@nocobase/app-template-default 1.0.0-beta.83 → 1.0.0-beta.85

package/server/config/auth.ts

@@ -12,6 +12,8 @@ import { bearer, deviceAuthorization, username } from 'better-auth/plugins';
  */
 const CLI_CLIENT_IDS: readonly string[] = ['nocobase-cli'];
 
+// defineAuthConfig supplies AUTH_EMAIL_* mappings and validates the private auth.email sender.
+// Automatic recovery requires passwordReset.enabled: true; leave the switch absent for custom callback compatibility.
 const auth: AppConfigFactory<AuthConfig> = defineAuthConfig({
   defaults: {
     plugins: [

package/server/config/concurrency.ts

@@ -0,0 +1,3 @@
+import { defineConcurrencyConfig } from '@nocobase/app-plugin-concurrency/config';
+
+export default defineConcurrencyConfig();

package/server/config/index.ts

@@ -12,6 +12,7 @@ import server from './server.js';
 import spa from './spa.js';
 import logging from './logging.js';
 import drive from './drive.js';
+import concurrency from './concurrency.js';
 import queue from './queue.js';
 import jobs from './jobs.js';
 import scheduler from './scheduler.js';
@@ -35,6 +36,7 @@ const defaultConfigs: AppConfigFactory<{
   spa: ReturnType<typeof spa>;
   logging: ReturnType<typeof logging>;
   drive: ReturnType<typeof drive>;
+  concurrency: ReturnType<typeof concurrency>;
   queue: ReturnType<typeof queue>;
   jobs: ReturnType<typeof jobs>;
   scheduler: ReturnType<typeof scheduler>;
@@ -57,6 +59,7 @@ const defaultConfigs: AppConfigFactory<{
   spa,
   logging,
   drive,
+  concurrency,
   queue,
   jobs,
   scheduler,

package/server/config/jobs.ts

@@ -4,24 +4,12 @@ import {
 } from '@nocobase/app-server/config';
 import type { AppJobsConfig } from '@nocobase/app-server/jobs';
 
-/**
- * Configurations the jobs service can run on. None is the default: until `jobs.default` names one, executors
- * run on the built-in memory adapter, which serves one process and writes its state under storage/jobs when the
- * application stops, and which is reported at startup outside development. Name `memory` to keep that choice without
- * the report, or `redis` to run any number of instances with each firing executed once.
- */
+/** Single-process persistence. Distributed jobs require an explicitly registered backend plugin. */
 const jobs: AppConfigFactory<AppJobsConfig> = defineAppConfig(({ paths }) => ({
   memory: {
     adapter: 'memory',
     persistence: { path: paths.storage('jobs') },
   },
-  redis: {
-    adapter: 'redis',
-    connection: { host: '127.0.0.1', port: 6379, db: 0 },
-    // Every firing leaves a finished job behind; keep the history bounded.
-    removeOnComplete: { count: 1000 },
-    removeOnFail: { age: 604_800 },
-  },
 }));
 
 export default jobs;

package/server/config/notification.ts

@@ -1,4 +1,4 @@
-import { defineMailChannelsConfig } from '@nocobase/app-server/mailer';
+import { defineMailChannelsConfig } from '@nocobase/app-plugin-notification-providers/config';
 import { type AppConfigFactory } from '@nocobase/app-server/config';
 import type { NotificationConfig } from '@nocobase/app-plugin-notification/server';
 

package/server/config/queue.ts

@@ -8,7 +8,7 @@ import type { AppQueueConfig } from '@nocobase/app-server/queue';
  * Configurations queues can run on. None is the default: until `queue.default` names one, queues run on the
  * built-in memory configuration, which serves one process and writes its pending jobs under storage/queue when the
  * application stops, and which is reported at startup outside development. Name `memory` to keep that choice without
- * the report, or `redis` to share queues across instances.
+ * the report. Shared Redis queues require explicit registration of @nocobase/app-plugin-queue-redis/server.
  */
 const queue: AppConfigFactory<AppQueueConfig> = defineAppConfig(
   ({ paths }) => ({
@@ -16,12 +16,6 @@ const queue: AppConfigFactory<AppQueueConfig> = defineAppConfig(
       adapter: 'inMemory',
       persistence: { path: paths.storage('queue') },
     },
-    redis: {
-      adapter: 'redis',
-      connection: { host: '127.0.0.1', port: 6379, db: 0 },
-      removeOnComplete: { count: 1000 },
-      removeOnFail: { age: 604_800 },
-    },
   }),
 );
 

