XiaChangSong/BPOS-TMP-REPO
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

统一鉴权中心接入(ADR-012):org 重写为 Keycloak 身份 + 角色→端;中间件按路由归属统一判;口令/会话/岗位授权退役;迁移 0032

Browse Source 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015kAzS35kMnZNt4YGgJXtfw
This commit is contained in:
xcs
2026-08-25 17:40:55 +08:00
co-authored by Claude Opus 5
parent 81a185cd61
commit dd31b91829
38 changed files with 1236 additions and 1485 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/app/routes/desk-approval.ts
+3 -2
View File
@@ -9,6 +9,7 @@ import type { Hono } from 'hono';
import type { ApiError, ApprovalItem, ProcessPackage, ProcessNode } from '@contracts';
import { decideApprovalRoute, listApprovalsForMeRoute } from '@contracts';
import type { Container } from '../container.ts';
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
/** 驳回走向的人读说明 —— 声明式,写在流程包里,不由临场决定 */
@@ -23,7 +24,7 @@ export function registerDeskApprovalRoutes(app: Hono<AppEnv>, container: Contain
/** 我岗位上待批的审批点 —— 审批人由节点声明的岗位解析而来 */
app.get(listApprovalsForMeRoute.path, async (c) => {
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
if (me === undefined) return c.json(unauthenticated, 401);
const workflows = await container.process.listWorkflows(50);
@@ -72,7 +73,7 @@ export function registerDeskApprovalRoutes(app: Hono<AppEnv>, container: Contain
});
app.post(decideApprovalRoute.path, async (c) => {
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
if (me === undefined) return c.json(unauthenticated, 401);
const parsed = decideApprovalRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
apps/api/src/app/routes/desk-elements.ts
+7 -10
View File
@@ -23,13 +23,10 @@ import { MinuteNotFoundError, ResolutionAlreadyRegisteredError } from '@modules/
import type { Report } from '@modules/report';
import { ReportAlreadySubmittedError, ReportNotFoundError } from '@modules/report';
import type { Container } from '../container.ts';
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Container): void {
async function me(account: string) {
return container.org.findByAccount(account);
}
const unauthenticated: ApiError = { code: 'unauthenticated', message: '会话无效' };
/** 汇报投影:草案内容平铺,前端不必知道 draft 的嵌套 */
@@ -85,7 +82,7 @@ export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Containe
});
app.post(createMinuteRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const parsed = createMinuteRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
@@ -104,7 +101,7 @@ export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Containe
});
app.post(appendResolutionRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const parsed = appendResolutionRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
@@ -129,7 +126,7 @@ export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Containe
/** 决议 → 登记起单:登记人即来源(OS 3.1) */
app.post(registerResolutionRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const parsed = registerResolutionRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
@@ -167,14 +164,14 @@ export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Containe
/* ── 汇报 ─────────────────────────────────────────────────────────── */
app.get(listReportsRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const reports = await container.report.list(staff.id);
return c.json({ reports: reports.map(toReportView) });
});
app.get(draftReportRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const period = reportPeriodSchema.safeParse(c.req.param('period'));
if (!period.success) {
@@ -186,7 +183,7 @@ export function registerDeskElementRoutes(app: Hono<AppEnv>, container: Containe
});
app.post(submitReportRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json(unauthenticated, 401);
const parsed = submitReportRoute.body.safeParse(await c.req.json().catch(() => ({})));
try {
apps/api/src/app/routes/desk.ts
+13 -18
View File
@@ -41,6 +41,7 @@ function rowsOf<T>(result: unknown): T[] {
const rows = (result as { rows?: unknown }).rows;
return Array.isArray(rows) ? (rows as T[]) : [];
}
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
import { coerceToColumn, missingReadings, rowLabel } from '../wiring/engines.ts';
import { orderChat } from '../chat-order.ts';
@@ -846,12 +847,6 @@ export function gateOf(
}
export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): void {
/** 当前登录者;缺会话即 401 */
async function me(account: string) {
const staff = await container.org.findByAccount(account);
return staff;
}
/** 任务卡 —— 一条 = 一个活动的一次运行;序位取自工作流的节点实例 */
async function toCard(task: Awaited<ReturnType<Container['task']['get']>>): Promise<TaskCard> {
let position = 1;
@@ -949,7 +944,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
