@nocobase/app-template-default 1.0.0-beta.73 → 1.0.0-beta.75

package/client/pages/settings/role-form.tsx

@@ -11,6 +11,7 @@ import {
 import { useTranslation } from '@nocobase/i18n/client';
 import {
   useAuthorizationClient,
+  useCan,
   type AuthorizationOptionsResponse,
   type LocalizedText,
   type PermissionGrant,
@@ -20,6 +21,7 @@ import { pagePermissionResources } from './page-permissions.js';
 import { pagePermissionTitles } from './page-permission-titles.js';
 import { useEffect, useMemo, useRef, useState, type ReactElement } from 'react';
 import {
+  Link,
   useLocation,
   useNavigate,
   useOutletContext,
@@ -72,6 +74,10 @@ function RoleEditor(): ReactElement {
   const options = useSettingsData<{ data: AuthorizationOptionsResponse }>(
     'authorization/permissionSets/options',
   );
+  const canReadDefaults = useCan({
+    resource: { type: 'settings', id: 'authorization.default-access' },
+    action: 'read',
+  }).can;
   const canCreate = useRolePermission('create');
   const canUpdate = useRolePermission('update');
   const [nameDraft, setNameDraft] = useState<string>();
@@ -113,14 +119,35 @@ function RoleEditor(): ReactElement {
           title: { key: 'settings.userPermissions' },
           order: 0,
           subsections: [
-            {
-              name: 'users.accounts',
-              title: { key: 'settings.users' },
+            ...[
+              {
+                name: 'users.information',
+                title: 'userInformation',
+                actions: ['read', 'create', 'update', 'invite', 'delete'],
+              },
+              {
+                name: 'users.security',
+                title: 'accountSecurity',
+                actions: [
+                  'reset-password',
+                  'disable',
+                  'enable',
+                  'revoke-sessions',
+                ],
+              },
+              {
+                name: 'users.roles',
+                title: 'roleAssignment',
+                actions: ['assign-role'],
+              },
+            ].map((group) => ({
+              name: group.name,
+              title: { key: `settings.${group.title}` },
               resources: [
                 {
                   type: 'user',
                   id: '*',
-                  title: { key: 'settings.users' },
+                  title: { key: `settings.${group.title}` },
                   actions: [
                     { name: 'read', title: { key: 'settings.readUsers' } },
                     { name: 'create', title: { key: 'settings.createUsers' } },
@@ -141,10 +168,10 @@ function RoleEditor(): ReactElement {
                       name: 'revoke-sessions',
                       title: { key: 'settings.revokeSessions' },
                     },
-                  ],
+                  ].filter((action) => group.actions.includes(action.name)),
                 },
               ],
-            },
+            })),
           ],
         },
         ...source.sections.map((section) => ({
@@ -316,13 +343,23 @@ function RoleEditor(): ReactElement {
                   {t('settings.protectedHint')}
                 </p>
               )}
+              {canReadDefaults && (
+                <div>
+                  <Link
+                    to='/default-access'
+                    className='text-sm text-foreground underline-offset-4 hover:underline'
+                  >
+                    {t('settings.defaultAccess.manage')}
+                  </Link>
+                </div>
+              )}
               <PermissionEditor
                 sections={sections}
                 readOnly={!allowed || busy}
                 labels={{
-                  selectAll: t('settings.selectAllPermissions'),
-                  selectVisible: (name) =>
-                    t('settings.selectVisiblePermissions', { name }),
+                  dataRanges: (count) => t('settings.dataRanges', { count }),
+                  scopeExplanation: t('settings.scopeExplanation'),
+                  scopeHintFor: (name) => t('settings.scopeHintFor', { name }),
                   levelFor: (name) => t('settings.levelFor', { name }),
                   search: t('settings.permissionSearch'),
                   enabledOnly: t('settings.enabledOnly'),
@@ -330,8 +367,6 @@ function RoleEditor(): ReactElement {
                   empty: t('settings.noPermissions'),
                   noResults: t('settings.noResults'),
                   navigation: t('settings.permissionCategories'),
-                  summary: (enabled, total) =>
-                    t('settings.permissionSummary', { enabled, total }),
                 }}
                 onEnabledChange={(id, enabled) => {
                   if (!catalog) return;
@@ -342,13 +377,6 @@ function RoleEditor(): ReactElement {
                   );
                   setDirty(true);
                 }}
-                onEnabledBatchChange={(changes) => {
-                  if (!catalog) return;
-                  setGrantsDraft((current) =>
-                    setPermissions(current ?? grants, catalog, changes),
-                  );
-                  setDirty(true);
-                }}
                 onLevelChange={(id, value) => {
                   if (value === 'customFilter') {
                     setEditingScope(id);

