@nocobase/flow-engine 2.0.0-alpha.7 → 2.0.0-alpha.71

package/lib/utils/safeGlobals.d.ts

@@ -6,11 +6,9 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-/**
- * 统一的安全全局对象代理：window/document
- * - 默认仅允许常用的定时器、console、Math、Date、addEventListener（绑定原 window）
- * - document 仅允许 createElement/querySelector/querySelectorAll
- * - 不允许随意访问未声明的属性，最小权限原则
- */
-export declare function createSafeWindow(extra?: Record<string, any>): {};
-export declare function createSafeDocument(extra?: Record<string, any>): {};
+export declare function registerRunJSSafeWindowGlobals(keys: Iterable<string> | null | undefined): void;
+export declare function registerRunJSSafeDocumentGlobals(keys: Iterable<string> | null | undefined): void;
+export declare function __resetRunJSSafeGlobalsRegistryForTests(): void;
+export declare function createSafeWindow(extra?: Record<string, any>): Record<string, any>;
+export declare function createSafeDocument(extra?: Record<string, any>): Record<string, any>;
+export declare function createSafeNavigator(extra?: Record<string, any>): {};

package/lib/utils/safeGlobals.js

@@ -27,13 +27,73 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var safeGlobals_exports = {};
 __export(safeGlobals_exports, {
+  __resetRunJSSafeGlobalsRegistryForTests: () => __resetRunJSSafeGlobalsRegistryForTests,
   createSafeDocument: () => createSafeDocument,
-  createSafeWindow: () => createSafeWindow
+  createSafeNavigator: () => createSafeNavigator,
+  createSafeWindow: () => createSafeWindow,
+  registerRunJSSafeDocumentGlobals: () => registerRunJSSafeDocumentGlobals,
+  registerRunJSSafeWindowGlobals: () => registerRunJSSafeWindowGlobals
 });
 module.exports = __toCommonJS(safeGlobals_exports);
+function getRunJSSafeGlobalsRegistry() {
+  var _a, _b;
+  const g = globalThis;
+  if (((_a = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _a.windowAllow) && ((_b = g.__nocobaseRunJSSafeGlobalsRegistry) == null ? void 0 : _b.documentAllow)) {
+    return g.__nocobaseRunJSSafeGlobalsRegistry;
+  }
+  const reg = {
+    windowAllow: /* @__PURE__ */ new Set(),
+    documentAllow: /* @__PURE__ */ new Set()
+  };
+  g.__nocobaseRunJSSafeGlobalsRegistry = reg;
+  return reg;
+}
+__name(getRunJSSafeGlobalsRegistry, "getRunJSSafeGlobalsRegistry");
+function registerRunJSSafeWindowGlobals(keys) {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== "string") continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.windowAllow.add(key);
+  }
+}
+__name(registerRunJSSafeWindowGlobals, "registerRunJSSafeWindowGlobals");
+function registerRunJSSafeDocumentGlobals(keys) {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== "string") continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.documentAllow.add(key);
+  }
+}
+__name(registerRunJSSafeDocumentGlobals, "registerRunJSSafeDocumentGlobals");
+function __resetRunJSSafeGlobalsRegistryForTests() {
+  var _a, _b, _c, _d;
+  const g = globalThis;
+  if (g.__nocobaseRunJSSafeGlobalsRegistry) {
+    try {
+      (_b = (_a = g.__nocobaseRunJSSafeGlobalsRegistry.windowAllow) == null ? void 0 : _a.clear) == null ? void 0 : _b.call(_a);
+      (_d = (_c = g.__nocobaseRunJSSafeGlobalsRegistry.documentAllow) == null ? void 0 : _c.clear) == null ? void 0 : _d.call(_c);
+    } catch {
+    }
+  }
+}
+__name(__resetRunJSSafeGlobalsRegistryForTests, "__resetRunJSSafeGlobalsRegistryForTests");
+function isAllowedDynamicWindowKey(key) {
+  return getRunJSSafeGlobalsRegistry().windowAllow.has(key);
+}
+__name(isAllowedDynamicWindowKey, "isAllowedDynamicWindowKey");
+function isAllowedDynamicDocumentKey(key) {
+  return getRunJSSafeGlobalsRegistry().documentAllow.has(key);
+}
+__name(isAllowedDynamicDocumentKey, "isAllowedDynamicDocumentKey");
 function createSafeWindow(extra) {
   const getSafeBaseHref = /* @__PURE__ */ __name(() => `${window.location.origin}${window.location.pathname}`, "getSafeBaseHref");
-  const safeOpen = /* @__PURE__ */ __name((url, target, features) => {
+  const safeOpen = /* @__PURE__ */ __name((url, target2, features) => {
     const isSafeUrl = /* @__PURE__ */ __name((u) => {
       try {
         const parsed = new URL(u, getSafeBaseHref());
@@ -110,7 +170,7 @@ function createSafeWindow(extra) {
           case "replace":
             return (u) => guardedNavigate(u, { replace: true });
           case "reload":
-            throw new Error("Access to location.reload is not allowed.");
+            return window.location.reload.bind(window.location);
           case "href":
             throw new Error("Reading location.href is not allowed.");
           default:
@@ -135,6 +195,9 @@ function createSafeWindow(extra) {
     console,
     Math,
     Date,
+    FormData,
