@nocobase/flow-engine 2.0.0-alpha.3 → 2.0.0-alpha.30

package/src/utils/jsxTransform.ts

@@ -0,0 +1,39 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+/**
+ * Lightweight JSX -> JS compiler for RunJS user code.
+ * - Uses sucrase via dynamic import (lazy; avoids static cycles and cost when not needed)
+ * - Maps JSX to ctx.React.createElement / ctx.React.Fragment so no global React is required
+ * - If sucrase is unavailable or transform throws, returns original code as graceful fallback
+ */
+export async function compileRunJs(code: string): Promise<string> {
+  // Fast path: cheap heuristic to skip import if no JSX likely present
+  // (not strict; still safe because we fall back to transform if dynamic import is cheap)
+  const maybeJSX = /<[A-Za-z]|<\//.test(code);
+  if (!maybeJSX) return code;
+
+  try {
+    const mod: any = await import('sucrase');
+    const transform = mod?.transform || mod?.default?.transform;
+    if (typeof transform !== 'function') return code;
+    const res = transform(code, {
+      transforms: ['jsx'],
+      jsxPragma: 'ctx.React.createElement',
+      jsxFragmentPragma: 'ctx.React.Fragment',
+      // Keep ES syntax as-is; JSRunner runs in modern engines
+      disableESTransforms: true,
+      production: true,
+    });
+    return (res && (res.code || res?.output)) ?? code;
+  } catch (_e) {
+    // Fallback: return original code if transform fails
+    return code;
+  }
+}

package/src/utils/params-resolvers.ts

@@ -7,9 +7,9 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
+import { getValuesByPath } from '@nocobase/shared';
 import _ from 'lodash';
 import { FlowContext, FlowModelContext, FlowRuntimeContext } from '../flowContext';
-import { getValuesByPath } from '@nocobase/utils/client';
 import type { FlowModel } from '../models';
 import type { ServerContextParams } from './serverContextParams';
 
@@ -440,7 +440,7 @@ async function compileExpression<TModel extends FlowModel = FlowModel>(expressio
    * ✅ "{{ctx.user}}"            -> 捕获: "ctx.user"
    * ❌ "Hello {{ ctx.user }}"    -> 不匹配（不是纯表达式）
    */
-  const singleMatch = expression.match(/^\{\{\s*(.+)\s*\}\}$/);
+  const singleMatch = expression.match(/^\s*\{\{\s*([^{}]+?)\s*\}\}\s*$/);
   if (singleMatch) {
     const inner = singleMatch[1];
     const dotPath = matchDotOnly(inner);

package/src/utils/safeGlobals.ts

@@ -8,9 +8,10 @@
  */
 
 /**
- * 统一的安全全局对象代理：window/document
- * - 默认仅允许常用的定时器、console、Math、Date、addEventListener（绑定原 window）
- * - document 仅允许 createElement/querySelector/querySelectorAll
+ * 统一的安全全局对象代理：window/document/navigator
+ * - window：仅允许常用的定时器、console、Math、Date、addEventListener、open（安全包装）、location（安全代理）
+ * - document：仅允许 createElement/querySelector/querySelectorAll
+ * - navigator：仅提供极少量低风险能力（clipboard.writeText、onLine、language、languages）
  * - 不允许随意访问未声明的属性，最小权限原则
  */
 
