@nocobase/app-template-default 1.0.0-beta.82 → 1.0.0-beta.84

package/client/pages/settings/users.tsx

@@ -1,11 +1,15 @@
+import { useListLocation } from '#hooks/use-list-location';
 import { RecordLink } from '#components/record-link';
 import { BackButton } from '#components/back-button';
 import { safeReturnTo } from '../../lib/return-to.js';
-import { useTableUrlState } from '#hooks/use-table-url-state';
+import {
+  readTableUrlState,
+  useTableUrlState,
+} from '#hooks/use-table-url-state';
 import { DataTable, DataTableColumnHeader } from '#components/data-table';
 import type { ColumnDef } from '@tanstack/react-table';
 import { useSettingsData, useUserPermission } from './hooks.js';
-import { useApiClient, useToaster } from '@nocobase/app-client';
+import { useApiClient, useSubmission, useToaster } from '@nocobase/app-client';
 import { useTranslation } from '@nocobase/i18n/client';
 import {
   UsersClient,
@@ -20,13 +24,7 @@ import {
   useEffect,
   type ReactElement,
 } from 'react';
-import {
-  Link,
-  Outlet,
-  useLocation,
-  useSearchParams,
-  useResolvedPath,
-} from 'react-router';
+import { Link, Outlet, useLocation, useResolvedPath } from 'react-router';
 import { PlusIcon, UsersIcon } from 'lucide-react';
 import { PageContainer } from '#components/page-container';
 import { PageHeader } from '#components/page-header';
@@ -79,14 +77,21 @@ function UserActions({
   const [action, setAction] = useState<
     'disable' | 'enable' | 'revokeSessions'
   >();
-  const [busy, setBusy] = useState(false);
+  const [requestBusy, setRequestBusy] = useState(false);
   const [error, setError] = useState<unknown>();
+  const submission = useSubmission();
+  const busy = requestBusy || submission.submitting;
   const run = async () => {
     if (!action) return;
-    setBusy(true);
+    setRequestBusy(true);
     setError(undefined);
     try {
-      const updated = await client[action](user.id);
+      const outcome = await submission.run(
+        { action, id: user.id },
+        async (key) => ({ updated: await client[action](user.id, key) }),
+      );
+      if (!outcome) return;
+      const updated = outcome.updated;
       toaster.show({
         type: 'success',
         title: t(`settings.userActionSaved.${action}`, { name: user.name }),
@@ -96,7 +101,7 @@ function UserActions({
     } catch (next) {
       setError(next);
     } finally {
-      setBusy(false);
+      setRequestBusy(false);
     }
   };
   if (!canRevoke && !(user.disabledAt ? canEnable : canDisable)) return <></>;
@@ -156,7 +161,7 @@ function UserActions({
 
 export default function UsersPage(): ReactElement {
   const { t } = useTranslation();
-  const [params, setParams] = useSearchParams();
+  const { params, setParams, active } = useListLocation();
   const location = useLocation();
   const listPath = useResolvedPath('.').pathname;
   const searchRef = useRef<HTMLInputElement>(null);
@@ -218,16 +223,14 @@ export default function UsersPage(): ReactElement {
     !roleChoices.some((option) => option.value === selectedRole)
   )
     roleChoices.push({ value: selectedRole, label: `${roleScope} · ${role}` });
-  const page = Math.max(
-    1,
-    Number.isSafeInteger(Number(params.get('page')))
-      ? Number(params.get('page'))
-      : 1,
-  );
+  const { paginationState, sortingState } = readTableUrlState(params, {
+    defaultPageSize: 20,
+    pageSizeOptions: [20, 50, 100],
+    sortColumns: ['name'],
+  });
+  const page = paginationState.pageIndex + 1;
   const status = params.get('status') ?? 'all';
-  const pageSize = [20, 50, 100].includes(Number(params.get('pageSize')))
-    ? Number(params.get('pageSize'))
-    : 20;
+  const pageSize = paginationState.pageSize;
   const update = (key: string, value: string) => {
     setParams(
       (old) => {
@@ -263,15 +266,20 @@ export default function UsersPage(): ReactElement {
     ...(status !== 'all' ? { status } : {}),
     ...(roleScope ? { roleScope } : {}),
     ...(role ? { role } : {}),
-    ...(params.get('order')
-      ? { sort: 'name', order: params.get('order')! }
+    ...(sortingState[0]
+      ? {
+          sort: sortingState[0].id,
+          order: sortingState[0].desc ? 'desc' : 'asc',
+        }
       : {}),
   });
   const request = useSettingsData<{
     data: readonly ManagedUser[];
     meta: { total: number };
-  }>(`users?${remote}`, true);
+  }>(`users?${remote}`, { keepPreviousData: true, active });
   const tableState = useTableUrlState({
+    active,
+    revision: request.revision,
     defaultPageSize: 20,
     pageSizeOptions: [20, 50, 100],
     sortColumns: ['name'],
@@ -481,10 +489,14 @@ export default function UsersPage(): ReactElement {
           </p>
         )}
         <SettingsError error={options.error} retry={options.reload} />
-        <SettingsError error={request.error} retry={request.reload} />
+        <SettingsError
+          error={tableState.error ?? request.error}
+          retry={request.reload}
+        />
         {request.loading && !request.data ? (
           <SettingsLoading />
         ) : (
+          !tableState.error &&
           !request.error &&
           (rows.length ? (
             <DataTable<ManagedUser>

