@lark-apaas/fullstack-nestjs-core 1.1.10-alpha.33 → 1.1.10-alpha.35

package/dist/index.cjs

@@ -172,6 +172,51 @@ CsrfMiddleware = _ts_decorate2([
 // src/middlewares/view-context/index.ts
 var import_common3 = require("@nestjs/common");
 var import_nestjs_common = require("@lark-apaas/nestjs-common");
+
+// src/utils/safe-stringify.ts
+function safeEscape(s) {
+  return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
+    switch (c.charCodeAt(0)) {
+      case 60:
+        return "\\u003c";
+      // <
+      case 62:
+        return "\\u003e";
+      // >
+      case 38:
+        return "\\u0026";
+      // &
+      case 61:
+        return "\\u003d";
+      // =
+      case 39:
+        return "\\u0027";
+      // '
+      case 34:
+        return "\\u0022";
+      // "
+      case 10:
+        return "\\u000a";
+      // \n
+      case 13:
+        return "\\u000d";
+      // \r
+      // 正常来说用户无法输入这几个字符, 现代浏览器也修复了这个问题
+      // https://zhuanlan.zhihu.com/p/29958439
+      case 8232:
+        return "\\u2028";
+      // 行分隔符
+      case 8233:
+        return "\\u2029";
+      // 段落分隔符
+      default:
+        return c;
+    }
+  });
+}
+__name(safeEscape, "safeEscape");
+
+// src/middlewares/view-context/index.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -222,14 +267,13 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
     const { userId, tenantId, appId, loginUrl, userType } = req.userContext;
     const csrfToken = req.csrfToken;
     const appInfo = await this.getAppInfo(appId);
-    this.logger.debug(`appInfo: ${JSON.stringify(appInfo)}`);
     req.__platform_data__ = {
       csrfToken: csrfToken ?? "",
       userId: userId ?? "",
       appId: appId ?? "",
-      appName: appInfo?.app_name ?? "",
+      appName: safeEscape(appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528"),
       appAvatar: appInfo?.app_avatar ?? "",
-      appDescription: appInfo?.app_description ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
       loginUrl: loginUrl ?? "",
       userType: userType ?? "",
       tenantId
@@ -242,9 +286,9 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
       loginUrl: loginUrl ?? "",
       userType: userType ?? "",
       appId: appId ?? "",
-      appName: appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528",
+      appName: safeEscape(appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528"),
       appAvatar: appInfo?.app_avatar ?? "",
-      appDescription: appInfo?.app_description ?? ""
+      appDescription: safeEscape(appInfo?.app_description ?? "")
     };
     next();
   }
@@ -434,26 +478,30 @@ var HttpInterceptorService = class {
   setupInterceptors() {
     const axiosInstance = this.httpService.axiosRef;
     axiosInstance.interceptors.request.use((config) => {
-      this.logger.log("HTTP Request", {
-        method: config.method?.toUpperCase(),
-        url: config.url,
-        headers: config.headers,
-        params: config.params,
-        data: config.data
-      }, "HttpService");
+      if (process.env.NODE_ENV === "development") {
+        this.logger.log("HTTP Request", {
+          method: config.method?.toUpperCase(),
+          url: config.url,
+          headers: config.headers,
+          params: config.params,
+          data: config.data
+        }, "HttpService");
+      }
       return config;
     }, (error) => {
       this.logger.error("HTTP Request Error", error, "HttpService");
       return Promise.reject(error);
     });
     axiosInstance.interceptors.response.use((response) => {
-      this.logger.log("HTTP Response", {
-        method: response.config.method?.toUpperCase(),
-        url: response.config.url,
-        status: response.status,
-        statusText: response.statusText,
-        data: response.data
-      }, "HttpService");