@@ -186,3 +187,48 @@ export function createSafeDocument(extra?: Record<string, any>) {
     },
   );
 }
+
+export function createSafeNavigator(extra?: Record<string, any>) {
+  const nav: any = (typeof window !== 'undefined' && window.navigator) || undefined;
+
+  // 始终提供 clipboard 对象，避免可选链访问时抛错
+  const clipboard: Record<string, any> = {};
+  const writeText = nav?.clipboard?.writeText;
+  if (typeof writeText === 'function') {
+    clipboard.writeText = writeText.bind(nav.clipboard);
+  }
+
+  const allowed: Record<string, any> = {
+    clipboard,
+  };
+
+  // 只读常用标识，避免泄露更多指纹信息
+  Object.defineProperty(allowed, 'onLine', {
+    get: () => !!nav?.onLine,
+    enumerable: true,
+    configurable: false,
+  });
+  Object.defineProperty(allowed, 'language', {
+    get: () => nav?.language,
+    enumerable: true,
+    configurable: false,
+  });
+  Object.defineProperty(allowed, 'languages', {
+    get: () => (nav?.languages ? [...nav.languages] : undefined),
+    enumerable: true,
+    configurable: false,
+  });
+
+  // 允许额外注入（例如自定义能力的受控暴露）
+  Object.assign(allowed, extra || {});
+
+  return new Proxy(
+    {},
+    {
+      get(_t, prop: string) {
+        if (prop in allowed) return (allowed as any)[prop];
+        throw new Error(`Access to navigator property "${String(prop)}" is not allowed.`);
+      },
+    },
+  );
+}

package/src/utils/schema-utils.ts

@@ -181,7 +181,7 @@ export async function resolveStepUiSchema<TModel extends FlowModel = FlowModel>(
 
   if (step.use) {
     try {
-      const action = model.flowEngine?.getAction?.(step.use);
+      const action = model.getAction?.(step.use);
       if (action && action.uiSchema) {
         stepUiSchema = stepUiSchema || action.uiSchema;
       }

package/src/utils/serverContextParams.ts

@@ -14,6 +14,7 @@ export type RecordRef = {
   id?: any; // primary key value
   filterByTk?: any; // alias for id
   dataSourceKey?: string;
+  sourceId?: any;
   fields?: string[];
   appends?: string[];
   record?: any; // full record object (try to infer pk from it)

package/src/utils/variablesParams.ts

@@ -7,15 +7,15 @@
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
 
-import type { FlowContext, PropertyMeta, PropertyMetaFactory } from '../flowContext';
-import type { JSONValue } from './params-resolvers';
-import type { Collection } from '../data-source';
-import { createCollectionContextMeta } from './createCollectionContextMeta';
-import { buildServerContextParams, type RecordRef, type ServerContextParams } from '../utils/serverContextParams';
 import {
   extractUsedVariableNames as _extractUsedVariableNames,
   extractUsedVariablePaths as _extractUsedVariablePaths,
-} from '@nocobase/utils/client';
+} from '@nocobase/shared';
+import type { Collection } from '../data-source';
+import type { FlowContext, PropertyMeta, PropertyMetaFactory } from '../flowContext';
+import { buildServerContextParams, type RecordRef, type ServerContextParams } from '../utils/serverContextParams';
+import { createCollectionContextMeta } from './createCollectionContextMeta';
+import type { JSONValue } from './params-resolvers';
 
 // Narrowest resource shape we rely on for inference
 type ResourceLike = {
@@ -45,6 +45,7 @@ function getCollection(ctx: FlowContext): CollectionShape | undefined {
   return undefined;
 }
 
+// 从 FlowContext 中推断当前记录的 context params 信息
 export function inferRecordRef(ctx: FlowContext): RecordRef | undefined {
   const resource = getResource(ctx);
   const collectionObj = getCollection(ctx);
@@ -59,13 +60,26 @@ export function inferRecordRef(ctx: FlowContext): RecordRef | undefined {
   return { collection, dataSourceKey, filterByTk };
 }
 