package/client/routing/session-preparation.tsx

@@ -1,6 +1,11 @@
 import { useAuthentication } from '@nocobase/app-plugin-authentication/client';
 import { useTranslation } from '@nocobase/i18n/client';
-import { useState, type PropsWithChildren, type ReactElement } from 'react';
+import {
+  Fragment,
+  useState,
+  type PropsWithChildren,
+  type ReactElement,
+} from 'react';
 
 import { Loading } from '#components/loading';
 import { Button } from '#components/ui/button';
@@ -9,13 +14,15 @@ import { Button } from '#components/ui/button';
 export function SessionPreparation({
   children,
 }: PropsWithChildren): ReactElement {
-  const { preparation, retryPreparation, client, refresh } =
+  const { preparation, retryPreparation, client, refresh, session } =
     useAuthentication();
   const { t } = useTranslation();
   const [signingOut, setSigningOut] = useState(false);
   const [signOutFailed, setSignOutFailed] = useState(false);
 
-  if (preparation === 'ready') return <>{children}</>;
+  // List memory and ancestor queries belong to one signed-in identity only.
+  if (preparation === 'ready')
+    return <Fragment key={session?.user.id}>{children}</Fragment>;
   if (preparation === 'preparing') {
     return <Loading className='min-h-svh' label={t('auth.preparingSession')} />;
   }

package/database/main/migrations/202611020002_create_mutation_receipts.ts

@@ -0,0 +1,19 @@
+import { defineMigration, type MigrationDefinition } from '@nocobase/db';
+
+const migration: MigrationDefinition = defineMigration({
+  name: '202611020002_create_mutation_receipts',
+  async up({ builder }) {
+    await builder.createCollection('mutationReceipts', (collection) => {
+      collection.string('id', { length: 64 }).notNull();
+      collection.string('digest', { length: 64 }).notNull();
+      collection.json('result').nullable();
+      collection.datetime('expiresAt').notNull();
+      collection.primary('id', { name: 'pk_mutation_receipts' });
+      collection.index('expiresAt', { name: 'ix_mutation_receipts_expiry' });
+    });
+  },
+  async down({ builder }) {
+    await builder.dropCollection('mutationReceipts');
+  },
+});
+export default migration;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.82",
+  "version": "1.0.0-beta.84",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.82"
+    "defaultTemplateVersion": "1.0.0-beta.84"
   },
   "devDependencies": {
     "@ai-sdk/react": "4.0.131",
@@ -73,9 +73,10 @@
     "@xyflow/react": "^12.11.5",
     "elkjs": "^0.10.2",
     "@types/jsdom": "^30.0.0",
-    "@nocobase/app-client": "^4.0.0-beta.3",
+    "@noble/hashes": "2.3.0",
+    "@nocobase/app-client": "^4.0.0-beta.4",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.52",
+    "@nocobase/app-skills": "0.1.0-beta.54",
     "@nocobase/app-testing": "0.1.0-beta.6",
     "@nocobase/app-websocket": "^0.1.0-beta.1",
     "@nocobase/dev-config": "0.1.0-beta.25",
@@ -141,28 +142,28 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-agents": "^1.0.0-beta.27",
+    "@nocobase/app-plugin-agents": "^1.0.0-beta.28",
     "@nocobase/app-plugin-api-keys": "^1.0.0-beta.19",
     "@nocobase/app-plugin-authentication": "^2.0.0-beta.15",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.32",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.33",
     "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.17",
     "@nocobase/app-plugin-file": "^1.0.0-beta.27",
     "@nocobase/app-plugin-foundation": "^0.1.0-beta.9",
     "@nocobase/app-plugin-i18n": "^1.0.0-beta.18",
-    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.13",
+    "@nocobase/app-plugin-knowledge": "^0.1.0-beta.14",
     "@nocobase/app-plugin-mail": "^1.0.0-beta.17",
     "@nocobase/app-plugin-notification": "^2.0.0-beta.1",
     "@nocobase/app-plugin-notification-in-app": "^2.0.0-beta.0",
     "@nocobase/app-plugin-notification-providers": "^1.0.0-beta.15",
     "@nocobase/app-plugin-scheduler": "^1.0.0-beta.20",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.10",
-    "@nocobase/app-server": "^3.0.0-beta.3",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.11",
+    "@nocobase/app-server": "^3.0.0-beta.4",
     "@nocobase/config": "^0.1.0-beta.3",
-    "@nocobase/db": "^1.0.0-beta.22",
+    "@nocobase/db": "^1.0.0-beta.23",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
-    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.16",
+    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.17",
     "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.16",
     "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.15",
     "@nocobase/authorization": "^1.0.0-beta.15",
@@ -172,7 +173,7 @@
     "@nocobase/i18n": "^2.0.0-beta.1",
     "@nocobase/caching": "^0.1.0-beta.3",
     "@nocobase/repository-input": "^0.1.0-beta.3",
-    "@nocobase/app-cli": "^1.0.0-beta.28",
+    "@nocobase/app-cli": "^1.0.0-beta.30",
     "@nocobase/realtime": "^0.1.0-beta.3"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",