package/server/plugins.ts

@@ -1,3 +1,4 @@
+import concurrency from '@nocobase/app-plugin-concurrency/server';
 import foundation from '@nocobase/app-plugin-foundation/server';
 import defaultAccess from '@nocobase/app-plugin-authz-default-access/server';
 import sharingRules from '@nocobase/app-plugin-authz-sharing-rules/server';
@@ -20,6 +21,7 @@ import file from '@nocobase/app-plugin-file/server';
 import mail from '@nocobase/app-plugin-mail/server';
 
 const serverPlugins: AppServerPlugins = defineServerPlugins([
+  concurrency,
   authentication,
   authorization,
   defaultAccess,

package/server/providers/index.ts

@@ -1,5 +1,8 @@
+import SubmissionProvider from './submission.js';
 import type { ApplicationServiceProviderConstructor } from '@nocobase/app-server/application';
 
-const serviceProviders: readonly ApplicationServiceProviderConstructor[] = [];
+const serviceProviders: readonly ApplicationServiceProviderConstructor[] = [
+  SubmissionProvider,
+];
 
 export default serviceProviders;

package/server/providers/submission.ts

@@ -0,0 +1,61 @@
+import type { Application } from '@nocobase/app-server/application';
+import {
+  authenticationToken,
+  type AuthEnv,
+} from '@nocobase/app-plugin-authentication';
+import {
+  repositoryIdempotencyToken,
+  pruneMutationReceipts,
+} from '@nocobase/app-server/router';
+import { jobExecutorServiceToken } from '@nocobase/app-server/jobs';
+import { databaseManagerToken } from '@nocobase/db';
+import { ServiceProvider } from '@nocobase/service-provider';
+import type { Context } from 'hono';
+import type { ScheduleExecutor } from '@nocobase/jobs';
+
+/** Standard data writes require an operation key; custom HTTP actions opt in explicitly. */
+export default class SubmissionProvider extends ServiceProvider<Application> {
+  readonly name = 'app/submission';
+  private cleanup?: ScheduleExecutor;
+  override register(): void {
+    this.app.container.singleton(repositoryIdempotencyToken, () => ({
+      required: true,
+      principal: async (context) => {
+        const auth =
+          (context as Context<AuthEnv>).get('auth') ??
+          (await this.app.container
+            .resolve(authenticationToken)
+            .getSession(context.req.raw.headers, {
+              disableRefresh: true,
+              disableCookieCache: true,
+            }));
+        return auth && !auth.credential
+          ? `${this.app.appName}:${auth.user.id}`
+          : undefined;
+      },
+    }));
+  }
+  override async boot(): Promise<void> {
+    if (
+      !this.app.container.has(databaseManagerToken) ||
+      !this.app.container.has(jobExecutorServiceToken)
+    )
+      return;
+    const database = this.app.container.resolve(databaseManagerToken);
+    this.cleanup = this.app.container
+      .resolve(jobExecutorServiceToken)
+      .getScheduleExecutor('app.mutation-receipts');
+    await this.cleanup.addJob({
+      name: 'prune',
+      options: { every: 60 * 60 * 1000 },
+      payload: {},
+      execute: async () => {
+        await pruneMutationReceipts(database.connection());
+      },
+    });
+    await this.cleanup.setup();
+  }
+  override async shutdown(): Promise<void> {
+    await this.cleanup?.shutdown();
+  }
+}

package/tests/client/auth-i18n.test.tsx

@@ -116,6 +116,15 @@ describe('authentication translations', () => {
   it('retranslates an existing password mismatch', async () => {
     const value = await runtime();
     const { container } = renderPage(value, <RegisterPage />);
+    for (const [label, text] of [
+      ['Name', 'Test'],
+      ['Username', 'tester'],
+      ['Email', 'tester@example.test'],
+    ]) {
+      fireEvent.change(screen.getByLabelText(label!), {
+        target: { value: text },
+      });
+    }
     fireEvent.change(screen.getByLabelText('Password'), {
       target: { value: 'one' },
     });