}
app.get(listTasksRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -960,7 +955,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.get(taskDetailRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1192,7 +1187,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 否则再读回来成 `FileDoc` 给前端渲 —— 读得回来才证明那份文件是真的。
*/
app.get(openAssetFileRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1298,7 +1293,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(saveTableRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1337,7 +1332,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
/** 回传:与后端回传校验**同 schema** —— 前端提交校验用的也是它 */
app.post(replyWorkOrderRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1431,7 +1426,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 与工单回传同一条规矩:校验用**同 schema**,拒收由 human-tool 判定并给出违规明细。
*/
app.post(replyChatCardRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1556,7 +1551,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 只许改**自己负责的那一单**的记录 —— 别人的单轮不到你替他标已读。
*/
app.post(markCommReadRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1615,7 +1610,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(sayRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1630,7 +1625,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.get(listMessagesRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1686,7 +1681,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
/** 确认起单(触发确认链路第 5 步)—— 幂等;只有被点名的确认人按得动 */
app.post(confirmTriggerPendingRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1710,7 +1705,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
});
app.post(markMessageReadRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
@@ -1725,7 +1720,7 @@ export function registerDeskRoutes(app: Hono<AppEnv>, container: Container): voi
* 由 message 经统一入口写回来源任务;调用与回传全程在任务侧留痕。
*/
app.post(answerMessageRoute.path, async (c) => {
const staff = await me(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '会话无效' };
return c.json(body, 401);
apps/api/src/app/routes/governance-ops.ts
+8 -137
View File
@@ -7,7 +7,7 @@
import { sql } from 'drizzle-orm';
import { extractText } from '../upload-extract.ts';
import type { Hono } from 'hono';
import type { ApiError, GovernanceFunction, GrantAction } from '@contracts';
import type { ApiError } from '@contracts';
import {
browseLedgerRoute,
controlTaskRoute,
@@ -71,6 +71,7 @@ import {
VersionTakenError,
} from '@modules/process';
import type { Container } from '../container.ts';
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
import { displayLog } from './log-lines.ts';
@@ -366,46 +367,9 @@ async function assembleFromMail(
}
export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Container): void {
/**
* 岗位授权:客体 = 治理功能,动作按路由分级 —— **看是 `read`,动才是 `govern`**。
*
* 客体三类 × 动作三种的分法就是为此:BD 有 `task:read` 能看在途,却动不了控制事件;
* PM 有 `task:govern`,读写皆通(动作蕴含 govern ⊃ write ⊃ read)。
* 一律要 govern 会把只读监控也锁死,等于把三种动作压成一种。
*/
function guard(fn: GovernanceFunction, action: GrantAction) {
return async (account: string): Promise<ApiError | undefined> => {
const staff = await container.org.findByAccount(account);
if (staff === undefined) return { code: 'unauthenticated', message: '会话无效' };
const ok = await container.org.authorize(staff.id, { kind: 'governance', function: fn }, action);
if (ok) return undefined;
const need = action === 'govern' ? '治理权' : '查看权';
return { code: 'forbidden', message: `岗位 ${staff.position.code} 无「${fn}」${need}` };
};
}
const readTask = guard('task', 'read');
const governTask = guard('task', 'govern');
const readProcess = guard('process', 'read');
const governProcess = guard('process', 'govern');
const readTrigger = guard('trigger', 'read');
const governTrigger = guard('trigger', 'govern');
const readActivity = guard('activity', 'read');
const governActivity = guard('activity', 'govern');
const readTool = guard('tool', 'read');
const governTool = guard('tool', 'govern');
const readData = guard('data', 'read');
const readMemory = guard('memory', 'read');
/** 拒绝的 HTTP 语义:无权 403,无会话 401 */
const denyStatus = (body: ApiError): 401 | 403 => (body.code === 'forbidden' ? 403 : 401);
/* ── 任务管理:在途监控 · 控制 · 改派 · 任务日志 ──────────────────── */
app.get(listGovTasksRoute.path, async (c) => {
const denied = await readTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const { staff } = await container.org.listStaff();
const nameOf = new Map(staff.map((s) => [s.id, s.name]));
const rows = await Promise.all(
@@ -438,9 +402,7 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 控制三语义 —— 叫停留痕为最重档纠正信号 */
app.post(controlTaskRoute.path, async (c) => {