+    ...typeof Blob !== "undefined" ? { Blob } : {},
+    ...typeof URL !== "undefined" ? { URL } : {},
     // 事件侦听仅绑定到真实 window，便于少量需要的全局监听
     addEventListener: addEventListener.bind(window),
     // 安全的 window.open 代理
@@ -143,15 +206,40 @@ function createSafeWindow(extra) {
     location: safeLocation,
     ...extra || {}
   };
-  return new Proxy(
-    {},
-    {
-      get(_target, prop) {
-        if (prop in allowedGlobals) return allowedGlobals[prop];
-        throw new Error(`Access to global property "${prop}" is not allowed.`);
+  const target = /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get(t, prop) {
+      if (typeof prop !== "string") {
+        return Reflect.get(t, prop);
+      }
+      if (prop in allowedGlobals) return allowedGlobals[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
+      if (isAllowedDynamicWindowKey(prop)) {
+        const v = window[prop];
+        if (typeof v === "function") return v.bind(window);
+        return v;
       }
+      throw new Error(`Access to global property "${prop}" is not allowed.`);
+    },
+    set(t, prop, value) {
+      if (typeof prop !== "string") {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowedGlobals) {
+        throw new Error(`Mutation of global property "${prop}" is not allowed.`);
+      }
+      t[prop] = value;
+      return true;
+    },
+    has(t, prop) {
+      if (typeof prop !== "string") return Reflect.has(t, prop);
+      if (prop in allowedGlobals) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicWindowKey(prop)) return true;
+      return false;
     }
-  );
+  });
 }
 __name(createSafeWindow, "createSafeWindow");
 function createSafeDocument(extra) {
@@ -161,19 +249,86 @@ function createSafeDocument(extra) {
     querySelectorAll: document.querySelectorAll.bind(document),
     ...extra || {}
   };
+  const target = /* @__PURE__ */ Object.create(null);
+  return new Proxy(target, {
+    get(t, prop) {
+      if (typeof prop !== "string") {
+        return Reflect.get(t, prop);
+      }
+      if (prop in allowed) return allowed[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return t[prop];
+      if (isAllowedDynamicDocumentKey(prop)) {
+        const v = document[prop];
+        if (typeof v === "function") return v.bind(document);
+        return v;
+      }
+      throw new Error(`Access to document property "${prop}" is not allowed.`);
+    },
+    set(t, prop, value) {
+      if (typeof prop !== "string") {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowed) {
+        throw new Error(`Mutation of document property "${prop}" is not allowed.`);
+      }
+      t[prop] = value;
+      return true;
+    },
+    has(t, prop) {
+      if (typeof prop !== "string") return Reflect.has(t, prop);
+      if (prop in allowed) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicDocumentKey(prop)) return true;
+      return false;
+    }
+  });
+}
+__name(createSafeDocument, "createSafeDocument");
+function createSafeNavigator(extra) {
+  var _a;
+  const nav = typeof window !== "undefined" && window.navigator || void 0;
+  const clipboard = {};
+  const writeText = (_a = nav == null ? void 0 : nav.clipboard) == null ? void 0 : _a.writeText;
+  if (typeof writeText === "function") {
+    clipboard.writeText = writeText.bind(nav.clipboard);
+  }
+  const allowed = {
+    clipboard
+  };
+  Object.defineProperty(allowed, "onLine", {
+    get: /* @__PURE__ */ __name(() => !!(nav == null ? void 0 : nav.onLine), "get"),
+    enumerable: true,
+    configurable: false
+  });
+  Object.defineProperty(allowed, "language", {
+    get: /* @__PURE__ */ __name(() => nav == null ? void 0 : nav.language, "get"),
+    enumerable: true,
+    configurable: false
+  });
+  Object.defineProperty(allowed, "languages", {
+    get: /* @__PURE__ */ __name(() => (nav == null ? void 0 : nav.languages) ? [...nav.languages] : void 0, "get"),
+    enumerable: true,
+    configurable: false
+  });
+  Object.assign(allowed, extra || {});
   return new Proxy(
     {},
     {
-      get(_target, prop) {
+      get(_t, prop) {
         if (prop in allowed) return allowed[prop];
-        throw new Error(`Access to document property "${prop}" is not allowed.`);
+        throw new Error(`Access to navigator property "${String(prop)}" is not allowed.`);
       }
     }
   );
 }
-__name(createSafeDocument, "createSafeDocument");
+__name(createSafeNavigator, "createSafeNavigator");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  __resetRunJSSafeGlobalsRegistryForTests,
   createSafeDocument,
-  createSafeWindow
+  createSafeNavigator,
+  createSafeWindow,
+  registerRunJSSafeDocumentGlobals,
+  registerRunJSSafeWindowGlobals
 });

