@nocobase/client-v2 2.2.0-alpha.7 → 2.2.0-alpha.9

package/lib/locale/languageCodes.js

@@ -83,7 +83,8 @@ const languageCodes = {
   "tk-TK": { label: "Turkmen" },
   "tr-TR": { label: "T\xFCrk\xE7e" },
   "uk-UA": { label: "\u0423\u043A\u0440\u0430\u0457\u043D\u0441\u044C\u043A\u0430" },
-  "ur-PK": { label: "O\u02BBzbekcha" },
+  "ur-PK": { label: "\u0627\u0631\u062F\u0648" },
+  "uz-UZ": { label: "O\u02BBzbekcha" },
   "vi-VN": { label: "Ti\u1EBFng Vi\u1EC7t" },
   "zh-CN": { label: "\u7B80\u4F53\u4E2D\u6587" },
   "zh-HK": { label: "\u7E41\u9AD4\u4E2D\u6587\uFF08\u9999\u6E2F\uFF09" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/client-v2",
-  "version": "2.2.0-alpha.7",
+  "version": "2.2.0-alpha.9",
   "license": "Apache-2.0",
   "main": "lib/index.js",
   "module": "es/index.mjs",
@@ -27,11 +27,11 @@
     "@formily/antd-v5": "1.2.3",
     "@formily/react": "^2.2.27",
     "@formily/shared": "^2.2.27",
-    "@nocobase/evaluators": "2.2.0-alpha.7",
-    "@nocobase/flow-engine": "2.2.0-alpha.7",
-    "@nocobase/sdk": "2.2.0-alpha.7",
-    "@nocobase/shared": "2.2.0-alpha.7",
-    "@nocobase/utils": "2.2.0-alpha.7",
+    "@nocobase/evaluators": "2.2.0-alpha.9",
+    "@nocobase/flow-engine": "2.2.0-alpha.9",
+    "@nocobase/sdk": "2.2.0-alpha.9",
+    "@nocobase/shared": "2.2.0-alpha.9",
+    "@nocobase/utils": "2.2.0-alpha.9",
     "ahooks": "^3.7.2",
     "antd": "5.24.2",
     "antd-style": "3.7.1",
@@ -47,5 +47,5 @@
     "react-i18next": "^11.15.1",
     "react-router-dom": "^6.30.1"
   },
-  "gitHead": "34ba02960fca9ab0b6881d3db7040a8a64067bba"
+  "gitHead": "4949bf5ebcd92d77a3a0a718ed578c270e4bd570"
 }

package/src/APIClient.ts

@@ -7,7 +7,7 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import { APIClient as APIClientSDK, type APIClientOptions, hasHeaderValue } from '@nocobase/sdk';
+import { APIClient as APIClientSDK, hasHeaderValue } from '@nocobase/sdk';
 
 function offsetToTimeZone(offset: number) {
   const hours = Math.floor(Math.abs(offset));
@@ -23,15 +23,6 @@ function getCurrentTimezone() {
 }
 
 export class APIClient extends APIClientSDK {
-  appName?: string;
-
-  constructor(options?: APIClientOptions) {
-    super(options);
-    if (options && typeof options !== 'function') {
-      this.appName = options.appName;
-    }
-  }
-
   getHostname() {
     if (process.env.API_BASE_URL) {
       try {

package/src/Application.tsx

@@ -46,6 +46,10 @@ export class Application extends BaseApplication<
 
   protected createApiClient(options: ApplicationOptions) {
     return new APIClient({
+      // Cross-origin API deployments rely on cookies for auth (e.g. permanent file
+      // URLs); trust is enforced server-side via the CORS origin whitelist and the
+      // CSRF middleware, not by omitting credentials.
+      withCredentials: true,
       ...options.apiClient,
       appName: options.name || getSubAppName(options.publicPath),
     });

package/src/BaseApplication.tsx

@@ -35,6 +35,7 @@ import { SystemSettingsSource } from './flow/system-settings';
 import { LayoutManager } from './layout-manager/LayoutManager';
 import type { PluginClass, PluginManager, PluginType } from './PluginManager';
 import { RouteRepository } from './RouteRepository';
+import { stripModernClientPrefix } from './authRedirect';
 import type {
   ComponentTypeAndString,
   RenderableComponentType,
@@ -402,7 +403,7 @@ export abstract class BaseApplication<
       this.favicon = favicon || '';
     }
 
