@nocobase/cli 2.3.0-beta.8 → 2.3.0-beta.9

package/assets/env-proxy/nginx/snippets/maps-http.conf

@@ -12,3 +12,8 @@ map $http_host $final_host {
     default $http_host;
     ""      $host;
 }
+
+map $request_uri $legacy_file_app {
+    default "";
+    ~[?&]__appName=(?<legacy_file_app_name>[A-Za-z0-9_-]+)(?:&|$) $legacy_file_app_name;
+}

package/assets/env-proxy/nginx/snippets/uploads-location.conf

@@ -1,4 +1,8 @@
-add_header Cache-Control "public" always;
+auth_request /_nocobase_legacy_file_auth;
+auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+
+add_header Cache-Control "private, no-store" always;
+add_header Set-Cookie $legacy_auth_set_cookie always;
 add_header Content-Security-Policy "sandbox" always;
 add_header X-Content-Type-Options "nosniff" always;
 
@@ -7,7 +11,8 @@ autoindex off;
 
 # Force potentially renderable uploaded files to download.
 location ~* \.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$ {
-    add_header Cache-Control "public" always;
+    add_header Cache-Control "private, no-store" always;
+    add_header Set-Cookie $legacy_auth_set_cookie always;
     add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "attachment" always;
@@ -17,7 +22,8 @@ location ~* \.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$ {
 location ~* \.md$ {
     default_type text/markdown;
 
-    add_header Cache-Control "public" always;
+    add_header Cache-Control "private, no-store" always;
+    add_header Set-Cookie $legacy_auth_set_cookie always;
     add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "inline" always;

package/dist/lib/env-proxy.js

@@ -510,6 +510,19 @@ function buildNginxManagedConfigBlock(context) {
         `    include ${context.snippetsDir}/mime-types.conf;`,
         `    include ${context.snippetsDir}/gzip.conf;`,
         '',
+        '    location = /_nocobase_legacy_file_auth {',
+        '        internal;',
+        `        proxy_pass ${context.backendUrl}${context.apiBasePath}auth:checkLegacyFileAccess;`,
+        '        proxy_pass_request_body off;',
+        '        proxy_set_header Content-Length "";',
+        '        proxy_set_header Cookie $http_cookie;',
+        '        proxy_set_header Authorization $http_authorization;',
+        '        proxy_set_header X-App $legacy_file_app;',
+        '        proxy_set_header X-Original-URI $request_uri;',
+        '        proxy_set_header Host $final_host;',
+        '        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;',
+        '    }',
+        '',
         `    location ${context.appPublicPath}storage/uploads/ {`,
         `        alias ${context.uploadsDir}/;`,
         `        include ${context.snippetsDir}/uploads-location.conf;`,
@@ -1010,10 +1023,26 @@ function renderNginxLocationTemplate(context) {
     const proxyPassBlock = buildNginxProxyPassBlock(context.proxyHost, context.apiPort);
     const wsProxyPassTarget = `http://${context.proxyHost}:${context.apiPort}${context.wsPath}`;
     const apiBasePathNoTrailingSlash = trimTrailingSlash(context.apiBasePath);
-    return `    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.md)$ {
+    return `    location = /_nocobase_legacy_file_auth {
+        internal;
+        proxy_pass http://${context.proxyHost}:${context.apiPort}${context.apiBasePath}auth:checkLegacyFileAccess;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
+        proxy_set_header Authorization $http_authorization;
+        proxy_set_header X-App $legacy_file_app;
+        proxy_set_header X-Original-URI $request_uri;
+        proxy_set_header Host $final_host;
+        proxy_set_header X-Forwarded-Proto $upstream_x_forwarded_proto;
+    }
+
+    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.md)$ {
         alias ${context.uploadsPath}/$1;
         default_type text/markdown;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
         add_header Content-Disposition "inline";
         add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
@@ -1023,7 +1052,10 @@ function renderNginxLocationTemplate(context) {
 
     location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt))$ {
         alias ${context.uploadsPath}/$1;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
         add_header Content-Disposition "attachment" always;
         add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
@@ -1033,7 +1065,10 @@ function renderNginxLocationTemplate(context) {
 
     location ${context.appPublicPath}storage/uploads/ {
         alias ${context.uploadsPath}/;
-        add_header Cache-Control "public";
+        auth_request /_nocobase_legacy_file_auth;
+        auth_request_set $legacy_auth_set_cookie $upstream_http_set_cookie;
+        add_header Cache-Control "private, no-store" always;
+        add_header Set-Cookie $legacy_auth_set_cookie always;
         add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
@@ -1083,7 +1118,12 @@ function renderNginxLocationTemplate(context) {
 `;
 }
 function renderLegacyEnvProxyAppTemplate(context) {
-    return `server {
+    return `map $request_uri $legacy_file_app {
+    default "";
+    ~[?&]__appName=(?<legacy_file_app_name>[A-Za-z0-9_-]+)(?:&|$) $legacy_file_app_name;
+}
+
+server {
     listen 80;
     server_name _;
     client_max_body_size 0;
@@ -1155,15 +1195,32 @@ function renderCaddyAppTemplate(siteAddress, context, publicDir) {
         `${siteAddress} {`,
         `    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}`,
         '',
-        '    @activeUploadedContent path_regexp activeUploadedContent (?i)\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$',
-        '',
         `    handle_path ${uploadsPathMatcher} {`,
-        `        root * ${context.uploadsPath}`,
-        '        header Cache-Control public',
-        '        header Content-Security-Policy sandbox',
-        '        header X-Content-Type-Options nosniff',
-        '        header @activeUploadedContent Content-Disposition attachment',
-        '        file_server',
+        '        route {',
+        '            request_header -X-NocoBase-Auth-Set-Cookie',
+        `            forward_auth ${context.proxyHost}:${context.apiPort} {`,
+        `                uri ${context.apiBasePath}auth:checkLegacyFileAccess`,
+        '                header_up X-App {query.__appName}',
+        '                copy_headers Set-Cookie>X-NocoBase-Auth-Set-Cookie',
+        '            }',
+        '',
+        '            @refreshedAuth header X-NocoBase-Auth-Set-Cookie *',
+        '            header @refreshedAuth Set-Cookie {header.X-NocoBase-Auth-Set-Cookie}',
+        '            header Cache-Control "private, no-store"',
+        '            header Content-Security-Policy sandbox',
+        '            header X-Content-Type-Options nosniff',
+        '            header Content-Disposition inline',
+        '',
+        '            @activeUploadedContent path_regexp activeUploadedContent (?i)\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$',
+        '            header @activeUploadedContent Content-Disposition attachment',
+        '            @download query download=1',
+        '            header @download Content-Disposition attachment',
+        '            @markdown path_regexp markdown (?i)\\.md$',
+        '            header @markdown Content-Type text/markdown',
+        '',
+        `            root * ${context.uploadsPath}`,
+        '            file_server',
+        '        }',
         '    }',
         '',
         `    handle_path ${distPathMatcher} {`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.3.0-beta.8",
+  "version": "2.3.0-beta.9",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",
@@ -144,5 +144,5 @@
     "type": "git",
     "url": "git+https://github.com/nocobase/nocobase.git"
   },
-  "gitHead": "5d458884528593b2d3142a6a33de93bf0ad96543"
+  "gitHead": "c215e60ed704afe6c086bd96304f4b0d3b46d02e"
 }