@nocobase/app-template-default 1.0.0-beta.76 → 1.0.0-beta.78

package/client/locales/system/settings-en-US.ts

@@ -78,7 +78,7 @@ const settings = {
   scopeExplanation:
     'Each range applies to its corresponding data. The operation must also pass its authorization checks.',
   noAdditionalScopeHint:
-    'This action grants no additional record access here. Default access, sharing and restriction rules still determine actual access.',
+    'This role adds no records. Effective access also depends on other roles and default, sharing and restriction rules.',
   systemToolsHint:
     'Manage system configuration and tools. Review the capabilities each action includes before granting access.',
   userAccountsHint:
@@ -86,7 +86,7 @@ const settings = {
   businessOperationsHint:
     'Choose the operations this role can perform and the data each operation can use.',
   pageAccessHint:
-    'Controls which pages this role can open. Data and actions on each page require their own permissions.',
+    'Choose the business pages this role can open. All system settings, including user management and business configuration, are controlled under Configuration permissions. Data and business actions require separate permissions.',
   roleAssignment: 'Role assignment',
   accountSecurity: 'Account security',
   userInformation: 'User information',
@@ -197,16 +197,27 @@ const settings = {
   total_one: '{{count}} user',
   total_other: '{{count}} users',
   access: 'Access',
+  expandPermissionGroup: 'Expand {{name}}',
+  collapsePermissionGroup: 'Collapse {{name}}',
+  pagesOutsideNavigation: 'Pages outside navigation',
+  configurationPermissions: 'Configuration permissions',
+  configurationPermissionsHint:
+    'Control access and actions for system settings, user management and business configuration. Only actual application features are shown.',
   permissionSearch: 'Search categories, groups or permissions',
   enabledOnly: 'Enabled only',
   noPermissions: 'No permissions to configure',
+  permissionEmptyHint:
+    'Ask the application developer to expose the permissions this role can configure.',
+  permissionReadOnlyHint: 'These permissions are read-only.',
+  permissionManagedHint: 'This permission is managed by the application.',
+  permissionSaveHint: 'Permission changes take effect after saving.',
   permissionCategories: 'Permission categories',
   selectAllPermissions: 'All',
   dataRanges: 'Data ranges ({{count}})',
   selectVisiblePermissions: 'Select visible permissions in {{name}}',
   permissionSummary: '{{enabled}} of {{total}} enabled',
   preservedRecordScope: 'Keep existing configuration',
-  noRecordScope: 'No additional record access',
+  noRecordScope: 'Use default rules',
   permissionFilter: {
     limit: 'Up to 20 conditions',
     configure: 'Conditions',

package/client/locales/system/settings-zh-CN.ts

@@ -68,14 +68,14 @@ const settings = {
   scopeExplanation:
     '每项范围分别约束对应数据，实际操作还需通过相应的权限检查。',
   noAdditionalScopeHint:
-    '此操作在这里不额外授予数据访问权限，实际可访问范围仍取决于默认数据范围、共享与限制规则。',
+    '此角色不增加记录范围；实际访问还取决于其他角色及默认、共享和限制规则。',
   systemToolsHint: '管理系统配置与工具，授权前请确认每项操作包含的能力。',
   userAccountsHint:
     '管理用户资料、账号安全和角色分配，请逐项确认需要授予的权限。',
   businessOperationsHint:
     '设置此角色可以执行的业务操作，以及每项操作可使用的数据范围。',
   pageAccessHint:
-    '控制此角色可以进入哪些页面。页面中的数据和操作仍需单独授权。',
+    '设置此角色可访问的业务页面。系统设置（包括用户管理、业务配置项）统一在“配置项权限”中控制。页面内的数据和业务操作仍需单独授权。',
   roleAssignment: '角色分配',
   accountSecurity: '账号安全',
   userInformation: '用户资料',
@@ -181,15 +181,25 @@ const settings = {
   total_one: '共 {{count}} 位用户',
   total_other: '共 {{count}} 位用户',
   access: '访问',
+  expandPermissionGroup: '展开“{{name}}”',
+  collapsePermissionGroup: '收起“{{name}}”',
+  pagesOutsideNavigation: '未显示在菜单中的页面',
+  configurationPermissions: '配置项权限',
+  configurationPermissionsHint:
+    '统一设置系统设置、用户管理和业务配置项的访问与操作权限，仅显示应用实际开放的功能。',
   permissionSearch: '搜索分类、分组或权限',
   enabledOnly: '仅显示已授权',
   noPermissions: '暂无可配置权限',
+  permissionEmptyHint: '请联系应用开发者，开放此角色需要配置的权限。',
+  permissionReadOnlyHint: '当前权限配置为只读。',
+  permissionManagedHint: '此权限由应用管理。',
+  permissionSaveHint: '权限修改保存后生效。',
   permissionCategories: '权限分类',
   selectAllPermissions: '全选',
   dataRanges: '数据范围（{{count}}）',
   selectVisiblePermissions: '选择“{{name}}”中显示的权限',
   permissionSummary: '已授权 {{enabled}} / {{total}}',
-  noRecordScope: '不额外授权数据范围',
+  noRecordScope: '按默认规则',
   preservedRecordScope: '保留现有配置',
   permissionFilter: {
     limit: '最多支持 20 个条件',