const denied = await governTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const staff = await container.org.findByAccount(c.get('account'));
const staff = staffOf(c);
const parsed = controlTaskRoute.body.safeParse(await c.req.json());
if (!parsed.success || staff === undefined) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法' };
@@ -456,18 +418,14 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.post(resumeTaskRoute.path, async (c) => {
const denied = await governTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const staff = await container.org.findByAccount(c.get('account'));
const staff = staffOf(c);
if (staff === undefined) return c.json({ code: 'unauthenticated', message: '会话无效' } satisfies ApiError, 401);
const task = await container.task.resume(taskIdSchema.parse(c.req.param('taskId')), staff.id);
return c.json({ ok: true, runtime: task.runtime });
});
app.post(reassignTaskRoute.path, async (c) => {
const denied = await governTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const staff = await container.org.findByAccount(c.get('account'));
const staff = staffOf(c);
const parsed = reassignTaskRoute.body.safeParse(await c.req.json());
if (!parsed.success || staff === undefined) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法' };
@@ -482,8 +440,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(govTaskLogRoute.path, async (c) => {
const denied = await readTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const lines = await container.memory.taskLog(taskIdSchema.parse(c.req.param('taskId')));
return c.json({
// 与工作台同一份日志、同一套口径:章是四字动作,内容带主语
@@ -502,9 +458,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 它在实现上是卡到审批人工位的验收工单,`taskId` 位坐的是 workflowId(见 wiring/engines.ts)。
*/
app.get(listApprovalsRoute.path, async (c) => {
const denied = await readTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const workflows = await container.process.listWorkflows(50);
const perWorkflow = await Promise.all(
workflows.map(async (w) => {
@@ -551,14 +504,12 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* (指派不是代答,人那一环还是真的),测试台只管起单与看穿全程。
*/
app.post(testRunRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = testRunRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '试跑入参不合协议', detail: parsed.error.issues };
return c.json(body, 400);
}
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
const { packageId, mail, assignments } = parsed.data;
try {
const data = await assembleFromMail(container, packageId, mail);
@@ -592,8 +543,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 仿真不是生产:试跑留下的任务不该在别人工作台上过夜,也不该混进在途口径。
*/
app.post(testStopRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = testStopRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '停止仿真入参不合协议' };
@@ -620,8 +569,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 当前在跑的仿真 —— 刷新页面也认得回来(测试台一次只跑一条) */
app.get(testCurrentRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
/*
* **在跑与跑完要分得开**(`live`)。
*
@@ -668,14 +615,12 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* `origin='testbed'`,好让人随时连根拔掉。
*/
app.post(testRunActivityRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = testRunActivityRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '试跑入参不合协议', detail: parsed.error.issues };
return c.json(body, 400);
}
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
const { activityId, data, message, ownerId } = parsed.data;
/*
* 派给谁:显式指定优先,否则**派给操作者自己**。
@@ -729,8 +674,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 拿 trace 树看不出「第三拍为什么被拒」—— 那句话在任务轨迹里。
*/
app.get(testActivityStateRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const taskId = taskIdSchema.parse(c.req.param('taskId'));
/*
* **「这一单没了」是 404,不是 500**(2026-08-23 用户:「推进完成了,但测试台还在
@@ -776,16 +719,12 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
});
/* ── 上传件:附件要能真正进活动 ─────────────────────────────────── */
/** 上限 8MB —— 超了当场拒,不静默截断(截断过的文件比没有更害人) */
const UPLOAD_CAP = 8 * 1024 * 1024;
app.post(uploadFileRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = uploadFileRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '上传入参不合协议', detail: parsed.error.issues };
@@ -806,7 +745,7 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
}
// 读文本就在入口这一步做完:活动那一侧读得懂的只有文字,读不出就如实记 note
const got = extractText(name, contentType, bytes);
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
const ref = crypto.randomUUID();
await container.db.execute(sql`
insert into sys.upload (id, name, content_type, size, bytes, text, note, uploaded_by)
@@ -823,8 +762,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(downloadFileRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const rows = await container.db.execute<{ name: string; content_type: string; bytes: Buffer }>(
