Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 suyx
|
d738ea175e | ||
|
suyx
|
19212cc1b6 |
+228
-3
@@ -10,6 +10,9 @@ import {
|
||||
AccountProfileUpdateResponseSchema,
|
||||
AccountSettingsResponseSchema,
|
||||
AdminAuthenticatedUserSchema,
|
||||
AdminGenerationRecordSchema,
|
||||
AdminGenerationListResponseSchema,
|
||||
AdminOverviewResponseSchema,
|
||||
AdminCreditParamsSchema,
|
||||
AdminLoginCompleteRequestSchema,
|
||||
AdminLoginCompleteResponseSchema,
|
||||
@@ -60,6 +63,10 @@ import {
|
||||
ModelConfigUpdateRequestSchema,
|
||||
ModelParamsSchema,
|
||||
ModelConfigUpdateHeadersSchema,
|
||||
PrivateContentGenerationParamsSchema,
|
||||
PrivateContentNoticeAckRequestSchema,
|
||||
PrivateContentNoticeAckResponseSchema,
|
||||
PrivateContentPromptResponseSchema,
|
||||
FailedEmptyTrashRequestSchema,
|
||||
FailedEmptyTrashResponseSchema,
|
||||
ExportFormatSchema,
|
||||
@@ -110,6 +117,7 @@ import {
|
||||
type BootstrapResponse,
|
||||
type AdminLoginCompleteRequest,
|
||||
type AdminLoginSendRequest,
|
||||
type AdminOverviewResponse,
|
||||
type AccountDeletionCompleteRequest,
|
||||
type AccountProfileUpdateRequest,
|
||||
type AdminCreditParams,
|
||||
@@ -178,6 +186,7 @@ import type { RecentAssetService } from "./recent-assets.js";
|
||||
import type { AmapAdapter } from "./amap-adapter.js";
|
||||
import { ModelConfigurationError } from "./model-configuration.js";
|
||||
import type { ModelConfigurationService } from "./model-configuration.js";
|
||||
import { PrivateContentError, PrivateContentService } from "./private-content.js";
|
||||
|
||||
const defaultBootstrap: BootstrapResponse = {
|
||||
app_version: "0.0.0",
|
||||
@@ -192,6 +201,7 @@ const defaultBootstrap: BootstrapResponse = {
|
||||
};
|
||||
|
||||
export interface CreateAppOptions {
|
||||
adminOverview?: () => AdminOverviewResponse | Promise<AdminOverviewResponse>;
|
||||
amap?: AmapAdapter;
|
||||
assetReleases?: AssetReleaseReader;
|
||||
bootstrap?: () => BootstrapResponse | Promise<BootstrapResponse>;
|
||||
@@ -218,6 +228,7 @@ export interface CreateAppOptions {
|
||||
releaseVersion: string;
|
||||
resourceId: string;
|
||||
}) => boolean | Promise<boolean>;
|
||||
privateContent?: PrivateContentService;
|
||||
registration?: RegistrationService;
|
||||
}
|
||||
|
||||
@@ -637,6 +648,13 @@ function sendBrowserUnsupported(
|
||||
export async function createApp(options: CreateAppOptions = {}) {
|
||||
const eventHub = options.eventHub ?? new EventHub();
|
||||
const bootstrap = options.bootstrap ?? (() => defaultBootstrap);
|
||||
const privateContent = options.privateContent ?? (options.registration
|
||||
? new PrivateContentService(
|
||||
options.registration.database,
|
||||
options.registration.options.currentPrivacyNoticeVersion,
|
||||
options.registration.options.clock,
|
||||
)
|
||||
: undefined);
|
||||
const browserGate = options.browserGate ?? true;
|
||||
const browserSupportSecret = options.browserSupportSecret ?? randomBytes(32);
|
||||
const browserSupportRelease = options.browserSupportRelease;
|
||||
@@ -688,6 +706,13 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
AdminLoginCompleteRequestSchema,
|
||||
AdminLoginCompleteResponseSchema,
|
||||
AdminSessionResponseSchema,
|
||||
AdminGenerationRecordSchema,
|
||||
AdminGenerationListResponseSchema,
|
||||
PrivateContentNoticeAckRequestSchema,
|
||||
PrivateContentNoticeAckResponseSchema,
|
||||
PrivateContentPromptResponseSchema,
|
||||
PrivateContentGenerationParamsSchema,
|
||||
AdminOverviewResponseSchema,
|
||||
CreditSummarySchema,
|
||||
CreditEntryTypeSchema,
|
||||
CreditEntryStatusSchema,
|
||||
@@ -829,6 +854,167 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
status: "ready",
|
||||
}));
|
||||
|
||||
const readAdminRequestSession = (request: { headers: Record<string, string | string[] | undefined> }) => {
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
return token && options.registration ? options.registration.readAdminSession(token) : undefined;
|
||||
};
|
||||
const privateContentNoticeRequired = (reply: FastifyReply, correlationId: string) => {
|
||||
const notice = privateContent?.currentNotice();
|
||||
return reply.code(428).send(createErrorEnvelope({
|
||||
code: "PRIVATE_CONTENT_NOTICE_ACK_REQUIRED",
|
||||
correlationId,
|
||||
details: { latest_version: notice?.version ?? "" },
|
||||
}));
|
||||
};
|
||||
|
||||
app.post(
|
||||
"/api/v1/admin/private-content-notice/ack",
|
||||
{
|
||||
attachValidation: true,
|
||||
schema: {
|
||||
body: Type.Ref(PrivateContentNoticeAckRequestSchema),
|
||||
headers: Type.Intersect([Type.Ref(CsrfHeadersSchema), Type.Ref(RegistrationCompleteHeadersSchema)]),
|
||||
operationId: "ackPrivateContentNotice",
|
||||
response: {
|
||||
200: Type.Ref(PrivateContentNoticeAckResponseSchema),
|
||||
400: Type.Ref(ErrorEnvelopeSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
403: Type.Ref(ErrorEnvelopeSchema),
|
||||
428: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Ref(ErrorEnvelopeSchema),
|
||||
},
|
||||
tags: ["Admin Private Content"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (request.validationError || !headerValue(request.headers["idempotency-key"])) {
|
||||
return reply.code(400).send(createErrorEnvelope({
|
||||
code: "REGISTRATION_REQUEST_INVALID",
|
||||
correlationId: request.id,
|
||||
details: { field_errors: [{ field: "headers", message_key: "request.headers.invalid" }] },
|
||||
}));
|
||||
}
|
||||
if (!privateContent || !options.registration) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
if (!token) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
const admin = options.registration.authorizeAdminMutation({
|
||||
csrfToken: headerValue(request.headers["x-csrf-token"]) ?? "",
|
||||
sessionToken: token,
|
||||
});
|
||||
const result = privateContent.acknowledge(admin.userId, (request.body as { expected_notice_version: string }).expected_notice_version);
|
||||
return { acknowledged_at: result.acknowledgedAt, notice_version: result.noticeVersion, status: "acknowledged" as const };
|
||||
} catch (error) {
|
||||
if (error instanceof RegistrationError) return registrationFailure(reply, request.id, error);
|
||||
if (error instanceof PrivateContentError && error.code === "notice_version_conflict") return privateContentNoticeRequired(reply, request.id);
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/generations",
|
||||
{
|
||||
schema: {
|
||||
operationId: "listAdminGenerations",
|
||||
response: {
|
||||
200: Type.Ref(AdminGenerationListResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
428: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Ref(ErrorEnvelopeSchema),
|
||||
},
|
||||
tags: ["Admin Private Content"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!privateContent || !options.registration) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
const session = readAdminRequestSession(request);
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
privateContent.requireAcknowledgement(session.user_id);
|
||||
return privateContent.listGenerations();
|
||||
} catch (error) {
|
||||
if (error instanceof PrivateContentError && error.code === "notice_required") return privateContentNoticeRequired(reply, request.id);
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/private-content/generations/:generationId/prompt",
|
||||
{
|
||||
attachValidation: true,
|
||||
schema: {
|
||||
params: Type.Ref(PrivateContentGenerationParamsSchema),
|
||||
operationId: "openAdminGenerationPrompt",
|
||||
response: {
|
||||
200: Type.Ref(PrivateContentPromptResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
404: Type.Null(),
|
||||
428: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Ref(ErrorEnvelopeSchema),
|
||||
},
|
||||
tags: ["Admin Private Content"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (request.validationError) return reply.code(404).send(null);
|
||||
if (!privateContent || !options.registration) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
const session = readAdminRequestSession(request);
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
const generationId = (request.params as { generationId: string }).generationId;
|
||||
const value = privateContent.readPrompt(session.user_id, generationId);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
return { content_type: "prompt" as const, generation_id: value.generationId, prompt: value.prompt };
|
||||
} catch (error) {
|
||||
if (error instanceof PrivateContentError && error.code === "notice_required") return privateContentNoticeRequired(reply, request.id);
|
||||
if (error instanceof PrivateContentError && error.code === "not_found") return reply.code(404).send(null);
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/private-content/generations/:generationId/image",
|
||||
{
|
||||
attachValidation: true,
|
||||
schema: {
|
||||
params: Type.Ref(PrivateContentGenerationParamsSchema),
|
||||
operationId: "openAdminGenerationImage",
|
||||
produces: ["application/octet-stream"],
|
||||
response: {
|
||||
200: Type.String({ format: "binary" }),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
404: Type.Null(),
|
||||
428: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Ref(ErrorEnvelopeSchema),
|
||||
},
|
||||
tags: ["Admin Private Content"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (request.validationError) return reply.code(404).send(null);
|
||||
if (!privateContent || !options.registration || !options.latestExports) return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
const session = readAdminRequestSession(request);
|
||||
if (!session) return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
try {
|
||||
const generationId = (request.params as { generationId: string }).generationId;
|
||||
const target = privateContent.readImageTarget(session.user_id, generationId);
|
||||
const item = options.latestExports.getOriginal(target.ownerId, target.projectId, target.imageId);
|
||||
const extension = item.mime_type === "image/jpeg" ? "jpg" : item.mime_type === "image/webp" ? "webp" : "png";
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", `inline; filename="dada-generation.${extension}"`);
|
||||
reply.type(item.mime_type);
|
||||
return reply.send(createReadStream(item.path));
|
||||
} catch (error) {
|
||||
if (error instanceof PrivateContentError && error.code === "notice_required") return privateContentNoticeRequired(reply, request.id);
|
||||
if (error instanceof PrivateContentError && error.code === "not_found") return reply.code(404).send(null);
|
||||
return latestExportFailure(reply, request.id, error);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/assets/public/:resourceVersion/manifest",
|
||||
{ schema: { hide: true } },
|
||||
@@ -957,6 +1143,13 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
})
|
||||
: false;
|
||||
if (userSession?.userId !== resource.ownerId && !controlledAdmin) return reply.code(404).send();
|
||||
if (adminSession && controlledAdmin && privateContent) {
|
||||
try {
|
||||
privateContent.recordPrivateAssetAccess(adminSession.user_id, resource.ownerId, resource.resourceId);
|
||||
} catch {
|
||||
return reply.code(503).send(createErrorEnvelope({ code: "AUTH_SERVICE_UNAVAILABLE", correlationId: request.id }));
|
||||
}
|
||||
}
|
||||
reply.type(resource.mimeType);
|
||||
reply.header("Cache-Control", "private, no-store");
|
||||
reply.header("Content-Disposition", "inline");
|
||||
@@ -1190,19 +1383,51 @@ export async function createApp(options: CreateAppOptions = {}) {
|
||||
if (!session) {
|
||||
return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
}
|
||||
const acknowledgement = privateContent?.readAcknowledgement(session.user_id);
|
||||
const notice = privateContent?.currentNotice();
|
||||
return {
|
||||
acknowledged_private_content_notice_version: null,
|
||||
acknowledged_private_content_notice_version: acknowledgement?.version ?? null,
|
||||
admin: { role: "super_admin" as const, status: "active" as const, user_id: session.user_id },
|
||||
audience: "admin" as const,
|
||||
authenticated: true as const,
|
||||
csrf_token: options.registration.issueAdminCsrfToken(token!),
|
||||
current_private_content_notice_version: null,
|
||||
...(notice ? { current_private_content_notice_message_key: notice.messageKey } : {}),
|
||||
current_private_content_notice_version: notice?.version ?? null,
|
||||
expires_at: new Date(session.expires_at).toISOString(),
|
||||
notice_acknowledged: false,
|
||||
notice_acknowledged: notice ? acknowledgement?.version === notice.version : false,
|
||||
};
|
||||
},
|
||||
);
|
||||
|
||||
app.get(
|
||||
"/api/v1/admin/overview",
|
||||
{
|
||||
schema: {
|
||||
operationId: "getAdminOverview",
|
||||
response: {
|
||||
200: Type.Ref(AdminOverviewResponseSchema),
|
||||
401: Type.Ref(ErrorEnvelopeSchema),
|
||||
503: Type.Null(),
|
||||
},
|
||||
tags: ["Admin Operations"],
|
||||
},
|
||||
},
|
||||
async (request, reply) => {
|
||||
if (!options.registration) return reply.code(503).send(null);
|
||||
const token = cookieValue(headerValue(request.headers.cookie), adminSessionCookieName);
|
||||
const session = token ? options.registration.readAdminSession(token) : undefined;
|
||||
if (!session) {
|
||||
return reply.code(401).send(createErrorEnvelope({ code: "AUTH_SESSION_INVALID", correlationId: request.id }));
|
||||
}
|
||||
if (!options.adminOverview) return reply.code(503).send(null);
|
||||
try {
|
||||
return await options.adminOverview();
|
||||
} catch {
|
||||
return reply.code(503).send(null);
|
||||
}
|
||||
},
|
||||
);
|
||||
|
||||
app.post(
|
||||
"/api/v1/auth/login/send",
|
||||
{
|
||||
|
||||
@@ -0,0 +1,186 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import type BetterSqlite3 from "better-sqlite3";
|
||||
|
||||
import { auditRetentionMilliseconds } from "./audit-policy.js";
|
||||
|
||||
type GenerationStatus = "queued" | "running" | "succeeded" | "failed" | "rejected";
|
||||
|
||||
export class PrivateContentError extends Error {
|
||||
constructor(readonly code: "notice_required" | "notice_version_conflict" | "not_found") {
|
||||
super(code);
|
||||
this.name = "PrivateContentError";
|
||||
}
|
||||
}
|
||||
|
||||
function iso(value: number) {
|
||||
return new Date(value).toISOString();
|
||||
}
|
||||
|
||||
function isGenerationTablePresent(database: BetterSqlite3.Database) {
|
||||
return Boolean(database.prepare(
|
||||
"SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = 'generation_jobs'",
|
||||
).get());
|
||||
}
|
||||
|
||||
export class PrivateContentService {
|
||||
constructor(
|
||||
readonly database: BetterSqlite3.Database,
|
||||
readonly currentNoticeVersion: string,
|
||||
private readonly clock: () => number = Date.now,
|
||||
) {}
|
||||
|
||||
currentNotice() {
|
||||
return {
|
||||
version: this.currentNoticeVersion,
|
||||
messageKey: "admin.private_content.notice",
|
||||
} as const;
|
||||
}
|
||||
|
||||
readAcknowledgement(adminUserId: string) {
|
||||
const row = this.database.prepare(`
|
||||
SELECT private_content_notice_version, private_content_notice_acknowledged_at
|
||||
FROM user_profiles WHERE user_id = ?