-    const iconHref = this.favicon || '/favicon/favicon.ico';
+    const iconHref = this.favicon || this.getCdnUrl() + 'favicon/favicon.ico';
 
     if (faviconLinkElement) {
       faviconLinkElement.href = iconHref;
@@ -438,7 +439,7 @@ export abstract class BaseApplication<
   }
 
   getCdnUrl() {
-    return ensureTrailingSlash(window['__webpack_public_path__'] || this.getPublicPath());
+    return ensureTrailingSlash(window['__webpack_public_path__'] || stripModernClientPrefix(this.getPublicPath()));
   }
 
   getPublicPath() {

package/src/__tests__/app.test.tsx

@@ -35,6 +35,7 @@ describe('app', () => {
       document.querySelectorAll('link[rel="shortcut icon"]').forEach((node) => node.remove());
       document.documentElement.removeAttribute('lang');
       delete window['__webpack_public_path__'];
+      delete window['__nocobase_modern_client_prefix__'];
       vi.restoreAllMocks();
     });
 
@@ -51,6 +52,24 @@ describe('app', () => {
       expect(app.getHref('/test')).toBe('/test');
     });
 
+    it('should enable credentials for api clients by default', () => {
+      const sameOriginApp = new Application({
+        router,
+        apiClient: {
+          baseURL: '/api/',
+        },
+      });
+      const crossOriginApp = new Application({
+        router,
+        apiClient: {
+          baseURL: 'https://api.example.com/api/',
+        },
+      });
+
+      expect(sameOriginApp.apiClient.axios.defaults.withCredentials).toBe(true);
+      expect(crossOriginApp.apiClient.axios.defaults.withCredentials).toBe(true);
+    });
+
     it('should initialize shared jsonLogic operators', () => {
       const app = new Application({ router });
 
@@ -84,6 +103,34 @@ describe('app', () => {
       expect(app.getCdnUrl()).toBe('/cdn/assets/');
     });
 
+    it('should remove the modern client prefix from the CDN fallback path', () => {
+      const app = new Application({
+        router,
+        publicPath: '/v/',
+      });
+
+      expect(app.getCdnUrl()).toBe('/');
+    });
+
+    it('should preserve APP_PUBLIC_PATH when removing the modern client prefix', () => {
+      const app = new Application({
+        router,
+        publicPath: '/nocobase/v/',
+      });
+
+      expect(app.getCdnUrl()).toBe('/nocobase/');
+    });
+
+    it('should support a custom modern client prefix', () => {
+      window['__nocobase_modern_client_prefix__'] = 'modern';
+      const app = new Application({
+        router,
+        publicPath: '/nocobase/modern/',
+      });
+
+      expect(app.getCdnUrl()).toBe('/nocobase/');
+    });
+
     it('should apply the provided favicon immediately', () => {
       const app = new Application({ router });
 

package/src/__tests__/nocobase-buildin-plugin-auth.test.tsx

@@ -55,6 +55,7 @@ describe('nocobase buildin plugin auth redirect', () => {
   const originalLocation = globalThis.window.location;
 
   beforeEach(() => {
+    globalThis.window.localStorage.clear();
     // These fixtures mount the modern client under the `v2` segment; tell the
     // runtime-prefix helper so v2-runtime detection matches (server injects it
     // in production).
@@ -75,6 +76,7 @@ describe('nocobase buildin plugin auth redirect', () => {
   });
 