package/lib/utils/schema-utils.d.ts

@@ -38,3 +38,9 @@ export declare function compileUiSchema(scope: Record<string, any>, uiSchema: an
  * @returns 合并后的uiSchema对象，如果为空则返回null
  */
 export declare function resolveStepUiSchema<TModel extends FlowModel = FlowModel>(model: TModel, flow: any, step: StepDefinition): Promise<Record<string, ISchema> | null>;
+/**
+ * 判断步骤在设置菜单中是否应被隐藏。
+ * - 支持 StepDefinition.hideInSettings 与 ActionDefinition.hideInSettings（step 优先）。
+ * - hideInSettings 可为布尔值或函数（接收 FlowRuntimeContext）。
+ */
+export declare function shouldHideStepInSettings<TModel extends FlowModel = FlowModel>(model: TModel, flow: any, step: StepDefinition): Promise<boolean>;

package/lib/utils/schema-utils.js

@@ -29,7 +29,8 @@ var schema_utils_exports = {};
 __export(schema_utils_exports, {
   compileUiSchema: () => compileUiSchema,
   resolveStepUiSchema: () => resolveStepUiSchema,
-  resolveUiMode: () => resolveUiMode
+  resolveUiMode: () => resolveUiMode,
+  shouldHideStepInSettings: () => shouldHideStepInSettings
 });
 module.exports = __toCommonJS(schema_utils_exports);
 var import_json_schema = require("@formily/json-schema");
@@ -68,6 +69,28 @@ async function resolveUiMode(uiMode, ctx) {
 }
 __name(resolveUiMode, "resolveUiMode");
 const compileCache = {};
+const hasFunctionValue = /* @__PURE__ */ __name((source) => {
+  if (typeof source === "function") return true;
+  if (!source || typeof source !== "object") return false;
+  const seen = /* @__PURE__ */ new WeakSet();
+  const walk = /* @__PURE__ */ __name((val) => {
+    if (typeof val === "function") return true;
+    if (!val || typeof val !== "object") return false;
+    if (seen.has(val)) return false;
+    seen.add(val);
+    if (Array.isArray(val)) {
+      for (const it of val) {
+        if (walk(it)) return true;
+      }
+      return false;
+    }
+    for (const k of Object.keys(val)) {
+      if (walk(val[k])) return true;
+    }
+    return false;
+  }, "walk");
+  return walk(source);
+}, "hasFunctionValue");
 function compileUiSchema(scope, uiSchema, options = {}) {
   const { noCache = false } = options;
   const hasVariable = /* @__PURE__ */ __name((source) => {
@@ -88,8 +111,17 @@ function compileUiSchema(scope, uiSchema, options = {}) {
         console.warn("Failed to stringify:", e);
         return source;
       }
-      if (compileCache[cacheKey]) return compileCache[cacheKey];
       shouldCompile = hasVariable(cacheKey);
+      const hasFn = shouldCompile && !noCache ? hasFunctionValue(source) : false;
+      if (compileCache[cacheKey] && !noCache && !hasFn) return compileCache[cacheKey];
+      if (hasFn) {
+        try {
+          return import_json_schema.Schema.compile(source, scope);
+        } catch (error) {
+          console.warn("Failed to compile with Formily Schema.compile:", error);
+          return source;
+        }
+      }
     }
     if (Array.isArray(source)) {
       try {
@@ -98,8 +130,17 @@ function compileUiSchema(scope, uiSchema, options = {}) {
         console.warn("Failed to stringify:", e);
         return source;
       }
-      if (compileCache[cacheKey]) return compileCache[cacheKey];
       shouldCompile = hasVariable(cacheKey);
+      const hasFn = shouldCompile && !noCache ? hasFunctionValue(source) : false;
+      if (compileCache[cacheKey] && !noCache && !hasFn) return compileCache[cacheKey];
+      if (hasFn) {
+        try {
+          return import_json_schema.Schema.compile(source, scope);
+        } catch (error) {
+          console.warn("Failed to compile with Formily Schema.compile:", error);
+          return source;