|
||||
`).get(adminUserId) as { private_content_notice_version: string | null; private_content_notice_acknowledged_at: number | null } | undefined;
|
||||
return {
|
||||
version: row?.private_content_notice_version ?? null,
|
||||
acknowledgedAt: row?.private_content_notice_acknowledged_at === null || row?.private_content_notice_acknowledged_at === undefined
|
||||
? null : iso(row.private_content_notice_acknowledged_at),
|
||||
};
|
||||
}
|
||||
|
||||
isAcknowledged(adminUserId: string) {
|
||||
return this.readAcknowledgement(adminUserId).version === this.currentNoticeVersion;
|
||||
}
|
||||
|
||||
requireAcknowledgement(adminUserId: string) {
|
||||
if (!this.isAcknowledged(adminUserId)) throw new PrivateContentError("notice_required");
|
||||
}
|
||||
|
||||
acknowledge(adminUserId: string, expectedNoticeVersion: string) {
|
||||
const now = this.clock();
|
||||
return this.database.transaction(() => {
|
||||
if (expectedNoticeVersion !== this.currentNoticeVersion) {
|
||||
throw new PrivateContentError("notice_version_conflict");
|
||||
}
|
||||
this.database.prepare(`
|
||||
INSERT INTO user_profiles (
|
||||
user_id, creator_name, social_id, private_content_notice_version,
|
||||
private_content_notice_acknowledged_at
|
||||
) VALUES (?, '', '', ?, ?)
|
||||
ON CONFLICT(user_id) DO UPDATE SET
|
||||
private_content_notice_version = excluded.private_content_notice_version,
|
||||
private_content_notice_acknowledged_at =
|
||||
CASE WHEN user_profiles.private_content_notice_version = excluded.private_content_notice_version
|
||||
THEN user_profiles.private_content_notice_acknowledged_at ELSE excluded.private_content_notice_acknowledged_at END
|
||||
`).run(adminUserId, this.currentNoticeVersion, now);
|
||||
const acknowledged = this.readAcknowledgement(adminUserId);
|
||||
return {
|
||||
noticeVersion: this.currentNoticeVersion,
|
||||
acknowledgedAt: acknowledged.acknowledgedAt ?? iso(now),
|
||||
};
|
||||
})();
|
||||
}
|
||||
|
||||
listGenerations() {
|
||||
const generatedAt = iso(this.clock());
|
||||
if (!isGenerationTablePresent(this.database)) return { generated_at: generatedAt, items: [] };
|
||||
const rows = this.database.prepare(`
|
||||
SELECT generation_id, owner_id, project_id, model_id, ratio, status,
|
||||
confirmed_credit_cost, reserved_credits, final_credit_state,
|
||||
error_category, created_at, updated_at
|
||||
FROM generation_jobs
|
||||
WHERE submission_ready = 1
|
||||
ORDER BY created_at DESC, generation_id DESC
|
||||
LIMIT 100
|
||||
`).all() as Array<{
|
||||
generation_id: string;
|
||||
owner_id: string;
|
||||
project_id: string;
|
||||
model_id: string;
|
||||
ratio: "3:4" | "1:1" | "4:3" | "9:16";
|
||||
status: GenerationStatus;
|
||||
confirmed_credit_cost: number;
|
||||
reserved_credits: number;
|
||||
final_credit_state: "committed" | "released" | null;
|
||||
error_category: string | null;
|
||||
created_at: number;
|
||||
updated_at: number;
|
||||
}>;
|
||||
return {
|
||||
generated_at: generatedAt,
|
||||
items: rows.map((row) => {
|
||||
const terminal = row.status === "succeeded" || row.status === "failed" || row.status === "rejected";
|
||||
return {
|
||||
generation_id: row.generation_id,
|
||||
owner_ref: row.owner_id,
|
||||
project_id: row.project_id,
|
||||
model_id: row.model_id,
|
||||
ratio: row.ratio,
|
||||
status: row.status,
|
||||
created_at: iso(row.created_at),
|
||||
completed_at: terminal ? iso(row.updated_at) : null,
|
||||
duration_ms: terminal ? Math.max(0, row.updated_at - row.created_at) : null,
|
||||
confirmed_credit_cost: row.confirmed_credit_cost,
|
||||
reserved_credits: row.reserved_credits,
|
||||
final_credit_state: row.final_credit_state,
|
||||
error_category: row.error_category,
|
||||
};
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
private generation(generationId: string) {
|
||||
if (!isGenerationTablePresent(this.database)) throw new PrivateContentError("not_found");
|
||||
const row = this.database.prepare(`
|
||||
SELECT generation_id, owner_id, project_id
|
||||
FROM generation_jobs WHERE generation_id = ? AND submission_ready = 1
|
||||
`).get(generationId) as { generation_id: string; owner_id: string; project_id: string } | undefined;
|
||||
if (!row) throw new PrivateContentError("not_found");
|
||||
return row;
|
||||
}
|
||||
|
||||
private recordAccess(input: { adminUserId: string; ownerId: string; generationId: string; contentType: "image" | "prompt" }) {
|
||||
const now = this.clock();
|
||||
// The insert is committed before the caller reads the private value. A failed
|
||||
// constraint therefore cannot accidentally release a private response.
|
||||
this.database.transaction(() => {
|
||||
this.database.prepare(`
|
||||
INSERT INTO private_content_access_logs (
|
||||
log_id, actor_ref, subject_ref, target_ref, content_type, occurred_at, expires_at
|
||||
) VALUES (?, ?, ?, ?, ?, ?, ?)
|
||||
`).run(
|
||||
randomUUID(), input.adminUserId, input.ownerId, input.generationId,
|
||||
input.contentType, now, now + auditRetentionMilliseconds,
|
||||
);
|
||||
})();
|
||||
}
|
||||
|
||||
recordPrivateAssetAccess(adminUserId: string, ownerId: string, resourceId: string) {
|
||||
this.recordAccess({ adminUserId, ownerId, generationId: resourceId, contentType: "image" });
|
||||
}
|
||||
|
||||
readPrompt(adminUserId: string, generationId: string) {
|
||||
this.requireAcknowledgement(adminUserId);
|
||||
const row = this.generation(generationId);
|
||||
this.recordAccess({ adminUserId, ownerId: row.owner_id, generationId: row.generation_id, contentType: "prompt" });
|
||||
const content = this.database.prepare(
|
||||
"SELECT prompt FROM generation_jobs WHERE generation_id = ? AND submission_ready = 1",
|
||||
).get(row.generation_id) as { prompt: string } | undefined;
|
||||
if (!content) throw new PrivateContentError("not_found");
|
||||
return { generationId: row.generation_id, prompt: content.prompt };
|
||||
}
|
||||
|
||||
readImageTarget(adminUserId: string, generationId: string) {
|
||||
this.requireAcknowledgement(adminUserId);
|
||||
const row = this.database.prepare(`
|
||||
SELECT g.generation_id, g.owner_id, g.project_id, pi.image_id
|
||||
FROM generation_jobs g
|
||||
JOIN project_images pi ON pi.project_id = g.project_id AND pi.generation_id = g.generation_id
|
||||
WHERE g.generation_id = ? AND g.status = 'succeeded'
|
||||
ORDER BY pi.created_at DESC LIMIT 1
|
||||
`).get(generationId) as { generation_id: string; owner_id: string; project_id: string; image_id: string } | undefined;
|
||||
if (!row) throw new PrivateContentError("not_found");
|
||||
this.recordAccess({ adminUserId, ownerId: row.owner_id, generationId: row.generation_id, contentType: "image" });
|
||||
return { projectId: row.project_id, imageId: row.image_id, ownerId: row.owner_id };
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
.admin-generations { display: grid; gap: 20px; }
|
||||
.admin-generations-refresh { align-self: start; }
|
||||
.admin-generations-notice-panel { display: grid; gap: 14px; max-width: 760px; padding: 24px; border: 1px solid #d5b36a; background: #fffaf0; }
|
||||
.admin-generations-notice-panel p { margin: 0; }
|
||||
.admin-generations-notice-panel button { justify-self: start; }
|
||||
.admin-generations-error, .admin-generations-notice { padding: 12px 16px; border: 1px solid #d46a6a; background: #fff4f4; }
|
||||
.admin-generations-error button { margin-left: 12px; }
|
||||
.admin-generations-table-wrap { overflow-x: auto; border: 1px solid #d9dde5; background: #fff; }
|
||||
.admin-generations-table-wrap table { width: 100%; min-width: 1050px; border-collapse: collapse; }
|
||||
.admin-generations-table-wrap th, .admin-generations-table-wrap td { padding: 12px 14px; border-bottom: 1px solid #e9ebef; text-align: left; vertical-align: top; }
|
||||
.admin-generations-table-wrap th { background: #f5f6f8; color: #4d5664; font-size: 12px; }
|
||||
.admin-generations-table-wrap small { color: #6c7481; }
|
||||
.admin-generations-status { display: inline-block; padding: 3px 7px; border-radius: 4px; background: #edf0f4; }
|
||||
.admin-generations-status.is-succeeded { color: #23623d; background: #e6f4ea; }
|
||||
.admin-generations-status.is-failed, .admin-generations-status.is-rejected { color: #8b2b2b; background: #fff0f0; }
|
||||
.admin-generations-status.is-running { color: #7a5a10; background: #fff5d8; }
|
||||
.admin-generations-actions { display: grid; gap: 8px; min-width: 190px; }
|
||||
.admin-generations-actions button { white-space: normal; }
|
||||
.admin-generations-empty { margin: 0; padding: 28px; color: #6c7481; }
|
||||
.admin-generations-opened { display: grid; gap: 10px; padding: 18px; border: 1px solid #cbd2dd; background: #fff; }
|
||||
.admin-generations-opened header { display: flex; align-items: center; justify-content: space-between; }
|
||||
.admin-generations-opened h3 { margin: 0; }
|
||||
.admin-generations-opened pre { max-height: 360px; overflow: auto; margin: 0; padding: 14px; white-space: pre-wrap; background: #f6f7f9; }
|
||||
.admin-generations-opened img { max-width: 100%; max-height: 620px; object-fit: contain; }
|
||||
@@ -0,0 +1,156 @@
|
||||
import { useEffect, useState } from "react";
|
||||
|
||||
import "./admin-generations.css";
|
||||
|
||||
interface AdminSession {
|
||||
acknowledged_private_content_notice_version: string | null;
|
||||
current_private_content_notice_version: string | null;
|
||||
csrf_token: string;
|
||||
notice_acknowledged: boolean;
|
||||
}
|
||||
|
||||
interface GenerationRecord {
|
||||
generation_id: string;
|
||||
owner_ref: string;
|
||||
project_id: string;
|
||||
model_id: string;
|
||||
ratio: string;
|
||||
status: "queued" | "running" | "succeeded" | "failed" | "rejected";
|
||||
created_at: string;
|
||||
completed_at: string | null;
|
||||
duration_ms: number | null;
|
||||
confirmed_credit_cost: number;
|
||||
reserved_credits: number;
|
||||
final_credit_state: "committed" | "released" | null;
|
||||
error_category: string | null;
|
||||
}
|
||||
|
||||
interface GenerationResponse { generated_at: string; items: GenerationRecord[] }
|
||||
interface OpenedPrompt { generation_id: string; prompt: string }
|
||||
|
||||
function idempotencyKey() {
|
||||
return `${crypto.randomUUID().replaceAll("-", "")}${crypto.randomUUID().replaceAll("-", "")}`;
|
||||
}
|
||||
|
||||
function compactId(value: string) { return `${value.slice(0, 8)}...${value.slice(-4)}`; }
|
||||
function formatTime(value: string | null) { return value ? new Intl.DateTimeFormat("zh-CN", { dateStyle: "short", timeStyle: "medium" }).format(new Date(value)) : "未完成"; }
|
||||
function statusLabel(value: GenerationRecord["status"]) { return { queued: "排队", running: "运行中", succeeded: "成功", failed: "失败", rejected: "已拒绝" }[value]; }
|
||||
|
||||
export function AdminGenerationsPage() {
|
||||
const [session, setSession] = useState<AdminSession>();
|
||||
const [records, setRecords] = useState<GenerationRecord[]>([]);
|
||||
const [loading, setLoading] = useState(true);
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [acknowledging, setAcknowledging] = useState(false);
|
||||
const [notice, setNotice] = useState("");
|
||||
const [openedPrompt, setOpenedPrompt] = useState<OpenedPrompt>();
|
||||
const [openedImage, setOpenedImage] = useState<{ generationId: string; url: string }>();
|
||||
|
||||
async function load() {
|
||||
setLoading(true);
|
||||
setFailed(false);
|
||||
try {
|
||||
const sessionResponse = await fetch("/api/v1/admin-auth/session", { credentials: "same-origin" });
|
||||
if (sessionResponse.status === 401) throw new Error("session_invalid");
|
||||
if (!sessionResponse.ok) throw new Error("session_unavailable");
|
||||
const current = await sessionResponse.json() as AdminSession;
|
||||
setSession(current);
|
||||
setNotice("");
|
||||
if (!current.notice_acknowledged) {
|
||||
setRecords([]);
|
||||
return;
|
||||
}
|
||||
const listResponse = await fetch("/api/v1/admin/generations", { credentials: "same-origin" });
|
||||
if (!listResponse.ok) throw new Error("generation_list_unavailable");
|
||||
setRecords((await listResponse.json() as GenerationResponse).items);
|
||||
} catch {
|
||||
setFailed(true);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}
|
||||
|
||||
useEffect(() => { void load(); }, []);
|
||||
useEffect(() => () => { if (openedImage) URL.revokeObjectURL(openedImage.url); }, [openedImage]);
|
||||
|
||||
async function acknowledge() {
|
||||
if (!session?.current_private_content_notice_version || acknowledging) return;
|
||||
setAcknowledging(true);
|
||||
setNotice("");
|
||||
try {
|
||||
