Archived
契约:三个端与路由归属(access 必填)、Principal / 角色→端 / 名册同步 schema、退役路由标 @deprecated(ADR-012)
- packages/contracts/src/api/http.ts:新增 SURFACES / surfaceSchema / Surface / SURFACE_LABEL / RouteAccess;RouteContract.access 必填;API_ERROR_CODES 增 'gone'。 - packages/contracts/src/org.ts:staffSchema 补 email? / roles(realm 角色快照);新增 principalSchema/Principal、roleAccessSchema/RoleAccess、rosterSyncOutcomeSchema/RosterSyncOutcome、 inFlightWorkSchema/InFlightWork;旧岗位授权(grant* / governanceFunction*)与 sessionSchema/Session 全部标 @deprecated 留一轮(web 编译不受影响,下个迭代删)。 - workbench.ts / governance.ts / ingest.ts:每条既有路由补 access(按所属端/两端共用/退役 public); 新增 meRoute、authTicketRoute(access:'any')与 syncStaffRoute、setStaffPositionRoute、 staffInFlightRoute、listRoleAccessRoute、setRoleAccessRoute、deleteRoleAccessRoute(access:'ops')。 - apps/api 的 org-service.ts 两处 staff.insert 补 roles: [](staffSchema 新必填字段,该文件下个 迭代会整份替换,这里只是让本次 typecheck 过)。 - 新增 packages/contracts/src/__tests__/route-access.test.ts:95 条路由的 access 归属断言。 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw
This commit is contained in:
xcs
+107
-23
@@ -1,9 +1,9 @@
|
||||
/**
|
||||
* 员工、岗位与权限(编码规范 §4 · `org`;语义出处 OS 02 员工管理)。
|
||||
* 员工、岗位与端(编码规范 §4 · `org`;语义出处 OS 02 员工管理;鉴权归统一鉴权中心,ADR-012)。
|
||||
*
|
||||
* 权限按岗位授予:客体三类(数据 域.对象[.字段] / 治理功能 / 任务)× 动作三种(读 / 写 / 治理)。
|
||||
* 任务负责人与被征答人对所涉内容**天然可见**,不另行授权。
|
||||
* 单组织、≤50 人:不做多租户,不引 OAuth/OIDC(编码规范 §4 鉴权定调)。
|
||||
* 身份来自 Keycloak:`Staff.id` 就是 token 的 `sub`。权限只到「端」(design / ops / workbench),
|
||||
* 角色 → 端由运营中心的表定;岗位仍是本系统的表(流程引擎按它解析负责人)。
|
||||
* 旧的岗位授权(客体三类 × 动作三种)与口令会话已退役 —— 类型留一轮(@deprecated,下个迭代删)。
|
||||
*/
|
||||
import { z } from 'zod';
|
||||
export declare const positionSchema: z.ZodObject<{
|
||||
@@ -23,23 +23,115 @@ export declare const staffSchema: z.ZodObject<{
|
||||
id: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
account: z.ZodString;
|
||||
name: z.ZodString;
|
||||
email: z.ZodOptional<z.ZodString>;
|
||||
positionId: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
state: z.ZodDefault<z.ZodEnum<{
|
||||
active: "active";
|
||||
disabled: "disabled";
|
||||
}>>;
|
||||
roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
||||
}, z.core.$strip>;
|
||||
export type Staff = z.infer<typeof staffSchema>;
|
||||
export declare const principalSchema: z.ZodObject<{
|
||||
staff: z.ZodObject<{
|
||||
id: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
account: z.ZodString;
|
||||
name: z.ZodString;
|
||||
email: z.ZodOptional<z.ZodString>;
|
||||
positionId: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
state: z.ZodDefault<z.ZodEnum<{
|
||||
active: "active";
|
||||
disabled: "disabled";
|
||||
}>>;
|
||||
roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
||||
}, z.core.$strip>;
|
||||
position: z.ZodObject<{
|
||||
id: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
code: z.ZodString;
|
||||
name: z.ZodString;
|
||||
note: z.ZodOptional<z.ZodString>;
|
||||
}, z.core.$strip>;
|
||||
roles: z.ZodArray<z.ZodString>;
|
||||
ends: z.ZodArray<z.ZodEnum<{
|
||||
design: "design";
|
||||
ops: "ops";
|
||||
workbench: "workbench";
|
||||
}>>;
|
||||
}, z.core.$strip>;
|
||||
export type Principal = z.infer<typeof principalSchema>;
|
||||
/** 角色 → 端:一行一个 realm 角色 */
|
||||
export declare const roleAccessSchema: z.ZodObject<{
|
||||
role: z.ZodString;
|
||||
ends: z.ZodArray<z.ZodEnum<{
|
||||
design: "design";
|
||||
ops: "ops";
|
||||
workbench: "workbench";
|
||||
}>>;
|
||||
}, z.core.$strip>;
|
||||
export type RoleAccess = z.infer<typeof roleAccessSchema>;
|
||||
/** 名册同步的结果 —— 没配 provisioning 就如实说没配,不摆零 */
|
||||
export declare const rosterSyncOutcomeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
||||
configured: z.ZodLiteral<false>;
|
||||
message: z.ZodString;
|
||||
}, z.core.$strip>, z.ZodObject<{
|
||||
configured: z.ZodLiteral<true>;
|
||||
inserted: z.ZodNumber;
|
||||
updated: z.ZodNumber;
|
||||
disabled: z.ZodNumber;
|
||||
total: z.ZodNumber;
|
||||
}, z.core.$strip>], "configured">;
|
||||
export type RosterSyncOutcome = z.infer<typeof rosterSyncOutcomeSchema>;
|
||||
export declare const inFlightWorkSchema: z.ZodObject<{
|
||||
staffId: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
blocked: z.ZodBoolean;
|
||||
openTasks: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
taskId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openCards: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
cardId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openApprovals: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
approvalId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
}, z.core.$strip>;
