@nocobase/client-v2 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/nocobase-buildin-plugin/index.tsx

@@ -15,7 +15,12 @@ import type { Application } from '../Application';
 import { getCurrentV2RedirectPath, getDefaultV2AdminRedirectPath } from '../authRedirect';
 import { AppNotFound } from '../components';
 import { PluginFlowEngine } from '../flow';
-import { ADMIN_LAYOUT_MODEL_UID, AdminLayoutMenuItemModel, AdminLayoutModel } from '../flow/admin-shell/admin-layout';
+import {
+  ADMIN_LAYOUT_MODEL_UID,
+  AdminLayoutMenuItemModel,
+  AdminLayoutModel,
+  AppSwitcherActionPanelModel,
+} from '../flow/admin-shell/admin-layout';
 import { useApp } from '../hooks/useApp';
 import { Plugin } from '../Plugin';
 import { AdminSettingsLayoutModel } from '../settings-center';
@@ -28,6 +33,13 @@ export type CurrentUserState = {
   loading: boolean;
 };
 
+type CurrentUserAuthStatus = 'unknown' | 'authenticated' | 'unauthenticated' | 'redirecting';
+
+type CurrentUserInternalState = CurrentUserState & {
+  authStatus: CurrentUserAuthStatus;
+  error?: Error | null;
+};
+
 export type CurrentRoleOption = {
   name: string;
   title: string;
@@ -151,7 +163,7 @@ const DataSourceBootstrapProvider: FC = ({ children }) => {
       }
     };
 
-    void run();
+    run();
 
     return () => {
       mounted = false;
@@ -173,21 +185,33 @@ const CurrentUserProvider: FC = ({ children }) => {
   const app = useApp<Application>();
   const location = useLocation();
   const navigate = useNavigate();
-  const [state, setState] = useState<CurrentUserState>({ loading: true });
+  const [state, setState] = useState<CurrentUserInternalState>({ loading: true, authStatus: 'unknown' });
   const locationRef = useRef(location);
   locationRef.current = location;
   const authCheckRouteState = getCurrentUserAuthCheckRouteState(app, location.pathname);
+  const shouldBlockAuthRequiredRoute = authCheckRouteState === 'required' && state.authStatus !== 'authenticated';
+  const contextValue = useMemo<CurrentUserState>(
+    () => ({
+      data: state.data,
+      loading: state.loading,
+    }),
+    [state.data, state.loading],
+  );
 
   useEffect(() => {
     let mounted = true;
 
     if (authCheckRouteState !== 'required') {
       // 认证页等免鉴权路由不应再执行 `/auth:check`，否则未登录时会重复鉴权并触发重定向抖动。
-      setState({ loading: false });
+      setState({ loading: false, authStatus: 'unauthenticated', error: null });
       return;
     }
 
-    setState((previous) => (previous.loading ? previous : { ...previous, loading: true }));
+    setState((previous) =>
+      previous.authStatus === 'authenticated'
+        ? previous
+        : { data: previous.data, loading: true, authStatus: 'unknown', error: null },
+    );
 
     const run = async () => {
       try {
@@ -204,17 +228,28 @@ const CurrentUserProvider: FC = ({ children }) => {
         const user = res?.data?.data;
         // 服务端通过 `{ code: 302, redirect }` 通知客户端先去某个中间页(例如 2FA 验证页)。这类响应没有 user.id,但也不能视为未登录——否则会和处理 302 的全局响应拦截器 (例如 plugin-two-factor-authentication 注册的那一个)竞态,而 `window.location.replace` 会覆盖更早发出的 `window.location.href`,把用户错误地弹回登录页。让响应拦截器接管跳转。
         if (user?.code === 302) {
-          setState({ loading: false });
+          setState({ loading: false, authStatus: 'redirecting', error: null });
           return;
         }
         if (user?.id == null) {
           // 用 react-router navigate (虚拟跳转)而不是 location.replace, 这样如果有其他响应拦截器已经发起了 window.location.href 整页跳转(例如 2FA 插件接收到服务端 302 重定向), 真实跳转可以胜出 navigate, 不会被这里的 signin 重定向覆盖。
+          setState({ loading: true, authStatus: 'unauthenticated', error: null });
           navigate(`/signin?redirect=${encodeURIComponent(getCurrentV2RedirectPath(app, locationRef.current))}`, {
             replace: true,
           });
           return;
         }
 