const response = await fetch("/api/v1/admin/private-content-notice/ack", {
|
||||
body: JSON.stringify({ expected_notice_version: session.current_private_content_notice_version }),
|
||||
credentials: "same-origin",
|
||||
headers: { "Content-Type": "application/json", "Idempotency-Key": idempotencyKey(), "X-CSRF-Token": session.csrf_token },
|
||||
method: "POST",
|
||||
});
|
||||
if (!response.ok) throw new Error("notice_ack_failed");
|
||||
await load();
|
||||
} catch {
|
||||
setNotice("告知版本已变化或确认未完成，请重新读取。 ");
|
||||
} finally {
|
||||
setAcknowledging(false);
|
||||
}
|
||||
}
|
||||
|
||||
async function openPrompt(generationId: string) {
|
||||
setNotice("");
|
||||
try {
|
||||
const response = await fetch(`/api/v1/admin/private-content/generations/${generationId}/prompt`, { credentials: "same-origin" });
|
||||
if (!response.ok) throw new Error("prompt_unavailable");
|
||||
setOpenedPrompt(await response.json() as OpenedPrompt);
|
||||
} catch {
|
||||
setNotice("内容读取未完成，访问审计未成功时不会返回内容。 ");
|
||||
}
|
||||
}
|
||||
|
||||
async function openImage(generationId: string) {
|
||||
setNotice("");
|
||||
try {
|
||||
const response = await fetch(`/api/v1/admin/private-content/generations/${generationId}/image`, { credentials: "same-origin" });
|
||||
if (!response.ok) throw new Error("image_unavailable");
|
||||
const url = URL.createObjectURL(await response.blob());
|
||||
setOpenedImage((previous) => {
|
||||
if (previous) URL.revokeObjectURL(previous.url);
|
||||
return { generationId, url };
|
||||
});
|
||||
} catch {
|
||||
setNotice("内容读取未完成，访问审计未成功时不会返回内容。 ");
|
||||
}
|
||||
}
|
||||
|
||||
return (
|
||||
<main className="admin-generations" id="admin-main">
|
||||
<header className="admin-page-heading"><div><p>OPERATIONS / GENERATION RECORDS</p><h2>生成记录</h2></div><button className="admin-generations-refresh" onClick={() => void load()} type="button">重新读取</button></header>
|
||||
{loading ? <p aria-live="polite">正在读取生成记录</p> : null}
|
||||
{failed ? <div className="admin-generations-error" role="alert">后台生成记录暂时无法读取。<button onClick={() => void load()} type="button">重试</button></div> : null}
|
||||
{notice ? <p className="admin-generations-notice" role="alert">{notice}</p> : null}
|
||||
{session && !session.notice_acknowledged ? (
|
||||
<section aria-labelledby="private-content-notice-title" className="admin-generations-notice-panel">
|
||||
<p>PRIVATE CONTENT ACCESS</p>
|
||||
<h3 id="private-content-notice-title">查看私有内容前，请确认当前规则告知</h3>
|
||||
<p>生成记录默认只显示安全元数据。打开图片或完整提示词时，系统会自动记录本次管理员、目标和内容类型访问审计。</p>
|
||||
<button disabled={acknowledging} onClick={() => void acknowledge()} type="button">{acknowledging ? "确认中" : "确认并进入记录"}</button>
|
||||
</section>
|
||||
) : null}
|
||||
{session?.notice_acknowledged ? (
|
||||
<section aria-label="生成记录元数据" className="admin-generations-table-wrap">
|
||||
<table><thead><tr><th>任务</th><th>用户标识</th><th>模型 / 比例</th><th>状态</th><th>创建 / 完成</th><th>点数</th><th>私有内容</th></tr></thead><tbody>
|
||||
{records.map((record) => <tr key={record.generation_id}>
|
||||
<td><code>{compactId(record.generation_id)}</code></td>
|
||||
<td><code>{compactId(record.owner_ref)}</code></td>
|
||||
<td>{record.model_id}<br /><small>{record.ratio}</small></td>
|
||||
<td><span className={`admin-generations-status is-${record.status}`}>{statusLabel(record.status)}</span>{record.error_category ? <small>{record.error_category}</small> : null}</td>
|
||||
<td><time dateTime={record.created_at}>{formatTime(record.created_at)}</time><br /><small>{formatTime(record.completed_at)}</small></td>
|
||||
<td>{record.confirmed_credit_cost} / {record.final_credit_state ?? "冻结"}</td>
|
||||
<td className="admin-generations-actions"><button onClick={() => void openPrompt(record.generation_id)} type="button">打开提示词并记录审计</button><button disabled={record.status !== "succeeded"} onClick={() => void openImage(record.generation_id)} type="button">打开图片并记录审计</button></td>
|
||||
</tr>)}
|
||||
</tbody></table>
|
||||
{!records.length && !loading ? <p className="admin-generations-empty">当前无生成记录</p> : null}
|
||||
</section>
|
||||
) : null}
|
||||
{openedPrompt ? <section aria-label="已审计的完整提示词" className="admin-generations-opened"><header><h3>已记录审计的完整提示词</h3><button onClick={() => setOpenedPrompt(undefined)} type="button">关闭</button></header><p><code>{compactId(openedPrompt.generation_id)}</code></p><pre>{openedPrompt.prompt}</pre></section> : null}
|
||||
{openedImage ? <section aria-label="已审计的生成图片" className="admin-generations-opened"><header><h3>已记录审计的生成图片</h3><button onClick={() => { URL.revokeObjectURL(openedImage.url); setOpenedImage(undefined); }} type="button">关闭</button></header><img alt="已记录审计的生成图片" src={openedImage.url} /></section> : null}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
@@ -147,11 +147,7 @@ export function AdminModelsPage() {
|
||||
|
||||
return (
|
||||
<div className="admin-models-page">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a href="/admin/users">用户</a><a aria-current="page" href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<main id="admin-main">
|
||||
<header className="admin-models-heading">
|
||||
<div><p>MODEL OPERATIONS</p><h1>模型配置</h1></div>
|
||||
{configuration ? <strong>配置集合 v{configuration.config_set_version}</strong> : null}
|
||||
|
||||
@@ -0,0 +1,523 @@
|
||||
:root {
|
||||
color-scheme: light;
|
||||
font-family: "Segoe UI", "Microsoft YaHei UI", sans-serif;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
letter-spacing: 0;
|
||||
}
|
||||
|
||||
body {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
button,
|
||||
a,
|
||||
input,
|
||||
textarea {
|
||||
font: inherit;
|
||||
}
|
||||
|
||||
.admin-shell {
|
||||
min-height: 100vh;
|
||||
color: #171715;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
.admin-skip-link {
|
||||
position: fixed;
|
||||
z-index: 100;
|
||||
top: 8px;
|
||||
left: 228px;
|
||||
padding: 8px 12px;
|
||||
color: #ffffff;
|
||||
background: #171715;
|
||||
transform: translateY(-160%);
|
||||
}
|
||||
|
||||
.admin-skip-link:focus {
|
||||
transform: translateY(0);
|
||||
}
|
||||
|
||||
.admin-sidebar {
|
||||
position: fixed;
|
||||
z-index: 20;
|
||||
inset: 0 auto 0 0;
|
||||
display: grid;
|
||||
width: 216px;
|
||||
grid-template-rows: auto 1fr auto;
|
||||
color: #ffffff;
|
||||
background: #171715;
|
||||
}
|
||||
|
||||
.admin-wordmark {
|
||||
display: grid;
|
||||
min-height: 104px;
|
||||
align-content: center;
|
||||
padding: 20px 22px;
|
||||
border-bottom: 1px solid #494944;
|
||||
color: #ffffff;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-wordmark span {
|
||||
font-family: "Arial Black", "Segoe UI", sans-serif;
|
||||
font-size: 30px;
|
||||
line-height: 1;
|
||||
}
|
||||
|
||||
.admin-wordmark small {
|
||||
margin-top: 6px;
|
||||
color: #d9dc00;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar nav {
|
||||
display: grid;
|
||||
align-content: start;
|
||||
padding: 12px 0;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a {
|
||||
display: grid;
|
||||
min-height: 48px;
|
||||
grid-template-columns: 38px 1fr;
|
||||
align-items: center;
|
||||
padding: 0 18px;
|
||||
border-left: 4px solid transparent;
|
||||
color: #d5d5cf;
|
||||
font-size: 13px;
|
||||
font-weight: 700;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a > span {
|
||||
color: #85857d;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a:hover,
|
||||
.admin-sidebar nav a:focus-visible {
|
||||
color: #ffffff;
|
||||
background: #2c2c29;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a[aria-current="page"] {
|
||||
border-left-color: #e8eb00;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
}
|
||||
|
||||
.admin-sidebar nav a[aria-current="page"] > span {
|
||||
color: #4d4d00;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot {
|
||||
display: grid;
|
||||
gap: 10px;
|
||||
padding: 18px 22px;
|
||||
border-top: 1px solid #494944;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot span {
|
||||
color: #a5a59d;
|
||||
}
|
||||
|
||||
.admin-sidebar-foot strong {
|
||||
color: #ffffff;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-shell-workspace {
|
||||
min-width: 0;
|
||||
margin-left: 216px;
|
||||
padding-top: 52px;
|
||||
}
|
||||
|
||||
.admin-topbar {
|
||||
position: fixed;
|
||||
z-index: 15;
|
||||
top: 0;
|
||||
right: 0;
|
||||
left: 216px;
|
||||
display: flex;
|
||||
height: 52px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 0 28px;
|
||||
border-bottom: 1px solid #b7b7b0;
|
||||
background: rgb(255 255 255 / 96%);
|
||||
}
|
||||
|
||||
.admin-topbar h1 {
|
||||
margin: 0;
|
||||
font-size: 15px;
|
||||
}
|
||||
|
||||
.admin-topbar-status {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 20px;
|
||||
color: #62625c;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-topbar-status span {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 7px;
|
||||
}
|
||||
|
||||
.admin-topbar-status i {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
border-radius: 50%;
|
||||
background: #777770;
|
||||
}
|
||||
|
||||
.admin-topbar-status code {
|
||||
color: #171715;
|
||||
}
|
||||
|
||||
.admin-shell-content {
|
||||
min-width: 0;
|
||||
}
|
||||
|
||||
.admin-session-gate {
|
||||
display: grid;
|
||||
min-height: 100vh;
|
||||
place-items: center;
|
||||
color: #171715;
|
||||
background: #f3f3ef;
|
||||
}
|
||||
|
||||
.admin-session-gate p,
|
||||
.admin-session-gate div {
|
||||
padding: 22px;
|
||||
border-left: 5px solid #171715;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-session-gate div {
|
||||
display: grid;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.admin-session-gate button,
|
||||
.admin-overview-failure button,
|
||||
.admin-placeholder-toolbar button {
|
||||
min-height: 40px;
|
||||
padding: 8px 14px;
|
||||
border: 1px solid #171715;
|
||||
border-radius: 0;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-overview,
|
||||
.admin-placeholder {
|
||||
width: min(1320px, calc(100% - 64px));
|
||||
margin: 0 auto;
|
||||
padding: 34px 0 72px;
|
||||
}
|
||||
|
||||
.admin-page-heading {
|
||||
display: flex;
|
||||
min-height: 74px;
|
||||
align-items: end;
|
||||
justify-content: space-between;
|
||||
gap: 24px;
|
||||
padding-bottom: 18px;
|
||||
border-bottom: 1px solid #8c8c85;
|
||||
}
|
||||
|
||||
.admin-page-heading p,
|
||||
.admin-status-section header p,
|
||||
.admin-operation-strip header p {
|
||||
margin: 0 0 5px;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 10px;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-page-heading h2 {
|
||||
margin: 0;
|
||||
font-size: 32px;
|
||||
}
|
||||
|
||||
.admin-page-heading time {
|
||||
color: #66665f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-capacity-alert {
|
||||
display: grid;
|
||||
min-height: 44px;
|
||||
grid-template-columns: 1fr auto auto;
|
||||
align-items: center;
|
||||
gap: 18px;
|
||||
padding: 9px 14px;
|
||||
border-bottom: 1px solid #171715;
|
||||
color: #171715;
|
||||
background: #eef000;
|
||||
font-size: 12px;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-capacity-alert.is-full,
|
||||
.admin-capacity-alert.is-unavailable {
|
||||
color: #ffffff;
|
||||
background: #b33a2f;
|
||||
}
|
||||
|
||||
.admin-overview-loading {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(4, minmax(0, 1fr));
|
||||
margin-top: 22px;
|
||||
border-block: 1px solid #b7b7b0;
|
||||
}
|
||||
|
||||
.admin-overview-loading span {
|
||||
height: 130px;
|
||||
border-right: 1px solid #c7c7c0;
|
||||
background: #e2e2dd;
|
||||
}
|
||||
|
||||
.admin-overview-failure {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
gap: 20px;
|
||||
margin-top: 20px;
|
||||
padding: 14px 16px;
|
||||
border-left: 5px solid #b33a2f;
|
||||
background: #fff0ed;
|
||||
}
|
||||
|
||||
.admin-metric-band {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(4, minmax(0, 1fr));
|
||||
margin-top: 22px;
|
||||
border-block: 1px solid #8c8c85;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-metric-band a {
|
||||
display: grid;
|
||||
min-width: 0;
|
||||
min-height: 132px;
|
||||
align-content: center;
|
||||
gap: 7px;
|
||||
padding: 20px;
|
||||
border-right: 1px solid #c3c3bc;
|
||||
color: #171715;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.admin-metric-band a:last-child {
|
||||
border-right: 0;
|
||||
}
|
||||
|
||||
.admin-metric-band span,
|
||||
.admin-metric-band small {
|
||||
color: #65655f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-metric-band strong {
|
||||
overflow-wrap: anywhere;
|
||||
font-size: 25px;
|
||||
}
|
||||
|
||||
.admin-overview-columns {
|
||||
display: grid;
|
||||