   afterEach(() => {
+    globalThis.window.localStorage.clear();
     delete (globalThis.window as any).__nocobase_modern_client_prefix__;
     Object.defineProperty(globalThis.window, 'location', {
       configurable: true,
@@ -116,6 +118,7 @@ describe('nocobase buildin plugin auth redirect', () => {
       plugins: [NocoBaseBuildInPlugin as any],
       router: { type: 'memory', initialEntries: ['/v2/admin'] },
     });
+    app.apiClient.auth.setToken('test-token');
     app.apiMock.onGet('app:getLang').reply(200, {
       data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
@@ -130,6 +133,7 @@ describe('nocobase buildin plugin auth redirect', () => {
     await new Promise((resolve) => setTimeout(resolve, 50));
     expect(app.router.router.state.location.pathname).toBe('/v2/admin');
     expect(app.router.router.state.location.search).toBe('');
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(0);
   });
 
   it('should redirect unauthenticated v2 root access to v2 signin via <Navigate />', async () => {
@@ -326,6 +330,29 @@ describe('nocobase buildin plugin auth redirect', () => {
       data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
     app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
+    app.apiMock.onPost('auth:syncCookies').reply(200, { data: { synced: true } });
+    const ensureLoaded = vi.spyOn(app.dataSourceManager, 'ensureLoaded').mockResolvedValue(undefined);
+
+    const Root = app.getRootComponent();
+    render(<Root />);
+
+    expect(await screen.findByText('secure page')).toBeInTheDocument();
+    expect(ensureLoaded).toHaveBeenCalledTimes(1);
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(1);
+  });
+
+  it('should keep authenticated v2 startup working when cookie bootstrap fails', async () => {
+    const app = createMockClient({
+      publicPath: '/v2/',
+      plugins: [NocoBaseBuildInPlugin as any, AuthBootstrapRoutePlugin as any],
+      router: { type: 'memory', initialEntries: ['/v2/secure'] },
+    });
+    app.apiClient.auth.setToken('test-token');
+    app.apiMock.onGet('app:getLang').reply(200, {
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
+    });
+    app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
+    app.apiMock.onPost('auth:syncCookies').reply(500, { errors: [{ message: 'cookie sync failed' }] });
     const ensureLoaded = vi.spyOn(app.dataSourceManager, 'ensureLoaded').mockResolvedValue(undefined);
 
     const Root = app.getRootComponent();
@@ -333,6 +360,7 @@ describe('nocobase buildin plugin auth redirect', () => {
 
     expect(await screen.findByText('secure page')).toBeInTheDocument();
     expect(ensureLoaded).toHaveBeenCalledTimes(1);
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(1);
   });
 
   it('should not auth-check or bootstrap authCheck false routes', async () => {

package/src/collection-manager/field-validation.ts

@@ -132,7 +132,7 @@ fieldValidationConfigureRegistry.registerMany([
   { key: 'uri', label: 'URI', hasValue: false, params: [], paramsType: 'object' },
   {
     key: 'multiple',
-    label: 'Multiple',
+    label: 'Multiple of',
     hasValue: true,
     params: [{ key: 'base', label: 'Base', componentType: 'inputNumber', required: true }],
   },

package/src/components/form/ScanInput/CodeScanner.tsx

@@ -49,6 +49,21 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     message.error(t('Code recognition failed, please scan again'));
   }, [t]);
 
+  const showCameraStartFailure = useCallback(
+    (error: unknown) => {
+      const errorName = error instanceof Error ? error.name : '';
+      const errorMessage = error instanceof Error ? error.message : '';
+      const errorMap: Record<string, string> = {
+        NotFoundError: t('No camera device detected'),
+        NotAllowedError: t('You have not granted permission to use the camera'),
+      };
+
+      message.error(errorMap[errorName] || errorMessage || t('You have not granted permission to use the camera'));
+      onClose();
+    },
+    [onClose, t],
+  );
+
   const handleScanSuccess = useCallback(
     (text: string) => {
       onScanSuccess(text);
@@ -64,6 +79,7 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     scanBoxSize,
     onScanSuccess: handleScanSuccess,
     onScanFailure: showScanFailure,
+    onCameraStartFailure: showCameraStartFailure,
   });
 
   useEffect(() => {
@@ -129,7 +145,7 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     inset: 0;
     z-index: ${token.zIndexPopupBase + 1000};
     overflow: hidden;
-    background: ${token.colorBgMask};
+    background: #000;
   `;
   const scannerWrapperClass = css`
     position: absolute;
@@ -137,16 +153,17 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     overflow: hidden;
   `;
   const scannerClass = css`
+    position: relative;
     width: 100%;
     height: 100%;
-    display: flex;
-    justify-content: center;
-    align-items: center;
+    overflow: hidden;
 
     video {
-      width: auto !important;
+      position: absolute !important;
+      inset: 0 !important;
+      width: 100% !important;
       height: 100% !important;
-      max-width: none !important;
+      object-fit: cover !important;
     }
 