sql`select name, content_type, bytes from sys.upload where id = ${c.req.param('id')}`,
);
@@ -844,8 +781,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 列表只给读数与计数 —— 一次试跑的轨迹上百条,列表页不需要正文 */
app.get(listTestLogsRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const rows = await container.db.execute<TestLogDbRow>(sql`
select id, kind, subject, target, task_id, workflow_id, terminal, reason, used, caps,
jsonb_array_length(trail) as trail_count,
@@ -857,8 +792,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(testLogDetailRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const rows = await container.db.execute<TestLogDbRow & { trail: unknown; drafts: unknown; cards: unknown }>(sql`
select id, kind, subject, target, task_id, workflow_id, terminal, reason, used, caps,
jsonb_array_length(trail) as trail_count,
@@ -875,8 +808,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.delete(deleteTestLogRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const rows = await container.db.execute<{ id: string }>(
sql`delete from sys.testbed_run where id = ${c.req.param('id')} returning id`,
);
@@ -884,25 +815,18 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.delete(clearTestLogsRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const rows = await container.db.execute<{ id: string }>(sql`delete from sys.testbed_run returning id`);
return c.json({ deleted: rowsOf<{ id: string }>(rows).length });
});
/** 全链 Trace:一条工作流的 span 树 —— 节点 → 步骤 / 工具 / 模型 / 人卡 */
app.get(traceOfWorkflowRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const spans = await container.trace.ofWorkflow(c.req.param('id'));
return c.json({ spans });
});
/** 工作流下钻:流程包 × 节点实例 × 在途任务 —— 编排画布的数据面 */
app.get(govWorkflowRoute.path, async (c) => {
const denied = await readTask(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const workflow = await container.process.getWorkflow(c.req.param('id'));
const pkg = await container.process.getPackage(workflow.packageId, workflow.packageVersion);
if (pkg === undefined) {
@@ -945,8 +869,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/* ── 工作流管理 ──────────────────────────────────────────────────── */
app.get(listProcessPackagesRoute.path, async (c) => {
const denied = await readProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
return c.json({ packages: await container.process.listPackages() });
});
@@ -955,8 +877,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 编辑即其身:保存写回当前版本;在途钉版不可变,新版本只出自显式新建。
*/
app.put(saveProcessRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = saveProcessRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '流程包不合 schema', detail: parsed.error.issues };
@@ -986,8 +906,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 版本启停:激活即独占,停用即下线 —— 在途按启动版本跑完,零影响 */
/** 删一版:生效版先停用(409),在途钉版不许删(409)—— 那些单要按它跑完 */
app.delete(deleteProcessVersionRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
try {
const packages = await container.process.deleteVersion(c.req.param('id'), Number(c.req.param('version')));
return c.json({ packages });
@@ -1004,14 +922,10 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/* ── 审批模板(审批活动)—— 活动库里配、编排里引 ─────────────── */
app.get(listApprovalTemplatesRoute.path, async (c) => {
const denied = await readProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
return c.json({ templates: await container.process.approvalTemplates() });
});
app.put(upsertApprovalTemplateRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = upsertApprovalTemplateRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '审批模板不合协议(标识与名称必填)' };
@@ -1021,8 +935,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.delete(deleteApprovalTemplateRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
try {
await container.process.deleteApprovalTemplate(c.req.param('id'));
return c.json({ ok: true });
@@ -1042,8 +954,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 反查放在路由层而不是用例层:process 不该知道 trigger 的存在(L7 不依赖它)。
*/
app.delete(deleteProcessFlowRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const id = c.req.param('id');
const rules = (await container.trigger.list()).filter((t) => t.processPackageId === id);
if (rules.length > 0) {
@@ -1067,8 +977,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 改版本记录:号自己定、名随之 —— 撞号与「跑过单改号」409,别的版一字不动 */
app.post(editProcessVersionRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = editProcessVersionRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '版本号要 1–9999 的整数,名字 1–40 字' };
@@ -1096,8 +1004,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.post(setProcessStateRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = setProcessStateRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '启停状态不合协议' };