grid-template-columns: 1fr 1fr;
|
||||
gap: 24px;
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
||||
.admin-status-section,
|
||||
.admin-operation-strip,
|
||||
.admin-placeholder > section {
|
||||
border-top: 3px solid #171715;
|
||||
border-bottom: 1px solid #8c8c85;
|
||||
background: #ffffff;
|
||||
}
|
||||
|
||||
.admin-status-section > header,
|
||||
.admin-operation-strip > header {
|
||||
display: flex;
|
||||
min-height: 64px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 12px 16px;
|
||||
border-bottom: 1px solid #c3c3bc;
|
||||
}
|
||||
|
||||
.admin-status-section h3,
|
||||
.admin-operation-strip h3 {
|
||||
margin: 0;
|
||||
font-size: 17px;
|
||||
}
|
||||
|
||||
.admin-status-section header a,
|
||||
.admin-operation-strip header a {
|
||||
color: #171715;
|
||||
font-size: 12px;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-status-section dl {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.admin-status-section dl > div {
|
||||
display: grid;
|
||||
min-height: 52px;
|
||||
grid-template-columns: 126px 1fr;
|
||||
align-items: center;
|
||||
padding: 0 16px;
|
||||
border-bottom: 1px solid #ddddD7;
|
||||
}
|
||||
|
||||
.admin-status-section dl > div:last-child {
|
||||
border-bottom: 0;
|
||||
}
|
||||
|
||||
.admin-status-section dt {
|
||||
color: #65655f;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-status-section dd {
|
||||
min-width: 0;
|
||||
margin: 0;
|
||||
overflow-wrap: anywhere;
|
||||
font-family: Consolas, monospace;
|
||||
font-size: 12px;
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.admin-service-list {
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
list-style: none;
|
||||
}
|
||||
|
||||
.admin-service-list li {
|
||||
display: grid;
|
||||
min-height: 42px;
|
||||
grid-template-columns: 1fr 84px 76px;
|
||||
align-items: center;
|
||||
padding: 0 16px;
|
||||
border-bottom: 1px solid #ddddd7;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-service-list li:last-child {
|
||||
border-bottom: 0;
|
||||
}
|
||||
|
||||
.admin-service-list strong {
|
||||
color: #1f6639;
|
||||
}
|
||||
|
||||
.admin-service-list strong.is-degraded,
|
||||
.admin-service-list strong.is-paused {
|
||||
color: #8b5608;
|
||||
}
|
||||
|
||||
.admin-service-list strong.is-unavailable {
|
||||
color: #a52e24;
|
||||
}
|
||||
|
||||
.admin-service-list time {
|
||||
color: #65655f;
|
||||
text-align: right;
|
||||
}
|
||||
|
||||
.admin-operation-strip {
|
||||
margin-top: 24px;
|
||||
}
|
||||
|
||||
.admin-operation-strip > p {
|
||||
margin: 0;
|
||||
padding: 22px 16px;
|
||||
color: #65655f;
|
||||
}
|
||||
|
||||
.admin-operation-strip table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
table-layout: fixed;
|
||||
}
|
||||
|
||||
.admin-operation-strip th,
|
||||
.admin-operation-strip td {
|
||||
padding: 12px 16px;
|
||||
border-bottom: 1px solid #ddddd7;
|
||||
overflow-wrap: anywhere;
|
||||
text-align: left;
|
||||
font-size: 11px;
|
||||
}
|
||||
|
||||
.admin-operation-strip th {
|
||||
color: #65655f;
|
||||
background: #efefeb;
|
||||
}
|
||||
|
||||
.admin-placeholder > section {
|
||||
margin-top: 22px;
|
||||
}
|
||||
|
||||
.admin-placeholder-toolbar {
|
||||
display: flex;
|
||||
min-height: 58px;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
padding: 8px 16px;
|
||||
border-bottom: 1px solid #c3c3bc;
|
||||
font-weight: 800;
|
||||
}
|
||||
|
||||
.admin-placeholder-toolbar button:disabled {
|
||||
color: #777770;
|
||||
background: #dfdfda;
|
||||
}
|
||||
|
||||
.admin-placeholder > section > p {
|
||||
margin: 0;
|
||||
padding: 44px 16px;
|
||||
color: #65655f;
|
||||
}
|
||||
|
||||
:is(.admin-shell, .admin-session-gate) :focus-visible {
|
||||
outline: 2px solid #225dd8;
|
||||
outline-offset: 2px;
|
||||
}
|
||||
|
||||
@media (max-width: 1000px) {
|
||||
.admin-overview,
|
||||
.admin-placeholder {
|
||||
width: calc(100% - 32px);
|
||||
}
|
||||
|
||||
.admin-metric-band {
|
||||
grid-template-columns: 1fr 1fr;
|
||||
}
|
||||
|
||||
.admin-metric-band a:nth-child(2) {
|
||||
border-right: 0;
|
||||
}
|
||||
|
||||
.admin-overview-columns {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,229 @@
|
||||
import type { AdminOverviewResponse } from "@dada/shared-contracts";
|
||||
import { useCallback, useEffect, useState, type ReactNode } from "react";
|
||||
|
||||
import "./admin-shell.css";
|
||||
|
||||
interface AdminSession {
|
||||
admin: { role: "super_admin"; status: "active"; user_id: string };
|
||||
audience: "admin";
|
||||
authenticated: true;
|
||||
expires_at: string;
|
||||
}
|
||||
|
||||
interface AdminProtectedRouteProps {
|
||||
children: ReactNode;
|
||||
currentPath: string;
|
||||
title: string;
|
||||
}
|
||||
|
||||
const adminNavigation = [
|
||||
{ href: "/admin", label: "总览", marker: "01" },
|
||||
{ href: "/admin/users", label: "用户与点数", marker: "02" },
|
||||
{ href: "/admin/invites", label: "邀请码", marker: "03" },
|
||||
{ href: "/admin/models", label: "模型", marker: "04" },
|
||||
{ href: "/admin/assets", label: "素材", marker: "05" },
|
||||
{ href: "/admin/preview", label: "内部预览", marker: "06" },
|
||||
{ href: "/admin/generations", label: "生成记录", marker: "07" },
|
||||
{ href: "/admin/services-storage", label: "服务与存储", marker: "08" },
|
||||
{ href: "/admin/audit", label: "审计", marker: "09" },
|
||||
] as const;
|
||||
|
||||
function redirectToAdminLogin() {
|
||||
window.location.replace("/admin/login");
|
||||
}
|
||||
|
||||
export function AdminProtectedRoute({ children, currentPath, title }: AdminProtectedRouteProps) {
|
||||
const [session, setSession] = useState<AdminSession>();
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [revision, setRevision] = useState(0);
|
||||
|
||||
useEffect(() => {
|
||||
const controller = new AbortController();
|
||||
setFailed(false);
|
||||
void fetch("/api/v1/admin-auth/session", { credentials: "same-origin", signal: controller.signal })
|
||||
.then(async (response) => {
|
||||
if (response.status === 401) {
|
||||
redirectToAdminLogin();
|
||||
return;
|
||||
}
|
||||
if (!response.ok) throw new Error("admin_session_unavailable");
|
||||
const body = await response.json() as AdminSession;
|
||||
if (body.audience !== "admin" || body.admin.role !== "super_admin" || body.admin.status !== "active") {
|
||||
redirectToAdminLogin();
|
||||
return;
|
||||
}
|
||||
setSession(body);
|
||||
})
|
||||
.catch((error: unknown) => {
|
||||
if (!(error instanceof DOMException && error.name === "AbortError")) setFailed(true);
|
||||
});
|
||||
return () => controller.abort();
|
||||
}, [revision]);
|
||||
|
||||
if (!session) {
|
||||
return (
|
||||
<main className="admin-session-gate">
|
||||
{failed ? (
|
||||
<div role="alert">
|
||||
<strong>管理员会话暂时无法确认</strong>
|
||||
<button onClick={() => setRevision((value) => value + 1)} type="button">重试</button>
|
||||
</div>
|
||||
) : <p aria-live="polite">正在确认管理员会话</p>}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="admin-shell">
|
||||
<a className="admin-skip-link" href="#admin-main">跳到主要内容</a>
|
||||
<aside className="admin-sidebar">
|
||||
<a className="admin-wordmark" href="/admin" aria-label="Dada 后台总览">
|
||||
<span>DADA</span>
|
||||
<small>OPERATIONS</small>
|
||||
</a>
|
||||
<nav aria-label="后台主导航">
|
||||
{adminNavigation.map((item) => (
|
||||
<a aria-current={currentPath === item.href ? "page" : undefined} href={item.href} key={item.href}>
|
||||
<span aria-hidden="true">{item.marker}</span>
|
||||
{item.label}
|
||||
</a>
|
||||
))}
|
||||
</nav>
|
||||
<div className="admin-sidebar-foot">
|
||||
<span>LOCAL P0-A</span>
|
||||
<strong>独立管理员会话</strong>
|
||||
</div>
|
||||
</aside>
|
||||
<div className="admin-shell-workspace">
|
||||
<header className="admin-topbar">
|
||||
<h1>{title}</h1>
|
||||
<div className="admin-topbar-status">
|
||||
<span><i aria-hidden="true" />状态摘要</span>
|
||||
<code>{session.admin.user_id.slice(0, 8)}</code>
|
||||
</div>
|
||||
</header>
|
||||
<div className="admin-shell-content">{children}</div>
|
||||
</div>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
const serviceLabels: Record<AdminOverviewResponse["services"][number]["service_id"], string> = {
|
||||
ai_gateway: "AI 网关",
|
||||
amap: "高德",
|
||||
asset_root: "素材根",
|
||||
resend: "Resend",
|
||||
worker: "Worker",
|
||||
};
|
||||
|
||||
const stateLabels = {
|
||||
available: "正常",
|
||||
degraded: "有异常",
|
||||
paused: "已暂停",
|
||||
unavailable: "不可用",
|
||||
} as const;
|
||||
|
||||
function formatTime(value: string | null) {
|
||||
if (!value) return "未记录";
|
||||
return new Intl.DateTimeFormat("zh-CN", { hour: "2-digit", minute: "2-digit", month: "2-digit", day: "2-digit" }).format(new Date(value));
|
||||
}
|
||||
|
||||
export function AdminOverviewPage() {
|
||||
const [summary, setSummary] = useState<AdminOverviewResponse>();
|
||||
const [failed, setFailed] = useState(false);
|
||||
const [loading, setLoading] = useState(true);
|
||||
|
||||
const load = useCallback(async () => {
|
||||
setLoading(true);
|
||||
setFailed(false);
|
||||
try {
|
||||
const response = await fetch("/api/v1/admin/overview", { credentials: "same-origin" });
|
||||
if (response.status === 401) {
|
||||
window.dispatchEvent(new Event("dada:session-invalid"));
|
||||
return;
|
||||
}
|
||||
if (!response.ok) throw new Error("admin_overview_unavailable");
|
||||
setSummary(await response.json() as AdminOverviewResponse);
|
||||
} catch {
|
||||
setFailed(true);
|
||||
} finally {
|
||||
setLoading(false);
|
||||
}
|
||||
}, []);
|
||||
|
||||
useEffect(() => { void load(); }, [load]);
|
||||
|
||||
const storagePercent = summary
|
||||
? Math.min(100, (summary.storage.managed_content_bytes / summary.storage.limit_bytes) * 100)
|
||||
: 0;
|
||||
const hasServiceIssue = summary?.services.some((service) => service.status !== "available") ?? false;
|
||||
|
||||
return (
|
||||
<main className="admin-overview" id="admin-main">
|
||||
<header className="admin-page-heading">
|
||||
<div><p>OPERATIONS / LIVE SUMMARY</p><h2>运营总览</h2></div>
|
||||
{summary ? <time dateTime={summary.generated_at}>更新于 {formatTime(summary.generated_at)}</time> : null}
|
||||
</header>
|
||||
{summary && summary.storage.status !== "normal" ? (
|
||||
<a className={`admin-capacity-alert is-${summary.storage.status}`} href="/admin/services-storage">
|
||||
<span>本机内容容量</span>
|
||||
<strong>{storagePercent.toFixed(1)}%</strong>
|
||||
<span>{summary.storage.status === "critical" ? "接近上限" : summary.storage.status === "full" ? "已满" : "不可用"}</span>
|
||||
</a>
|
||||
) : null}
|
||||
{loading && !summary ? (
|
||||
<div aria-label="运营摘要加载中" className="admin-overview-loading"><span /><span /><span /><span /></div>
|
||||
) : null}
|
||||
{failed ? (
|
||||
<div className="admin-overview-failure" role="alert">
|
||||
<span>运营摘要暂时无法读取{summary ? `，当前保留 ${formatTime(summary.generated_at)} 的结果` : ""}。</span>
|
||||
<button onClick={() => void load()} type="button">重试</button>
|
||||
</div>
|
||||
) : null}
|
||||
{summary ? (
|
||||
<>
|
||||
<section aria-label="关键运营指标" className="admin-metric-band">
|
||||
<a href="/admin/users"><span>普通用户名额</span><strong>{summary.user_slots.active_and_suspended} / {summary.user_slots.limit}</strong><small>active + suspended</small></a>
|
||||
<a href="/admin/generations"><span>进行中任务</span><strong>{summary.generation_jobs.queued + summary.generation_jobs.running}</strong><small>排队 {summary.generation_jobs.queued} · 运行 {summary.generation_jobs.running}</small></a>
|
||||
<a href="/admin/generations"><span>成本核对</span><strong>待人工核对 {summary.generation_jobs.pending_manual_review}</strong><small>最早 {formatTime(summary.generation_jobs.pending_manual_review_oldest_at)}</small></a>
|
||||
<a href="/admin/assets"><span>清理任务</span><strong>{summary.asset_cleanup.pending_jobs}</strong><small>等待处理</small></a>
|
||||
</section>
|
||||
<div className="admin-overview-columns">
|
||||
<section className="admin-status-section" aria-labelledby="model-status-heading">
|
||||
<header><div><p>MODEL STATE</p><h3 id="model-status-heading">模型状态</h3></div><a href="/admin/models">查看</a></header>
|
||||
<dl>
|
||||
<div><dt>配置默认</dt><dd>{summary.models.configured_default_model_id ?? "无"}</dd></div>
|
||||
<div><dt>运行时可用</dt><dd>{summary.models.runtime_available_count} / {summary.models.configured_model_count}</dd></div>
|
||||
<div><dt>当前推荐</dt><dd>{summary.models.recommended_model_id ?? "无"}</dd></div>
|
||||
</dl>
|
||||
</section>
|
||||
<section className="admin-status-section" aria-labelledby="service-status-heading">
|
||||
<header><div><p>SERVICE STATE</p><h3 id="service-status-heading">服务状态</h3></div><a href="/admin/services-storage">{hasServiceIssue ? "有异常" : "全部正常"}</a></header>
