@nocobase/flow-engine 2.0.0-alpha.10

package/src/utils/safeGlobals.ts

@@ -0,0 +1,188 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+/**
+ * 统一的安全全局对象代理：window/document
+ * - 默认仅允许常用的定时器、console、Math、Date、addEventListener（绑定原 window）
+ * - document 仅允许 createElement/querySelector/querySelectorAll
+ * - 不允许随意访问未声明的属性，最小权限原则
+ */
+
+export function createSafeWindow(extra?: Record<string, any>) {
+  // 解析相对 URL 使用脱敏 base（不含 query/hash），避免在解析时泄露敏感信息
+  const getSafeBaseHref = () => `${window.location.origin}${window.location.pathname}`;
+
+  // 安全的 window.open 代理
+  const safeOpen = (url: string, target?: string, features?: string): Window | null => {
+    // 仅允许 http/https 和 about:blank
+    const isSafeUrl = (u: string): boolean => {
+      try {
+        const parsed = new URL(u, getSafeBaseHref()); // 使用脱敏 base
+        const protocol = parsed.protocol.toLowerCase();
+        if (protocol === 'about:') return parsed.href === 'about:blank';
+        return protocol === 'http:' || protocol === 'https:';
+      } catch {
+        return false;
+      }
+    };
+
+    if (!isSafeUrl(url)) {
+      throw new Error('Unsafe URL: window.open only allows http/https/about:blank.');
+    }
+
+    // 强制在新标签页打开，避免覆盖当前页或父窗口
+    const sanitizedTarget = '_blank';
+
+    // 合并并强制加上安全特性
+    const enforceFeatures = (f?: string): string => {
+      const set = new Set<string>();
+      if (f) {
+        f.split(',')
+          .map((s) => s.trim())
+          .filter(Boolean)
+          .forEach((part) => {
+            const key = part.split('=')[0].trim().toLowerCase();
+            if (key !== 'noopener' && key !== 'noreferrer') set.add(part);
+          });
+      }
+      set.add('noopener');
+      set.add('noreferrer');
+      return Array.from(set).join(',');
+    };
+
+    const sanitizedFeatures = enforceFeatures(features);
+
+    // 调用原生 window.open
+    const newWin = window.open.call(window, url, sanitizedTarget, sanitizedFeatures);
+
+    // 双重保险：禁用 opener（部分浏览器/场景下 features 可能不生效）
+    if (newWin && 'opener' in newWin) {
+      try {
+        (newWin as any).opener = null;
+      } catch {
+        // ignore
+      }
+    }
+    return newWin;
+  };
+
+  // 同源在当前页导航；跨域强制用新标签页 + noreferrer/noopener
+  const guardedNavigate = (rawUrl: string, opts?: { replace?: boolean }) => {
+    const parsed = new URL(rawUrl, getSafeBaseHref());
+    const protocol = parsed.protocol.toLowerCase();
+
+    const isAboutBlank = protocol === 'about:' && parsed.href === 'about:blank';
+    const isHttp = protocol === 'http:' || protocol === 'https:';
+    if (!isHttp && !isAboutBlank) {
+      throw new Error('Unsafe URL: only http/https/about:blank are allowed.');
+    }
+
+    if (isAboutBlank) {
+      return opts?.replace ? window.location.replace('about:blank') : window.location.assign('about:blank');
+    }
+
+    const sameOrigin =
+      parsed.protocol === window.location.protocol &&
+      parsed.hostname === window.location.hostname &&
+      parsed.port === window.location.port;
+
+    if (sameOrigin) {
+      return opts?.replace ? window.location.replace(parsed.href) : window.location.assign(parsed.href);
+    }
+
+    const win = safeOpen(parsed.href);
+    if (!win) throw new Error('Popup blocked: cross-origin navigation is opened in a new tab.');
+  };
+
+  // 只读/脱敏的 location 代理；支持安全的 href 赋值和 assign/replace
+  const safeLocation = new Proxy(
+    {},
+    {
+      get(_t, prop: string) {
+        switch (prop) {
+          case 'origin':
+            return window.location.origin;
+          case 'protocol':
+            return window.location.protocol;
+          case 'host':
+            return window.location.host;
+          case 'hostname':
+            return window.location.hostname;
+          case 'port':
+            return window.location.port;
+          case 'pathname':
+            return window.location.pathname;
+          case 'assign':
+            return (u: string) => guardedNavigate(u, { replace: false });
+          case 'replace':
+            return (u: string) => guardedNavigate(u, { replace: true });
+          case 'reload':
+            throw new Error('Access to location.reload is not allowed.');
+          case 'href':
+            throw new Error('Reading location.href is not allowed.');
+          default:
+            throw new Error(`Access to location property "${prop}" is not allowed.`);
+        }
+      },
+      set(_t, prop: string, value: any) {
+        if (prop === 'href') {
+          guardedNavigate(String(value), { replace: false });
+          return true;
+        }
+        throw new Error('Mutation on location is not allowed.');
+      },
+    },
+  );
+
+  const allowedGlobals: Record<string, any> = {
+    // 需绑定到原始 window，避免严格模式下触发 Illegal invocation
+    setTimeout: window.setTimeout.bind(window),
+    clearTimeout: window.clearTimeout.bind(window),
+    setInterval: window.setInterval.bind(window),
+    clearInterval: window.clearInterval.bind(window),
+    console,
+    Math,
+    Date,
+    // 事件侦听仅绑定到真实 window，便于少量需要的全局监听
+    addEventListener: addEventListener.bind(window),
+    // 安全的 window.open 代理
+    open: safeOpen,
+    // 安全的 location 代理
+    location: safeLocation,
+    ...(extra || {}),
+  };
+
+  return new Proxy(
+    {},
+    {
+      get(_target, prop: string) {
+        if (prop in allowedGlobals) return allowedGlobals[prop];
+        throw new Error(`Access to global property "${prop}" is not allowed.`);
+      },
+    },
+  );
+}
+
+export function createSafeDocument(extra?: Record<string, any>) {
+  const allowed: Record<string, any> = {
+    createElement: document.createElement.bind(document),
+    querySelector: document.querySelector.bind(document),
+    querySelectorAll: document.querySelectorAll.bind(document),
+    ...(extra || {}),
+  };
+  return new Proxy(
+    {},
+    {
+      get(_target, prop: string) {
+        if (prop in allowed) return allowed[prop];
+        throw new Error(`Access to document property "${prop}" is not allowed.`);
+      },
+    },
+  );
+}