package/server/providers/index.ts

@@ -1,5 +1,8 @@
+import SubmissionProvider from './submission.js';
 import type { ApplicationServiceProviderConstructor } from '@nocobase/app-server/application';
 
-const serviceProviders: readonly ApplicationServiceProviderConstructor[] = [];
+const serviceProviders: readonly ApplicationServiceProviderConstructor[] = [
+  SubmissionProvider,
+];
 
 export default serviceProviders;

package/server/providers/submission.ts

@@ -0,0 +1,61 @@
+import type { Application } from '@nocobase/app-server/application';
+import {
+  authenticationToken,
+  type AuthEnv,
+} from '@nocobase/app-plugin-authentication';
+import {
+  repositoryIdempotencyToken,
+  pruneMutationReceipts,
+} from '@nocobase/app-server/router';
+import { jobExecutorServiceToken } from '@nocobase/app-server/jobs';
+import { databaseManagerToken } from '@nocobase/db';
+import { ServiceProvider } from '@nocobase/service-provider';
+import type { Context } from 'hono';
+import type { ScheduleExecutor } from '@nocobase/jobs';
+
+/** Standard data writes require an operation key; custom HTTP actions opt in explicitly. */
+export default class SubmissionProvider extends ServiceProvider<Application> {
+  readonly name = 'app/submission';
+  private cleanup?: ScheduleExecutor;
+  override register(): void {
+    this.app.container.singleton(repositoryIdempotencyToken, () => ({
+      required: true,
+      principal: async (context) => {
+        const auth =
+          (context as Context<AuthEnv>).get('auth') ??
+          (await this.app.container
+            .resolve(authenticationToken)
+            .getSession(context.req.raw.headers, {
+              disableRefresh: true,
+              disableCookieCache: true,
+            }));
+        return auth && !auth.credential
+          ? `${this.app.appName}:${auth.user.id}`
+          : undefined;
+      },
+    }));
+  }
+  override async boot(): Promise<void> {
+    if (
+      !this.app.container.has(databaseManagerToken) ||
+      !this.app.container.has(jobExecutorServiceToken)
+    )
+      return;
+    const database = this.app.container.resolve(databaseManagerToken);
+    this.cleanup = this.app.container
+      .resolve(jobExecutorServiceToken)
+      .getScheduleExecutor('app.mutation-receipts');
+    await this.cleanup.addJob({
+      name: 'prune',
+      options: { every: 60 * 60 * 1000 },
+      payload: {},
+      execute: async () => {
+        await pruneMutationReceipts(database.connection());
+      },
+    });
+    await this.cleanup.setup();
+  }
+  override async shutdown(): Promise<void> {
+    await this.cleanup?.shutdown();
+  }
+}

package/tests/client/auth-i18n.test.tsx

@@ -116,6 +116,15 @@ describe('authentication translations', () => {
   it('retranslates an existing password mismatch', async () => {
     const value = await runtime();
     const { container } = renderPage(value, <RegisterPage />);
+    for (const [label, text] of [
+      ['Name', 'Test'],
+      ['Username', 'tester'],
+      ['Email', 'tester@example.test'],
+    ]) {
+      fireEvent.change(screen.getByLabelText(label!), {
+        target: { value: text },
+      });
+    }
     fireEvent.change(screen.getByLabelText('Password'), {
       target: { value: 'one' },
     });