|
||||
<ul className="admin-service-list">
|
||||
{summary.services.map((service) => <li key={service.service_id}><span>{serviceLabels[service.service_id]}</span><strong className={`is-${service.status}`}>{stateLabels[service.status]}</strong><time dateTime={service.checked_at ?? undefined}>{formatTime(service.checked_at)}</time></li>)}
|
||||
</ul>
|
||||
</section>
|
||||
</div>
|
||||
<section className="admin-operation-strip" aria-labelledby="recent-operation-heading">
|
||||
<header><div><p>AUDIT SNAPSHOT</p><h3 id="recent-operation-heading">最近后台操作</h3></div><a href="/admin/audit">查看全部</a></header>
|
||||
{summary.recent_operations.length === 0 ? <p>当前无近期操作</p> : (
|
||||
<table><thead><tr><th>时间</th><th>操作</th><th>对象摘要</th><th>结果</th></tr></thead><tbody>{summary.recent_operations.map((operation) => <tr key={operation.operation_id}><td>{formatTime(operation.created_at)}</td><td>{operation.operation_type}</td><td><code>{operation.target_ref}</code></td><td>{operation.result}</td></tr>)}</tbody></table>
|
||||
)}
|
||||
</section>
|
||||
</>
|
||||
) : null}
|
||||
</main>
|
||||
);
|
||||
}
|
||||
|
||||
export function AdminPlaceholderPage({ title }: { title: string }) {
|
||||
return (
|
||||
<main className="admin-placeholder" id="admin-main">
|
||||
<header className="admin-page-heading"><div><p>OPERATIONS</p><h2>{title}</h2></div></header>
|
||||
<section aria-label={`${title}安全摘要`}>
|
||||
<div className="admin-placeholder-toolbar"><span>安全摘要</span><button disabled type="button">新建</button></div>
|
||||
<p>当前无记录</p>
|
||||
</section>
|
||||
</main>
|
||||
);
|
||||
}
|
||||
@@ -100,11 +100,7 @@ export function AdminUsersPage() {
|
||||
|
||||
return (
|
||||
<div className="admin-users-page">
|
||||
<header className="admin-product-header">
|
||||
<a href="/admin">DADA ADMIN</a>
|
||||
<nav aria-label="后台导航"><a aria-current="page" href="/admin/users">用户</a><a href="/admin/models">模型</a><a href="/admin/audit">审计</a></nav>
|
||||
</header>
|
||||
<main>
|
||||
<main id="admin-main">
|
||||
<header className="admin-users-heading">
|
||||
<div><p>USER OPERATIONS</p><h1>用户点数</h1></div>
|
||||
{balance ? <button onClick={openAdjustment} type="button">调整点数</button> : null}
|
||||
|
||||
@@ -1,9 +1,18 @@
|
||||
// Generated from openapi/openapi.json. Do not edit by hand.
|
||||
|
||||
import type { CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
|
||||
import type { PrivateContentNoticeAckResponse, PrivateContentNoticeAckRequest, CreditAdjustmentResponse, CreditAdjustmentRequest, BrowserSupportSuccess, BrowserSupportRequest, AccountDeletionResponse, AccountDeletionCompleteRequest, AdminLoginCompleteResponse, AdminLoginCompleteRequest, LoginCompleteResponse, LoginCompleteRequest, RegistrationCompleteResponse, RegistrationCompleteRequest, GenerationCreateResponse, AccountSettingsResponse, AdminOverviewResponse, AdminSessionResponse, CreditBalanceResponse, BootstrapResponse, GenerationTaskResponse, SseEvent, ModelConfig, ModelConfigurationResponse, CreditLedgerResponse, ProjectDetailResponse, UserSessionResponse, AdminGenerationListResponse, ProjectListResponse, RecentAssetListResponse, LogoutResponse, PrivateContentPromptResponse, ProjectPurgeResponse, RecentAssetRecordResponse, RecentAssetRecordRequest, ProjectRenameResponse, ProjectRenameRequest, ModelConfigUpdateRequest, ProjectRestoreResponse, ReverseGeocodeResponse, ReverseGeocodeRequest, LatestExportSaveResponse, ProjectStateSaveResponse, ProjectEditableState, AccountDeletionSendResponse, RegistrationSendResponse, AdminLoginSendRequest, LoginSendRequest, RegistrationSendRequest, FailedEmptyTrashResponse, FailedEmptyTrashRequest, ProjectTrashResponse, AccountProfileUpdateResponse, AccountProfileUpdateRequest } from "./types.gen.js";
|
||||
|
||||
export interface ClientOptions { baseUrl?: string; fetch?: typeof globalThis.fetch; headers?: HeadersInit; }
|
||||
|
||||
export async function ackPrivateContentNotice(body: PrivateContentNoticeAckRequest, options: ClientOptions = {}): Promise<PrivateContentNoticeAckResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const headers = new Headers(options.headers);
|
||||
headers.set("Content-Type", "application/json");
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content-notice/ack`, { body: JSON.stringify(body), method: "POST", headers });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<PrivateContentNoticeAckResponse>;
|
||||
}
|
||||
|
||||
export async function adjustAdminUserCredits(body: CreditAdjustmentRequest, options: ClientOptions = {}): Promise<CreditAdjustmentResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const headers = new Headers(options.headers);
|
||||
@@ -87,6 +96,13 @@ export async function getAccountSettings(options: ClientOptions = {}): Promise<A
|
||||
return response.json() as Promise<AccountSettingsResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminOverview(options: ClientOptions = {}): Promise<AdminOverviewResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/overview`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<AdminOverviewResponse>;
|
||||
}
|
||||
|
||||
export async function getAdminSession(options: ClientOptions = {}): Promise<AdminSessionResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin-auth/session`, { method: "GET", headers: options.headers ?? {} });
|
||||
@@ -168,6 +184,13 @@ export async function getUserSession(options: ClientOptions = {}): Promise<UserS
|
||||
return response.json() as Promise<UserSessionResponse>;
|
||||
}
|
||||
|
||||
export async function listAdminGenerations(options: ClientOptions = {}): Promise<AdminGenerationListResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/generations`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<AdminGenerationListResponse>;
|
||||
}
|
||||
|
||||
export async function listProjects(options: ClientOptions = {}): Promise<ProjectListResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/projects`, { method: "GET", headers: options.headers ?? {} });
|
||||
@@ -189,6 +212,20 @@ export async function logoutUser(options: ClientOptions = {}): Promise<LogoutRes
|
||||
return response.json() as Promise<LogoutResponse>;
|
||||
}
|
||||
|
||||
export async function openAdminGenerationImage(options: ClientOptions = {}): Promise<Blob> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content/generations/{generationId}/image`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.blob() as Promise<Blob>;
|
||||
}
|
||||
|
||||
export async function openAdminGenerationPrompt(options: ClientOptions = {}): Promise<PrivateContentPromptResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/admin/private-content/generations/{generationId}/prompt`, { method: "GET", headers: options.headers ?? {} });
|
||||
if (!response.ok) throw new Error(`HTTP ${response.status}`);
|
||||
return response.json() as Promise<PrivateContentPromptResponse>;
|
||||
}
|
||||
|
||||
export async function purgeProject(options: ClientOptions = {}): Promise<ProjectPurgeResponse> {
|
||||
const request = options.fetch ?? globalThis.fetch;
|
||||
const response = await request(`${options.baseUrl ?? ""}/api/v1/projects/{projectId}/purge`, { method: "POST", headers: options.headers ?? {} });
|
||||
|
||||
@@ -60,6 +60,27 @@ export type AdminCreditParams = {
|
||||
"userId": string;
|
||||
};
|
||||
|
||||
export type AdminGenerationListResponse = {
|
||||
"generated_at": string;
|
||||
"items": Array<AdminGenerationRecord>;
|
||||
};
|
||||
|
||||
export type AdminGenerationRecord = {
|
||||
"completed_at": string | null;
|
||||
"confirmed_credit_cost": number;
|
||||
"created_at": string;
|
||||
"duration_ms": number | null;
|
||||
"error_category": "upstream_timeout" | "upstream_failed" | "safety_rejected" | "model_disabled" | "gateway_balance_insufficient" | "gateway_contract_invalid" | "reference_invalid" | "unknown_retryable" | "unknown_non_retryable" | null;
|
||||
"final_credit_state": "committed" | "released" | null;
|
||||
"generation_id": string;
|
||||
"model_id": string;
|
||||
"owner_ref": string;
|
||||
"project_id": string;
|
||||
"ratio": "3:4" | "1:1" | "4:3" | "9:16";
|
||||
"reserved_credits": number;
|
||||
"status": "queued" | "running" | "succeeded" | "failed" | "rejected";
|
||||
};
|
||||
|
||||
export type AdminLoginCompleteRequest = {
|
||||
"registration_id": string;
|
||||
"verification_code": string;
|
||||
@@ -76,12 +97,54 @@ export type AdminLoginSendRequest = {
|
||||
"email": string;
|
||||
};
|
||||
|
||||
export type AdminOverviewResponse = {
|
||||
"asset_cleanup": {
|
||||
"pending_jobs": number;
|
||||
};
|
||||
"generated_at": string;
|
||||
"generation_jobs": {
|
||||
"pending_manual_review": number;
|
||||
"pending_manual_review_oldest_at": string | null;
|
||||
"queued": number;
|
||||
"running": number;
|
||||
};
|
||||
"models": {
|
||||
"configured_default_model_id": string | null;
|
||||
"configured_model_count": number;
|
||||
"recommended_model_id": string | null;
|
||||
"runtime_available_count": number;
|
||||
};
|
||||
"recent_operations": Array<{
|
||||
"created_at": string;
|
||||
"operation_id": string;
|
||||
"operation_type": string;
|
||||
"result": "succeeded" | "rejected" | "failed";
|
||||
"target_ref": string;
|
||||
}>;
|
||||
"services": Array<{
|
||||
"checked_at": string | null;
|
||||
"service_id": "resend" | "amap" | "ai_gateway" | "worker" | "asset_root";
|
||||
"status": "available" | "degraded" | "paused" | "unavailable";
|
||||
}>;
|
||||
"storage": {
|
||||
"last_measured_at": string | null;
|
||||
"limit_bytes": number;
|
||||
"managed_content_bytes": number;
|
||||
"status": "normal" | "critical" | "full" | "unavailable";
|
||||
};
|
||||
"user_slots": {
|
||||
"active_and_suspended": number;
|
||||
"limit": number;
|
||||
};
|
||||
};
|
||||
|
||||
export type AdminSessionResponse = {
|
||||
"acknowledged_private_content_notice_version": string | null;
|
||||
"admin": AdminAuthenticatedUser;
|
||||
"audience": "admin";
|
||||
"authenticated": true;
|
||||
"csrf_token": string;
|
||||
"current_private_content_notice_message_key"?: string;
|
||||
"current_private_content_notice_version": string | null;
|
||||
"expires_at": string;
|
||||
"notice_acknowledged": boolean;
|
||||
@@ -541,6 +604,26 @@ export type ModelRuntimeSseEvent = {
|
||||
"runtime_availability_version": number;
|
||||
};
|
||||
|
||||
export type PrivateContentGenerationParams = {
|
||||
"generationId": string;
|
||||
};
|
||||
|
||||
export type PrivateContentNoticeAckRequest = {
|
||||
"expected_notice_version": string;
|
||||
};
|
||||
|
||||
export type PrivateContentNoticeAckResponse = {
|
||||
"acknowledged_at": string;
|
||||
"notice_version": string;
|
||||
"status": "acknowledged";
|
||||
};
|
||||
|
||||
export type PrivateContentPromptResponse = {
|
||||
"content_type": "prompt";
|
||||
"generation_id": string;
|
||||
"prompt": string;
|
||||
};
|
||||
|
||||
export type ProjectDetailResponse = {
|
||||
"canvas_state": CanvasState;
|
||||
"created_at": string;
|
||||
|
||||
+23
-4
@@ -1,4 +1,4 @@
|
||||
import { StrictMode } from "react";
|
||||
import { StrictMode, type ReactNode } from "react";
|
||||
import { createRoot } from "react-dom/client";
|
||||
|
||||
import { registerPublicAssetServiceWorker } from "./public-asset-cache.js";
|
||||
@@ -7,9 +7,11 @@ import { UserAuthPage } from "./user-auth.js";
|
||||
import { AccountSettingsPage } from "./account-settings.js";
|
||||
import { AdminUsersPage } from "./admin-users.js";
|
||||
import { AdminModelsPage } from "./admin-models.js";
|
||||
import { AdminGenerationsPage } from "./admin-generations.js";
|
||||
import { CreditsPage } from "./credits-page.js";
|
||||
import { ProjectDetailPage, ProjectsPage, WorkspacePage } from "./project-pages.js";
|
||||
import { EditorPage } from "./editor-page.js";
|
||||
import { AdminOverviewPage, AdminPlaceholderPage, AdminProtectedRoute } from "./admin-shell.js";
|
||||
|
||||
const root = document.getElementById("root");
|
||||
|
||||
@@ -34,9 +36,26 @@ function renderAuthenticationEntry() {
|
||||
else if (projectDetail?.[1]) authenticationPage = <ProjectDetailPage key={authRevision} projectId={projectDetail[1]} />;
|
||||
else if (window.location.pathname === "/app/projects") authenticationPage = <ProjectsPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/app") authenticationPage = <WorkspacePage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/users") authenticationPage = <AdminUsersPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/models") authenticationPage = <AdminModelsPage key={authRevision} />;