package/src/utils/schema-utils.ts

@@ -0,0 +1,201 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { ISchema } from '@formily/json-schema';
+import { Schema } from '@formily/json-schema';
+import type { FlowModel } from '../models';
+import { FlowRuntimeContext } from '../flowContext';
+import type { StepDefinition, StepUIMode } from '../types';
+import { setupRuntimeContextSteps } from './setupRuntimeContextSteps';
+
+/**
+ * 解析 uiSchema，支持静态值和函数形式
+ * 函数可以接收 FlowRuntimeContext（在 settings 中）
+ * @param {Record<string, ISchema> | ((ctx: FlowRuntimeContext<TModel>) => Record<string, ISchema> | Promise<Record<string, ISchema>>)} uiSchema UI Schema 定义
+ * @param {FlowRuntimeContext<TModel>} ctx 上下文
+ * @returns {Promise<Record<string, ISchema>>} 解析后的 UI Schema 对象
+ */
+async function resolveUiSchema<TModel extends FlowModel = FlowModel>(
+  uiSchema:
+    | Record<string, ISchema>
+    | ((ctx: FlowRuntimeContext<TModel>) => Record<string, ISchema> | Promise<Record<string, ISchema>>)
+    | undefined,
+  ctx: FlowRuntimeContext<TModel>,
+): Promise<Record<string, ISchema>> {
+  if (!uiSchema) {
+    return {};
+  }
+
+  if (typeof uiSchema === 'function') {
+    try {
+      const result = await uiSchema(ctx);
+      return result || {};
+    } catch (error) {
+      console.error('Error resolving uiSchema function:', error);
+      return {};
+    }
+  }
+
+  return uiSchema;
+}
+
+/**
+ * 解析 uiMode，支持静态值和函数形式
+ * 函数可以接收 FlowRuntimeContext
+ * @param {StepUIMode | ((ctx: FlowRuntimeContext<TModel>) => StepUIMode | Promise<StepUIMode>)} uiMode UI模式定义
+ * @param {FlowRuntimeContext<TModel>} ctx 上下文
+ * @returns {Promise<StepUIMode>} 解析后的 UI 模式
+ */
+export async function resolveUiMode<TModel extends FlowModel = FlowModel>(
+  uiMode: StepUIMode | ((ctx: FlowRuntimeContext<TModel>) => StepUIMode | Promise<StepUIMode>) | undefined,
+  ctx: FlowRuntimeContext<TModel>,
+): Promise<StepUIMode> {
+  if (!uiMode) {
+    return 'dialog';
+  }
+
+  if (typeof uiMode === 'function') {
+    try {
+      const result = await uiMode(ctx);
+      return result || 'dialog';
+    } catch (error) {
+      console.error('Error resolving uiMode function:', error);
+      return 'dialog';
+    }
+  }
+
+  return uiMode;
+}
+
+// 模块级全局缓存，与 useCompile 保持一致
+const compileCache = {};
+
+/**
+ * 编译 UI Schema 中的表达式
+ *
+ * @param scope 编译作用域，包含可用的变量和函数（如 t, randomString 等）
+ * @param uiSchema 待编译的 UI Schema
+ * @param options 编译选项
+ * @returns 编译后的 UI Schema
+ */
+export function compileUiSchema(scope: Record<string, any>, uiSchema: any, options: { noCache?: boolean } = {}): any {
+  const { noCache = false } = options;
+
+  const hasVariable = (source: string): boolean => {
+    const reg = /\{\{.*?\}\}/g;
+    return reg.test(source);
+  };
+
+  const compile = (source: any): any => {
+    let shouldCompile = false;
+    let cacheKey: string;
+
+    // source is expression, for example: {{ t('Add new') }}
+    if (typeof source === 'string' && source.startsWith('{{')) {
+      shouldCompile = true;