package/tests/client/back-button.test.tsx

@@ -46,15 +46,15 @@ function renderAt(url: string, child: ReactElement) {
 }
 
 describe('BackButton', () => {
-  it('leads to the parent route and keeps the query string', async () => {
+  it('uses the default parent list when no source visit exists', async () => {
     const router = renderAt('/projects/12?q=alpha&page=2', <BackButton />);
 
     const link = screen.getByRole('link', { name: enUS.navigation.back });
-    expect(link).toHaveAttribute('href', '/projects?q=alpha&page=2');
+    expect(link).toHaveAttribute('href', '/projects');
 
     await userEvent.click(link);
     expect(router.state.location.pathname).toBe('/projects');
-    expect(router.state.location.search).toBe('?q=alpha&page=2');
+    expect(router.state.location.search).toBe('');
     // Leaving the child page replaces its entry, as closing an overlay does.
     expect(router.state.historyAction).toBe('REPLACE');
   });

package/tests/client/data-table.test.tsx

@@ -114,14 +114,19 @@ describe('standard DataTable', () => {
     expect(screen.getByText('Page 4 of 6')).toBeVisible();
     expect(screen.getByText('row-0')).toBeVisible();
   });
-  it('keeps empty-state and paging controls localized in Chinese', async () => {
+  it('localizes successful emptiness and keeps the table headers without paging controls', async () => {
     await renderWithApp(
       <DataTable columns={columns} data={[]} showSelectedCount={false} />,
       { namespace, namespaces, locale: 'zh-CN' },
     );
-    expect(screen.getByText(zhCN.dataTable.noResults)).toBeVisible();
+    expect(screen.getByText(zhCN.listFeedback.empty)).toBeVisible();
+    expect(screen.getByRole('table')).toBeVisible();
+    expect(screen.getByRole('columnheader', { name: 'ID' })).toBeVisible();
     expect(
-      screen.getByRole('button', { name: zhCN.dataTable.nextPage }),
-    ).toBeDisabled();
+      screen.queryByText(zhCN.dataTable.noResults),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole('button', { name: zhCN.dataTable.nextPage }),
+    ).not.toBeInTheDocument();
   });
 });

package/tests/client/default-access.test.tsx

@@ -1,4 +1,5 @@
-import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import { renderSettingsClient as renderWithApp } from '../helpers/settings-client.js';
+import { answerApi } from '@nocobase/app-testing/client';
 import { apiClientToken, type ClientApplication } from '@nocobase/app-client';
 import {
   AuthorizationClient,
@@ -207,7 +208,7 @@ it('supports read-only inspection and does not show write or delete actions with
 });
 it('shows unknown rules read-only and refuses overwriting a rule changed after loading', async () => {
   const user = userEvent.setup();
-  let count = 0;
+  let changed = false;
   let writes = 0;
   await renderWithApp(tree(), {
     route: '/default-access/project-default/edit',
@@ -219,14 +220,14 @@ it('shows unknown rules read-only and refuses overwriting a rule changed after l
         return { data: { unrestricted: true, permissions: [] } };
       if (path.endsWith('/options')) return { data: catalog };
       if (method === 'PATCH') writes++;
-      count++;
-      return { data: [count > 2 ? { ...existing, actions: [] } : existing] };
+      return { data: [changed ? { ...existing, actions: [] } : existing] };
     }),
   });
   await user.click(
     await screen.findByRole('combobox', { name: 'Edit · Projects' }),
   );
   await user.click(await screen.findByRole('option', { name: 'All records' }));
+  changed = true;
   await user.click(screen.getByRole('button', { name: 'Save' }));
   expect(
     await screen.findByText(enUS.settings.defaultAccess.changed),
@@ -342,7 +343,7 @@ it('keeps failed deletion in its confirmation and deletes only after explicit co
   expect(screen.getByRole('alertdialog')).toBeVisible();
   expect(screen.queryByText('Private server detail')).not.toBeInTheDocument();
   await user.click(screen.getByRole('button', { name: 'Delete', exact: true }));
-  await screen.findByText(enUS.settings.defaultAccess.empty);
+  await screen.findByText(enUS.listFeedback.empty);
   expect(deletes).toBe(2);
 });
 it('retains the create draft when the server rejects a duplicate and shows a contextual error', async () => {
@@ -484,6 +485,46 @@ it('refuses deleting a changed rule and refreshes the list for explicit re-confi
   expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument();
 });
 
