Archived
契约:三个端与路由归属(access 必填)、Principal / 角色→端 / 名册同步 schema、退役路由标 @deprecated(ADR-012)
- packages/contracts/src/api/http.ts:新增 SURFACES / surfaceSchema / Surface / SURFACE_LABEL / RouteAccess;RouteContract.access 必填;API_ERROR_CODES 增 'gone'。 - packages/contracts/src/org.ts:staffSchema 补 email? / roles(realm 角色快照);新增 principalSchema/Principal、roleAccessSchema/RoleAccess、rosterSyncOutcomeSchema/RosterSyncOutcome、 inFlightWorkSchema/InFlightWork;旧岗位授权(grant* / governanceFunction*)与 sessionSchema/Session 全部标 @deprecated 留一轮(web 编译不受影响,下个迭代删)。 - workbench.ts / governance.ts / ingest.ts:每条既有路由补 access(按所属端/两端共用/退役 public); 新增 meRoute、authTicketRoute(access:'any')与 syncStaffRoute、setStaffPositionRoute、 staffInFlightRoute、listRoleAccessRoute、setRoleAccessRoute、deleteRoleAccessRoute(access:'ops')。 - apps/api 的 org-service.ts 两处 staff.insert 补 roles: [](staffSchema 新必填字段,该文件下个 迭代会整份替换,这里只是让本次 typecheck 过)。 - 新增 packages/contracts/src/__tests__/route-access.test.ts:95 条路由的 access 归属断言。 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw
This commit is contained in:
xcs
@@ -1,12 +1,13 @@
|
||||
/**
|
||||
* 员工、岗位与权限(编码规范 §4 · `org`;语义出处 OS 02 员工管理)。
|
||||
* 员工、岗位与端(编码规范 §4 · `org`;语义出处 OS 02 员工管理;鉴权归统一鉴权中心,ADR-012)。
|
||||
*
|
||||
* 权限按岗位授予:客体三类(数据 域.对象[.字段] / 治理功能 / 任务)× 动作三种(读 / 写 / 治理)。
|
||||
* 任务负责人与被征答人对所涉内容**天然可见**,不另行授权。
|
||||
* 单组织、≤50 人:不做多租户,不引 OAuth/OIDC(编码规范 §4 鉴权定调)。
|
||||
* 身份来自 Keycloak:`Staff.id` 就是 token 的 `sub`。权限只到「端」(design / ops / workbench),
|
||||
* 角色 → 端由运营中心的表定;岗位仍是本系统的表(流程引擎按它解析负责人)。
|
||||
* 旧的岗位授权(客体三类 × 动作三种)与口令会话已退役 —— 类型留一轮(@deprecated,下个迭代删)。
|
||||
*/
|
||||
import { z } from 'zod';
|
||||
import { positionIdSchema, staffIdSchema } from './id.ts';
|
||||
import { surfaceSchema } from './api/http.ts';
|
||||
|
||||
export const positionSchema = z.object({
|
||||
id: positionIdSchema,
|
||||
@@ -21,27 +22,84 @@ export const staffStateSchema = z.enum(STAFF_STATES);
|
||||
export type StaffState = z.infer<typeof staffStateSchema>;
|
||||
|
||||
export const staffSchema = z.object({
|
||||
/** = Keycloak `sub`(手册硬约束 8:业务外键用 sub,不用用户名) */
|
||||
id: staffIdSchema,
|
||||
/** = `preferred_username`,只作显示 —— 用户名允许改,别拿它当键 */
|
||||
account: z.string().min(1),
|
||||
/** = `name` claim,缺则回退 account */
|
||||
name: z.string().min(1),
|
||||
email: z.string().optional(),
|
||||
/** 未指派 = 哨兵岗 `NONE / 未分配` 的 id */
|
||||
positionId: positionIdSchema,
|
||||
/** 只由名册同步置 `disabled`(Keycloak 停用或删除);有效 token 不改它 */
|
||||
state: staffStateSchema.default('active'),
|
||||
/** realm 角色快照(token 签发时;噪声角色已滤) */
|
||||
roles: z.array(z.string()).default([]),
|
||||
});
|
||||
export type Staff = z.infer<typeof staffSchema>;
|
||||
|
||||
/* ── 岗位授权:客体三类 × 动作三种 ─────────────────────────────────── */
|
||||
/* ── 我是谁、能进哪几个端(ADR-012) ───────────────────────────────── */
|
||||
|
||||
export const principalSchema = z.object({
|
||||
staff: staffSchema,
|
||||
position: positionSchema,
|
||||
roles: z.array(z.string()),
|
||||
ends: z.array(surfaceSchema),
|
||||
});
|
||||
export type Principal = z.infer<typeof principalSchema>;
|
||||
|
||||
/** 角色 → 端:一行一个 realm 角色 */
|
||||
export const roleAccessSchema = z.object({
|
||||
role: z.string().min(1),
|
||||
ends: z.array(surfaceSchema),
|
||||
});
|
||||
export type RoleAccess = z.infer<typeof roleAccessSchema>;
|
||||
|
||||
/** 名册同步的结果 —— 没配 provisioning 就如实说没配,不摆零 */
|
||||
export const rosterSyncOutcomeSchema = z.discriminatedUnion('configured', [
|
||||
z.object({ configured: z.literal(false), message: z.string() }),
|
||||
z.object({
|
||||
configured: z.literal(true),
|
||||
inserted: z.number().int().min(0),
|
||||
updated: z.number().int().min(0),
|
||||
disabled: z.number().int().min(0),
|
||||
total: z.number().int().min(0),
|
||||
}),
|
||||
]);
|
||||
export type RosterSyncOutcome = z.infer<typeof rosterSyncOutcomeSchema>;
|
||||
|
||||
/* ── 在途工作(只读;OS 02:改派先于停用,停用本身已归鉴权中心) ───── */
|
||||
|
||||
export const inFlightWorkSchema = z.object({
|
||||