@@ -1122,8 +1028,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 画图即校验 —— 与前端画布同源 */
app.post(validateProcessRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = validateProcessRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '流程包不合 schema', detail: parsed.error.issues };
@@ -1135,14 +1039,10 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/* ── 触发器配置 ──────────────────────────────────────────────────── */
app.get(listTriggersRoute.path, async (c) => {
const denied = await readTrigger(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
return c.json({ triggers: await container.trigger.list() });
});
app.post(toggleTriggerRoute.path, async (c) => {
const denied = await governTrigger(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = toggleTriggerRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法' };
@@ -1158,8 +1058,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 设计动规则不碰这两项,运营动这两项不碰规则。
*/
app.post(setTriggerConfirmRoute.path, async (c) => {
const denied = await governTrigger(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = setTriggerConfirmRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法' };
@@ -1178,15 +1076,11 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/** 节点负责人(运营配置):显式指派 > 这里 > 轮值 */
app.get(listNodeOwnersRoute.path, async (c) => {
const denied = await readProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const owners = await container.process.nodeOwners(c.req.param('id'));
return c.json({ owners: Object.entries(owners).map(([nodeId, staffId]) => ({ nodeId, staffId })) });
});
app.put(setNodeOwnerRoute.path, async (c) => {
const denied = await governProcess(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = setNodeOwnerRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法' };
@@ -1201,8 +1095,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 启停不走这里(那是运营的事,见 toggle);改定义同样不动任何流程包版本。
*/
app.put(upsertTriggerRoute.path, async (c) => {
const denied = await governTrigger(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = upsertTriggerRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '触发器不合 schema', detail: parsed.error.issues };
@@ -1219,8 +1111,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 恒为新增、版本并存:装入不覆盖旧版本,在途任务按启动时版本跑完。
*/
app.post(installActivityRoute.path, async (c) => {
const denied = await governActivity(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = installActivityRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '活动清单不合 schema', detail: parsed.error.issues };
@@ -1259,8 +1149,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(listActivitiesRoute.path, async (c) => {
const denied = await readActivity(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const cards = await container.registry.list();
/*
* 契约面随卡一起给 —— 开发一个活动要照着的东西全在清单里:
@@ -1374,8 +1262,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 入目录不等于能用:还要治理台把它放进某个活动的白名单(授权在白名单与契约,不在活动代码)。
*/
app.post(registerToolRoute.path, async (c) => {
const denied = await governTool(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = registerToolRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '工具契约不合 schema', detail: parsed.error.issues };
@@ -1397,8 +1283,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(listToolsRoute.path, async (c) => {
const denied = await readTool(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const tools = await container.toolbox.list();
return c.json({
tools: tools.map((t) => ({
@@ -1417,8 +1301,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/* ── 数据管理:域 / 对象目录 + 记录浏览 ─────────────────────────── */
app.get(listLedgerObjectsRoute.path, async (c) => {
const denied = await readData(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
/*
* 性质随 `listObjects` **一次查询带回**(0026_object_meta)——
* 这里从前是拿 12 个活动的清单现场重建的:`manifestOf` 是 select *,
@@ -1438,9 +1320,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* · 草稿行数与时刻 —— `ledger.__draft`(在办中的单写下的,放行才进正式表)。
*/
app.get(ledgerByActivityRoute.path, async (c) => {
const denied = await readData(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const [cards, materialized] = await Promise.all([
container.registry.list(),
container.ledger.listObjects(),
@@ -1557,8 +1436,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(browseLedgerRoute.path, async (c) => {
const denied = await readData(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const address = { domain: c.req.param('domain'), object: c.req.param('object') };
const described = await container.ledger.describe(address);
if (described === undefined) {
@@ -1595,8 +1472,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
