@nocobase/app-template-default 1.0.0-beta.76 → 1.0.0-beta.77

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.76",
+  "version": "1.0.0-beta.77",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.76"
+    "defaultTemplateVersion": "1.0.0-beta.77"
   },
   "devDependencies": {
     "@ai-sdk/react": "4.0.131",
@@ -72,9 +72,9 @@
     "tar": "^7.5.22",
     "@xyflow/react": "^12.11.5",
     "elkjs": "^0.10.2",
-    "@nocobase/app-client": "^4.0.0-beta.1",
+    "@nocobase/app-client": "^4.0.0-beta.2",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.44",
+    "@nocobase/app-skills": "0.1.0-beta.46",
     "@nocobase/app-testing": "0.1.0-beta.6",
     "@nocobase/app-websocket": "^0.1.0-beta.1",
     "@nocobase/dev-config": "0.1.0-beta.24",
@@ -139,24 +139,24 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-agents": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-agents": "^1.0.0-beta.19",
     "@nocobase/app-plugin-api-keys": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.12",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.30",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.31",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.13",
     "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.16",
     "@nocobase/app-plugin-file": "^1.0.0-beta.26",
     "@nocobase/app-plugin-foundation": "^0.1.0-beta.1",
     "@nocobase/app-plugin-i18n": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.9",
+    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.10",
     "@nocobase/app-plugin-mail": "^1.0.0-beta.16",
     "@nocobase/app-plugin-notification": "^2.0.0-beta.0",
     "@nocobase/app-plugin-notification-in-app": "^2.0.0-beta.0",
     "@nocobase/app-plugin-notification-providers": "^1.0.0-beta.15",
     "@nocobase/app-plugin-scheduler": "^1.0.0-beta.19",
     "@nocobase/app-plugin-users": "^2.0.0-beta.9",
-    "@nocobase/app-server": "^3.0.0-beta.2",
+    "@nocobase/app-server": "^3.0.0-beta.3",
     "@nocobase/config": "^0.1.0-beta.3",
-    "@nocobase/db": "^1.0.0-beta.21",
+    "@nocobase/db": "^1.0.0-beta.22",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
@@ -170,7 +170,7 @@
     "@nocobase/i18n": "^2.0.0-beta.1",
     "@nocobase/caching": "^0.1.0-beta.3",
     "@nocobase/repository-input": "^0.1.0-beta.3",
-    "@nocobase/app-cli": "^1.0.0-beta.26",
+    "@nocobase/app-cli": "^1.0.0-beta.27",
     "@nocobase/realtime": "^0.1.0-beta.3"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",

package/server/config/app.ts

@@ -27,7 +27,7 @@ const app: AppConfigFactory<AppIdentityConfig> = defineAppConfig({
   },
   defaults: (runtime) => {
     const { routing } = runtime;
-    const publicBasePath = normalizeBasePath(routing.publicBasePath || '/main');
+    const publicBasePath = normalizeBasePath(routing.publicBasePath);
     return {
       name: routing.name || resolveAppNameFromBasePath(publicBasePath, 'main'),
       publicBasePath,

package/server/config/session.ts

@@ -4,7 +4,10 @@ import {
   type AppConfigFactory,
 } from '@nocobase/app-server/config';
 import type { AppSessionConfigInput } from '@nocobase/app-server/session';
-import { normalizeBasePath } from '@nocobase/app-server/support';
+import {
+  createAppCookieScope,
+  normalizeBasePath,
+} from '@nocobase/app-server/support';
 
 const session: AppConfigFactory<AppSessionConfigInput> = defineAppConfig({
   env: {
@@ -19,10 +22,9 @@ const session: AppConfigFactory<AppSessionConfigInput> = defineAppConfig({
     enabled: true,
     default: 'memory',
     cookie: {
-      name: 'nocobase_session',
-      // The application's own public base path, as `app.publicBasePath` resolves it: applications sharing an origin
-      // under different paths (`/crm`, `/acme`) each keep their own session cookie instead of overwriting one another's.
-      path: normalizeBasePath(routing.publicBasePath || '/main'),
+      name: `nocobase_session_${createAppCookieScope(routing.publicBasePath)}`,
+      // A distinct name also keeps a child application from reading a parent's cookie sent under an overlapping path.
+      path: normalizeBasePath(routing.publicBasePath) || '/',
       secure: env.NODE_ENV === 'production',
       httpOnly: true,
       sameSite: 'lax' as const,

