@nocobase/client-v2 2.2.0-beta.12 → 2.2.0-beta.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/client-v2",
-  "version": "2.2.0-beta.12",
+  "version": "2.2.0-beta.14",
   "license": "Apache-2.0",
   "main": "lib/index.js",
   "module": "es/index.mjs",
@@ -27,11 +27,11 @@
     "@formily/antd-v5": "1.2.3",
     "@formily/react": "^2.2.27",
     "@formily/shared": "^2.2.27",
-    "@nocobase/evaluators": "2.2.0-beta.12",
-    "@nocobase/flow-engine": "2.2.0-beta.12",
-    "@nocobase/sdk": "2.2.0-beta.12",
-    "@nocobase/shared": "2.2.0-beta.12",
-    "@nocobase/utils": "2.2.0-beta.12",
+    "@nocobase/evaluators": "2.2.0-beta.14",
+    "@nocobase/flow-engine": "2.2.0-beta.14",
+    "@nocobase/sdk": "2.2.0-beta.14",
+    "@nocobase/shared": "2.2.0-beta.14",
+    "@nocobase/utils": "2.2.0-beta.14",
     "ahooks": "^3.7.2",
     "antd": "5.24.2",
     "antd-style": "3.7.1",
@@ -47,5 +47,5 @@
     "react-i18next": "^11.15.1",
     "react-router-dom": "^6.30.1"
   },
-  "gitHead": "ad8ed32d47eaec2dc56f15999934f720787d5070"
+  "gitHead": "1ef021f3ce0a84469e40f181a19551a50b6f850c"
 }

package/src/APIClient.ts

@@ -7,7 +7,7 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import { APIClient as APIClientSDK, type APIClientOptions, hasHeaderValue } from '@nocobase/sdk';
+import { APIClient as APIClientSDK, hasHeaderValue } from '@nocobase/sdk';
 
 function offsetToTimeZone(offset: number) {
   const hours = Math.floor(Math.abs(offset));
@@ -23,15 +23,6 @@ function getCurrentTimezone() {
 }
 
 export class APIClient extends APIClientSDK {
-  appName?: string;
-
-  constructor(options?: APIClientOptions) {
-    super(options);
-    if (options && typeof options !== 'function') {
-      this.appName = options.appName;
-    }
-  }
-
   getHostname() {
     if (process.env.API_BASE_URL) {
       try {

package/src/Application.tsx

@@ -46,6 +46,10 @@ export class Application extends BaseApplication<
 
   protected createApiClient(options: ApplicationOptions) {
     return new APIClient({
+      // Cross-origin API deployments rely on cookies for auth (e.g. permanent file
+      // URLs); trust is enforced server-side via the CORS origin whitelist and the
+      // CSRF middleware, not by omitting credentials.
+      withCredentials: true,
       ...options.apiClient,
       appName: options.name || getSubAppName(options.publicPath),
     });

package/src/BaseApplication.tsx

@@ -403,7 +403,7 @@ export abstract class BaseApplication<
       this.favicon = favicon || '';
     }
 
-    const iconHref = this.favicon || '/favicon/favicon.ico';
+    const iconHref = this.favicon || this.getCdnUrl() + 'favicon/favicon.ico';
 
     if (faviconLinkElement) {
       faviconLinkElement.href = iconHref;

package/src/__tests__/app.test.tsx

@@ -52,6 +52,24 @@ describe('app', () => {
       expect(app.getHref('/test')).toBe('/test');
     });
 
+    it('should enable credentials for api clients by default', () => {
+      const sameOriginApp = new Application({
+        router,
+        apiClient: {
+          baseURL: '/api/',
+        },
+      });
+      const crossOriginApp = new Application({
+        router,
+        apiClient: {
+          baseURL: 'https://api.example.com/api/',
+        },
+      });
+
+      expect(sameOriginApp.apiClient.axios.defaults.withCredentials).toBe(true);
+      expect(crossOriginApp.apiClient.axios.defaults.withCredentials).toBe(true);
+    });
+
     it('should initialize shared jsonLogic operators', () => {
       const app = new Application({ router });
 

package/src/__tests__/nocobase-buildin-plugin-auth.test.tsx

@@ -55,6 +55,7 @@ describe('nocobase buildin plugin auth redirect', () => {
   const originalLocation = globalThis.window.location;
 