* 仪表读数,同源同口径」),这里只是把它接上,不另起一套口径。
*/
app.get(govMetricsRoute.path, async (c) => {
const denied = await readMemory(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const parsed = govMetricsRoute.query.safeParse(c.req.query());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '统计窗口不合法', detail: parsed.error.issues };
@@ -1612,8 +1487,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
/* ── 系统管理 · 通道实例 ────────────────────────────────────────── */
app.get(listChannelsRoute.path, async (c) => {
const denied = await readTrigger(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const channels = await container.channel.list();
return c.json({
channels: channels.map((ch) => ({
@@ -1632,8 +1505,6 @@ export function registerGovernanceOpsRoutes(app: Hono<AppEnv>, container: Contai
});
app.get(listActivityMemoryRoute.path, async (c) => {
const denied = await readMemory(c.get('account'));
if (denied) return c.json(denied, denyStatus(denied));
const entries = await container.memory.loadActivityMemory(c.req.param('activityId'), { limit: 100 });
return c.json({
entries: entries.map((e) => ({
apps/api/src/app/routes/governance.ts
+70 -89
View File
@@ -1,107 +1,108 @@
/**
* 治理台路由组装(编码规范 §3:治理台九功能不设后端 governance 模块 ——
* 每个功能是对应模块的管理用例 + 本文件的路由组装)。
* 端级授权由 server.ts 的鉴权中间件按路由归属统一判(ADR-012),这里不再各写守卫。
*/
import type { Hono } from 'hono';
import type { ApiError, GovernanceFunction } from '@contracts';
import type { ApiError } from '@contracts';
import {
createStaffRoute,
disableStaffCheckRoute,
disableStaffRoute,
listGrantsRoute,
deleteLlmInstanceRoute,
deleteRoleAccessRoute,
listLlmInstancesRoute,
listLlmProvidersRoute,
listRoleAccessRoute,
listStaffRoute,
listWorkGroupsRoute,
positionIdSchema,
listLlmProvidersRoute,
LLM_PROVIDERS,
deleteLlmInstanceRoute,
probeLlmDraftRoute,
probeLlmInstanceRoute,
saveWorkGroupRoute,
setGrantsRoute,
setRoleAccessRoute,
setStaffPositionRoute,
staffIdSchema,
staffInFlightRoute,
syncStaffRoute,
upsertLlmInstanceRoute,
} from '@contracts';
import { DisableBlockedError } from '@modules/org';
import { AccessLockoutError, PositionNotFoundError, StaffNotFoundError } from '@modules/org';
import { PROVIDER_PROFILES } from '@modules/llm';
import type { Container } from '../container.ts';
import type { AppEnv } from '../http-env.ts';
/** 治理动作要过岗位授权(客体 = 治理功能,动作 = 治理) */
function requireGovern(container: Container, fn: GovernanceFunction) {
return async (account: string): Promise<ApiError | undefined> => {
const staff = await container.org.findByAccount(account);
if (staff === undefined) return { code: 'unauthenticated', message: '会话无效' };
const ok = await container.org.authorize(staff.id, { kind: 'governance', function: fn }, 'govern');
return ok ? undefined : { code: 'forbidden', message: `岗位 ${staff.position.code} 无「${fn}」治理权` };
};
}
export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container): void {
const guardStaff = requireGovern(container, 'staff');
const guardSystem = requireGovern(container, 'system');
/* ── 员工管理:名册来自鉴权中心,这里只管岗位与同步(ADR-012) ─────────── */
/* ── 员工管理 ─────────────────────────────────────────────────────── */
app.get(listStaffRoute.path, async (c) => c.json(await container.org.listStaff()));
app.get(listStaffRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
return c.json(await container.org.listStaff());
});
/** 从 Keycloak Admin API 同步名册;没配 provisioning 就回 configured:false(界面不撒谎) */
app.post(syncStaffRoute.path, async (c) => c.json(await container.org.syncRoster()));
app.post(createStaffRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const parsed = createStaffRoute.body.safeParse(await c.req.json());
app.put(setStaffPositionRoute.path, async (c) => {
const staffId = staffIdSchema.parse(c.req.param('staffId'));
const parsed = setStaffPositionRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
return c.json(body, 400);
}
return c.json(await container.org.createStaff(parsed.data));
});
app.get(disableStaffCheckRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const staffId = staffIdSchema.parse(c.req.param('staffId'));
return c.json(await container.org.checkDisable(staffId));
});
app.post(disableStaffRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const staffId = staffIdSchema.parse(c.req.param('staffId'));
try {
await container.org.disableStaff(staffId);
return c.json({ ok: true, check: await container.org.checkDisable(staffId) });
return c.json(await container.org.setPosition(staffId, parsed.data.positionId));
} catch (error) {
if (error instanceof DisableBlockedError) {
// 停用前置检查未过:在途任务与待答卡须先改派完毕(OS 02)
const body: ApiError = { code: 'precondition-failed', message: error.message, detail: error.check };