+        }
+      }
     }
     if (shouldCompile) {
       if (!cacheKey) {
@@ -131,14 +172,14 @@ function compileUiSchema(scope, uiSchema, options = {}) {
 }
 __name(compileUiSchema, "compileUiSchema");
 async function resolveStepUiSchema(model, flow, step) {
-  var _a, _b;
+  var _a;
   const flowRuntimeContext = new import_flowContext.FlowRuntimeContext(model, flow.key, "settings");
   (0, import_setupRuntimeContextSteps.setupRuntimeContextSteps)(flowRuntimeContext, flow.steps, model, flow.key);
   flowRuntimeContext.defineProperty("currentStep", { value: step });
   let stepUiSchema = step.uiSchema;
   if (step.use) {
     try {
-      const action = (_b = (_a = model.flowEngine) == null ? void 0 : _a.getAction) == null ? void 0 : _b.call(_a, step.use);
+      const action = (_a = model.getAction) == null ? void 0 : _a.call(model, step.use);
       if (action && action.uiSchema) {
         stepUiSchema = stepUiSchema || action.uiSchema;
       }
@@ -153,9 +194,33 @@ async function resolveStepUiSchema(model, flow, step) {
   return resolvedStepUiSchema;
 }
 __name(resolveStepUiSchema, "resolveStepUiSchema");
+async function shouldHideStepInSettings(model, flow, step) {
+  var _a;
+  if (!step) return true;
+  let hideInSettings = step.hideInSettings;
+  if (typeof hideInSettings === "undefined" && step.use) {
+    const action = (_a = model.getAction) == null ? void 0 : _a.call(model, step.use);
+    hideInSettings = action == null ? void 0 : action.hideInSettings;
+  }
+  if (typeof hideInSettings === "function") {
+    try {
+      const ctx = new import_flowContext.FlowRuntimeContext(model, flow.key, "settings");
+      (0, import_setupRuntimeContextSteps.setupRuntimeContextSteps)(ctx, flow.steps, model, flow.key);
+      ctx.defineProperty("currentStep", { value: step });
+      const result = await hideInSettings(ctx);
+      return !!result;
+    } catch (error) {
+      console.warn(`Error evaluating hideInSettings for step '${step.key || ""}' in flow '${flow.key}':`, error);
+      return false;
+    }
+  }
+  return !!hideInSettings;
+}
+__name(shouldHideStepInSettings, "shouldHideStepInSettings");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   compileUiSchema,
   resolveStepUiSchema,
-  resolveUiMode
+  resolveUiMode,
+  shouldHideStepInSettings
 });

package/lib/utils/serverContextParams.d.ts

@@ -12,6 +12,8 @@ export type RecordRef = {
     id?: any;
     filterByTk?: any;
     dataSourceKey?: string;
+    associationName?: string;
+    sourceId?: any;
     fields?: string[];
     appends?: string[];
     record?: any;
@@ -22,6 +24,8 @@ export type NormalizedRecordParams = {
     collection: string;
     filterByTk: any;
     dataSourceKey?: string;
+    associationName?: string;
+    sourceId?: any;
     fields?: string[];
     appends?: string[];
 };

package/lib/utils/serverContextParams.js

@@ -63,6 +63,8 @@ function normalizeOne(ctx, ref) {
     collection,
     filterByTk,
     dataSourceKey,
+    associationName: ref.associationName,
+    sourceId: ref.sourceId,
     fields: ref.fields,
     appends: ref.appends
   });

package/lib/utils/translation.d.ts

@@ -14,5 +14,8 @@ import type { FlowModel } from '../models';
  * @returns 翻译函数，自动使用 flow-engine 命名空间
  */
 export declare function getT(model: FlowModel): (key: string, options?: any) => string;
+export declare function tExpr(text: TFuncKey | TFuncKey[], options?: TOptions): string;
+/**
+ * @deprecated use tExpr from `@nocobase/flow-engine` instead
+ */
 export declare function escapeT(text: TFuncKey | TFuncKey[], options?: TOptions): string;
-export { escapeT as tExpr };

