type RoleListParams, type RoleUsersParams, type SaveDataManagementConfigParams, type SearchComponentName, type SearchExpression, type SearchFieldKey, type SearchGroup, type SearchLogic, type SearchOperator, type SearchRule, type SearchSortItem, type SearchSystemField, type SendNotificationByTypeParams, type SendNotificationResult, type SubFormRule, type SwitchAppRoleParams, type SwitchPlatformRoleParams, type TerminateProcessInstanceParams, type TriggerCallbackTaskParams, type UiPermissionListParams, type UpdateApiPermissionParams, type UpdateFormPermissionGroupDto, type UpdatePagePermissionGroupDto, type UpdateRoleParams, type UpdateUiPermissionParams, type UpdateUserParams, type UserListParams, type UserMenuPermissionsResponse, type ValidateUserParams, type ViewFieldPermissionValue, type ViewOperationPermission, type ViewPermissionSummary, createPageSdk, createReactPage, useCurrentUser, useDataSource, useFormViewPermissions, useMessage, useModal, useNavigation, usePageContext, usePageProps, usePageRoute, usePageSdk };

package/packages/sdk/dist/runtime/index.d.ts

@@ -10,6 +10,15 @@ interface FieldPermissionDto {
     label: string;
     value: "FORM_FILED_EDIT" | "FORM_FILED_VIEW" | "FORM_FILED_HIDDEN";
 }
+type FieldAccessLevel = "edit" | "readonly" | "hidden";
+interface FieldAccessPolicyItemDto {
+    fieldId: string;
+    access: FieldAccessLevel;
+}
+interface FieldAccessPolicyDto {
+    defaultAccess: FieldAccessLevel;
+    fields?: FieldAccessPolicyItemDto[];
+}
 type ViewFieldPermissionValue = "FORM_FILED_EDIT" | "FORM_FILED_VIEW" | "FORM_FILED_HIDDEN";
 interface DataPermissionRuleDto {
     field: string;
@@ -535,6 +544,7 @@ interface FormPermissionGroup {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
     createdAt?: string;
     updatedAt?: string;
@@ -553,6 +563,7 @@ interface CreateFormPermissionGroupDto {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
 }
 interface UpdateFormPermissionGroupDto {
@@ -564,6 +575,7 @@ interface UpdateFormPermissionGroupDto {
     dataScope?: "all" | "self";
     operations?: string[];
     fieldPermissions?: FieldPermissionDto[];
+    fieldAccessPolicy?: FieldAccessPolicyDto | null;
     dataPermission?: DataPermissionDto;
 }
 interface QueryFormPermissionGroupDto {
@@ -965,4 +977,4 @@ declare const usePageRoute: () => PageRouteInfo;
 
 declare const usePageSdk: () => PageSdk;
 