+      cacheKey = source;
+    }
+
+    // source is Component Object, for example: { 'x-component': "Cascader", type: "array", title: "所属地区(行政区划)" }
+    if (source && typeof source === 'object' && !Array.isArray(source)) {
+      try {
+        cacheKey = JSON.stringify(source);
+      } catch (e) {
+        console.warn('Failed to stringify:', e);
+        return source;
+      }
+      if (compileCache[cacheKey]) return compileCache[cacheKey];
+      shouldCompile = hasVariable(cacheKey);
+    }
+
+    // source is Array, for example: [{ 'title': "{{ t('Admin') }}", name: 'admin' }, { 'title': "{{ t('Root') }}", name: 'root' }]
+    if (Array.isArray(source)) {
+      try {
+        cacheKey = JSON.stringify(source);
+      } catch (e) {
+        console.warn('Failed to stringify:', e);
+        return source;
+      }
+      if (compileCache[cacheKey]) return compileCache[cacheKey];
+      shouldCompile = hasVariable(cacheKey);
+    }
+
+    if (shouldCompile) {
+      if (!cacheKey) {
+        try {
+          return Schema.compile(source, scope);
+        } catch (error) {
+          console.warn('Failed to compile with Formily Schema.compile:', error);
+          return source;
+        }
+      }
+      try {
+        if (noCache) {
+          return Schema.compile(source, scope);
+        }
+        compileCache[cacheKey] = compileCache[cacheKey] || Schema.compile(source, scope);
+        return compileCache[cacheKey];
+      } catch (e) {
+        console.log('compileUiSchema error', source, e);
+        try {
+          return Schema.compile(source, scope);
+        } catch (error) {
+          return source;
+        }
+      }
+    }
+
+    // source is: plain object、string、number、boolean、undefined、null
+    return source;
+  };
+
+  return compile(uiSchema);
+}
+
+/**
+ * 解析并合并步骤的完整uiSchema
+ * 这个函数提取了在多个组件中重复使用的uiSchema解析和合并逻辑
+ * @param model 模型实例
+ * @param flow 流程定义
+ * @param step 步骤定义
+ * @returns 合并后的uiSchema对象，如果为空则返回null
+ */
+export async function resolveStepUiSchema<TModel extends FlowModel = FlowModel>(
+  model: TModel,
+  flow: any,
+  step: StepDefinition,
+): Promise<Record<string, ISchema> | null> {
+  // 创建运行时上下文
+  const flowRuntimeContext = new FlowRuntimeContext(model, flow.key, 'settings');
+  setupRuntimeContextSteps(flowRuntimeContext, flow.steps, model, flow.key);
+  flowRuntimeContext.defineProperty('currentStep', { value: step });
+
+  // 获取步骤的uiSchema
+  let stepUiSchema = step.uiSchema;
+
+  if (step.use) {
+    try {
+      const action = model.flowEngine?.getAction?.(step.use);
+      if (action && action.uiSchema) {
+        stepUiSchema = stepUiSchema || action.uiSchema;
+      }
+    } catch (error) {
+      console.warn(`Failed to get action ${step.use}:`, error);
+    }
+  }
+
+  const resolvedStepUiSchema = await resolveUiSchema(stepUiSchema || {}, flowRuntimeContext);
+
+  // 如果解析后没有可配置的UI Schema，返回null
+  if (Object.keys(resolvedStepUiSchema).length === 0) {
+    return null;
+  }
+
+  return resolvedStepUiSchema;
+}