package/tests/client/back-button.test.tsx

@@ -46,15 +46,15 @@ function renderAt(url: string, child: ReactElement) {
 }
 
 describe('BackButton', () => {
-  it('leads to the parent route and keeps the query string', async () => {
+  it('uses the default parent list when no source visit exists', async () => {
     const router = renderAt('/projects/12?q=alpha&page=2', <BackButton />);
 
     const link = screen.getByRole('link', { name: enUS.navigation.back });
-    expect(link).toHaveAttribute('href', '/projects?q=alpha&page=2');
+    expect(link).toHaveAttribute('href', '/projects');
 
     await userEvent.click(link);
     expect(router.state.location.pathname).toBe('/projects');
-    expect(router.state.location.search).toBe('?q=alpha&page=2');
+    expect(router.state.location.search).toBe('');
     // Leaving the child page replaces its entry, as closing an overlay does.
     expect(router.state.historyAction).toBe('REPLACE');
   });

package/tests/client/default-access.test.tsx

@@ -1,4 +1,5 @@
-import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import { renderSettingsClient as renderWithApp } from '../helpers/settings-client.js';
+import { answerApi } from '@nocobase/app-testing/client';
 import { apiClientToken, type ClientApplication } from '@nocobase/app-client';
 import {
   AuthorizationClient,
@@ -207,7 +208,7 @@ it('supports read-only inspection and does not show write or delete actions with
 });
 it('shows unknown rules read-only and refuses overwriting a rule changed after loading', async () => {
   const user = userEvent.setup();
-  let count = 0;
+  let changed = false;
   let writes = 0;
   await renderWithApp(tree(), {
     route: '/default-access/project-default/edit',
@@ -219,14 +220,14 @@ it('shows unknown rules read-only and refuses overwriting a rule changed after l
         return { data: { unrestricted: true, permissions: [] } };
       if (path.endsWith('/options')) return { data: catalog };
       if (method === 'PATCH') writes++;
-      count++;
-      return { data: [count > 2 ? { ...existing, actions: [] } : existing] };
+      return { data: [changed ? { ...existing, actions: [] } : existing] };
     }),
   });
   await user.click(
     await screen.findByRole('combobox', { name: 'Edit · Projects' }),
   );
   await user.click(await screen.findByRole('option', { name: 'All records' }));
+  changed = true;
   await user.click(screen.getByRole('button', { name: 'Save' }));
   expect(
     await screen.findByText(enUS.settings.defaultAccess.changed),
@@ -691,3 +692,58 @@ it('replaces the saved editor history entry and keeps the list query when going
   ).not.toBeInTheDocument();
   expect(patches).toBe(1);
 });
+
+it.each(['transport', 'server'])(
+  'verifies an uncertain %s delete without replaying the mutation',
+  async (failure) => {
+    let deleted = false;
+    let writes = 0;
+    await renderWithApp(tree(), {
+      route: '/default-access',
+      namespace,
+      namespaces,
+      services,
+      fetch: answerApi(({ path, method }) => {
+        if (path === 'authorization/permissions')
+          return { data: { unrestricted: true, permissions: [] } };
+        if (path.endsWith('/options')) return { data: catalog };
+        if (method === 'DELETE') {
+          deleted = true;
+          writes++;
+          if (failure === 'transport') throw new TypeError('Response lost');
+          return Response.json(
+            {
+              error: {
+                code: 'INTERNAL_SERVER_ERROR',
+                message: 'Response lost',
+              },
+            },
+            { status: 500 },
+          );
+        }
+        return { data: deleted ? [] : [existing] };
+      }),
+    });
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Actions for Projects' }),
+    );
+    await userEvent.click(
+      await screen.findByRole('menuitem', { name: 'Delete' }),
+    );
+    await userEvent.click(
+      screen.getByRole('button', { name: 'Delete', exact: true }),
+    );
+    expect(
+      await screen.findByText(enUS.settings.defaultAccess.empty),
+    ).toBeVisible();
+    expect(screen.getByRole('alertdialog')).toBeVisible();
+    expect(screen.getByText(enUS.settings.failed)).toBeVisible();
+    await userEvent.click(
+      screen.getByRole('button', { name: 'Cancel', exact: true }),
+    );
+    await waitFor(() =>
+      expect(screen.getByText(enUS.settings.defaultAccess.empty)).toBeVisible(),
+    );
+    expect(writes).toBe(1);
+  },
+);