+        try {
+          await app.apiClient.auth.syncCookies();
+        } catch {
+          // Cookie bootstrap is best-effort; auth:check remains the source of truth for the current page load.
+        }
+
+        if (!mounted) {
+          return;
+        }
+
         const userMeta = createCollectionContextMeta(
           () => app.flowEngine.context.dataSourceManager?.getDataSource('main')?.getCollection('users') || null,
           app.flowEngine.translate('Current user'),
@@ -230,21 +265,28 @@ const CurrentUserProvider: FC = ({ children }) => {
         setState({
           data: res?.data,
           loading: false,
+          authStatus: 'authenticated',
+          error: null,
         });
-      } catch (error: any) {
+      } catch (error: unknown) {
         if (!mounted) {
           return;
         }
 
-        const isAuthError = error?.response?.status === 401 || error?.status === 401;
+        const errorLike = error as { response?: { status?: number }; status?: number };
+        const isAuthError = errorLike?.response?.status === 401 || errorLike?.status === 401;
         if (isAuthError) {
+          setState({ loading: true, authStatus: 'unauthenticated', error: null });
           navigate(`/signin?redirect=${encodeURIComponent(getCurrentV2RedirectPath(app, locationRef.current))}`, {
             replace: true,
           });
           return;
         }
-        setState({ loading: false });
-        throw error;
+        setState({
+          loading: false,
+          authStatus: 'unknown',
+          error: error instanceof Error ? error : new Error(String(error)),
+        });
       }
     };
 
@@ -255,13 +297,19 @@ const CurrentUserProvider: FC = ({ children }) => {
     };
   }, [app, authCheckRouteState, navigate]);
 
-  if (state.loading) {
+  if (state.error) {
+    throw state.error;
+  }
+
+  if (state.loading || shouldBlockAuthRequiredRoute) {
     return app.renderComponent('AppSpin');
   }
 
-  return <CurrentUserContext.Provider value={state}>{children}</CurrentUserContext.Provider>;
+  return <CurrentUserContext.Provider value={contextValue}>{children}</CurrentUserContext.Provider>;
 };
 
+CurrentUserProvider.displayName = 'CurrentUserProvider';
+
 const RootRedirect: FC = () => {
   const app = useApp<Application>();
   const hasToken = !!app?.apiClient?.auth?.token;
@@ -289,11 +337,13 @@ export class NocoBaseBuildInPlugin extends Plugin<any, Application> {
     this.addComponents();
     this.addRoutes();
 
-    this.app.use(DataSourceBootstrapProvider);
+    // Auth-required routes must finish auth check or redirect before data source metadata requests can start.
     this.app.use(CurrentUserProvider);
+    this.app.use(DataSourceBootstrapProvider);
     this.app.flowEngine.registerModels({
       AdminLayoutModel,
       AdminLayoutMenuItemModel,
+      AppSwitcherActionPanelModel,
       AdminSettingsLayoutModel,
     });
     this.app.layoutManager.registerLayout({
@@ -323,7 +373,6 @@ export class NocoBaseBuildInPlugin extends Plugin<any, Application> {
       title: this.app.i18n.t('System settings'),
       icon: 'SettingOutlined',
       aclSnippet: 'pm.system-settings.system-settings',
-      sort: -100,
     });
     this.app.pluginSettingsManager.addPageTabItem({
       menuKey: 'system-settings',
@@ -331,7 +380,6 @@ export class NocoBaseBuildInPlugin extends Plugin<any, Application> {
       title: this.app.i18n.t('System settings'),
       componentLoader: () => import('../settings-center/SystemSettingsPage'),
       aclSnippet: 'pm.system-settings.system-settings',
-      sort: -100,
     });
     // Parent menu for security-related plugin settings (password policy, locked users, etc.). Registered here in the buildin plugin so any pro plugin can attach page tabs to `menuKey: 'security'` without each one re-registering the same parent.
     this.app.pluginSettingsManager.addMenuItem({