+      if (process.env.NODE_ENV === "development") {
+        this.logger.log("HTTP Response", {
+          method: response.config.method?.toUpperCase(),
+          url: response.config.url,
+          status: response.status,
+          statusText: response.statusText,
+          data: response.data
+        }, "HttpService");
+      }
       return response;
     }, (error) => {
       this.logger.error("HTTP Response Error", {
@@ -696,14 +744,14 @@ var PlatformHttpClientService = class _PlatformHttpClientService {
   */
   registerGlobalInterceptors() {
     this.client.interceptors.request.use((config) => {
-      this.logger.log(`HTTP Request: ${config.method?.toUpperCase()} ${config.url}`);
+      this.logger.debug(`Server SDK HTTP Request: ${config.method?.toUpperCase()} ${config.url}`);
       return config;
     }, (error) => {
-      this.logger.error("HTTP Request Error", error, "HttpService");
+      this.logger.error("Server SDK HTTP Request Error", error, "HttpService");
       return Promise.reject(error);
     });
     this.client.interceptors.response.use((response) => {
-      this.logger.log(`HTTP Response: ${response.status} ${response.url}`);
+      this.logger.debug(`Server SDK HTTP Response: ${response.status} ${response.url}`);
       return response;
     }, (error) => {
       const errorLog = {
@@ -711,7 +759,7 @@ var PlatformHttpClientService = class _PlatformHttpClientService {
         statusText: error.response?.statusText,
         message: error.message
       };
-      this.logger.error(`HTTP Response Error: ${error.config?.method?.toUpperCase()} ${error.config?.url} ${JSON.stringify(errorLog)}`);
+      this.logger.error(`Server SDK HTTP Response Error: ${error.config?.method?.toUpperCase()} ${error.config?.url} ${JSON.stringify(errorLog)}`);
       return Promise.reject(error);
     });
   }
@@ -722,6 +770,9 @@ PlatformHttpClientService = _ts_decorate8([
   _ts_metadata5("design:paramtypes", [])
 ], PlatformHttpClientService);
 
+// src/modules/platform/config/feature-switch.ts
+var DISABLE_DATAPASS = process.env.FORCE_FRAMEWORK_DISABLE_DATAPASS === "true";
+
 // src/modules/platform/module.ts
 var import_nestjs_authzpaas = require("@lark-apaas/nestjs-authzpaas");
 function _ts_decorate9(decorators, target, key, desc) {
@@ -759,34 +810,37 @@ var PlatformModule = class _PlatformModule {
           timeout: 5e3,
           maxRedirects: 5
         }),
-        import_nestjs_datapaas.DataPaasModule.forRootAsync({
-          imports: [
-            import_config2.ConfigModule,
-            import_nestjs_logger2.LoggerModule
-          ],
-          inject: [
-            import_config2.ConfigService,
-            import_nestjs_logger2.AppLogger
-          ],
-          useFactory: /* @__PURE__ */ __name(async (...args) => {
-            const configService = args[0];
-            const appLogger = args[1];
-            const drizzleLogger = {
-              logQuery(query, params) {
-                appLogger.log?.("SQL Query " + JSON.stringify({
-                  query,
-                  params
-                }), {
-                  source_type: "platform"
-                }, "Database");
-              }
-            };
-            return {
-              connectionString: configService.get("app.databaseUrl") ?? "",
-              logger: drizzleLogger
-            };
-          }, "useFactory")
-        }),
+        // 读取环境变量判断是否启用 DataPaasModule
+        ...DISABLE_DATAPASS ? [] : [
+          import_nestjs_datapaas.DataPaasModule.forRootAsync({
+            imports: [
+              import_config2.ConfigModule,
+              import_nestjs_logger2.LoggerModule
+            ],
+            inject: [
+              import_config2.ConfigService,
+              import_nestjs_logger2.AppLogger
+            ],