package/src/utils/serverContextParams.ts

@@ -0,0 +1,112 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { FlowContext } from '../flowContext';
+
+export type RecordRef = {
+  collection?: string;
+  id?: any; // primary key value
+  filterByTk?: any; // alias for id
+  dataSourceKey?: string;
+  sourceId?: any;
+  fields?: string[];
+  appends?: string[];
+  record?: any; // full record object (try to infer pk from it)
+};
+
+// Arbitrary key input and flattened output (dot-joined keys)
+export type BuildServerContextParamsInput = Record<string, any>;
+export type ServerContextParams = Record<string, NormalizedRecordParams>;
+
+export type NormalizedRecordParams = {
+  collection: string;
+  filterByTk: any;
+  dataSourceKey?: string;
+  fields?: string[];
+  appends?: string[];
+};
+
+function pickDefined<T extends object>(obj: T): T {
+  const out: any = {};
+  Object.entries(obj || {}).forEach(([k, v]) => {
+    if (typeof v !== 'undefined' && v !== null) out[k] = v;
+  });
+  return out as T;
+}
+
+function resolvePrimaryKey(ctx: FlowContext, dataSourceKey: string, collection: string): string | undefined {
+  try {
+    const ds = ctx.dataSourceManager?.getDataSource?.(dataSourceKey || 'main');
+    const col = ds?.collectionManager?.getCollection?.(collection);
+    const pk = col?.getPrimaryKey?.();
+    return pk || 'id';
+  } catch (e) {
+    return 'id';
+  }
+}
+
+function normalizeOne(ctx: FlowContext, ref?: RecordRef): NormalizedRecordParams | undefined {
+  if (!ref) return undefined;
+  const dataSourceKey = ref.dataSourceKey || 'main';
+  const collection = ref.collection || ref.record?.__collectionName;
+  if (!collection) return undefined;
+  const pk = resolvePrimaryKey(ctx, dataSourceKey, collection) || 'id';
+  const filterByTk =
+    typeof ref.filterByTk !== 'undefined' ? ref.filterByTk : typeof ref.id !== 'undefined' ? ref.id : ref.record?.[pk];
+  if (typeof filterByTk === 'undefined') return undefined;
+  return pickDefined({
+    collection,
+    filterByTk,
+    dataSourceKey,
+    fields: ref.fields,
+    appends: ref.appends,
+  });
+}
+
+export function buildServerContextParams(
+  ctx: FlowContext,
+  input: BuildServerContextParamsInput = {},
+): ServerContextParams | undefined {
+  // Helper: detect a record-like object
+  const isRecordRef = (val: any) => {
+    if (!val || typeof val !== 'object') return false;
+    return (
+      typeof (val as any).collection === 'string' &&
+      (typeof (val as any).filterByTk !== 'undefined' || typeof (val as any).id !== 'undefined' || (val as any).record)
+    );
+  };
+
+  const out: Record<string, NormalizedRecordParams> = {};
+
+  const visit = (src: any, path: string[]) => {
+    if (isRecordRef(src)) {
+      const norm = normalizeOne(ctx, src as RecordRef);
+      if (norm) {
+        const key = path.join('.');
+        out[key] = norm;
+      }
+      return;
+    }
+    if (Array.isArray(src)) {
+      for (let i = 0; i < src.length; i++) {
+        visit(src[i], [...path, String(i)]);
+      }
+      return;
+    }
+    if (src && typeof src === 'object') {
+      for (const [k, v] of Object.entries(src)) {
+        visit(v, [...path, k]);
+      }
+      return;
+    }
+  };
+
+  visit(input, []);
+  return Object.keys(out).length ? out : undefined;
+}