|
||||
export type InFlightWork = z.infer<typeof inFlightWorkSchema>;
|
||||
/** @deprecated 随 ADR-012 改名 `inFlightWorkSchema`;下个迭代删 */
|
||||
export declare const disableCheckSchema: z.ZodObject<{
|
||||
staffId: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
blocked: z.ZodBoolean;
|
||||
openTasks: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
taskId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openCards: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
cardId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openApprovals: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
approvalId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
}, z.core.$strip>;
|
||||
/** @deprecated 改用 `InFlightWork` */
|
||||
export type DisableCheck = InFlightWork;
|
||||
/** @deprecated 权限只到端,动作三分已退役 */
|
||||
export declare const GRANT_ACTIONS: readonly ["read", "write", "govern"];
|
||||
/** @deprecated */
|
||||
export declare const grantActionSchema: z.ZodEnum<{
|
||||
read: "read";
|
||||
write: "write";
|
||||
govern: "govern";
|
||||
}>;
|
||||
/** @deprecated */
|
||||
export type GrantAction = z.infer<typeof grantActionSchema>;
|
||||
/** @deprecated */
|
||||
export declare const GRANT_ACTION_LABEL: Readonly<Record<GrantAction, string>>;
|
||||
/** 治理台九功能 —— 授权客体之一 */
|
||||
/** @deprecated 治理台九功能不再是授权客体 */
|
||||
export declare const GOVERNANCE_FUNCTIONS: readonly ["task", "staff", "process", "trigger", "activity", "tool", "data", "memory", "system"];
|
||||
/** @deprecated */
|
||||
export declare const governanceFunctionSchema: z.ZodEnum<{
|
||||
trigger: "trigger";
|
||||
data: "data";
|
||||
@@ -51,8 +143,11 @@ export declare const governanceFunctionSchema: z.ZodEnum<{
|
||||
process: "process";
|
||||
memory: "memory";
|
||||
}>;
|
||||
/** @deprecated */
|
||||
export type GovernanceFunction = z.infer<typeof governanceFunctionSchema>;
|
||||
/** @deprecated */
|
||||
export declare const GOVERNANCE_FUNCTION_LABEL: Readonly<Record<GovernanceFunction, string>>;
|
||||
/** @deprecated */
|
||||
export declare const grantObjectSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
||||
kind: z.ZodLiteral<"data">;
|
||||
domain: z.ZodString;
|
||||
@@ -75,7 +170,9 @@ export declare const grantObjectSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
||||
kind: z.ZodLiteral<"task">;
|
||||
activityId: z.ZodOptional<z.ZodString>;
|
||||
}, z.core.$strip>], "kind">;
|
||||
/** @deprecated */
|
||||
export type GrantObject = z.infer<typeof grantObjectSchema>;
|
||||
/** @deprecated */
|
||||
export declare const grantSchema: z.ZodObject<{
|
||||
positionId: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
object: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
||||
@@ -106,35 +203,21 @@ export declare const grantSchema: z.ZodObject<{
|
||||
govern: "govern";
|
||||
}>;
|
||||
}, z.core.$strip>;
|
||||
/** @deprecated */
|
||||
export type Grant = z.infer<typeof grantSchema>;
|
||||
/** 员工停用前,其在途任务与待答卡须先改派完毕 */
|
||||
export declare const disableCheckSchema: z.ZodObject<{
|
||||
staffId: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
blocked: z.ZodBoolean;
|
||||
openTasks: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
taskId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openCards: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
cardId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
openApprovals: z.ZodDefault<z.ZodArray<z.ZodObject<{
|
||||
approvalId: z.ZodString;
|
||||
title: z.ZodString;
|
||||
}, z.core.$strip>>>;
|
||||
}, z.core.$strip>;
|
||||
export type DisableCheck = z.infer<typeof disableCheckSchema>;
|
||||
/** @deprecated 改用 `principalSchema` / `GET /api/me` */
|
||||
export declare const sessionSchema: z.ZodObject<{
|
||||
staff: z.ZodObject<{
|
||||
id: z.core.$ZodBranded<z.ZodString, "StaffId", "out">;
|
||||
account: z.ZodString;
|
||||
name: z.ZodString;
|
||||
email: z.ZodOptional<z.ZodString>;
|
||||
positionId: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
state: z.ZodDefault<z.ZodEnum<{
|
||||
active: "active";
|
||||
disabled: "disabled";
|
||||
}>>;
|
||||
roles: z.ZodDefault<z.ZodArray<z.ZodString>>;
|
||||
}, z.core.$strip>;
|
||||
position: z.ZodObject<{
|
||||
id: z.core.$ZodBranded<z.ZodString, "PositionId", "out">;
|
||||
@@ -173,6 +256,7 @@ export declare const sessionSchema: z.ZodObject<{
|
||||
}>;
|
||||
}, z.core.$strip>>;
|
||||
}, z.core.$strip>;
|
||||
/** @deprecated 改用 `Principal` */
|
||||
export type Session = z.infer<typeof sessionSchema>;
|
||||
/**
|
||||
* 工作组 —— 一组「岗位 → 员工」的绑定,起单时装载、随工作流走。
|
||||
|
||||
Reference in New Issue
Block a user