+            useFactory: /* @__PURE__ */ __name(async (...args) => {
+              const configService = args[0];
+              const appLogger = args[1];
+              const drizzleLogger = {
+                logQuery(query, params) {
+                  if (process.env.NODE_ENV === "development") {
+                    appLogger.log?.("SQL Query " + JSON.stringify({
+                      query,
+                      params
+                    }), "Database");
+                  }
+                }
+              };
+              return {
+                connectionString: configService.get("app.databaseUrl") ?? "",
+                logger: drizzleLogger
+              };
+            }, "useFactory")
+          })
+        ],
         import_nestjs_authnpaas.AuthNPaasModule.forRoot(),
         import_nestjs_trigger.AutomationModule.forRoot(),
         import_nestjs_authzpaas.AuthZPaasModule.forRoot()
@@ -873,6 +927,7 @@ async function configureApp(app, perms = defaultPerms) {
   app.use((0, import_cookie_parser.default)());
   const globalPrefix = process.env.CLIENT_BASE_PATH ?? "";
   app.setGlobalPrefix(globalPrefix);
+  app.set("trust proxy", true);
   if (process.env.NODE_ENV !== "production" && perms.disableSwagger !== true) {
     try {
       await import_nestjs_openapi_devtools.DevToolsV2Module.mount(app, {
@@ -884,6 +939,7 @@ async function configureApp(app, perms = defaultPerms) {
       console.error("[OpenAPI] OpenAPI \u751F\u6210\u5931\u8D25:", err);
     }
   }
+  console.log("App Started Successfully.");
 }
 __name(configureApp, "configureApp");
 

package/dist/index.js

@@ -128,6 +128,51 @@ CsrfMiddleware = _ts_decorate2([
 // src/middlewares/view-context/index.ts
 import { Inject, Injectable as Injectable3, Logger } from "@nestjs/common";
 import { PLATFORM_HTTP_CLIENT } from "@lark-apaas/nestjs-common";
+
+// src/utils/safe-stringify.ts
+function safeEscape(s) {
+  return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
+    switch (c.charCodeAt(0)) {
+      case 60:
+        return "\\u003c";
+      // <
+      case 62:
+        return "\\u003e";
+      // >
+      case 38:
+        return "\\u0026";
+      // &
+      case 61:
+        return "\\u003d";
+      // =
+      case 39:
+        return "\\u0027";
+      // '
+      case 34:
+        return "\\u0022";
+      // "
+      case 10:
+        return "\\u000a";
+      // \n
+      case 13:
+        return "\\u000d";
+      // \r
+      // 正常来说用户无法输入这几个字符, 现代浏览器也修复了这个问题
+      // https://zhuanlan.zhihu.com/p/29958439
+      case 8232:
+        return "\\u2028";
+      // 行分隔符
+      case 8233:
+        return "\\u2029";
+      // 段落分隔符
+      default:
+        return c;
+    }
+  });
+}
+__name(safeEscape, "safeEscape");
+
+// src/middlewares/view-context/index.ts
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -178,14 +223,13 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
     const { userId, tenantId, appId, loginUrl, userType } = req.userContext;
     const csrfToken = req.csrfToken;
     const appInfo = await this.getAppInfo(appId);
-    this.logger.debug(`appInfo: ${JSON.stringify(appInfo)}`);
     req.__platform_data__ = {
       csrfToken: csrfToken ?? "",
       userId: userId ?? "",
       appId: appId ?? "",
-      appName: appInfo?.app_name ?? "",
+      appName: safeEscape(appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528"),
       appAvatar: appInfo?.app_avatar ?? "",
-      appDescription: appInfo?.app_description ?? "",
+      appDescription: safeEscape(appInfo?.app_description ?? ""),
       loginUrl: loginUrl ?? "",
       userType: userType ?? "",
       tenantId
@@ -198,9 +242,9 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
       loginUrl: loginUrl ?? "",
       userType: userType ?? "",
       appId: appId ?? "",
-      appName: appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528",