return c.json(body, 412);
if (error instanceof StaffNotFoundError || error instanceof PositionNotFoundError) {
const body: ApiError = { code: 'not-found', message: error.message };
return c.json(body, 404);
}
throw error;
}
});
app.get(listGrantsRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const positionId = positionIdSchema.parse(c.req.param('positionId'));
return c.json({ grants: await container.org.listGrants(positionId) });
/** 此人身上还挂着什么 —— 原「停用前置检查」降为只读信息;停用在 Keycloak 做 */
app.get(staffInFlightRoute.path, async (c) => {
const staffId = staffIdSchema.parse(c.req.param('staffId'));
try {
return c.json(await container.org.inFlightOf(staffId));
} catch (error) {
if (error instanceof StaffNotFoundError) {
const body: ApiError = { code: 'not-found', message: error.message };
return c.json(body, 404);
}
throw error;
}
});
app.post(setGrantsRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const positionId = positionIdSchema.parse(c.req.param('positionId'));
const parsed = setGrantsRoute.body.safeParse(await c.req.json());
/* ── 角色 → 端(ADR-012) ─────────────────────────────────────────────── */
app.get(listRoleAccessRoute.path, async (c) => c.json(await container.org.listRoleAccess()));
/** 锁死不变量不过(改完没人能进运营中心)→ 409 */
app.put(setRoleAccessRoute.path, async (c) => {
const role = c.req.param('role');
const parsed = setRoleAccessRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
return c.json(body, 400);
}
return c.json({ grants: await container.org.setGrants(positionId, parsed.data.grants) });
try {
return c.json(await container.org.setRoleAccess(role, parsed.data.ends));
} catch (error) {
if (error instanceof AccessLockoutError) {
const body: ApiError = { code: 'conflict', message: error.message };
return c.json(body, 409);
}
throw error;
}
});
app.delete(deleteRoleAccessRoute.path, async (c) => {
try {
await container.org.deleteRoleAccess(c.req.param('role'));
return c.json({ ok: true });
} catch (error) {
if (error instanceof AccessLockoutError) {
const body: ApiError = { code: 'conflict', message: error.message };
return c.json(body, 409);
}
throw error;
}
});
/* ── 员工管理 · 工作组(ADR-011) ──────────────────────────────────── */
@@ -111,8 +112,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
* `ownerName` 一并带出:前端要显示的是「柴浩的组」,不是一串 id。
*/
app.get(listWorkGroupsRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const { staff } = await container.org.listStaff();
const found = await Promise.all(
staff.map(async (s) => {
@@ -129,8 +128,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
* 改组**不影响在途**:装进工作流的是起单时的快照。
*/
app.put(saveWorkGroupRoute.path, async (c) => {
const denied = await guardStaff(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const parsed = saveWorkGroupRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '工作组不合 schema', detail: parsed.error.issues };
@@ -149,10 +146,8 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
/* ── 系统管理 · LLM 实例 ──────────────────────────────────────────── */
/** Provider 档案:默认端点与出参口径 —— 建实例的表单据它预填(唯一真相在服务端) */
app.get(listLlmProvidersRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
return c.json({
app.get(listLlmProvidersRoute.path, (c) =>
c.json({
providers: LLM_PROVIDERS.map((provider) => {
const profile = PROVIDER_PROFILES[provider];
return {
@@ -162,18 +157,12 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
structuredOutput: profile.structuredOutput,
};
}),
});
});
}),
);
app.get(listLlmInstancesRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
return c.json({ instances: await container.llm.list() });
});
app.get(listLlmInstancesRoute.path, async (c) => c.json({ instances: await container.llm.list() }));
app.post(upsertLlmInstanceRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const parsed = upsertLlmInstanceRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
@@ -184,8 +173,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
/** 删实例:被活动声明着的用途名不许删(409)—— 反查放这一层,llm 不该知道活动的存在 */
app.delete(deleteLlmInstanceRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const id = c.req.param('id');
const target = (await container.llm.list()).find((i) => i.id === id);
if (target === undefined) {
@@ -208,8 +195,6 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
/** 测试连接(草稿):只测不存 —— 必须排在 `/:id/probe` 之前,否则会被那条路由吃掉 */
app.post(probeLlmDraftRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
const parsed = probeLlmDraftRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '入参不合法', detail: parsed.error.issues };
@@ -218,9 +203,5 @@ export function registerGovernanceRoutes(app: Hono<AppEnv>, container: Container
return c.json(await container.llm.probeDraft(parsed.data));
});