package/src/utils/setupRuntimeContextSteps.ts

@@ -0,0 +1,89 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { FlowRuntimeContext } from '../flowContext';
+import { FlowModel } from '../models/flowModel';
+import { DefaultStructure, StepDefinition } from '../types';
+
+/**
+ * 为 FlowRuntimeContext 设置 steps 属性及其 meta 信息
+ * @param ctx FlowRuntimeContext 实例
+ * @param flowSteps 流定义
+ * @param model FlowModel 实例
+ * @param flowKey key
+ */
+export function setupRuntimeContextSteps(
+  ctx: FlowRuntimeContext<any>,
+  flowSteps: Record<string, StepDefinition<FlowModel<DefaultStructure>>>,
+  model: FlowModel,
+  flowKey: string,
+): void {
+  const steps: Record<string, any> = {};
+  const stepsMetaProperties: Record<string, any> = {};
+
+  // 构建 meta 信息和步骤对象
+  for (const stepKey in flowSteps) {
+    if (Object.prototype.hasOwnProperty.call(flowSteps, stepKey)) {
+      const flowStep = flowSteps[stepKey];
+
+      // 根据 uiSchema 构建细化的 params meta
+      const paramsProperties: Record<string, any> = {};
+
+      if (flowStep.uiSchema && typeof flowStep.uiSchema === 'object') {
+        for (const [paramKey, paramSchema] of Object.entries(flowStep.uiSchema)) {
+          if (paramSchema && typeof paramSchema === 'object') {
+            const schema = paramSchema as any;
+            paramsProperties[paramKey] = {
+              type: schema.type || 'any',
+              title: schema.title || schema['x-decorator-props']?.label || paramKey,
+              interface: schema['x-component'],
+              uiSchema: schema,
+            };
+          }
+        }
+      }
+
+      // 如果没有参数属性，则隐藏整个step
+      const hasParams = Object.keys(paramsProperties).length > 0;
+
+      stepsMetaProperties[stepKey] = {
+        type: 'object',
+        title: ctx.t(flowStep.title) || stepKey,
+        display: hasParams ? 'default' : 'none',
+        properties: hasParams
+          ? {
+              params: {
+                type: 'object',
+                title: 'Parameters',
+                display: 'flatten',
+                properties: paramsProperties,
+              },
+            }
+          : undefined,
+      };
+
+      // 始终创建步骤对象，确保运行时能够访问
+      steps[stepKey] = {
+        get params() {
+          return model.getStepParams(flowKey, stepKey) || {};
+        },
+        get uiSchema() {
+          return flowStep.uiSchema;
+        },
+        result: undefined, // result 会在运行时被设置
+      };
+    }
+  }
+
+  // 定义 steps 属性
+  // 暂时隐藏 settings 对应的变量选择项：不提供 meta，仅保留运行时访问能力
+  ctx.defineProperty('steps', {
+    get: () => steps,
+  });
+}

package/src/utils/translation.ts

@@ -0,0 +1,37 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import type { TFuncKey, TOptions } from 'i18next';
+import type { FlowModel } from '../models';
+import { FLOW_ENGINE_NAMESPACE } from './constants';
+
+/**
+ * 获取带有 flow-engine 命名空间的翻译函数
+ * @param model FlowModel 实例
+ * @returns 翻译函数，自动使用 flow-engine 命名空间
+ */
+export function getT(model: FlowModel): (key: string, options?: any) => string {
+  if (model.flowEngine?.translate) {
+    return (key: string, options?: any) => {
+      // 自动添加 flow-engine 命名空间
+      return model.flowEngine.translate(key, { ns: [FLOW_ENGINE_NAMESPACE, 'client'], nsMode: 'fallback', ...options });
+    };
+  }
+  // 回退到原始键值
+  return (key: string) => key;
+}
+
+export function escapeT(text: TFuncKey | TFuncKey[], options?: TOptions) {
+  if (options) {
+    return `{{t(${JSON.stringify(text)}, ${JSON.stringify(options)})}}`;
+  }
+  return `{{t(${JSON.stringify(text)})}}`;
+}
+
+export { escapeT as tExpr };