     #qr-shaded-region {

package/src/components/form/ScanInput/__tests__/useCodeScanner.test.tsx

@@ -74,13 +74,23 @@ vi.mock('html5-qrcode', () => ({
 
 vi.mock('jsqr', () => jsQrMocks);
 
-function ScannerHost({ scanBoxSize }: { scanBoxSize?: { width: number; height: number } } = {}) {
+function ScannerHost({
+  onCameraStartFailure,
+  onScanFailure,
+  scanBoxSize,
+}: {
+  onCameraStartFailure?: (error: unknown) => void;
+  onScanFailure?: () => void;
+  scanBoxSize?: { width: number; height: number };
+} = {}) {
   const handleScanSuccess = useCallback(() => undefined, []);
 
   useCodeScanner({
     elementId: 'scanner',
     enabled: true,
     scanBoxSize,
+    onCameraStartFailure,
+    onScanFailure,
     onScanSuccess: handleScanSuccess,
   });
 
@@ -194,6 +204,30 @@ describe('useCodeScanner', () => {
     expect(config?.qrbox?.(1200, 844)).toEqual({ width: 319, height: 240 });
   });
 
+  it('clamps the scan box to the camera viewfinder size', async () => {
+    render(<ScannerHost scanBoxSize={{ width: 319, height: 240 }} />);
+
+    await waitFor(() => expect(mocks.start).toHaveBeenCalled());
+
+    const config = mocks.start.mock.calls[0]?.[1] as
+      | { qrbox?: (width: number, height: number) => { width: number; height: number } }
+      | undefined;
+
+    expect(config?.qrbox?.(200, 160)).toEqual({ width: 200, height: 160 });
+  });
+
+  it('reports camera start failures through the dedicated handler', async () => {
+    const cameraStartError = Object.assign(new Error('Camera failed'), { name: 'NotAllowedError' });
+    const handleCameraStartFailure = vi.fn();
+    const handleScanFailure = vi.fn();
+    mocks.start.mockRejectedValueOnce(cameraStartError);
+
+    render(<ScannerHost onCameraStartFailure={handleCameraStartFailure} onScanFailure={handleScanFailure} />);
+
+    await waitFor(() => expect(handleCameraStartFailure).toHaveBeenCalledWith(cameraStartError));
+    expect(handleScanFailure).not.toHaveBeenCalled();
+  });
+
   it('uses jsQR first for Safari uploaded QR images', async () => {
     const handleScanSuccess = vi.fn();
     jsQrMocks.default.mockReturnValueOnce({ data: 'JSQR-CODE' });

package/src/components/form/ScanInput/useCodeScanner.ts

@@ -25,6 +25,7 @@ type UseCodeScannerOptions = {
   onScannerSizeChanged?: (size: ScannerSize) => void;
   onScanSuccess: (text: string) => void;
   onScanFailure?: () => void;
+  onCameraStartFailure?: (error: unknown) => void;
 };
 
 type ImageDataVariant = {
@@ -70,6 +71,13 @@ export function getCodeScanBoxSize(width: number, height: number) {
   };
 }
 
+function clampCodeScanBoxSize(scanBoxSize: ScannerSize, width: number, height: number) {
+  return {
+    width: Math.min(scanBoxSize.width, width),
+    height: Math.min(scanBoxSize.height, height),
+  };
+}
+
 async function stopScanner(scanner?: Html5Qrcode, options: { clear?: boolean } = {}) {
   if (!scanner) {
     return;
@@ -212,6 +220,7 @@ export function useCodeScanner({
   onScannerSizeChanged,
   onScanSuccess,
   onScanFailure,
+  onCameraStartFailure,
 }: UseCodeScannerOptions) {
   const [scanner, setScanner] = useState<Html5Qrcode>();
 