package/client/pages/settings/roles.tsx

@@ -7,11 +7,10 @@ import type {
 import { type ReactElement } from 'react';
 import { Link, Outlet, useLocation, useSearchParams } from 'react-router';
 import { ShieldCheckIcon, PlusIcon } from 'lucide-react';
-import { PageContainer } from '#components/page-container';
-import { PageHeader } from '#components/page-header';
+import { PermissionManagementPage } from './permission-management-page.js';
 import { Input } from '#components/ui/input';
 import { Button } from '#components/ui/button';
-import { Badge } from '#components/ui/badge';
+import { RoleList } from '#components/role-list';
 import {
   Empty,
   EmptyTitle,
@@ -60,12 +59,10 @@ export default function RolesPage(): ReactElement {
   ) : null;
   return (
     <>
-      <PageContainer>
-        <PageHeader
-          title={t('settings.roles')}
-          description={t('settings.rolesDescription')}
-          actions={rows.length || search ? create : undefined}
-        />
+      <PermissionManagementPage
+        tab='roles'
+        actions={rows.length || search ? create : undefined}
+      >
         <div className='flex items-center gap-3'>
           <Input
             className='sm:max-w-xs'
@@ -95,39 +92,25 @@ export default function RolesPage(): ReactElement {
         ) : (
           !request.error &&
           (rows.length ? (
-            <div className='divide-y overflow-hidden rounded-xl border bg-card'>
-              {rows.map((role) => (
-                <Link
-                  key={role.key}
-                  to={{
-                    pathname: `${encodeURIComponent(role.key)}/edit`,
-                    search: location.search,
-                  }}
-                  className='flex items-center justify-between gap-4 p-4 transition-colors hover:bg-muted/30 focus-visible:ring-2 focus-visible:ring-ring'
-                >
-                  <div className='flex min-w-0 items-center gap-3'>
-                    <div className='rounded-lg bg-primary/10 p-2 text-primary'>
-                      <ShieldCheckIcon className='size-4' />
-                    </div>
-                    <div className='min-w-0'>
-                      <p className='font-medium'>
-                        {text(role.title ?? role.key)}
-                      </p>
-                      <p className='text-xs text-muted-foreground'>
-                        {role.key}
-                      </p>
-                    </div>
-                  </div>
-                  <Badge variant='secondary'>
-                    {t(
-                      role.protection
-                        ? 'settings.protected'
-                        : 'settings.custom',
-                    )}
-                  </Badge>
-                </Link>
-              ))}
-            </div>
+            <RoleList
+              ariaLabel={t('settings.roles')}
+              roles={rows.map((role) => ({
+                key: role.key,
+                title: text(role.title ?? role.key),
+                to: {
+                  pathname: `${encodeURIComponent(role.key)}/edit`,
+                  search: location.search,
+                },
+                protected: Boolean(role.protection),
+              }))}
+              labels={{
+                name: t('settings.roleName'),
+                key: t('settings.key'),
+                type: t('settings.roleType'),
+                protected: t('settings.protected'),
+                custom: t('settings.custom'),
+              }}
+            />
           ) : (
             <Empty className='min-h-48 border border-dashed'>
               <EmptyMedia variant='icon'>
@@ -156,7 +139,7 @@ export default function RolesPage(): ReactElement {
             </Empty>
           ))
         )}
-      </PageContainer>
+      </PermissionManagementPage>
       <Outlet context={{ reload: request.reload }} />
     </>
   );