package/src/settings-center/AdminSettingsLayout.tsx

@@ -209,6 +209,9 @@ export const InternalAdminSettingsLayout = () => {
         style={{
           background: token.colorBgContainer,
           borderInlineEnd: `${token.lineWidth}px solid ${token.colorBorderSecondary}`,
+          minHeight: 0,
+          overflowY: 'auto',
+          overflowX: 'hidden',
         }}
       >
         <Menu
@@ -239,11 +242,12 @@ export const InternalAdminSettingsLayout = () => {
       <Layout.Content
         style={{
           background: token.colorBgLayout,
+          flex: 1,
           display: 'flex',
           flexDirection: 'column',
           minWidth: 0,
-          overflowY: 'auto',
-          overflowX: 'hidden',
+          minHeight: 0,
+          overflow: 'hidden',
         }}
       >
         <PageHeader
@@ -273,6 +277,10 @@ export const InternalAdminSettingsLayout = () => {
         />
         <div
           style={{
+            flex: 1,
+            minHeight: 0,
+            boxSizing: 'border-box',
+            overflow: 'auto',
             padding: token.paddingLG,
           }}
         >

package/src/settings-center/SystemSettingsPage.tsx

@@ -221,7 +221,6 @@ export const SystemSettingsPage = () => {
   return (
     <div
       style={{
-        minHeight: '100%',
         background: token.colorBgContainer,
         borderRadius: token.borderRadiusLG,
         padding: token.paddingLG,
@@ -240,7 +239,7 @@ export const SystemSettingsPage = () => {
         <Form.Item
           name="raw_title"
           label={t('System title')}
-          rules={[{ required: true, message: t('Please enter') + t('System title') }]}
+          rules={[{ required: true, message: t('Please enter') + ' ' + t('System title') }]}
         >
           <Input.TextArea autoSize={{ minRows: 2, maxRows: 4 }} />
         </Form.Item>

package/src/settings-center/plugin-manager/PluginCard.tsx

@@ -116,7 +116,7 @@ export const PluginCard: FC<PluginCardProps> = ({ data }) => {
   });
 
   const openSettings = useMemoizedFn(() => {
-    navigate(app.pluginSettingsManager.getRoutePath(name));
+    navigate(app.pluginSettingsManager.getPluginSettingsRoutePath(name));
   });
 
   const cardClassName = useMemo(
@@ -180,7 +180,7 @@ export const PluginCard: FC<PluginCardProps> = ({ data }) => {
           <ReadOutlined /> {t('Docs')}
         </a>
       )}
-      {enabled && app.pluginSettingsManager.has(name) && (
+      {enabled && app.pluginSettingsManager.hasPluginSettings(name) && (
         <a
           onClick={(e) => {
             e.stopPropagation();

package/src/settings-center/plugin-manager/index.tsx

@@ -86,6 +86,9 @@ export const PluginManagerPage: React.FC = () => {
     async () => {
       const response = await app.apiClient.request({
         url: 'pm:list',
+        params: {
+          v2: true,
+        },
         skipNotify: true,
       });
       return Array.isArray(response?.data?.data) ? response.data.data : [];

package/src/settings-center/utils.tsx

@@ -85,12 +85,6 @@ export function filterVisibleSettings(settings: readonly PluginSettingsPageType[
  */
 export function sortTopLevelSettings(settings: PluginSettingsPageType[] = []) {
   return [...settings].sort((a, b) => {
-    if (a.name === SYSTEM_SETTINGS_SETTING_NAME && b.name !== SYSTEM_SETTINGS_SETTING_NAME) {
-      return -1;
-    }
-    if (b.name === SYSTEM_SETTINGS_SETTING_NAME && a.name !== SYSTEM_SETTINGS_SETTING_NAME) {
-      return 1;
-    }
     if ((a.sort || 0) !== (b.sort || 0)) {
       return (a.sort || 0) - (b.sort || 0);
     }