@@ -223,7 +232,7 @@ export function useCodeScanner({
           fps: 10,
           qrbox(width, height) {
             onScannerSizeChanged?.({ width, height });
-            return scanBoxSize ?? getCodeScanBoxSize(width, height);
+            return clampCodeScanBoxSize(scanBoxSize ?? getCodeScanBoxSize(width, height), width, height);
           },
         },
         (decodedText) => {
@@ -273,14 +282,18 @@ export function useCodeScanner({
       verbose: false,
     });
     setScanner(scannerInstance);
-    startScanCamera(scannerInstance).catch(() => {
+    startScanCamera(scannerInstance).catch((error: unknown) => {
+      if (onCameraStartFailure) {
+        onCameraStartFailure(error);
+        return;
+      }
       onScanFailure?.();
     });
 
     return () => {
       stopScanner(scannerInstance, { clear: true }).catch(() => undefined);
     };
-  }, [elementId, enabled, formatsToSupport, onScanFailure, startScanCamera]);
+  }, [elementId, enabled, formatsToSupport, onCameraStartFailure, onScanFailure, startScanCamera]);
 
   return {
     startScanFile,

package/src/components/form/TypedVariableInput.tsx

@@ -121,12 +121,15 @@ function normalizeTypes(types: TypedConstantSpec[]): NormalizedType[] {
   );
 }
 
-function defaultValueFor(type: TypedConstantType): unknown {
+function defaultValueFor(type: TypedConstantType, typedProps: Record<string, unknown> = {}): unknown {
   switch (type) {
     case 'string':
       return '';
-    case 'number':
+    case 'number': {
+      const min = typeof typedProps.min === 'number' ? typedProps.min : undefined;
+      if (min !== undefined && min > 0) return min;
       return 0;
+    }
     case 'boolean':
       return false;
     case 'date': {
@@ -433,7 +436,7 @@ export function TypedVariableInput(props: TypedVariableInputProps) {
       return undefined;
     }
     const firstType = normalizedTypes[0];
-    return firstType ? defaultValueFor(firstType.type) : undefined;
+    return firstType ? defaultValueFor(firstType.type, firstType.props) : undefined;
   }, [defaultToFirstConstantTypeWhenUndefined, normalizedTypes, value, variableOnly]);
   const effectiveValue = value === undefined && defaultedValue !== undefined ? defaultedValue : value;
   const detected = useMemo(() => detectMode(effectiveValue, parseVariablePath), [effectiveValue, parseVariablePath]);
@@ -529,7 +532,8 @@ export function TypedVariableInput(props: TypedVariableInputProps) {
         const targetType = (path[1] as TypedConstantType | undefined) ?? normalizedTypes[0]?.type;
         if (!targetType) return;
         if (detected.mode === targetType) return;
-        onChange?.(defaultValueFor(targetType));
+        const target = normalizedTypes.find(({ type }) => type === targetType);
+        onChange?.(defaultValueFor(targetType, target?.props));
         return;
       }
       const leaf = selectedOptions?.[selectedOptions.length - 1] as SwitcherOption | undefined;
@@ -548,7 +552,7 @@ export function TypedVariableInput(props: TypedVariableInputProps) {
     }
     const first = normalizedTypes[0];
     if (first) {
-      onChange?.(defaultValueFor(first.type));
+      onChange?.(defaultValueFor(first.type, first.props));
       return;
     }
     if (nullable) {
@@ -585,11 +589,11 @@ export function TypedVariableInput(props: TypedVariableInputProps) {
     if (variableOnly) {
       return undefined;
     }
-    if (isNull) {
+    if (isNull && nullable) {
       return [NULL_KEY];
     }
     return [CONST_KEY, constantTypeForRendering];
-  }, [constantTypeForRendering, detected.variablePath, isNull, isVariable, variableOnly]);
+  }, [constantTypeForRendering, detected.variablePath, isNull, isVariable, nullable, variableOnly]);
 