|
||||
else if (window.location.pathname.startsWith("/admin")) authenticationPage = <AdminAuthPage key={authRevision} />;
|
||||
else if (window.location.pathname === "/admin/login") authenticationPage = <AdminAuthPage key={authRevision} />;
|
||||
else if (window.location.pathname.startsWith("/admin")) {
|
||||
const adminPages: Record<string, { content: ReactNode; title: string }> = {
|
||||
"/admin": { content: <AdminOverviewPage />, title: "运营总览" },
|
||||
"/admin/assets": { content: <AdminPlaceholderPage title="素材" />, title: "素材" },
|
||||
"/admin/audit": { content: <AdminPlaceholderPage title="审计" />, title: "审计" },
|
||||
"/admin/generations": { content: <AdminGenerationsPage />, title: "生成记录" },
|
||||
"/admin/invites": { content: <AdminPlaceholderPage title="邀请码" />, title: "邀请码" },
|
||||
"/admin/models": { content: <AdminModelsPage />, title: "模型" },
|
||||
"/admin/preview": { content: <AdminPlaceholderPage title="内部预览" />, title: "内部预览" },
|
||||
"/admin/services-storage": { content: <AdminPlaceholderPage title="服务与存储" />, title: "服务与存储" },
|
||||
"/admin/users": { content: <AdminUsersPage />, title: "用户与点数" },
|
||||
};
|
||||
const page = adminPages[window.location.pathname] ?? adminPages["/admin"]!;
|
||||
authenticationPage = (
|
||||
<AdminProtectedRoute currentPath={window.location.pathname} key={authRevision} title={page.title}>
|
||||
{page.content}
|
||||
</AdminProtectedRoute>
|
||||
);
|
||||
}
|
||||
else authenticationPage = <UserAuthPage key={authRevision} />;
|
||||
appRoot.render(
|
||||
<StrictMode>
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
+4
-2
@@ -14,7 +14,7 @@
|
||||
"test:integration": "vitest run tests/integration",
|
||||
"test:api": "pnpm check:openapi && vitest run tests/api",
|
||||
"test:worker": "pnpm --filter @dada/worker build && node scripts/worker-smoke.mjs && vitest run tests/worker",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts --config playwright.config.ts",
|
||||
"test:e2e": "pnpm check:openapi && playwright test tests/e2e/event-sync.spec.ts tests/e2e/support-gate.spec.ts tests/e2e/local-data-boundary.spec.ts tests/e2e/storage-capacity.spec.ts tests/e2e/public-asset-cache.spec.ts tests/e2e/user-auth.spec.ts tests/e2e/admin-auth.spec.ts tests/e2e/entry-state-ui.spec.ts tests/e2e/session-invalid-ui.spec.ts tests/e2e/user-registration.spec.ts tests/e2e/account-settings.spec.ts tests/e2e/projects-workspace.spec.ts tests/e2e/project-autosave-conflict.spec.ts tests/e2e/project-trash.spec.ts tests/e2e/credits.spec.ts tests/e2e/generation-workspace.spec.ts tests/e2e/generation-terminal-actions.spec.ts tests/e2e/project-latest-exports.spec.ts tests/e2e/admin-models.spec.ts tests/e2e/wp4-01-editor-background.spec.ts tests/e2e/wp4-02-editor-elements.spec.ts tests/e2e/wp4-03-text-editor.spec.ts tests/e2e/wp4-04-color-dynamic.spec.ts tests/e2e/wp4-05-export.spec.ts tests/e2e/wp4-06-accessibility.spec.ts tests/e2e/wp5-02-static-sticker-catalog.spec.ts tests/e2e/wp5-03-template-registry.spec.ts tests/e2e/wp5-04-resource-isolation.spec.ts tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts",
|
||||
"test:visual": "node scripts/validate-layer-scope.mjs VISUAL",
|
||||
"test:performance": "node scripts/validate-layer-scope.mjs PERFORMANCE",
|
||||
"test:security": "node scripts/verify-frozen-dependencies.mjs && node scripts/redaction-scan.mjs",
|
||||
@@ -94,7 +94,9 @@
|
||||
"test:wp5-03": "node scripts/run-wp5-03-validation.mjs",
|
||||
"test:wp5-03:red": "node scripts/run-wp5-03-validation.mjs --phase red",
|
||||
"test:wp5-04": "node scripts/run-wp5-04-validation.mjs",
|
||||
"test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red"
|
||||
"test:wp5-04:red": "node scripts/run-wp5-04-validation.mjs --phase red",
|
||||
"test:wp6-01": "node scripts/run-wp6-01-validation.mjs --phase scaffold",
|
||||
"test:wp6-01:red": "node scripts/run-wp6-01-validation.mjs --phase red"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@playwright/test": "1.62.0",
|
||||
|
||||
@@ -0,0 +1,160 @@
|
||||
import { Type, type Static } from "@sinclair/typebox";
|
||||
|
||||
const isoTimestampPattern = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{3})?Z$";
|
||||
const modelIdPattern = "^[a-z0-9][a-z0-9.-]+$";
|
||||
const safeReferencePattern = "^[A-Za-z0-9][A-Za-z0-9:._-]{0,159}$";
|
||||
const uuidPattern = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
|
||||
|
||||
export const AdminGenerationRecordSchema = Type.Object(
|
||||
{
|
||||
generation_id: Type.String({ pattern: uuidPattern }),
|
||||
owner_ref: Type.String({ pattern: uuidPattern }),
|
||||
project_id: Type.String({ pattern: uuidPattern }),
|
||||
model_id: Type.String({ maxLength: 80, pattern: modelIdPattern }),
|
||||
ratio: Type.Union([Type.Literal("3:4"), Type.Literal("1:1"), Type.Literal("4:3"), Type.Literal("9:16")]),
|
||||
status: Type.Union([Type.Literal("queued"), Type.Literal("running"), Type.Literal("succeeded"), Type.Literal("failed"), Type.Literal("rejected")]),
|
||||
created_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
completed_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
duration_ms: Type.Union([Type.Integer({ minimum: 0 }), Type.Null()]),
|
||||
confirmed_credit_cost: Type.Integer({ minimum: 0 }),
|
||||
reserved_credits: Type.Integer({ minimum: 0 }),
|
||||
final_credit_state: Type.Union([Type.Literal("committed"), Type.Literal("released"), Type.Null()]),
|
||||
error_category: Type.Union([
|
||||
Type.Literal("upstream_timeout"), Type.Literal("upstream_failed"), Type.Literal("safety_rejected"),
|
||||
Type.Literal("model_disabled"), Type.Literal("gateway_balance_insufficient"), Type.Literal("gateway_contract_invalid"),
|
||||
Type.Literal("reference_invalid"), Type.Literal("unknown_retryable"), Type.Literal("unknown_non_retryable"), Type.Null(),
|
||||
]),
|
||||
},
|
||||
{ additionalProperties: false, $id: "AdminGenerationRecord" },
|
||||
);
|
||||
|
||||
export const AdminGenerationListResponseSchema = Type.Object(
|
||||
{
|
||||
generated_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
items: Type.Array(Type.Ref(AdminGenerationRecordSchema), { maxItems: 100 }),
|
||||
},
|
||||
{ additionalProperties: false, $id: "AdminGenerationListResponse" },
|
||||
);
|
||||
|
||||
export const PrivateContentNoticeAckRequestSchema = Type.Object(
|
||||
{ expected_notice_version: Type.String({ minLength: 1, maxLength: 80, pattern: "^[A-Za-z0-9_.:-]+$" }) },
|
||||
{ additionalProperties: false, $id: "PrivateContentNoticeAckRequest" },
|
||||
);
|
||||
|
||||
export const PrivateContentNoticeAckResponseSchema = Type.Object(
|
||||
{
|
||||
notice_version: Type.String({ minLength: 1, maxLength: 80, pattern: "^[A-Za-z0-9_.:-]+$" }),
|
||||
acknowledged_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
status: Type.Literal("acknowledged"),
|
||||
},
|
||||
{ additionalProperties: false, $id: "PrivateContentNoticeAckResponse" },
|
||||
);
|
||||
|
||||
export const PrivateContentPromptResponseSchema = Type.Object(
|
||||
{
|
||||
generation_id: Type.String({ pattern: uuidPattern }),
|
||||
content_type: Type.Literal("prompt"),
|
||||
prompt: Type.String({ minLength: 1, maxLength: 4000 }),
|
||||
},
|
||||
{ additionalProperties: false, $id: "PrivateContentPromptResponse" },
|
||||
);
|
||||
|
||||
export const PrivateContentGenerationParamsSchema = Type.Object(
|
||||
{ generationId: Type.String({ pattern: uuidPattern }) },
|
||||
{ additionalProperties: false, $id: "PrivateContentGenerationParams" },
|
||||
);
|
||||
|
||||
export type AdminGenerationRecord = Static<typeof AdminGenerationRecordSchema>;
|
||||
export type AdminGenerationListResponse = Static<typeof AdminGenerationListResponseSchema>;
|
||||
export type PrivateContentNoticeAckRequest = Static<typeof PrivateContentNoticeAckRequestSchema>;
|
||||
export type PrivateContentNoticeAckResponse = Static<typeof PrivateContentNoticeAckResponseSchema>;
|
||||
export type PrivateContentPromptResponse = Static<typeof PrivateContentPromptResponseSchema>;
|
||||
|
||||
export const AdminOverviewResponseSchema = Type.Object(
|
||||
{
|
||||
generated_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
user_slots: Type.Object(
|
||||
{
|
||||
active_and_suspended: Type.Integer({ minimum: 0 }),
|
||||
limit: Type.Integer({ minimum: 1 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
generation_jobs: Type.Object(
|
||||
{
|
||||
pending_manual_review: Type.Integer({ minimum: 0 }),
|
||||
pending_manual_review_oldest_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
queued: Type.Integer({ minimum: 0 }),
|
||||
running: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
models: Type.Object(
|
||||
{
|
||||
configured_default_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
|
||||
configured_model_count: Type.Integer({ minimum: 0 }),
|
||||
recommended_model_id: Type.Union([Type.String({ maxLength: 80, pattern: modelIdPattern }), Type.Null()]),
|
||||
runtime_available_count: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
storage: Type.Object(
|
||||
{
|
||||
last_measured_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
limit_bytes: Type.Integer({ minimum: 1 }),
|
||||
managed_content_bytes: Type.Integer({ minimum: 0 }),
|
||||
status: Type.Union([
|
||||
Type.Literal("normal"),
|
||||
Type.Literal("critical"),
|
||||
Type.Literal("full"),
|
||||
Type.Literal("unavailable"),
|
||||
]),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
services: Type.Array(
|
||||
Type.Object(
|
||||
{
|
||||
checked_at: Type.Union([Type.String({ pattern: isoTimestampPattern }), Type.Null()]),
|
||||
service_id: Type.Union([
|
||||
Type.Literal("resend"),
|
||||
Type.Literal("amap"),
|
||||
Type.Literal("ai_gateway"),
|
||||
Type.Literal("worker"),
|
||||
Type.Literal("asset_root"),
|
||||
]),
|
||||
status: Type.Union([
|
||||
Type.Literal("available"),
|
||||
Type.Literal("degraded"),
|
||||
Type.Literal("paused"),
|
||||
Type.Literal("unavailable"),
|
||||
]),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
{ maxItems: 5 },
|
||||
),
|
||||
recent_operations: Type.Array(
|
||||
Type.Object(
|
||||
{
|
||||
created_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
operation_id: Type.String({ pattern: "^[0-9a-fA-F-]{36}$" }),
|
||||
operation_type: Type.String({ maxLength: 80, pattern: "^[a-z][a-z0-9_]+$" }),
|
||||
result: Type.Union([Type.Literal("succeeded"), Type.Literal("rejected"), Type.Literal("failed")]),
|
||||
target_ref: Type.String({ pattern: safeReferencePattern }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
{ maxItems: 10 },
|
||||
),
|
||||
asset_cleanup: Type.Object(
|
||||
{
|
||||
pending_jobs: Type.Integer({ minimum: 0 }),
|
||||
},
|
||||
{ additionalProperties: false },
|
||||
),
|
||||
},
|
||||
{ additionalProperties: false, $id: "AdminOverviewResponse" },
|
||||
);
|
||||
|
||||
export type AdminOverviewResponse = Static<typeof AdminOverviewResponseSchema>;
|
||||
@@ -149,6 +149,7 @@ export const AdminSessionResponseSchema = Type.Object(
|
||||
audience: Type.Literal("admin"),
|
||||
authenticated: Type.Literal(true),
|
||||
csrf_token: Type.String({ maxLength: 64, minLength: 43, pattern: "^[A-Za-z0-9_-]+$" }),
|
||||
current_private_content_notice_message_key: Type.Optional(Type.String({ maxLength: 120, pattern: "^[A-Za-z0-9_.-]+$" })),
|
||||
current_private_content_notice_version: Type.Union([Type.String(), Type.Null()]),
|
||||
expires_at: Type.String({ pattern: isoTimestampPattern }),
|
||||
notice_acknowledged: Type.Boolean(),
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
export { Type } from "@sinclair/typebox";
|
||||
export * from "./api.js";
|
||||
export * from "./admin.js";
|
||||
export * from "./assets.js";
|
||||
export * from "./auth.js";
|
||||
export * from "./bootstrap.js";
|
||||
|
||||
@@ -13,6 +13,7 @@ function runPnpm(args) {
|
||||
}
|
||||
|
||||
export function buildApiContracts() {
|
||||
runPnpm(["--filter", "@dada/asset-release-manifest", "build"]);
|
||||
runPnpm(["--filter", "@dada/shared-contracts", "build"]);
|
||||
runPnpm(["--filter", "@dada/api", "build"]);
|
||||
}
|
||||
|
||||
@@ -0,0 +1,115 @@
|
||||
import { createHash } from "node:crypto";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
const phaseIndex = process.argv.indexOf("--phase");
|
||||
const phase = phaseIndex >= 0 ? process.argv[phaseIndex + 1] : "scaffold";
|
||||
if (!new Set(["red", "scaffold"]).has(phase)) throw new Error(`Unsupported phase: ${phase}`);
|
||||
|
||||
const runId = process.env.DADA_TDD_RUN_ID ?? `wp6-01-${phase}-${new Date().toISOString().replace(/[^0-9]/g, "")}`;
|
||||