+      appName: safeEscape(appInfo?.app_name ?? "\u5999\u642D\u5E94\u7528"),
       appAvatar: appInfo?.app_avatar ?? "",
-      appDescription: appInfo?.app_description ?? ""
+      appDescription: safeEscape(appInfo?.app_description ?? "")
     };
     next();
   }
@@ -390,26 +434,30 @@ var HttpInterceptorService = class {
   setupInterceptors() {
     const axiosInstance = this.httpService.axiosRef;
     axiosInstance.interceptors.request.use((config) => {
-      this.logger.log("HTTP Request", {
-        method: config.method?.toUpperCase(),
-        url: config.url,
-        headers: config.headers,
-        params: config.params,
-        data: config.data
-      }, "HttpService");
+      if (process.env.NODE_ENV === "development") {
+        this.logger.log("HTTP Request", {
+          method: config.method?.toUpperCase(),
+          url: config.url,
+          headers: config.headers,
+          params: config.params,
+          data: config.data
+        }, "HttpService");
+      }
       return config;
     }, (error) => {
       this.logger.error("HTTP Request Error", error, "HttpService");
       return Promise.reject(error);
     });
     axiosInstance.interceptors.response.use((response) => {
-      this.logger.log("HTTP Response", {
-        method: response.config.method?.toUpperCase(),
-        url: response.config.url,
-        status: response.status,
-        statusText: response.statusText,
-        data: response.data
-      }, "HttpService");
+      if (process.env.NODE_ENV === "development") {
+        this.logger.log("HTTP Response", {
+          method: response.config.method?.toUpperCase(),
+          url: response.config.url,
+          status: response.status,
+          statusText: response.statusText,
+          data: response.data
+        }, "HttpService");
+      }
       return response;
     }, (error) => {
       this.logger.error("HTTP Response Error", {
@@ -652,14 +700,14 @@ var PlatformHttpClientService = class _PlatformHttpClientService {
   */
   registerGlobalInterceptors() {
     this.client.interceptors.request.use((config) => {
-      this.logger.log(`HTTP Request: ${config.method?.toUpperCase()} ${config.url}`);
+      this.logger.debug(`Server SDK HTTP Request: ${config.method?.toUpperCase()} ${config.url}`);
       return config;
     }, (error) => {
-      this.logger.error("HTTP Request Error", error, "HttpService");
+      this.logger.error("Server SDK HTTP Request Error", error, "HttpService");
       return Promise.reject(error);
     });
     this.client.interceptors.response.use((response) => {
-      this.logger.log(`HTTP Response: ${response.status} ${response.url}`);
+      this.logger.debug(`Server SDK HTTP Response: ${response.status} ${response.url}`);
       return response;
     }, (error) => {
       const errorLog = {
@@ -667,7 +715,7 @@ var PlatformHttpClientService = class _PlatformHttpClientService {
         statusText: error.response?.statusText,
         message: error.message
       };
-      this.logger.error(`HTTP Response Error: ${error.config?.method?.toUpperCase()} ${error.config?.url} ${JSON.stringify(errorLog)}`);
+      this.logger.error(`Server SDK HTTP Response Error: ${error.config?.method?.toUpperCase()} ${error.config?.url} ${JSON.stringify(errorLog)}`);
       return Promise.reject(error);
     });
   }
@@ -678,6 +726,9 @@ PlatformHttpClientService = _ts_decorate8([
   _ts_metadata5("design:paramtypes", [])
 ], PlatformHttpClientService);
 
+// src/modules/platform/config/feature-switch.ts
+var DISABLE_DATAPASS = process.env.FORCE_FRAMEWORK_DISABLE_DATAPASS === "true";
+
 // src/modules/platform/module.ts
 import { AuthZPaasModule } from "@lark-apaas/nestjs-authzpaas";
 function _ts_decorate9(decorators, target, key, desc) {