package/client/pages/home/use-copy.ts

@@ -1,4 +1,4 @@
-import { useToaster } from '@nocobase/app-client';
+import { copyText, useToaster } from '@nocobase/app-client';
 import { useTranslation } from '@nocobase/i18n/client';
 import { useCallback, useEffect, useState } from 'react';
 
@@ -23,11 +23,14 @@ export function useCopy(): CopyState {
   const copy = useCallback(
     async (text: string): Promise<void> => {
       try {
-        await navigator.clipboard.writeText(text);
+        if (!(await copyText(text))) {
+          toaster.show({ type: 'error', title: t('home.prompt.copyFailed') });
+          return;
+        }
         setCopied(true);
         toaster.show({ type: 'success', title: t('home.prompt.copied') });
       } catch {
-        // The Clipboard API is missing outside a secure context and rejects without permission.
+        // Copying can fail when neither browser mechanism is available.
         toaster.show({ type: 'error', title: t('home.prompt.copyFailed') });
       }
     },

package/client/pages/settings/default-access-form.tsx

@@ -25,6 +25,7 @@ import { Alert, AlertDescription } from '#components/ui/alert';
 import { SettingsError, SettingsLoading } from './shared.js';
 import { useSettingsData, useSettingsLeave } from './hooks.js';
 import { permissionFilterLabels } from './permission-filters.js';
+import { permissionFilterFieldLabel } from './permission-workspace.js';
 import {
   actionKey,
   resourceKey,
@@ -177,6 +178,7 @@ function DefaultAccessFormBody(): ReactElement {
       id: scope.id,
       error: scopeErrors[scope.id],
       action: text(scope.actionTitle),
+      actionId: scope.action,
       scope: text(scope.title),
       value: selectedValue,
       options: choices,
@@ -188,7 +190,13 @@ function DefaultAccessFormBody(): ReactElement {
             value={params}
             fields={scope.fields.map((field) => ({
               value: field,
-              label: fieldLabels[field] ?? field,
+              label:
+                fieldLabels[field] ??
+                permissionFilterFieldLabel(
+                  scope.collection,
+                  field,
+                  (key, fallback) => t(key, { defaultValue: fallback ?? key }),
+                ),
             }))}
             labels={labels}
             disabled={readOnly}
@@ -213,6 +221,7 @@ function DefaultAccessFormBody(): ReactElement {
       controls.push({
         id: actionKey(action),
         action: action.action,
+        actionId: action.action,
         scope: action.scopeKey ?? value.resource.id,
         value: JSON.stringify(action.selection),
         options: [

package/client/pages/settings/default-access-model.ts

@@ -3,6 +3,7 @@ import type {
   LocalizedText,
 } from '@nocobase/app-plugin-authorization/client';
 import type { CatalogResource } from './permissions-model.js';
+import { permissionScopeTitle } from './permission-workspace.js';
 