+it('keeps one authorized create entry in the header for an empty list', async () => {
+  await renderWithApp(tree(), {
+    route: '/default-access',
+    namespace,
+    namespaces,
+    services,
+    fetch: answerApi(({ path }) =>
+      path === 'authorization/permissions'
+        ? { data: { unrestricted: true, permissions: [] } }
+        : path.endsWith('/options')
+          ? { data: catalog }
+          : { data: [] },
+    ),
+  });
+  const label = enUS.settings.defaultAccess.new;
+  const create = await screen.findByRole('button', { name: label });
+  expect(create).toHaveAttribute('href', '/default-access/create');
+  expect(screen.getAllByRole('button', { name: label })).toHaveLength(1);
+});
+
+it('hides the create entry for a read-only empty list', async () => {
+  await renderWithApp(tree(), {
+    route: '/default-access',
+    namespace,
+    namespaces,
+    services,
+    fetch: answerApi(({ path }) =>
+      path === 'authorization/permissions'
+        ? { data: { unrestricted: false, permissions: [] } }
+        : path.endsWith('/options')
+          ? { data: catalog }
+          : { data: [] },
+    ),
+  });
+  const label = enUS.settings.defaultAccess.new;
+  expect(await screen.findByText(enUS.listFeedback.empty)).toBeVisible();
+  expect(screen.queryByRole('link', { name: label })).not.toBeInTheDocument();
+  expect(screen.queryByRole('button', { name: label })).not.toBeInTheDocument();
+});
+
 it('disables New rule with a reason when every available resource is already configured', async () => {
   await renderWithApp(tree(), {
     route: '/default-access',
@@ -691,3 +732,56 @@ it('replaces the saved editor history entry and keeps the list query when going
   ).not.toBeInTheDocument();
   expect(patches).toBe(1);
 });
+
+it.each(['transport', 'server'])(
+  'verifies an uncertain %s delete without replaying the mutation',
+  async (failure) => {
+    let deleted = false;
+    let writes = 0;
+    await renderWithApp(tree(), {
+      route: '/default-access',
+      namespace,
+      namespaces,
+      services,
+      fetch: answerApi(({ path, method }) => {
+        if (path === 'authorization/permissions')
+          return { data: { unrestricted: true, permissions: [] } };
+        if (path.endsWith('/options')) return { data: catalog };
+        if (method === 'DELETE') {
+          deleted = true;
+          writes++;
+          if (failure === 'transport') throw new TypeError('Response lost');
+          return Response.json(
+            {
+              error: {
+                code: 'INTERNAL_SERVER_ERROR',
+                message: 'Response lost',
+              },
+            },
+            { status: 500 },
+          );
+        }
+        return { data: deleted ? [] : [existing] };
+      }),
+    });
+    await userEvent.click(
+      await screen.findByRole('button', { name: 'Actions for Projects' }),
+    );
+    await userEvent.click(
+      await screen.findByRole('menuitem', { name: 'Delete' }),
+    );
+    await userEvent.click(
+      screen.getByRole('button', { name: 'Delete', exact: true }),
+    );
+    expect(await screen.findByText(enUS.listFeedback.empty)).toBeVisible();
+    expect(screen.getByRole('alertdialog')).toBeVisible();
+    expect(screen.getByText(enUS.settings.failed)).toBeVisible();
+    await userEvent.click(
+      screen.getByRole('button', { name: 'Cancel', exact: true }),
+    );
+    await waitFor(() =>
+      expect(screen.getByText(enUS.listFeedback.empty)).toBeVisible(),
+    );
+    expect(writes).toBe(1);
+  },
+);