   // Preload a saved variable's label path across lazy levels. `resolveVariableLabels` can only read already-loaded
   // `children`; when a saved reference points below a node whose children are still a lazy thunk (e.g. a relation field
@@ -734,7 +738,7 @@ export function TypedVariableInput(props: TypedVariableInputProps) {
             </div>
           ) : variableOnly ? (
             <Input placeholder={placeholder} readOnly disabled={disabled} style={{ width: '100%' }} />
-          ) : isNull ? (
+          ) : isNull && nullable ? (
             // v1 used the `placeholder` slot (not `value`) so the antd default placeholder colour applies — keeps the
             // field looking visibly empty/inactive rather than holding a real text value.
             <Input placeholder={`<${t('Null')}>`} readOnly disabled={disabled} style={{ width: '100%' }} />

package/src/components/form/__tests__/TypedVariableInput.test.tsx

@@ -81,6 +81,27 @@ describe('TypedVariableInput - constant rendering', () => {
     expect(screen.getByRole('button', { name: 'variable-switcher' }).className).not.toContain('ant-btn-primary');
   });
 
+  it('keeps the number editor usable when value=null and nullable=false', async () => {
+    const ctx = createContextWithEnv();
+    const handleChange = vi.fn();
+    renderWithCtx(
+      ctx,
+      <TypedVariableInput
+        value={null}
+        types={[['number', { min: 1 }]]}
+        namespaces={['$env']}
+        nullable={false}
+        onChange={handleChange}
+      />,
+    );
+
+    const numberInput = await screen.findByRole('spinbutton');
+    expect(screen.queryByPlaceholderText('<Null>')).toBeNull();
+    fireEvent.change(numberInput, { target: { value: '2' } });
+    fireEvent.blur(numberInput);
+    expect(handleChange).toHaveBeenCalledWith(2);
+  });
+
   it('defaults undefined to the first constant type', async () => {
     const ctx = createContextWithEnv();
     const handleChange = vi.fn();
@@ -102,6 +123,26 @@ describe('TypedVariableInput - constant rendering', () => {
     });
   });
 
+  it('uses a positive numeric minimum as the default value', async () => {
+    const ctx = createContextWithEnv();
+    const handleChange = vi.fn();
+    renderWithCtx(
+      ctx,
+      <TypedVariableInput
+        value={undefined}
+        types={[['number', { min: 1 }]]}
+        namespaces={['$env']}
+        nullable={false}
+        onChange={handleChange}
+      />,
+    );
+
+    expect(await screen.findByDisplayValue('1')).toBeInTheDocument();
+    await waitFor(() => {
+      expect(handleChange).toHaveBeenCalledWith(1);
+    });
+  });
+
   it('can still opt out to keep the null placeholder for undefined', async () => {
     const ctx = createContextWithEnv();
     renderWithCtx(
@@ -183,14 +224,14 @@ describe('TypedVariableInput - variable rendering', () => {
     expect(handleChange).toHaveBeenCalledWith(0);
   });
 
-  it('clears back to default-of-first-type when nullable=false', async () => {
+  it('clears back to the valid minimum of the first type when nullable=false', async () => {
     const ctx = createContextWithEnv();
     const handleChange = vi.fn();
     const { container } = renderWithCtx(
       ctx,
       <TypedVariableInput
         value="{{$env.SMTP_PORT}}"
-        types={['number']}
+        types={[['number', { min: 1 }]]}
         namespaces={['$env']}
         nullable={false}
         onChange={handleChange}
@@ -199,7 +240,7 @@ describe('TypedVariableInput - variable rendering', () => {
     const clear = container.querySelector('button.clear-button') as HTMLButtonElement | null;
     expect(clear).not.toBeNull();
     fireEvent.click(clear as HTMLButtonElement);
-    expect(handleChange).toHaveBeenCalledWith(0);
+    expect(handleChange).toHaveBeenCalledWith(1);
   });
 
   it('treats types=[] as variable-only mode with a readonly placeholder before selection', async () => {