@@ -715,34 +766,37 @@ var PlatformModule = class _PlatformModule {
           timeout: 5e3,
           maxRedirects: 5
         }),
-        DataPaasModule.forRootAsync({
-          imports: [
-            ConfigModule,
-            LoggerModule
-          ],
-          inject: [
-            ConfigService,
-            AppLogger2
-          ],
-          useFactory: /* @__PURE__ */ __name(async (...args) => {
-            const configService = args[0];
-            const appLogger = args[1];
-            const drizzleLogger = {
-              logQuery(query, params) {
-                appLogger.log?.("SQL Query " + JSON.stringify({
-                  query,
-                  params
-                }), {
-                  source_type: "platform"
-                }, "Database");
-              }
-            };
-            return {
-              connectionString: configService.get("app.databaseUrl") ?? "",
-              logger: drizzleLogger
-            };
-          }, "useFactory")
-        }),
+        // 读取环境变量判断是否启用 DataPaasModule
+        ...DISABLE_DATAPASS ? [] : [
+          DataPaasModule.forRootAsync({
+            imports: [
+              ConfigModule,
+              LoggerModule
+            ],
+            inject: [
+              ConfigService,
+              AppLogger2
+            ],
+            useFactory: /* @__PURE__ */ __name(async (...args) => {
+              const configService = args[0];
+              const appLogger = args[1];
+              const drizzleLogger = {
+                logQuery(query, params) {
+                  if (process.env.NODE_ENV === "development") {
+                    appLogger.log?.("SQL Query " + JSON.stringify({
+                      query,
+                      params
+                    }), "Database");
+                  }
+                }
+              };
+              return {
+                connectionString: configService.get("app.databaseUrl") ?? "",
+                logger: drizzleLogger
+              };
+            }, "useFactory")
+          })
+        ],
         AuthNPaasModule.forRoot(),
         AutomationModule.forRoot(),
         AuthZPaasModule.forRoot()
@@ -829,6 +883,7 @@ async function configureApp(app, perms = defaultPerms) {
   app.use(cookieParser());
   const globalPrefix = process.env.CLIENT_BASE_PATH ?? "";
   app.setGlobalPrefix(globalPrefix);
+  app.set("trust proxy", true);
   if (process.env.NODE_ENV !== "production" && perms.disableSwagger !== true) {
     try {
       await DevToolsV2Module.mount(app, {
@@ -840,6 +895,7 @@ async function configureApp(app, perms = defaultPerms) {
       console.error("[OpenAPI] OpenAPI \u751F\u6210\u5931\u8D25:", err);
     }
   }
+  console.log("App Started Successfully.");
 }
 __name(configureApp, "configureApp");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/fullstack-nestjs-core",
-  "version": "1.1.10-alpha.33",
+  "version": "1.1.10-alpha.35",
   "description": "FullStack Nestjs Core",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,13 +39,13 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@lark-apaas/http-client": "0.1.2",
+    "@lark-apaas/http-client": "^0.1.2",
     "@lark-apaas/nestjs-authnpaas": "^1.0.2",
-    "@lark-apaas/nestjs-authzpaas": "0.1.0-alpha.33",
-    "@lark-apaas/nestjs-common": "0.1.0-alpha.1",
-    "@lark-apaas/nestjs-datapaas": "^1.0.6-alpha.5",
-    "@lark-apaas/nestjs-logger": "1.0.2-alpha.33",
-    "@lark-apaas/nestjs-observable": "0.0.1-alpha.35",
+    "@lark-apaas/nestjs-authzpaas": "0.1.0-alpha.35",
+    "@lark-apaas/nestjs-common": "^0.1.1",
+    "@lark-apaas/nestjs-datapaas": "^1.0.7",
+    "@lark-apaas/nestjs-logger": "^1.0.5",
+    "@lark-apaas/nestjs-observable": "^0.0.2",
     "@lark-apaas/nestjs-openapi-devtools": "^1.0.9",
     "@lark-apaas/nestjs-trigger": "^0.0.1",
     "@nestjs/axios": "^4.0.1",