const runDirectory = resolve("artifacts", "tdd", runId);
|
||||
const caseDirectory = resolve(runDirectory, "cases", "TDD-WP6-ADM-001-role-and-summary");
|
||||
if (existsSync(runDirectory)) throw new Error(`Evidence run already exists: ${runId}`);
|
||||
mkdirSync(caseDirectory, { recursive: true });
|
||||
|
||||
const environment = {
|
||||
...process.env,
|
||||
DADA_EVIDENCE_DIR_ADMIN: caseDirectory,
|
||||
DADA_PLAYWRIGHT_OUTPUT_DIR: resolve(runDirectory, "playwright-output"),
|
||||
DADA_WP6_01_EVIDENCE_DIR: caseDirectory,
|
||||
};
|
||||
const commands = phase === "red"
|
||||
? [
|
||||
["api-red", "pnpm exec vitest run tests/api/wp6-01-admin-shell.test.ts"],
|
||||
["e2e-red", "pnpm exec playwright test tests/e2e/wp6-01-admin-shell.spec.ts --config playwright.config.ts"],
|
||||
]
|
||||
: [
|
||||
["api", "pnpm test:api"],
|
||||
["e2e", "pnpm test:e2e"],
|
||||
["security", "pnpm test:security"],
|
||||
["tdd-trace", "pnpm validate:tdd-trace"],
|
||||
];
|
||||
|
||||
const commandResults = [];
|
||||
for (const [name, command] of commands) {
|
||||
const started_at = new Date().toISOString();
|
||||
const result = spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", command], {
|
||||
encoding: "utf8",
|
||||
env: environment,
|
||||
maxBuffer: 40 * 1024 * 1024,
|
||||
});
|
||||
if (result.stdout) process.stdout.write(result.stdout);
|
||||
if (result.stderr) process.stderr.write(result.stderr);
|
||||
commandResults.push({ command, exit_code: result.status ?? 1, finished_at: new Date().toISOString(), name, started_at });
|
||||
if (phase === "scaffold" && (result.status ?? 1) !== 0) break;
|
||||
}
|
||||
|
||||
const redConfirmed = phase === "red" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code !== 0);
|
||||
if (phase === "red") {
|
||||
writeFileSync(resolve(caseDirectory, "red-observation.json"), `${JSON.stringify({
|
||||
expected_failure: "The protected admin overview route, nine-entry admin shell, denied-session redirect, and disabled-session ejection are absent before TASK-WP6-01.",
|
||||
observed_commands: commandResults,
|
||||
red_reason: "TDD-WP6-ADM-001 first Red: ordinary or preview subjects can reach the unguarded admin route, while no safe summary API exists.",
|
||||
status: redConfirmed ? "red_confirmed" : "failed",
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function findFiles(directory, name) {
|
||||
if (!existsSync(directory)) return [];
|
||||
const matches = [];
|
||||
for (const entry of readdirSync(directory, { withFileTypes: true })) {
|
||||
const path = resolve(directory, entry.name);
|
||||
if (entry.isDirectory()) matches.push(...findFiles(path, name));
|
||||
else if (entry.name === name) matches.push(path);
|
||||
}
|
||||
return matches;
|
||||
}
|
||||
|
||||
if (phase === "scaffold") {
|
||||
const trace = findFiles(environment.DADA_PLAYWRIGHT_OUTPUT_DIR, "trace.zip")
|
||||
.find((path) => path.toLowerCase().includes("wp6-01-admin-shell"));
|
||||
if (trace) copyFileSync(trace, resolve(caseDirectory, "trace.zip"));
|
||||
}
|
||||
|
||||
const expectedEvidence = phase === "red"
|
||||
? ["red-observation.json"]
|
||||
: ["response.json", "db-access.json", "trace.zip", "screenshots/admin-denied.png", "screenshots/admin-overview.png"];
|
||||
const missingEvidence = expectedEvidence.filter((file) => !existsSync(resolve(caseDirectory, file)));
|
||||
const commandsPassed = phase === "scaffold" && commandResults.length === commands.length && commandResults.every((item) => item.exit_code === 0);
|
||||
const status = phase === "red"
|
||||
? redConfirmed && missingEvidence.length === 0 ? "red_confirmed" : "failed"
|
||||
: commandsPassed && missingEvidence.length === 0 ? "red" : "failed";
|
||||
const commit = spawnSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).stdout.trim();
|
||||
const wp5BaselineSha = spawnSync("git", ["rev-parse", "origin/codex/wp5-04"], { encoding: "utf8" }).stdout.trim();
|
||||
const manifest = {
|
||||
path: "tasks.manifest.json",
|
||||
sha256: createHash("sha256").update(readFileSync("tasks.manifest.json")).digest("hex").toUpperCase(),
|
||||
};
|
||||
const result = {
|
||||
acceptance_criteria: ["AC-25", "AC-49"],
|
||||
automation: ["automated"],
|
||||
commit,
|
||||
dependency_gate: {
|
||||
blocked_by: ["TASK-WP5-05", "TASK-WP5-06", "TASK-WP5-07"],
|
||||
baseline_remote_branch: "origin/codex/wp5-04",
|
||||
baseline_remote_sha: wp5BaselineSha,
|
||||
final_green_allowed: false,
|
||||
},
|
||||
evidence_refs: expectedEvidence,
|
||||
layer: ["API", "E2E"],
|
||||
manifest,
|
||||
missing_evidence: missingEvidence,
|
||||
phase,
|
||||
requirements: ["ADMIN-01", "ADMIN-02", "ADMIN-04", "ADMIN-08"],
|
||||
run_id: runId,
|
||||
status,
|
||||
task_id: "TASK-WP6-01",
|
||||
test_id: "TDD-WP6-ADM-001-role-and-summary",
|
||||
work_package: "WP-6",
|
||||
};
|
||||
writeFileSync(resolve(caseDirectory, "commands.json"), `${JSON.stringify({ commands: commandResults, phase, run_id: runId }, null, 2)}\n`);
|
||||
writeFileSync(resolve(caseDirectory, "result.json"), `${JSON.stringify(result, null, 2)}\n`);
|
||||
writeFileSync(resolve(runDirectory, "evidence.json"), `${JSON.stringify({ cases: [{ missing_evidence: missingEvidence, status, test_id: result.test_id }], phase, run_id: runId, status }, null, 2)}\n`);
|
||||
console.log(JSON.stringify({ phase, run_id: runId, status }, null, 2));
|
||||
if (status === "failed") process.exit(1);
|
||||
@@ -0,0 +1,140 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
|
||||
|
||||
const roots: string[] = [];
|
||||
const services: RegistrationService[] = [];
|
||||
const now = Date.parse("2026-08-03T09:30:00.000Z");
|
||||
const requestHeaders = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
|
||||
function createRegistration() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp6-01-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
adminAllowlistPepper: Buffer.alloc(32, 0xd1),
|
||||
challengePepper: Buffer.alloc(32, 0xd2),
|
||||
clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-registration-notice-v1",
|
||||
databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0xd3),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0xd4),
|
||||
});
|
||||
services.push(registration);
|
||||
return registration;
|
||||
}
|
||||
|
||||
function seedSubject(registration: RegistrationService, role: "super_admin" | "user") {
|
||||
const userId = randomUUID();
|
||||
registration.database.prepare(`
|
||||
INSERT INTO users (
|
||||
user_id, normalized_email, role, status, counts_toward_stage_limit,
|
||||
registration_id, created_at
|
||||
) VALUES (?, ?, ?, 'active', ?, ?, ?)
|
||||
`).run(userId, `${role}-${userId}@example.invalid`, role, role === "user" ? 1 : 0, randomUUID(), now);
|
||||
if (role === "super_admin") {
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(userId);
|
||||
}
|
||||
return userId;
|
||||
}
|
||||
|
||||
function tableCounts(registration: RegistrationService) {
|
||||
return {
|
||||
admin: (registration.database.prepare("SELECT COUNT(*) AS count FROM admin_operation_logs").get() as { count: number }).count,
|
||||
private: (registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count,
|
||||
};
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const service of services.splice(0)) service.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP6-ADM-001-role-and-summary", () => {
|
||||
it("authorizes only an active admin audience and returns a schema-redacted summary", async () => {
|
||||
const registration = createRegistration();
|
||||
const adminId = seedSubject(registration, "super_admin");
|
||||
const ordinaryId = seedSubject(registration, "user");
|
||||
const previewId = seedSubject(registration, "user");
|
||||
registration.database.exec("CREATE TABLE asset_preview_grants_fixture (user_id TEXT PRIMARY KEY, status TEXT NOT NULL)");
|
||||
registration.database.prepare("INSERT INTO asset_preview_grants_fixture (user_id, status) VALUES (?, 'active')").run(previewId);
|
||||
|
||||
const adminSession = registration.issueAuthenticatedSession(adminId, "admin");
|
||||
const ordinarySession = registration.issueAuthenticatedSession(ordinaryId, "user");
|
||||
const previewSession = registration.issueAuthenticatedSession(previewId, "user");
|
||||
let providerCalls = 0;
|
||||
const app = await createApp({
|
||||
adminOverview: async () => {
|
||||
providerCalls += 1;
|
||||
return {
|
||||
...adminOverviewFixture,
|
||||
absolute_path: "forbidden-path-trap",
|
||||
["api" + "_key"]: "forbidden-key-trap",
|
||||
private_prompt: "forbidden-prompt-trap",
|
||||
recent_operations: adminOverviewFixture.recent_operations.map((operation) => ({
|
||||
...operation,
|
||||
actor_email: "forbidden@example.invalid",
|
||||
})),
|
||||
};
|
||||
},
|
||||
browserGate: false,
|
||||
networkBoundary: { allowTestPort: true },
|
||||
registration,
|
||||
});
|
||||
|
||||
for (const token of [undefined, ordinarySession.sessionToken, previewSession.sessionToken]) {
|
||||
const response = await app.inject({
|
||||
headers: token ? { ...requestHeaders, cookie: `dada_admin_session=${token}` } : requestHeaders,
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(response.statusCode).toBe(401);
|
||||
}
|
||||
expect(providerCalls).toBe(0);
|
||||
|
||||
const before = tableCounts(registration);
|
||||
const allowed = await app.inject({
|
||||
headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(allowed.statusCode).toBe(200);
|
||||
expect(allowed.json()).toEqual(adminOverviewFixture);
|
||||
expect(JSON.stringify(allowed.json())).not.toMatch(/absolute_path|api_key|private_prompt|actor_email|forbidden/i);
|
||||
expect(providerCalls).toBe(1);
|
||||
expect(tableCounts(registration)).toEqual(before);
|
||||
|
||||
registration.revokeAdminSessions(adminId, "disabled");
|
||||
const afterDisable = tableCounts(registration);
|
||||
const revoked = await app.inject({
|
||||
headers: { ...requestHeaders, cookie: `dada_admin_session=${adminSession.sessionToken}` },
|
||||
method: "GET",
|
||||
url: "/api/v1/admin/overview",
|
||||
});
|
||||
expect(revoked.statusCode).toBe(401);
|
||||
expect(providerCalls).toBe(1);
|
||||
expect(tableCounts(registration)).toEqual(afterDisable);
|
||||
const evidenceRoot = process.env.DADA_WP6_01_EVIDENCE_DIR;
|
||||
if (evidenceRoot) {
|
||||
mkdirSync(evidenceRoot, { recursive: true });
|
||||
writeFileSync(resolve(evidenceRoot, "response.json"), `${JSON.stringify({
|
||||
active_admin: allowed.json(),
|
||||
denied_statuses: { anonymous: 401, ordinary: 401, preview: 401, suspended_admin: revoked.statusCode },
|
||||
}, null, 2)}\n`);
|
||||
writeFileSync(resolve(evidenceRoot, "db-access.json"), `${JSON.stringify({
|
||||
active_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
|
||||
denied_read_delta: { admin_operation_logs: 0, private_content_access_logs: 0 },
|
||||
provider_calls: providerCalls,
|
||||
}, null, 2)}\n`);
|
||||
}
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,105 @@
|
||||
import { randomUUID } from "node:crypto";
|
||||
import { mkdtempSync, rmSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
import { afterEach, describe, expect, it } from "vitest";
|
||||
|
||||
import { createApp } from "../../apps/api/src/app.js";
|
||||
import { RegistrationService } from "../../apps/api/src/registration.js";
|
||||
import { MockResendAdapter } from "../../apps/api/src/resend-adapter.js";
|
||||
|
||||
const roots: string[] = [];
|
||||
const services: RegistrationService[] = [];
|
||||
const now = Date.parse("2026-08-04T09:30:00.000Z");
|
||||
const headers = { host: "127.0.0.1:43121", origin: "http://127.0.0.1:43121" };
|
||||
|
||||
function harness() {
|
||||
const root = mkdtempSync(join(tmpdir(), "dada-wp6-02-api-"));
|
||||
roots.push(root);
|
||||
const registration = new RegistrationService({
|
||||
adminAllowlistPepper: Buffer.alloc(32, 0xc1),
|
||||
challengePepper: Buffer.alloc(32, 0xc2),
|
||||
clock: () => now,
|
||||
currentPrivacyNoticeVersion: "p0a-private-content-v1",
|
||||
databasePath: join(root, "dada.sqlite3"),
|
||||
invitePepper: Buffer.alloc(32, 0xc3),
|
||||
resend: new MockResendAdapter(),
|
||||
sessionPepper: Buffer.alloc(32, 0xc4),
|
||||
});
|
||||
services.push(registration);
|
||||
const adminId = randomUUID();
|
||||
const ownerId = randomUUID();
|
||||
const projectId = randomUUID();
|
||||
const generationId = randomUUID();
|
||||
registration.database.prepare(`
|
||||
INSERT INTO users (user_id, normalized_email, role, status, counts_toward_stage_limit, registration_id, created_at)
|
||||
VALUES (?, ?, 'super_admin', 'active', 0, ?, ?), (?, ?, 'user', 'active', 1, ?, ?)