staffId: staffIdSchema,
|
||||
blocked: z.boolean(),
|
||||
openTasks: z.array(z.object({ taskId: z.string(), title: z.string() })).default([]),
|
||||
openCards: z.array(z.object({ cardId: z.string(), title: z.string() })).default([]),
|
||||
openApprovals: z.array(z.object({ approvalId: z.string(), title: z.string() })).default([]),
|
||||
});
|
||||
export type InFlightWork = z.infer<typeof inFlightWorkSchema>;
|
||||
|
||||
/** @deprecated 随 ADR-012 改名 `inFlightWorkSchema`;下个迭代删 */
|
||||
export const disableCheckSchema = inFlightWorkSchema;
|
||||
/** @deprecated 改用 `InFlightWork` */
|
||||
export type DisableCheck = InFlightWork;
|
||||
|
||||
/* ── 岗位授权(已退役,ADR-012;类型留一轮给 web 编译,下个迭代删) ──── */
|
||||
|
||||
/** @deprecated 权限只到端,动作三分已退役 */
|
||||
export const GRANT_ACTIONS = ['read', 'write', 'govern'] as const;
|
||||
/** @deprecated */
|
||||
export const grantActionSchema = z.enum(GRANT_ACTIONS);
|
||||
/** @deprecated */
|
||||
export type GrantAction = z.infer<typeof grantActionSchema>;
|
||||
|
||||
/** @deprecated */
|
||||
export const GRANT_ACTION_LABEL: Readonly<Record<GrantAction, string>> = {
|
||||
read: '读',
|
||||
write: '写',
|
||||
govern: '治理',
|
||||
};
|
||||
|
||||
/** 治理台九功能 —— 授权客体之一 */
|
||||
/** @deprecated 治理台九功能不再是授权客体 */
|
||||
export const GOVERNANCE_FUNCTIONS = [
|
||||
'task',
|
||||
'staff',
|
||||
@@ -53,9 +111,11 @@ export const GOVERNANCE_FUNCTIONS = [
|
||||
'memory',
|
||||
'system',
|
||||
] as const;
|
||||
/** @deprecated */
|
||||
export const governanceFunctionSchema = z.enum(GOVERNANCE_FUNCTIONS);
|
||||
/** @deprecated */
|
||||
export type GovernanceFunction = z.infer<typeof governanceFunctionSchema>;
|
||||
|
||||
/** @deprecated */
|
||||
export const GOVERNANCE_FUNCTION_LABEL: Readonly<Record<GovernanceFunction, string>> = {
|
||||
task: '任务管理',
|
||||
staff: '员工管理',
|
||||
@@ -68,6 +128,7 @@ export const GOVERNANCE_FUNCTION_LABEL: Readonly<Record<GovernanceFunction, stri
|
||||
system: '系统管理',
|
||||
};
|
||||
|
||||
/** @deprecated */
|
||||
export const grantObjectSchema = z.discriminatedUnion('kind', [
|
||||
z.object({
|
||||
kind: z.literal('data'),
|
||||
@@ -78,34 +139,27 @@ export const grantObjectSchema = z.discriminatedUnion('kind', [
|
||||
z.object({ kind: z.literal('governance'), function: governanceFunctionSchema }),
|
||||
z.object({ kind: z.literal('task'), activityId: z.string().optional() }),
|
||||
]);
|
||||
/** @deprecated */
|
||||
export type GrantObject = z.infer<typeof grantObjectSchema>;
|
||||
|
||||
/** @deprecated */
|
||||
export const grantSchema = z.object({
|
||||
positionId: positionIdSchema,
|
||||
object: grantObjectSchema,
|
||||
action: grantActionSchema,
|
||||
});
|
||||
/** @deprecated */
|
||||
export type Grant = z.infer<typeof grantSchema>;
|
||||
|
||||
/* ── 停用前置检查(OS 02) ─────────────────────────────────────────── */
|
||||
|
||||
/** 员工停用前,其在途任务与待答卡须先改派完毕 */
|
||||
export const disableCheckSchema = z.object({
|
||||
staffId: staffIdSchema,
|
||||
blocked: z.boolean(),
|
||||
openTasks: z.array(z.object({ taskId: z.string(), title: z.string() })).default([]),
|
||||
openCards: z.array(z.object({ cardId: z.string(), title: z.string() })).default([]),
|
||||
openApprovals: z.array(z.object({ approvalId: z.string(), title: z.string() })).default([]),
|
||||
});
|
||||
export type DisableCheck = z.infer<typeof disableCheckSchema>;
|
||||
|
||||
/* ── 会话 ─────────────────────────────────────────────────────────────── */
|
||||
/* ── 会话(已退役:身份在 token 里,ADR-012) ──────────────────────── */
|
||||
|
||||
/** @deprecated 改用 `principalSchema` / `GET /api/me` */
|
||||
export const sessionSchema = z.object({
|
||||
staff: staffSchema,
|
||||
position: positionSchema,
|
||||
grants: z.array(grantSchema),
|
||||
});
|
||||
/** @deprecated 改用 `Principal` */
|
||||
export type Session = z.infer<typeof sessionSchema>;
|
||||
|
||||
/* ── 工作组(ADR-011) ────────────────────────────────────────────────── */
|
||||
|
||||
Reference in New Issue
Block a user