app.post(probeLlmInstanceRoute.path, async (c) => {
const denied = await guardSystem(c.get('account'));
if (denied) return c.json(denied, denied.code === 'forbidden' ? 403 : 401);
return c.json(await container.llm.probe(c.req.param('id')));
});
app.post(probeLlmInstanceRoute.path, async (c) => c.json(await container.llm.probe(c.req.param('id'))));
}
apps/api/src/app/routes/registration.ts
+3 -2
View File
@@ -10,6 +10,7 @@ import type { Hono } from 'hono';
import type { ApiError } from '@contracts';
import { fireRegistrationRoute, listRegistrationTriggersRoute, triggerKindOf } from '@contracts';
import type { Container } from '../container.ts';
import { staffOf } from '../http-env.ts';
import type { AppEnv } from '../http-env.ts';
export function registerRegistrationRoutes(app: Hono<AppEnv>, container: Container): void {
@@ -17,7 +18,7 @@ export function registerRegistrationRoutes(app: Hono<AppEnv>, container: Contain
/** 可登记起单的触发器 + 各自流程包的调用接口 schema(表单由它自动渲染) */
app.get(listRegistrationTriggersRoute.path, async (c) => {
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
if (me === undefined) return c.json(unauthenticated, 401);
const triggers = await container.trigger.list();
@@ -38,7 +39,7 @@ export function registerRegistrationRoutes(app: Hono<AppEnv>, container: Contain
});
app.post(fireRegistrationRoute.path, async (c) => {
const me = await container.org.findByAccount(c.get('account'));
const me = staffOf(c);
if (me === undefined) return c.json(unauthenticated, 401);
const parsed = fireRegistrationRoute.body.safeParse(await c.req.json());
if (!parsed.success) {
apps/api/src/app/routes/workbench.ts
+16 -40
View File
@@ -1,13 +1,13 @@
/**
* 工作台路由组装 —— 路由契约在 @contracts/api,实现在此(编码规范 §3 / §9.2)。
* 登录 / 登出属鉴权面:中间件在 app 层,身份判定读 `org` 出口(§4 / ADR-010)。
* 登录已归统一鉴权中心(ADR-012):这里只剩「我是谁」与票据。
*/
import type { Hono } from 'hono';
import type { ApiError } from '@contracts';
import { CONTRACTS_VERSION, healthRoute, loginRoute, logoutRoute, sessionRoute } from '@contracts';
import { CONTRACTS_VERSION, authTicketRoute, healthRoute, meRoute } from '@contracts';
import type { Container } from '../container.ts';
import { SESSION_COOKIE, clearSessionCookie, setSessionCookie } from '../session-cookie.ts';
import type { AppEnv } from '../http-env.ts';
import { systemClock } from '../runtime.ts';
export function registerWorkbenchRoutes(app: Hono<AppEnv>, container: Container): void {
app.get(healthRoute.path, async (c) => {
@@ -21,44 +21,20 @@ export function registerWorkbenchRoutes(app: Hono<AppEnv>, container: Container)
return c.json({ ok: db === 'up', version: CONTRACTS_VERSION, db });
});
/** 我是谁 —— 会话由中间件解好放进上下文,这里只回投影 */
app.get(sessionRoute.path, (c) => {
const session = c.get('session');
if (session === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '尚未登录' };
return c.json(body, 401);
}
return c.json(session);
const unauthenticated: ApiError = { code: 'unauthenticated', message: '缺少 Bearer token' };
/** 我是谁、我能进哪几个端 —— 中间件已把 principal 放进上下文,这里只回投影;ends 为空也 200 */
app.get(meRoute.path, (c) => {
const principal = c.get('principal');
if (principal === undefined) return c.json(unauthenticated, 401);
return c.json(principal);
});
app.post(loginRoute.path, async (c) => {
const parsed = loginRoute.body.safeParse(await c.req.json().catch(() => ({})));
if (!parsed.success) {
const body: ApiError = { code: 'validation-failed', message: '请填写账号与口令' };
return c.json(body, 400);
}
const issued = await container.org.login(parsed.data.account, parsed.data.password);
// 失败只有一句话:不区分账号不存在 / 已停用 / 口令错,不外泄账号是否存在
if (issued === undefined) {
const body: ApiError = { code: 'unauthenticated', message: '账号或口令不对' };
return c.json(body, 401);
}
const session = await container.org.resolveSession(issued.token);
if (session === undefined) {
const body: ApiError = { code: 'internal', message: '会话签发后立即失效' };
return c.json(body, 500);
}
setSessionCookie(c, issued.token, new Date(issued.expiresAt));
return c.json(session);
});
app.post(logoutRoute.path, async (c) => {
const token = c.req.header('cookie')?.match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([^;]+)`))?.[1];
// 服务端表先作废,再清 cookie —— 顺序反了会留下「cookie 没了但会话还活着」的窗口
if (token !== undefined) await container.org.logout(token);
clearSessionCookie(c);
return c.json({ ok: true });
/** 60 秒票据(ADR-012 §9.3)—— 给 EventSource 与 <a href> 下载这两条带不了 Authorization 头的路 */
app.get(authTicketRoute.path, (c) => {
const principal = c.get('principal');
if (principal === undefined) return c.json(unauthenticated, 401);
const issued = container.tickets.issue(principal.staff.id, systemClock.now());
return c.json({ ticket: issued.ticket, expiresAt: issued.expiresAt.toISOString() });
});
}