 export type ScopeSelection =
   | { readonly type: 'all' }
@@ -51,7 +52,10 @@ export function ruleResources(
     ...catalog.collections.map((collection) => ({
       type: 'database.collection',
       id: collection.name,
-      title: collection.name,
+      title: permissionScopeTitle(
+        { type: 'database.collection', id: collection.name },
+        { collection: collection.name, title: collection.name },
+      ),
       actions: ['read', 'update', 'delete'].map((name) => ({
         name,
         title: {
@@ -98,7 +102,7 @@ export function ruleScopes(
           action: action.name,
           scopeKey: scope.key,
           actionTitle: action.title,
-          title: scope.title,
+          title: permissionScopeTitle(resource, scope, undefined, action.name),
           collection: scope.collection,
           fields: scope.fields,
           recordAccess: scope.recordAccess,

package/client/pages/settings/page-permissions.ts

@@ -1,6 +1,15 @@
 import type { AppClientRegisteredRoute } from '@nocobase/app-client/plugins';
 import type { LocalizedText } from '@nocobase/app-plugin-authorization/client';
-import type { CatalogResource } from './permissions-model.js';
+import { permissionRowId, type CatalogResource } from './permissions-model.js';
+import type {
+  PermissionEditorNavigationNode,
+  PermissionEditorSection,
+  PermissionEditorGroup,
+} from '#components/permission-editor';
+import {
+  buildRouteNavigation,
+  type RouteNavigationItem,
+} from '../../routing/route-navigation.js';
 