package/src/utils/getRouteRuntimeVersion.ts

@@ -0,0 +1,185 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export type RouteRuntimeVersion = 'legacy' | 'modern';
+
+declare global {
+  interface Window {
+    __nocobase_modern_client_prefix__?: string;
+    __nocobase_public_path__?: string;
+  }
+}
+
+function hasModernClientPrefix() {
+  return (
+    typeof window !== 'undefined' &&
+    typeof window.__nocobase_modern_client_prefix__ === 'string' &&
+    window.__nocobase_modern_client_prefix__.trim().length > 0
+  );
+}
+
+function hasConfiguredPublicPath() {
+  return typeof window !== 'undefined' && typeof window.__nocobase_public_path__ === 'string';
+}
+
+/** Normalize any app/public-path-like input into a root-relative pathname:
+ *
+ * - `nocobase//v/` -> `/nocobase/v`
+ * - `/` -> `/`
+ */
+function normalizeRootRelativePath(value = '/') {
+  const normalized = `/${String(value || '/').trim() || '/'}`.replace(/\/{2,}/g, '/');
+  if (normalized !== '/' && normalized.endsWith('/')) {
+    return normalized.replace(/\/+$/g, '');
+  }
+  return normalized;
+}
+
+/** Public-path form always ends with `/`, so it can be compared as a base path:
+ *
+ * - `/nocobase/v` -> `/nocobase/v/`
+ * - `/` -> `/`
+ */
+function normalizePublicPath(value = '/') {
+  const normalized = normalizeRootRelativePath(value);
+  return normalized.endsWith('/') ? normalized : `${normalized}/`;
+}
+
+/** Check whether a concrete pathname is rendered under a runtime base path:
+ *
+ * - pathname `/nocobase/v/admin/workflow/workflows/1`
+ *   basePath `/nocobase/v/`
+ *   => true
+ *
+ * - pathname `/nocobase/admin/settings/workflow/workflows/1`
+ *   basePath `/nocobase/v/`
+ *   => false
+ */
+function isPathnameInsideBasePath(pathname: string, basePath: string) {
+  const normalizedPathname = normalizeRootRelativePath(pathname);
+  const normalizedBasePath = normalizePublicPath(basePath);
+  const trimmedBasePath = normalizedBasePath.replace(/\/+$/g, '') || '/';
+
+  if (trimmedBasePath === '/') {
+    return true;
+  }
+
+  return normalizedPathname === trimmedBasePath || normalizedPathname.startsWith(`${trimmedBasePath}/`);
+}
+
+function getNormalizedModernClientPrefix() {
+  if (typeof window === 'undefined') {
+    return '';
+  }
+
+  const prefix = window.__nocobase_modern_client_prefix__?.trim();
+  return prefix ? prefix.replace(/^\/+|\/+$/g, '') : '';
+}
+
+/** Derive the actual modern-client base path from injected globals.
+ *
+ * Only returns a value when `__nocobase_public_path__` itself already points to
+ * the modern client shell:
+ *
+ * - legacy shell:
+ *   `__nocobase_public_path__ = "/nocobase/"`
+ *   `__nocobase_modern_client_prefix__ = "v"`
+ *   => `""`
+ *
+ * - modern shell:
+ *   `__nocobase_public_path__ = "/nocobase/v/"`
+ *   `__nocobase_modern_client_prefix__ = "v"`
+ *   => `"/nocobase/v/"`
+ */
+function getModernClientBasePath() {
+  const normalizedPrefix = getNormalizedModernClientPrefix();
+  if (!normalizedPrefix) {
+    return '';
+  }
+
+  if (typeof window === 'undefined') {
+    return '';
+  }
+
+  const publicPath = window.__nocobase_public_path__?.trim();
+  if (publicPath && normalizePublicPath(publicPath).endsWith(`/${normalizedPrefix}/`)) {
+    return normalizePublicPath(publicPath);
+  }
+
+  return '';
+}
+
+/** True only when the current page is actually running under the resolved
+ * modern-client base path.
+ *
+ * Example:
+ * - pathname `/v/admin/workflow/workflows/1`, modern base `/v/` => true
+ * - pathname `/admin/settings/workflow/workflows/1`, modern base `/v/` => false
+ */
+function isPathnameInModernClientRuntime() {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+
+  const pathname = window.location?.pathname ?? '';
+  const modernClientBasePath = getModernClientBasePath();
+  if (!pathname || !modernClientBasePath) {
+    return false;
+  }
+
+  return isPathnameInsideBasePath(pathname, modernClientBasePath);
+}
+
+/** Fallback for incomplete/mocked environments where public path was not
+ * injected but the modern prefix still exists.
+ *
+ * Example:
+ * - pathname `/v/admin/workflow/workflows/1`
+ *   `__nocobase_modern_client_prefix__ = "v"`
+ *   `__nocobase_public_path__` missing
+ *   => true
+ */
+function isPathnameInModernClientRuntimeByPrefix() {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+
+  const normalizedPrefix = getNormalizedModernClientPrefix();
+  const pathname = window.location?.pathname ?? '';
+  if (!normalizedPrefix || !pathname) {
+    return false;
+  }
+
+  return isPathnameInsideBasePath(pathname, normalizePublicPath(normalizedPrefix));
+}
+
+/** Resolve which client shell currently owns the route.
+ *
+ * - returns `modern` when the current page is actually mounted under the modern
+ *   client base path (`/v/`, `/nocobase/v/`, ...)
+ * - returns `legacy` when the route is still under the legacy shell, even if the
+ *   modern prefix global has been injected into the page
+ */
+export function getRouteRuntimeVersion(): RouteRuntimeVersion {
+  if (typeof window === 'undefined') {
+    return hasModernClientPrefix() ? 'modern' : 'legacy';
+  }
+
+  if (hasConfiguredPublicPath()) {
+    return isPathnameInModernClientRuntime() ? 'modern' : 'legacy';
+  }
+
+  // Defensive fallback for incomplete test/mocked environments where public
+  // path was not injected but the modern prefix still exists.
+  if (isPathnameInModernClientRuntimeByPrefix()) {
+    return 'modern';
+  }
+
+  return 'legacy';
+}