   beforeEach(() => {
+    globalThis.window.localStorage.clear();
     // These fixtures mount the modern client under the `v2` segment; tell the
     // runtime-prefix helper so v2-runtime detection matches (server injects it
     // in production).
@@ -75,6 +76,7 @@ describe('nocobase buildin plugin auth redirect', () => {
   });
 
   afterEach(() => {
+    globalThis.window.localStorage.clear();
     delete (globalThis.window as any).__nocobase_modern_client_prefix__;
     Object.defineProperty(globalThis.window, 'location', {
       configurable: true,
@@ -116,6 +118,7 @@ describe('nocobase buildin plugin auth redirect', () => {
       plugins: [NocoBaseBuildInPlugin as any],
       router: { type: 'memory', initialEntries: ['/v2/admin'] },
     });
+    app.apiClient.auth.setToken('test-token');
     app.apiMock.onGet('app:getLang').reply(200, {
       data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
@@ -130,6 +133,7 @@ describe('nocobase buildin plugin auth redirect', () => {
     await new Promise((resolve) => setTimeout(resolve, 50));
     expect(app.router.router.state.location.pathname).toBe('/v2/admin');
     expect(app.router.router.state.location.search).toBe('');
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(0);
   });
 
   it('should redirect unauthenticated v2 root access to v2 signin via <Navigate />', async () => {
@@ -326,6 +330,29 @@ describe('nocobase buildin plugin auth redirect', () => {
       data: { lang: 'en-US', resources: { client: {} }, cron: {} },
     });
     app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
+    app.apiMock.onPost('auth:syncCookies').reply(200, { data: { synced: true } });
+    const ensureLoaded = vi.spyOn(app.dataSourceManager, 'ensureLoaded').mockResolvedValue(undefined);
+
+    const Root = app.getRootComponent();
+    render(<Root />);
+
+    expect(await screen.findByText('secure page')).toBeInTheDocument();
+    expect(ensureLoaded).toHaveBeenCalledTimes(1);
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(1);
+  });
+
+  it('should keep authenticated v2 startup working when cookie bootstrap fails', async () => {
+    const app = createMockClient({
+      publicPath: '/v2/',
+      plugins: [NocoBaseBuildInPlugin as any, AuthBootstrapRoutePlugin as any],
+      router: { type: 'memory', initialEntries: ['/v2/secure'] },
+    });
+    app.apiClient.auth.setToken('test-token');
+    app.apiMock.onGet('app:getLang').reply(200, {
+      data: { lang: 'en-US', resources: { client: {} }, cron: {} },
+    });
+    app.apiMock.onGet('/auth:check').reply(200, { data: { id: 1 } });
+    app.apiMock.onPost('auth:syncCookies').reply(500, { errors: [{ message: 'cookie sync failed' }] });
     const ensureLoaded = vi.spyOn(app.dataSourceManager, 'ensureLoaded').mockResolvedValue(undefined);
 
     const Root = app.getRootComponent();
@@ -333,6 +360,7 @@ describe('nocobase buildin plugin auth redirect', () => {
 
     expect(await screen.findByText('secure page')).toBeInTheDocument();
     expect(ensureLoaded).toHaveBeenCalledTimes(1);
+    expect(app.apiMock.history.post.filter((request) => request.url === 'auth:syncCookies')).toHaveLength(1);
   });
 
   it('should not auth-check or bootstrap authCheck false routes', async () => {

package/src/collection-manager/field-validation.ts

@@ -132,7 +132,7 @@ fieldValidationConfigureRegistry.registerMany([
   { key: 'uri', label: 'URI', hasValue: false, params: [], paramsType: 'object' },
   {
     key: 'multiple',
-    label: 'Multiple',
+    label: 'Multiple of',
     hasValue: true,
     params: [{ key: 'base', label: 'Base', componentType: 'inputNumber', required: true }],
   },

package/src/components/form/ScanInput/CodeScanner.tsx

@@ -49,6 +49,21 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     message.error(t('Code recognition failed, please scan again'));
   }, [t]);
 