package/client/pages/settings/routes.ts

@@ -1,4 +1,10 @@
-import { Settings, Users, ShieldCheck } from 'lucide-react';
+import {
+  Settings,
+  Users,
+  ShieldCheck,
+  KeyRound,
+  ListFilter,
+} from 'lucide-react';
 import {
   defineAppRoutes,
   type AppClientRouteContribution,
@@ -41,35 +47,88 @@ const systemSettingsRoutes: AppClientRouteContribution = defineAppRoutes([
         ],
       },
       {
-        name: 'settingsRoles',
-        path: '/roles',
-        auth: 'required',
-        authz: {
-          resource: { type: 'settings', id: 'authorization.permission-sets' },
-          action: 'read',
+        name: 'permissionManagement',
+        navigation: {
+          title: 'settings.permissionManagement',
+          icon: ShieldCheck,
         },
-        navigation: { title: 'settings.roles', icon: ShieldCheck },
-        breadcrumb: { title: 'settings.roles' },
-        componentLoader: () => import('./roles.js'),
+        breadcrumb: { title: 'settings.permissionManagement' },
         children: [
           {
-            name: 'settingsRoleCreate',
-            path: 'create',
+            name: 'settingsRoles',
+            path: '/roles',
+            auth: 'required',
             authz: {
               resource: {
                 type: 'settings',
                 id: 'authorization.permission-sets',
               },
-              action: 'create',
+              action: 'read',
             },
-            breadcrumb: { title: 'settings.newRole' },
-            componentLoader: () => import('./role-form.js'),
+            navigation: { title: 'settings.roles', icon: KeyRound },
+            breadcrumb: { title: 'settings.roles' },
+            componentLoader: () => import('./roles.js'),
+            children: [
+              {
+                name: 'settingsRoleCreate',
+                path: 'create',
+                authz: {
+                  resource: {
+                    type: 'settings',
+                    id: 'authorization.permission-sets',
+                  },
+                  action: 'create',
+                },
+                breadcrumb: { title: 'settings.newRole' },
+                componentLoader: () => import('./role-form.js'),
+              },
+              {
+                name: 'settingsRoleEdit',
+                path: ':key/edit',
+                breadcrumb: { title: 'settings.editRole' },
+                componentLoader: () => import('./role-form.js'),
+              },
+            ],
           },
           {
-            name: 'settingsRoleEdit',
-            path: ':key/edit',
-            breadcrumb: { title: 'settings.editRole' },
-            componentLoader: () => import('./role-form.js'),
+            name: 'settingsDefaultAccess',
+            path: '/default-access',
+            auth: 'required',
+            authz: {
+              resource: {
+                type: 'settings',
+                id: 'authorization.default-access',
+              },
+              action: 'read',
+            },
+            navigation: {
+              title: 'settings.defaultAccess.title',
+              icon: ListFilter,
+            },
+            breadcrumb: { title: 'settings.defaultAccess.title' },
+            componentLoader: () => import('./default-access.js'),
+            children: [
+              {
+                name: 'settingsDefaultAccessCreate',
+                path: 'create',
+                authz: {
+                  resource: {
+                    type: 'settings',
+                    id: 'authorization.default-access',
+                  },
+                  action: 'create',
+                },
+                breadcrumb: { title: 'settings.defaultAccess.new' },
+                componentLoader: () => import('./default-access-form.js'),
+              },
+              // Read permission opens the full rule even when the viewer may not update it.
+              {
+                name: 'settingsDefaultAccessEdit',
+                path: ':key/edit',
+                breadcrumb: { title: 'settings.defaultAccess.edit' },
+                componentLoader: () => import('./default-access-form.js'),
+              },
+            ],
           },
         ],
       },

package/client/pages/settings/shared.tsx

@@ -78,6 +78,7 @@ export function ConfirmAction({
   title,
   description,
   confirmLabel,
+  error,
   busy,
   onCancel,
   onConfirm,
@@ -86,6 +87,7 @@ export function ConfirmAction({
   readonly title: string;
   readonly description: ReactNode;
   readonly confirmLabel?: string;
+  readonly error?: ReactNode;
   readonly busy: boolean;
   readonly onCancel: () => void;
   readonly onConfirm: () => void;
@@ -102,6 +104,7 @@ export function ConfirmAction({
         <AlertDialogHeader>
           <AlertDialogTitle>{title}</AlertDialogTitle>
           <AlertDialogDescription>{description}</AlertDialogDescription>
+          {error}
         </AlertDialogHeader>
         <AlertDialogFooter>
           <AlertDialogCancel disabled={busy}>

package/client/pages/settings/users.tsx

@@ -250,7 +250,7 @@ export default function UsersPage(): ReactElement {
         enableHiding: false,
         cell: ({ row }) => (
           <Link
-            className='font-medium text-primary hover:underline'
+            className='font-medium text-foreground underline-offset-4 hover:underline'
             to={{
               pathname: row.original.id,
               search: location.search,

package/client/plugins.ts

@@ -1,3 +1,4 @@
+import foundation from '@nocobase/app-plugin-foundation/client';
 import defaultAccess from '@nocobase/app-plugin-authz-default-access/client';
 import sharingRules from '@nocobase/app-plugin-authz-sharing-rules/client';
 import restrictionRules from '@nocobase/app-plugin-authz-restriction-rules/client';
@@ -34,6 +35,7 @@ const clientPlugins: AppClientPlugins = defineClientPlugins([
   file(),
   scheduler(),
   mail(),
+  foundation({ settingsGroup: true }),
 ]);
 
 export default clientPlugins;

package/client/routing/route-navigation.ts

@@ -11,6 +11,8 @@ import { EMPTY_ARRAY } from '#lib/constants';
 import { transformNavigation } from '#lib/navigation-transform';
 