+// 从 FlowContext.view 中推断记录的 context params 信息
+export function inferViewRecordRef(ctx: FlowContext): RecordRef | undefined {
+  const view = ctx.view;
+  if (!view) return undefined;
+  const inputArgs = (view as any)?.inputArgs || {};
+  const collection = inputArgs?.collectionName || (view as any)?.record?.collection;
+  const dataSourceKey = inputArgs?.dataSourceKey || (view as any)?.record?.dataSourceKey || 'main';
+  const filterByTk = inputArgs?.filterByTk || (view as any)?.record?.filterByTk;
+  const sourceId = inputArgs?.sourceId;
+  if (!collection || typeof filterByTk === 'undefined' || filterByTk === null) return undefined;
+  return { collection, dataSourceKey, filterByTk, sourceId };
+}
+
 export function inferParentRecordRef(ctx: FlowContext): RecordRef | undefined {
   const resource = getResource(ctx);
   const dataSourceKey = getCollection(ctx)?.dataSourceKey || resource?.getDataSourceKey?.();
-  const rn = resource?.getResourceName?.();
+  const resourceName = resource?.getResourceName?.();
   const sourceId = resource?.getSourceId?.();
-  if (!rn || typeof sourceId === 'undefined' || sourceId === null) return undefined;
-  const parts = String(rn).split('.');
+  if (!resourceName || typeof sourceId === 'undefined' || sourceId === null) return undefined;
+  const parts = String(resourceName).split('.');
   if (parts.length < 2) return undefined;
   return { collection: parts[0], dataSourceKey, filterByTk: sourceId };
 }
@@ -110,8 +124,11 @@ export function createRecordMetaFactory(
 export function createCurrentRecordMetaFactory(
   ctx: FlowContext,
   collectionAccessor: () => Collection | null,
+  options?: { title?: string },
 ): PropertyMetaFactory {
-  const title = (ctx as any)?.t?.('Current record') || 'Current record';
+  const title = options?.title
+    ? ctx.t?.(options.title) || options.title
+    : ctx.t?.('Current record') || 'Current record';
   return createRecordMetaFactory(collectionAccessor, title, (c) => inferRecordRef(c));
 }
 
@@ -141,35 +158,30 @@ export async function collectContextParamsForTemplate(
   ctx: FlowContext,
   template: JSONValue,
 ): Promise<ServerContextParams | undefined> {
-  try {
-    const usage = _extractUsedVariablePaths(template) || {};
-    const varNames = Object.keys(usage);
-    if (!varNames.length) return undefined;
-
-    const input: Record<string, any> = {};
-    for (const key of varNames) {
-      const opt = (ctx as any).getPropertyOptions?.(key);
-      const meta: PropertyMeta | (() => Promise<PropertyMeta | null> | PropertyMeta | null) | undefined = opt?.meta;
-      if (!meta) continue;
-      let built: any;
-      try {
-        const resolvedMeta = typeof meta === 'function' ? await (meta as any)() : (meta as any);
-        const builder = resolvedMeta?.buildVariablesParams;
-        if (typeof builder === 'function') {
-          built = await builder(ctx);
-        }
-      } catch (err) {
-        // 忽略构建变量参数时的异常，继续处理其他变量
-        // 使用 void 引用以避免 no-unused-vars，同时避免空代码块触发 no-empty
-        void err;
-        continue;
-      }
-      if (built) {
-        input[key] = built;
+  const usage = _extractUsedVariablePaths(template) || {};
+  const varNames = Object.keys(usage);
+  if (!varNames.length) return undefined;
+
+  const input: Record<string, any> = {};
+  for (const key of varNames) {
+    const opt = ctx.getPropertyOptions?.(key);
+    const meta: PropertyMeta | (() => Promise<PropertyMeta | null> | PropertyMeta | null) | undefined = opt?.meta;
+    if (!meta) continue;
+    let built: any;
+    try {
+      const resolvedMeta = typeof meta === 'function' ? await (meta as any)() : (meta as any);
+      const builder = resolvedMeta?.buildVariablesParams;
+      if (typeof builder === 'function') {
+        built = await builder(ctx);
       }
+    } catch (err) {
+      // 忽略构建变量参数时的异常，继续处理其他变量
+      void err;
+      continue;
+    }
+    if (built) {
+      input[key] = built;
     }
-    return buildServerContextParams(ctx, input);
-  } catch (_) {
-    return undefined;
   }
+  return buildServerContextParams(ctx, input);
 }

package/src/views/PageComponent.tsx

@@ -24,7 +24,7 @@ export const PageComponent = forwardRef((props: any, ref) => {
     hidden,
     title: _title,
     styles = {},
-    zIndex,
+    zIndex = 4, // 这个默认值是为了防止表格的阴影显示到子页面上面
   } = mergedProps;
   const closedRef = useRef(false);
   const flowEngine = useFlowEngine();