+  const showCameraStartFailure = useCallback(
+    (error: unknown) => {
+      const errorName = error instanceof Error ? error.name : '';
+      const errorMessage = error instanceof Error ? error.message : '';
+      const errorMap: Record<string, string> = {
+        NotFoundError: t('No camera device detected'),
+        NotAllowedError: t('You have not granted permission to use the camera'),
+      };
+
+      message.error(errorMap[errorName] || errorMessage || t('You have not granted permission to use the camera'));
+      onClose();
+    },
+    [onClose, t],
+  );
+
   const handleScanSuccess = useCallback(
     (text: string) => {
       onScanSuccess(text);
@@ -64,6 +79,7 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     scanBoxSize,
     onScanSuccess: handleScanSuccess,
     onScanFailure: showScanFailure,
+    onCameraStartFailure: showCameraStartFailure,
   });
 
   useEffect(() => {
@@ -129,7 +145,7 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     inset: 0;
     z-index: ${token.zIndexPopupBase + 1000};
     overflow: hidden;
-    background: ${token.colorBgMask};
+    background: #000;
   `;
   const scannerWrapperClass = css`
     position: absolute;
@@ -137,16 +153,17 @@ function CodeScannerContent({ visible, formatsToSupport, onClose, onScanSuccess
     overflow: hidden;
   `;
   const scannerClass = css`
+    position: relative;
     width: 100%;
     height: 100%;
-    display: flex;
-    justify-content: center;
-    align-items: center;
+    overflow: hidden;
 
     video {
-      width: auto !important;
+      position: absolute !important;
+      inset: 0 !important;
+      width: 100% !important;
       height: 100% !important;
-      max-width: none !important;
+      object-fit: cover !important;
     }
 
     #qr-shaded-region {

package/src/components/form/ScanInput/__tests__/useCodeScanner.test.tsx

@@ -74,13 +74,23 @@ vi.mock('html5-qrcode', () => ({
 
 vi.mock('jsqr', () => jsQrMocks);
 
-function ScannerHost({ scanBoxSize }: { scanBoxSize?: { width: number; height: number } } = {}) {
+function ScannerHost({
+  onCameraStartFailure,
+  onScanFailure,
+  scanBoxSize,
+}: {
+  onCameraStartFailure?: (error: unknown) => void;
+  onScanFailure?: () => void;
+  scanBoxSize?: { width: number; height: number };
+} = {}) {
   const handleScanSuccess = useCallback(() => undefined, []);
 
   useCodeScanner({
     elementId: 'scanner',
     enabled: true,
     scanBoxSize,
+    onCameraStartFailure,
+    onScanFailure,
     onScanSuccess: handleScanSuccess,
   });
 
@@ -194,6 +204,30 @@ describe('useCodeScanner', () => {
     expect(config?.qrbox?.(1200, 844)).toEqual({ width: 319, height: 240 });
   });
 
+  it('clamps the scan box to the camera viewfinder size', async () => {
+    render(<ScannerHost scanBoxSize={{ width: 319, height: 240 }} />);
+
+    await waitFor(() => expect(mocks.start).toHaveBeenCalled());
+
+    const config = mocks.start.mock.calls[0]?.[1] as
+      | { qrbox?: (width: number, height: number) => { width: number; height: number } }
+      | undefined;
+
+    expect(config?.qrbox?.(200, 160)).toEqual({ width: 200, height: 160 });
+  });
+
+  it('reports camera start failures through the dedicated handler', async () => {
+    const cameraStartError = Object.assign(new Error('Camera failed'), { name: 'NotAllowedError' });
+    const handleCameraStartFailure = vi.fn();
+    const handleScanFailure = vi.fn();
+    mocks.start.mockRejectedValueOnce(cameraStartError);
+
+    render(<ScannerHost onCameraStartFailure={handleCameraStartFailure} onScanFailure={handleScanFailure} />);
+
+    await waitFor(() => expect(handleCameraStartFailure).toHaveBeenCalledWith(cameraStartError));
+    expect(handleScanFailure).not.toHaveBeenCalled();
+  });
+
   it('uses jsQR first for Safari uploaded QR images', async () => {
     const handleScanSuccess = vi.fn();
     jsQrMocks.default.mockReturnValueOnce({ data: 'JSQR-CODE' });

package/src/components/form/ScanInput/useCodeScanner.ts

@@ -25,6 +25,7 @@ type UseCodeScannerOptions = {
   onScannerSizeChanged?: (size: ScannerSize) => void;
   onScanSuccess: (text: string) => void;
   onScanFailure?: () => void;
+  onCameraStartFailure?: (error: unknown) => void;
 };
 
 type ImageDataVariant = {
@@ -70,6 +71,13 @@ export function getCodeScanBoxSize(width: number, height: number) {
   };
 }
 