package/src/utils/index.tsx

@@ -11,6 +11,7 @@ import React, { ComponentType, FC } from 'react';
 import { BlankComponent } from '../components';
 
 export * from './appVersionHTML';
+export * from './getRouteRuntimeVersion';
 
 export function normalizeContainer(container: Element | ShadowRoot | string): Element | null {
   if (!container) {

package/src/utils/markdownSanitize.ts

@@ -0,0 +1,88 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+export function stripMarkdownIframeTags(markdown: string) {
+  if (!markdown) {
+    return markdown;
+  }
+
+  let result = '';
+  let cursor = 0;
+
+  while (cursor < markdown.length) {
+    const iframeStart = markdown.slice(cursor).search(/<iframe\b/i);
+    if (iframeStart === -1) {
+      result += markdown.slice(cursor);
+      break;
+    }
+
+    const start = cursor + iframeStart;
+    result += markdown.slice(cursor, start);
+
+    const openingEnd = findTagEnd(markdown, start);
+    if (openingEnd === -1) {
+      break;
+    }
+
+    const openingTag = markdown.slice(start, openingEnd + 1);
+    if (/\/\s*>$/.test(openingTag)) {
+      cursor = openingEnd + 1;
+      continue;
+    }
+
+    const closingStart = markdown.slice(openingEnd + 1).search(/<\/iframe\s*>/i);
+    if (closingStart === -1) {
+      break;
+    }
+
+    cursor =
+      openingEnd + 1 + closingStart + markdown.slice(openingEnd + 1 + closingStart).match(/^<\/iframe\s*>/i)[0].length;
+  }
+
+  return result;
+}
+
+export function stripMarkdownIframes(html: string) {
+  if (!html || typeof DOMParser === 'undefined') {
+    return html;
+  }
+
+  const doc = new DOMParser().parseFromString(html, 'text/html');
+  doc.querySelectorAll('iframe').forEach((iframe) => iframe.remove());
+  return doc.body.innerHTML;
+}
+
+export function removeMarkdownIframes(container?: ParentNode | null) {
+  container?.querySelectorAll('iframe').forEach((iframe) => iframe.remove());
+}
+
+function findTagEnd(html: string, start: number) {
+  let quote: string | undefined;
+
+  for (let index = start; index < html.length; index += 1) {
+    const char = html[index];
+    if (quote) {
+      if (char === quote) {
+        quote = undefined;
+      }
+      continue;
+    }
+
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+
+    if (char === '>') {
+      return index;
+    }
+  }
+
+  return -1;
+}