package/tests/components/default-access-editor.test.tsx

@@ -0,0 +1,130 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { expect, it, vi } from 'vitest';
+import { DefaultAccessEditor } from '../../client/components/default-access-editor.js';
+
+it('reports one explicit scope choice and does not mutate its controlled fields during browsing', async () => {
+  const user = userEvent.setup();
+  const onScopeChange = vi.fn();
+  const props = {
+    ruleKey: 'baseline',
+    resource: 'projects',
+    resources: [{ value: 'projects', label: 'Projects' }],
+    scopes: [
+      {
+        id: 'view-projects',
+        action: 'View',
+        scope: 'Projects',
+        value: 'own',
+        options: [
+          { value: 'own', label: 'Own records' },
+          { value: 'all', label: 'All records' },
+        ],
+      },
+    ],
+    labels: {
+      key: 'Key',
+      resource: 'Business object',
+      chooseResource: 'Choose an object',
+      action: 'Operation',
+      scope: 'Data scope',
+      noScopes: 'Choose an object',
+    },
+    onKeyChange: vi.fn(),
+    onResourceChange: vi.fn(),
+    onScopeChange,
+  };
+  render(<DefaultAccessEditor {...props} existing />);
+  expect(screen.getByRole('textbox', { name: 'Key *' })).toBeDisabled();
+  expect(props.onKeyChange).not.toHaveBeenCalled();
+  await user.click(screen.getByRole('combobox', { name: 'View · Projects' }));
+  expect(onScopeChange).not.toHaveBeenCalled();
+  await user.click(await screen.findByRole('option', { name: 'All records' }));
+  expect(onScopeChange).toHaveBeenCalledExactlyOnceWith('view-projects', 'all');
+});
+
+it('groups ranges by operation, keeps independent choices and preserves explicit operation identities', async () => {
+  const change = vi.fn();
+  const options = [
+    { value: '', label: 'No default scope' },
+    { value: 'all', label: 'All records' },
+  ];
+  const props = {
+    ruleKey: 'baseline',
+    resource: 'library',
+    resources: [{ value: 'library', label: 'Library' }],
+    scopes: [
+      {
+        id: 'books',
+        actionId: 'browse',
+        action: 'Browse holdings',
+        scope: 'Book information',
+        value: '',
+        options,
+      },
+      {
+        id: 'copies',
+        actionId: 'browse',
+        action: 'Browse holdings',
+        scope: 'Physical copies',
+        value: '',
+        options,
+        configuration: <button type='button'>Configure conditions</button>,
+      },
+      {
+        id: 'manage',
+        actionId: 'manage',
+        action: 'Manage',
+        scope: 'Book information',
+        value: '',
+        options,
+      },
+      {
+        id: 'settings',
+        actionId: 'settings',
+        action: 'Manage',
+        scope: 'Settings',
+        value: '',
+        options,
+      },
+    ],
+    labels: {
+      key: 'Key',
+      resource: 'Business object',
+      chooseResource: 'Choose',
+      action: 'Operation',
+      scope: 'Scope',
+      noScopes: 'Choose an object',
+    },
+    onKeyChange: vi.fn(),
+    onResourceChange: vi.fn(),
+    onScopeChange: change,
+  };
+  const view = render(<DefaultAccessEditor {...props} />);
+  expect(
+    screen.getAllByRole('heading', { name: 'Browse holdings' }),
+  ).toHaveLength(1);
+  expect(screen.getAllByRole('region', { name: 'Manage' })).toHaveLength(2);
+  await userEvent.click(
+    screen.getByRole('button', { name: 'Configure conditions' }),
+  );
+  expect(change).not.toHaveBeenCalled();
+  await userEvent.click(
+    screen.getByRole('combobox', { name: 'Browse holdings · Physical copies' }),
+  );
+  await userEvent.click(
+    await screen.findByRole('option', { name: 'All records' }),
+  );
+  expect(change).toHaveBeenCalledExactlyOnceWith('copies', 'all');
+  expect(
+    screen.getByRole('combobox', {
+      name: 'Browse holdings · Book information',
+    }),
+  ).toHaveTextContent('No default scope');
+  view.rerender(<DefaultAccessEditor {...props} readOnly />);
+  expect(
+    screen
+      .getAllByRole('combobox')
+      .every((item) => item.hasAttribute('disabled')),
+  ).toBe(true);
+});