+function clampCodeScanBoxSize(scanBoxSize: ScannerSize, width: number, height: number) {
+  return {
+    width: Math.min(scanBoxSize.width, width),
+    height: Math.min(scanBoxSize.height, height),
+  };
+}
+
 async function stopScanner(scanner?: Html5Qrcode, options: { clear?: boolean } = {}) {
   if (!scanner) {
     return;
@@ -212,6 +220,7 @@ export function useCodeScanner({
   onScannerSizeChanged,
   onScanSuccess,
   onScanFailure,
+  onCameraStartFailure,
 }: UseCodeScannerOptions) {
   const [scanner, setScanner] = useState<Html5Qrcode>();
 
@@ -223,7 +232,7 @@ export function useCodeScanner({
           fps: 10,
           qrbox(width, height) {
             onScannerSizeChanged?.({ width, height });
-            return scanBoxSize ?? getCodeScanBoxSize(width, height);
+            return clampCodeScanBoxSize(scanBoxSize ?? getCodeScanBoxSize(width, height), width, height);
           },
         },
         (decodedText) => {
@@ -273,14 +282,18 @@ export function useCodeScanner({
       verbose: false,
     });
     setScanner(scannerInstance);
-    startScanCamera(scannerInstance).catch(() => {
+    startScanCamera(scannerInstance).catch((error: unknown) => {
+      if (onCameraStartFailure) {
+        onCameraStartFailure(error);
+        return;
+      }
       onScanFailure?.();
     });
 
     return () => {
       stopScanner(scannerInstance, { clear: true }).catch(() => undefined);
     };
-  }, [elementId, enabled, formatsToSupport, onScanFailure, startScanCamera]);
+  }, [elementId, enabled, formatsToSupport, onCameraStartFailure, onScanFailure, startScanCamera]);
 
   return {
     startScanFile,

package/src/flow/models/blocks/table/TableBlockModel.tsx

@@ -310,7 +310,7 @@ export class TableBlockModel extends CollectionBlockModel<TableBlockModelStructu
                 transform: translateY(-50%);
               }
               &:hover {
-                background: rgba(24, 144, 255, 0.1) !important;
+                box-shadow: inset 0 0 0 9999px rgba(24, 144, 255, 0.1);
               }
               &:hover .edit-icon {
                 display: inline-flex;

package/src/flow/models/fields/AssociationFieldModel/PopupSubTableFieldModel/PopupSubTableFieldModel.tsx

@@ -102,7 +102,7 @@ const RenderCell = observer<any>((props) => {
               transform: translateY(-50%);
             }
             &:hover {
-              background: rgba(24, 144, 255, 0.1) !important;
+              box-shadow: inset 0 0 0 9999px rgba(24, 144, 255, 0.1);
             }
             &:hover .edit-icon {
               display: inline-flex;

package/src/flow-compat/fieldValidationConstants.ts

@@ -231,7 +231,7 @@ export const FIELDS_VALIDATION_OPTIONS = {
     },
     {
       key: 'multiple',
-      label: 'Multiple',
+      label: 'Multiple of',
       hasValue: true,
       params: [{ key: 'base', label: 'Base', componentType: 'inputNumber', required: true }],
     },

package/src/nocobase-buildin-plugin/index.tsx

@@ -240,6 +240,16 @@ const CurrentUserProvider: FC = ({ children }) => {
           return;
         }
 
+        try {
+          await app.apiClient.auth.syncCookies();
+        } catch {
+          // Cookie bootstrap is best-effort; auth:check remains the source of truth for the current page load.
+        }
+
+        if (!mounted) {
+          return;
+        }
+
         const userMeta = createCollectionContextMeta(
           () => app.flowEngine.context.dataSourceManager?.getDataSource('main')?.getCollection('users') || null,
           app.flowEngine.translate('Current user'),