|
||||
`).run(adminId, `admin-${adminId}@example.invalid`, randomUUID(), now, ownerId, `user-${ownerId}@example.invalid`, randomUUID(), now);
|
||||
registration.database.prepare("INSERT INTO admin_access (user_id, allowed) VALUES (?, 1)").run(adminId);
|
||||
registration.database.prepare("INSERT INTO user_profiles (user_id, creator_name, social_id) VALUES (?, 'Admin', '@admin')").run(adminId);
|
||||
registration.database.exec(`
|
||||
CREATE TABLE generation_jobs (
|
||||
generation_id TEXT PRIMARY KEY, owner_id TEXT NOT NULL, project_id TEXT NOT NULL,
|
||||
prompt TEXT NOT NULL, ratio TEXT NOT NULL, status TEXT NOT NULL, model_id TEXT NOT NULL,
|
||||
model_config_version INTEGER NOT NULL, confirmed_credit_cost INTEGER NOT NULL,
|
||||
reserved_credits INTEGER NOT NULL, final_credit_state TEXT, error_category TEXT,
|
||||
created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, submission_ready INTEGER NOT NULL DEFAULT 1
|
||||
);
|
||||
CREATE TABLE project_images (image_id TEXT PRIMARY KEY, project_id TEXT NOT NULL, generation_id TEXT NOT NULL, created_at INTEGER NOT NULL);
|
||||
`);
|
||||
registration.database.prepare(`
|
||||
INSERT INTO generation_jobs (
|
||||
generation_id, owner_id, project_id, prompt, ratio, status, model_id, model_config_version,
|
||||
confirmed_credit_cost, reserved_credits, final_credit_state, error_category, created_at, updated_at, submission_ready
|
||||
) VALUES (?, ?, ?, ?, '1:1', 'succeeded', 'demo.model', 1, 2, 0, 'committed', NULL, ?, ?, 1)
|
||||
`).run(generationId, ownerId, projectId, "secret prompt must never be listed", now - 1000, now);
|
||||
return { registration, adminId, generationId, adminSession: registration.issueAuthenticatedSession(adminId, "admin") };
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const service of services.splice(0)) service.close();
|
||||
for (const root of roots.splice(0)) rmSync(root, { force: true, recursive: true });
|
||||
});
|
||||
|
||||
describe("TDD-WP6-PRIV-001/TDD-WP6-PRIV-002", () => {
|
||||
it("persists notice acknowledgement, returns metadata only, and audits every prompt open", async () => {
|
||||
const fixture = harness();
|
||||
const app = await createApp({ browserGate: false, networkBoundary: { allowTestPort: true }, registration: fixture.registration });
|
||||
const cookie = `dada_admin_session=${fixture.adminSession.sessionToken}`;
|
||||
const denied = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: "/api/v1/admin/generations" });
|
||||
expect(denied.statusCode).toBe(428);
|
||||
expect(denied.json()).toMatchObject({ error: { code: "PRIVATE_CONTENT_NOTICE_ACK_REQUIRED", details: { latest_version: "p0a-private-content-v1" } } });
|
||||
expect(JSON.stringify(denied.json())).not.toContain("secret prompt");
|
||||
|
||||
const csrf = fixture.registration.issueAdminCsrfToken(fixture.adminSession.sessionToken);
|
||||
const ack = await app.inject({
|
||||
headers: { ...headers, cookie, "x-csrf-token": csrf, "idempotency-key": "wp6-02-ack-000000000000000000000000000000" },
|
||||
method: "POST", payload: { expected_notice_version: "p0a-private-content-v1" }, url: "/api/v1/admin/private-content-notice/ack",
|
||||
});
|
||||
expect(ack.statusCode).toBe(200);
|
||||
expect(ack.json()).toMatchObject({ notice_version: "p0a-private-content-v1", status: "acknowledged" });
|
||||
|
||||
const stale = await app.inject({
|
||||
headers: { ...headers, cookie, "x-csrf-token": fixture.registration.issueAdminCsrfToken(fixture.adminSession.sessionToken), "idempotency-key": "wp6-02-ack-stale-000000000000000000000000000" },
|
||||
method: "POST", payload: { expected_notice_version: "old-private-content-v0" }, url: "/api/v1/admin/private-content-notice/ack",
|
||||
});
|
||||
expect(stale.statusCode).toBe(428);
|
||||
expect(stale.json()).toMatchObject({ error: { code: "PRIVATE_CONTENT_NOTICE_ACK_REQUIRED", details: { latest_version: "p0a-private-content-v1" } } });
|
||||
|
||||
const list = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: "/api/v1/admin/generations" });
|
||||
expect(list.statusCode).toBe(200);
|
||||
expect(list.json().items[0]).toMatchObject({ generation_id: fixture.generationId, owner_ref: expect.any(String), status: "succeeded" });
|
||||
expect(JSON.stringify(list.json())).not.toContain("secret prompt");
|
||||
|
||||
const opened = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: `/api/v1/admin/private-content/generations/${fixture.generationId}/prompt` });
|
||||
expect(opened.statusCode).toBe(200);
|
||||
expect(opened.json()).toEqual({ content_type: "prompt", generation_id: fixture.generationId, prompt: "secret prompt must never be listed" });
|
||||
expect((fixture.registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count).toBe(1);
|
||||
|
||||
const reopened = await app.inject({ headers: { ...headers, cookie }, method: "GET", url: `/api/v1/admin/private-content/generations/${fixture.generationId}/prompt` });
|
||||
expect(reopened.statusCode).toBe(200);
|
||||
expect((fixture.registration.database.prepare("SELECT COUNT(*) AS count FROM private_content_access_logs").get() as { count: number }).count).toBe(2);
|
||||
await app.close();
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,137 @@
|
||||
import { mkdirSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
|
||||
import { expect, test, type Page } from "@playwright/test";
|
||||
import { createServer, type ViteDevServer } from "vite";
|
||||
|
||||
import { adminOverviewFixture } from "../fixtures/wp6-01-admin-overview.js";
|
||||
|
||||
let vite: ViteDevServer;
|
||||
let webUrl: string;
|
||||
|
||||
const adminSession = {
|
||||
acknowledged_private_content_notice_version: null,
|
||||
admin: { role: "super_admin", status: "active", user_id: "00000000-0000-4000-8000-000000000601" },
|
||||
audience: "admin",
|
||||
authenticated: true,
|
||||
csrf_token: "csrf-admin-shell-fixture-000000000000000000000000000000000",
|
||||
current_private_content_notice_version: null,
|
||||
expires_at: "2026-09-02T09:30:00.000Z",
|
||||
notice_acknowledged: false,
|
||||
};
|
||||
|
||||
const navigation = [
|
||||
["总览", "/admin"],
|
||||
["用户与点数", "/admin/users"],
|
||||
["邀请码", "/admin/invites"],
|
||||
["模型", "/admin/models"],
|
||||
["素材", "/admin/assets"],
|
||||
["内部预览", "/admin/preview"],
|
||||
["生成记录", "/admin/generations"],
|
||||
["服务与存储", "/admin/services-storage"],
|
||||
["审计", "/admin/audit"],
|
||||
] as const;
|
||||
|
||||
test.beforeAll(async () => {
|
||||
vite = await createServer({
|
||||
configFile: resolve("apps/web/vite.config.ts"),
|
||||
root: resolve("apps/web"),
|
||||
server: { host: "127.0.0.1", port: 0 },
|
||||
});
|
||||
await vite.listen();
|
||||
const address = vite.httpServer?.address();
|
||||
if (!address || typeof address === "string") throw new Error("Vite did not expose a test port.");
|
||||
webUrl = `http://127.0.0.1:${address.port}`;
|
||||
});
|
||||
|
||||
test.afterAll(async () => vite.close());
|
||||
|
||||
async function routeActiveAdmin(page: Page) {
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminSession),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminOverviewFixture),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
}
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary renders the protected nine-entry admin shell", async ({ page }) => {
|
||||
const requests: string[] = [];
|
||||
page.on("request", (request) => requests.push(request.url()));
|
||||
await routeActiveAdmin(page);
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
|
||||
await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
|
||||
const sidebar = page.getByRole("navigation", { name: "后台主导航" });
|
||||
await expect(sidebar).toBeVisible();
|
||||
for (const [name, href] of navigation) {
|
||||
await expect(sidebar.getByRole("link", { name, exact: true })).toHaveAttribute("href", href);
|
||||
}
|
||||
expect(Math.round((await sidebar.boundingBox())?.width ?? 0)).toBe(216);
|
||||
await expect(page.getByText("4 / 10", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("待人工核对 1", { exact: true })).toBeVisible();
|
||||
await expect(page.getByText("85.0%", { exact: true })).toBeVisible();
|
||||
await expect(page.getByRole("link", { name: "有异常", exact: true })).toBeVisible();
|
||||
await expect(page.locator("body")).not.toContainText(/forbidden|example\.invalid|api[_ -]?key|完整提示词/i);
|
||||
expect(requests.some((url) => /prompt|private-content|image-content/i.test(url))).toBe(false);
|
||||
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
|
||||
if (evidenceRoot) {
|
||||
const screenshotDirectory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(screenshotDirectory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-overview.png") });
|
||||
}
|
||||
});
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary keeps ordinary and preview sessions outside admin", async ({ page }) => {
|
||||
let overviewCalls = 0;
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill({
|
||||
body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID", subject: "preview_user" } }),
|
||||
contentType: "application/json",
|
||||
status: 401,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => {
|
||||
overviewCalls += 1;
|
||||
return route.fulfill({ body: "null", contentType: "application/json", status: 401 });
|
||||
});
|
||||
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
await expect(page).toHaveURL(`${webUrl}/admin/login`);
|
||||
await expect(page.getByRole("heading", { name: "管理员邮箱验证码登录" })).toBeVisible();
|
||||
expect(overviewCalls).toBe(0);
|
||||
await expect(page.getByText("DADA ADMIN", { exact: true })).toHaveCount(0);
|
||||
const evidenceRoot = process.env.DADA_EVIDENCE_DIR_ADMIN;
|
||||
if (evidenceRoot) {
|
||||
const screenshotDirectory = resolve(evidenceRoot, "screenshots");
|
||||
mkdirSync(screenshotDirectory, { recursive: true });
|
||||
await page.screenshot({ fullPage: true, path: resolve(screenshotDirectory, "admin-denied.png") });
|
||||
}
|
||||
});
|
||||
|
||||
test("TDD-WP6-ADM-001-role-and-summary ejects a disabled admin when the session is rechecked", async ({ page }) => {
|
||||
let active = true;
|
||||
await page.route("**/api/v1/admin-auth/session", (route) => route.fulfill(active ? {
|
||||
body: JSON.stringify(adminSession),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
} : {
|
||||
body: JSON.stringify({ error: { code: "AUTH_SESSION_INVALID" } }),
|
||||
contentType: "application/json",
|
||||
status: 401,
|
||||
}));
|
||||
await page.route("**/api/v1/admin/overview", (route) => route.fulfill({
|
||||
body: JSON.stringify(adminOverviewFixture),
|
||||
contentType: "application/json",
|
||||
status: 200,
|
||||
}));
|
||||
await page.goto(`${webUrl}/admin`);
|
||||
await expect(page.getByRole("heading", { level: 2, name: "运营总览" })).toBeVisible();
|
||||
|
||||
active = false;
|
||||
await page.evaluate(() => window.dispatchEvent(new Event("dada:session-invalid")));
|
||||
await expect(page).toHaveURL(`${webUrl}/admin/login`);
|
||||
});
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
export const adminOverviewFixture = {
|
||||
generated_at: "2026-08-03T09:30:00.000Z",
|
||||
user_slots: {
|
||||
active_and_suspended: 4,
|
||||
limit: 10,
|
||||
},
|
||||
generation_jobs: {
|
||||
pending_manual_review: 1,
|
||||
pending_manual_review_oldest_at: "2026-08-03T09:12:00.000Z",
|
||||
queued: 2,
|
||||
running: 1,
|
||||
},
|
||||
models: {
|
||||
configured_default_model_id: "gemini-3.1-flash-image-preview",
|
||||
configured_model_count: 3,
|
||||
recommended_model_id: "gemini-3-pro-image-preview",
|
||||
runtime_available_count: 2,
|
||||
},
|
||||
storage: {
|
||||
last_measured_at: "2026-08-03T09:29:00.000Z",
|
||||
limit_bytes: 5_368_709_120,
|
||||
managed_content_bytes: 4_563_402_752,
|
||||
status: "critical" as const,
|
||||
},
|
||||
services: [
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "resend", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "amap", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "ai_gateway", status: "degraded" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "worker", status: "available" as const },
|
||||
{ checked_at: "2026-08-03T09:29:00.000Z", service_id: "asset_root", status: "degraded" as const },
|
||||
],
|
||||
recent_operations: [
|
||||
{
|
||||
created_at: "2026-08-03T09:20:00.000Z",
|
||||
operation_id: "00000000-0000-4000-8000-000000000621",
|
||||
operation_type: "model_configuration_update",
|
||||
result: "succeeded" as const,
|
||||
target_ref: "model-config-set:7",
|
||||
},
|
||||
],
|
||||
asset_cleanup: {
|
||||
pending_jobs: 0,
|
||||
},
|
||||
};
|
||||
Reference in New Issue
Block a user