 export interface RouteNavigationItem {
+  /** Route keys represented by a single sidebar entry whose content uses tabs. */
+  readonly activeRouteKeys?: readonly string[];
   readonly section?: boolean;
   readonly route: AppClientRegisteredRoute;
   readonly children: readonly RouteNavigationItem[];
@@ -45,7 +47,25 @@ export function selectedNavigationId(
   denied: ReadonlySet<string> = new Set(),
 ): string | undefined {
   const matches = matchRouteTree(routes, pathname);
-  const pages = navigationPages(buildRouteNavigation(routes, denied));
+  const items = buildRouteNavigation(routes, denied);
+  const represented = (
+    nodes: readonly RouteNavigationItem[],
+  ): AppClientRegisteredRoute | undefined => {
+    for (const item of nodes) {
+      if (
+        item.activeRouteKeys?.some((key) =>
+          matches?.some(({ route }) => routeKey(route) === key),
+        )
+      )
+        return item.route;
+      const child = represented(item.children);
+      if (child) return child;
+    }
+    return undefined;
+  };
+  const active = represented(items);
+  if (active) return routeKey(active);
+  const pages = navigationPages(items);
   const visible = new Set(pages.map(routeKey));
   const selected =
     matches

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.73",
+  "version": "1.0.0-beta.75",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.73"
+    "defaultTemplateVersion": "1.0.0-beta.75"
   },
   "devDependencies": {
     "@ai-sdk/react": "4.0.131",
@@ -72,10 +72,10 @@
     "tar": "^7.5.22",
     "@xyflow/react": "^12.11.5",
     "elkjs": "^0.10.2",
-    "@nocobase/app-client": "^4.0.0-beta.0",
+    "@nocobase/app-client": "^4.0.0-beta.1",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.41",
-    "@nocobase/app-testing": "0.1.0-beta.5",
+    "@nocobase/app-skills": "0.1.0-beta.43",
+    "@nocobase/app-testing": "0.1.0-beta.6",
     "@nocobase/app-websocket": "^0.1.0-beta.1",
     "@nocobase/dev-config": "0.1.0-beta.24",
     "@nocobase/drive": "^0.1.0-beta.7",
@@ -139,36 +139,38 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-agents": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-agents": "^1.0.0-beta.17",
     "@nocobase/app-plugin-api-keys": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.11",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.29",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.12",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.30",
     "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.16",
-    "@nocobase/app-plugin-file": "^1.0.0-beta.25",
-    "@nocobase/app-plugin-i18n": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-mail": "^1.0.0-beta.15",
-    "@nocobase/app-plugin-notification": "^1.0.0-beta.28",
-    "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.26",
-    "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.13",
-    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.6",
-    "@nocobase/app-server": "^3.0.0-beta.0",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.26",
+    "@nocobase/app-plugin-foundation": "^0.1.0-beta.0",
+    "@nocobase/app-plugin-i18n": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.9",
+    "@nocobase/app-plugin-notification": "^1.0.0-beta.29",
+    "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.27",
+    "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.14",
+    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.19",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.8",
+    "@nocobase/app-server": "^3.0.0-beta.1",
     "@nocobase/config": "^0.1.0-beta.3",
     "@nocobase/db": "^1.0.0-beta.21",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
-    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.14",
-    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.14",
-    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.13",
-    "@nocobase/authorization": "^1.0.0-beta.14",
+    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.14",
+    "@nocobase/authorization": "^1.0.0-beta.15",
     "@nocobase/queue": "^0.1.0-beta.9",
     "@nocobase/jobs": "^0.1.0-beta.3",
     "@nocobase/lifecycle": "^0.1.0-beta.3",
-    "@nocobase/i18n": "^2.0.0-beta.0",
+    "@nocobase/i18n": "^2.0.0-beta.1",
     "@nocobase/caching": "^0.1.0-beta.3",
     "@nocobase/repository-input": "^0.1.0-beta.3",
-    "@nocobase/app-cli": "^1.0.0-beta.25",
+    "@nocobase/app-cli": "^1.0.0-beta.26",
+    "@nocobase/app-plugin-mail": "^1.0.0-beta.16",
     "@nocobase/realtime": "^0.1.0-beta.3"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",

package/server/plugins.ts

@@ -1,3 +1,4 @@
+import foundation from '@nocobase/app-plugin-foundation/server';
 import defaultAccess from '@nocobase/app-plugin-authz-default-access/server';
 import sharingRules from '@nocobase/app-plugin-authz-sharing-rules/server';
 import restrictionRules from '@nocobase/app-plugin-authz-restriction-rules/server';
@@ -34,6 +35,7 @@ const serverPlugins: AppServerPlugins = defineServerPlugins([
   file,
   scheduler,
   mail,
+  foundation,
 ]);
 
 export default serverPlugins;