 /** Application route names are stable within their owner; labels never change stored grants. */
 export type PagePermissionTitles = Readonly<Record<string, string>>;
@@ -49,3 +58,159 @@ export function pagePermissionResources(
   visit(routes);
   return [...resources.values()];
 }
+
+/** Resource ownership follows the application's real settings branch, not translated labels or URL guesses. */
+function configurationResources(
+  routes: readonly AppClientRegisteredRoute[],
+): ReadonlySet<string> {
+  const resources = new Set<string>();
+  const visit = (
+    items: readonly AppClientRegisteredRoute[],
+    inSettings = false,
+  ): void => {
+    for (const route of items) {
+      const settings =
+        inSettings ||
+        (route.source === 'application' &&
+          ['settings', 'systemManagement'].includes(route.name));
+      if (
+        settings &&
+        route.componentLoader &&
+        typeof route.authz === 'object'
+      ) {
+        resources.add(
+          JSON.stringify([route.authz.resource.type, route.authz.resource.id]),
+        );
+      }
+      visit(route.children ?? [], settings);
+    }
+  };
+  visit(routes);
+  return resources;
+}
+
+/** The business page tree excludes system settings, whose original grants are configured in their own category. */
+export function pagePermissionNavigation(
+  routes: readonly AppClientRegisteredRoute[],
+  titles: PagePermissionTitles,
+  unnamed: (path: string) => string,
+  text: (value: LocalizedText) => string,
+): readonly PermissionEditorNavigationNode[] {
+  const configuration = configurationResources(routes);
+  const pages = pagePermissionResources(routes, titles, unnamed).filter(
+    ({ type, id }) => !configuration.has(JSON.stringify([type, id])),
+  );
+  const resources = new Map(pages.map((page) => [page.id, page]));
+  const seen = new Set<string>();
+  const visit = (
+    items: readonly RouteNavigationItem[],
+  ): PermissionEditorNavigationNode[] =>
+    items.flatMap(({ route, children }) => {
+      const resource =
+        route.componentLoader &&
+        typeof route.authz === 'object' &&
+        route.authz.resource.type === 'page'
+          ? resources.get(route.authz.resource.id)
+          : undefined;
+      const rowId =
+        resource && !seen.has(resource.id)
+          ? permissionRowId(resource, 'access')
+          : undefined;
+      if (rowId && resource) seen.add(resource.id);
+      const descendants = visit(children);
+      if (!rowId && !descendants.length) return [];
+      return [
+        {
+          id: `menu:${route.packageName}:${route.id}:${route.path}`,
+          label: text(
+            rowId && resource
+              ? resource.title
+              : route.navigation?.title
+                ? { key: route.navigation.title, ns: route.packageName }
+                : unnamed(route.path),
+          ),
+          rowId,
+          children: descendants,
+        },
+      ];
+    });
+  // Author the catalog from the complete menu, not the signed-in editor's filtered navigation.
+  const navigation = visit(buildRouteNavigation(routes, new Set()));
+  const outside = pages
+    .filter((page) => !seen.has(page.id))
+    .map((page) => ({
+      id: `page:${page.id}`,
+      label: text(page.title),
+      rowId: permissionRowId(page, 'access'),
+    }));
+  return [
+    ...navigation,
+    ...(outside.length
+      ? [
+          {
+            id: 'pages:outside-navigation',
+            label: text({ key: 'settings.pagesOutsideNavigation' }),
+            children: outside,
+          },
+        ]
+      : []),
+  ];
+}
+
+/** Reclassify existing controls only: system settings never create a second page-access permission. */
+export function permissionNavigationSections(
+  sections: readonly PermissionEditorSection[],
+  routes: readonly AppClientRegisteredRoute[],
+  titles: PagePermissionTitles,
+  unnamed: (path: string) => string,
+  text: (value: LocalizedText) => string,
+): readonly PermissionEditorSection[] {
+  const configuration = configurationResources(routes);
+  const moved: PermissionEditorGroup[] = [];
+  const result = sections
+    .map((section) => {
+      if (section.id === 'configuration') return section;
+      const groups = section.groups.flatMap((group) => {
+        const belongs = (row: (typeof group.rows)[number]): boolean => {
+          const [type, id] = JSON.parse(row.id) as string[];
+          return configuration.has(JSON.stringify([type, id]));
+        };
+        const settingsRows = group.rows.filter(belongs);
+        if (settingsRows.length) moved.push({ ...group, rows: settingsRows });
+        const rows = group.rows.filter((row) => !belongs(row));
+        return rows.length ? [{ ...group, rows }] : [];
+      });
+      return {
+        ...section,
+        groups,
+        ...(section.id === 'pages'
+          ? {
+              navigation: pagePermissionNavigation(
+                routes,
+                titles,
+                unnamed,
+                text,
+              ),
+            }
+          : {}),
+      };
+    })
+    .filter((section) => section.groups.length);
+  if (!moved.length) return result;
+  const target = result.find((section) => section.id === 'configuration');
+  return target
+    ? result.map((section) =>
+        section === target
+          ? { ...section, groups: [...section.groups, ...moved] }
+          : section,
+      )
+    : [
+        ...result,
+        {
+          id: 'configuration',
+          title: text({ key: 'settings.configurationPermissions' }),
+          description: text({ key: 'settings.configurationPermissionsHint' }),
+          groups: moved,
+        },
+      ];
+}

package/client/pages/settings/permission-filters.tsx

@@ -8,6 +8,7 @@ import type {
   AuthorizationOptionsResponse,
 } from '@nocobase/app-plugin-authorization/client';
 import { getScopeSelection } from './permissions-model.js';
+import { permissionFilterFieldLabel } from './permission-workspace.js';
 
 export function configurePermissionScopes(
   sections: readonly PermissionEditorSection[],
@@ -39,7 +40,9 @@ export function configurePermissionScopes(
             const definition = resources
               .find(
                 (resource) =>
-                  resource.type === type && resource.id === resourceId,
+                  resource.type === type &&
+                  resource.id === resourceId &&
+                  resource.actions.some((item) => item.name === action),
               )
               ?.dataScopes?.[action ?? '']?.find((item) => item.key === key);
             const value = getScopeSelection(grants, scope.id);
@@ -62,7 +65,11 @@ export function configurePermissionScopes(
                   value={filter}
                   fields={(definition?.fields ?? []).map((field) => ({
                     value: field,
-                    label: text(`settings.permissionFields.${field}`, field),
+                    label: permissionFilterFieldLabel(
+                      definition?.collection ?? '',
+                      field,
+                      text,
+                    ),
                   }))}
                   labels={labels}
                   disabled={disabled}