-export { type ApiPermissionListParams, type ApproveTaskParams, type AssignPermissionsParams, type AssignRolesParams, type AuthLogoutRedirectOptions, type BatchAddUsersToRoleParams, type BatchSendNotificationByTypeParams, type ChangeUserRoleParams, type ConnectorCallParams, type ConnectorInvokeParams, type ConnectorInvokeResult, type ConnectorRequestBodyType, type ConnectorResponseType, type CreateApiPermissionParams, type CreateFormPermissionGroupDto, type CreatePagePermissionGroupDto, type CreateRoleParams, type CreateUiPermissionParams, type CreateUserParams, type CurrentUserDepartmentParents, type CustomPageEntryConfig, type CustomPageEntryMode, type DataManagementConfigParams, type DataManagementFilterState, type DataPermissionConditionDto, type DataPermissionDto, type DataPermissionRuleDto, type DataViewQueryParams, type DataViewQueryResult, type DataViewStatsParams, type FieldPermissionDto, type FindNotificationConfigParams, type FormAdvancedSearchParams, type FormChangeRecordParams, type FormCreateParams, type FormExportParams, type FormGetDetailParams, type FormImportParams, type FormPermissionGroup, type FormRemoveParams, type FormSearchParams, type FormUpdateParams, type GetParentDepartmentsOptions, type GetProcessInstanceParams, type GetUserRolesParams, type ImportExportRecordDownloadParams, type ImportExportRecordQuery, type InstanceStatus, type NotificationChannel, type NotificationChannelConfig, type NotificationChannelsConfig, type NotificationConfigLevel, type NotificationMessageRecord, type NotificationTemplate, type NotificationTemplatePreview, type NotificationTypeConfig, type PageApiPermissionRecord, type PageApiResponse, type PageAppInfo, type PageBinaryResponse, type PageBridgeApi, type PageContext, type PageDataManagementConfig, type PageDataSourceDescriptor, type PageDepartmentInfo, type PageDepartmentRecord, type PageHttpMethod, type PageInfo, type PageListResult, type PageMessageApi, type PageModalApi, type PageNavigationApi, type PageOffsetListResult, type PagePermissionGroup, type PagePermissionInfo, PageProvider, type PageQueryValue, type PageRequestOptions, type PageRoleRecord, type PageRouteInfo, type PageScope, type PageSdk, type PageSdkError, type PageSdkMeta, type PageTransportDownloadPayload, type PageTransportRequestPayload, type PageUiPermissionRecord, type PageUiPermissionType, type PageUserInfo, type PageUserRecord, type PageUserType, type PreviewNotificationTemplateParams, type ProcessApproveAction, type QueryFormPermissionGroupDto, type QueryPagePermissionGroupDto, type RoleListParams, type RoleUsersParams, type SaveDataManagementConfigParams, type SearchComponentName, type SearchExpression, type SearchFieldKey, type SearchGroup, type SearchLogic, type SearchOperator, type SearchRule, type SearchSortItem, type SearchSystemField, type SendNotificationByTypeParams, type SendNotificationResult, type SubFormRule, type SwitchAppRoleParams, type SwitchPlatformRoleParams, type TerminateProcessInstanceParams, type TriggerCallbackTaskParams, type UiPermissionListParams, type UpdateApiPermissionParams, type UpdateFormPermissionGroupDto, type UpdatePagePermissionGroupDto, type UpdateRoleParams, type UpdateUiPermissionParams, type UpdateUserParams, type UserListParams, type UserMenuPermissionsResponse, type ValidateUserParams, type ViewFieldPermissionValue, type ViewOperationPermission, type ViewPermissionSummary, createPageSdk, createReactPage, useCurrentUser, useDataSource, useFormViewPermissions, useMessage, useModal, useNavigation, usePageContext, usePageProps, usePageRoute, usePageSdk };
+export { type ApiPermissionListParams, type ApproveTaskParams, type AssignPermissionsParams, type AssignRolesParams, type AuthLogoutRedirectOptions, type BatchAddUsersToRoleParams, type BatchSendNotificationByTypeParams, type ChangeUserRoleParams, type ConnectorCallParams, type ConnectorInvokeParams, type ConnectorInvokeResult, type ConnectorRequestBodyType, type ConnectorResponseType, type CreateApiPermissionParams, type CreateFormPermissionGroupDto, type CreatePagePermissionGroupDto, type CreateRoleParams, type CreateUiPermissionParams, type CreateUserParams, type CurrentUserDepartmentParents, type CustomPageEntryConfig, type CustomPageEntryMode, type DataManagementConfigParams, type DataManagementFilterState, type DataPermissionConditionDto, type DataPermissionDto, type DataPermissionRuleDto, type DataViewQueryParams, type DataViewQueryResult, type DataViewStatsParams, type FieldAccessLevel, type FieldAccessPolicyDto, type FieldAccessPolicyItemDto, type FieldPermissionDto, type FindNotificationConfigParams, type FormAdvancedSearchParams, type FormChangeRecordParams, type FormCreateParams, type FormExportParams, type FormGetDetailParams, type FormImportParams, type FormPermissionGroup, type FormRemoveParams, type FormSearchParams, type FormUpdateParams, type GetParentDepartmentsOptions, type GetProcessInstanceParams, type GetUserRolesParams, type ImportExportRecordDownloadParams, type ImportExportRecordQuery, type InstanceStatus, type NotificationChannel, type NotificationChannelConfig, type NotificationChannelsConfig, type NotificationConfigLevel, type NotificationMessageRecord, type NotificationTemplate, type NotificationTemplatePreview, type NotificationTypeConfig, type PageApiPermissionRecord, type PageApiResponse, type PageAppInfo, type PageBinaryResponse, type PageBridgeApi, type PageContext, type PageDataManagementConfig, type PageDataSourceDescriptor, type PageDepartmentInfo, type PageDepartmentRecord, type PageHttpMethod, type PageInfo, type PageListResult, type PageMessageApi, type PageModalApi, type PageNavigationApi, type PageOffsetListResult, type PagePermissionGroup, type PagePermissionInfo, PageProvider, type PageQueryValue, type PageRequestOptions, type PageRoleRecord, type PageRouteInfo, type PageScope, type PageSdk, type PageSdkError, type PageSdkMeta, type PageTransportDownloadPayload, type PageTransportRequestPayload, type PageUiPermissionRecord, type PageUiPermissionType, type PageUserInfo, type PageUserRecord, type PageUserType, type PreviewNotificationTemplateParams, type ProcessApproveAction, type QueryFormPermissionGroupDto, type QueryPagePermissionGroupDto, type RoleListParams, type RoleUsersParams, type SaveDataManagementConfigParams, type SearchComponentName, type SearchExpression, type SearchFieldKey, type SearchGroup, type SearchLogic, type SearchOperator, type SearchRule, type SearchSortItem, type SearchSystemField, type SendNotificationByTypeParams, type SendNotificationResult, type SubFormRule, type SwitchAppRoleParams, type SwitchPlatformRoleParams, type TerminateProcessInstanceParams, type TriggerCallbackTaskParams, type UiPermissionListParams, type UpdateApiPermissionParams, type UpdateFormPermissionGroupDto, type UpdatePagePermissionGroupDto, type UpdateRoleParams, type UpdateUiPermissionParams, type UpdateUserParams, type UserListParams, type UserMenuPermissionsResponse, type ValidateUserParams, type ViewFieldPermissionValue, type ViewOperationPermission, type ViewPermissionSummary, createPageSdk, createReactPage, useCurrentUser, useDataSource, useFormViewPermissions, useMessage, useModal, useNavigation, usePageContext, usePageProps, usePageRoute, usePageSdk };