package/lib/utils/translation.js

@@ -29,7 +29,7 @@ var translation_exports = {};
 __export(translation_exports, {
   escapeT: () => escapeT,
   getT: () => getT,
-  tExpr: () => escapeT
+  tExpr: () => tExpr
 });
 module.exports = __toCommonJS(translation_exports);
 var import_constants = require("./constants");
@@ -43,12 +43,16 @@ function getT(model) {
   return (key) => key;
 }
 __name(getT, "getT");
-function escapeT(text, options) {
+function tExpr(text, options) {
   if (options) {
     return `{{t(${JSON.stringify(text)}, ${JSON.stringify(options)})}}`;
   }
   return `{{t(${JSON.stringify(text)})}}`;
 }
+__name(tExpr, "tExpr");
+function escapeT(text, options) {
+  return tExpr(text, options);
+}
 __name(escapeT, "escapeT");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/lib/utils/variablesParams.d.ts

@@ -6,11 +6,26 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-import type { FlowContext, PropertyMeta, PropertyMetaFactory } from '../flowContext';
-import type { JSONValue } from './params-resolvers';
+import { extractUsedVariableNames as _extractUsedVariableNames, extractUsedVariablePaths as _extractUsedVariablePaths } from '@nocobase/shared';
 import type { Collection } from '../data-source';
+import type { FlowContext, PropertyMeta, PropertyMetaFactory } from '../flowContext';
 import { type RecordRef, type ServerContextParams } from '../utils/serverContextParams';
+import type { JSONValue } from './params-resolvers';
 export declare function inferRecordRef(ctx: FlowContext): RecordRef | undefined;
+export declare function inferViewRecordRef(ctx: FlowContext): RecordRef | undefined;
+export declare function getViewRecordFromParent(flowContext: FlowContext, viewContext: FlowContext): unknown;
+export declare function createViewRecordResolveOnServer(ctx: FlowContext, getLocalRecord: () => unknown): (subPath: string) => boolean;
+/**
+ * 创建一个用于 “ctx.record” 变量的 resolveOnServer 判定函数：
+ * - 若本地 record 不存在：统一走服务端；
+ * - 若本地 record 存在：
+ *   - 访问空子路径（"{{ ctx.record }}"）时使用本地值，不走服务端；
+ *   - 访问非关联字段（如 id/title）：使用本地值；
+ *   - 访问关联字段：
+ *     - 若本地该字段无值（undefined/null），则交给服务端解析（无论是 "author" 还是 "author.name"）；
+ *     - 若本地已有值，则仅在访问子属性且本地缺少该子属性值时交给服务端。
+ */
+export declare function createRecordResolveOnServerWithLocal(collectionAccessor: () => Collection | null, valueAccessor: () => unknown): (subPath: string) => boolean;
 export declare function inferParentRecordRef(ctx: FlowContext): RecordRef | undefined;
 export type RecordParamsBuilder = (ctx: FlowContext) => RecordRef | Promise<RecordRef> | undefined;
 /**
@@ -27,12 +42,14 @@ export declare function createRecordMetaFactory(collectionAccessor: () => Collec
  * - Title: t('Current record')
  * - Params: inferRecordRef(ctx)
  */
-export declare function createCurrentRecordMetaFactory(ctx: FlowContext, collectionAccessor: () => Collection | null): PropertyMetaFactory;
+export declare function createCurrentRecordMetaFactory(ctx: FlowContext, collectionAccessor: () => Collection | null, options?: {
+    title?: string;
+}): PropertyMetaFactory;
 /**
  * Extract top-level ctx variable names used inside a JSON template.
  * Supports dot and bracket notations, e.g. {{ ctx.record.id }}, {{ ctx['parentRecord'].name }}.
  */
-export declare const extractUsedVariableNames: any;
+export declare const extractUsedVariableNames: typeof _extractUsedVariableNames;
 /**
  * Extract used top-level ctx variables with their subpaths.
  * Returns a map: varName -> string[] subPaths
@@ -42,7 +59,7 @@ export declare const extractUsedVariableNames: any;
  *  - {{ ctx.view.record.id }} => { view: ['record.id'] }
  *  - {{ ctx.twice(21) }}      => { twice: [''] } // method call -> empty subPath
  */
-export declare const extractUsedVariablePaths: any;
+export declare const extractUsedVariablePaths: typeof _extractUsedVariablePaths;
 /**
  * 根据模板中用到的 ctx 变量，收集并构建服务端解析所需的 contextParams。
  * - 通过 FlowContext 的 PropertyMeta.buildVariablesParams 收集 RecordRef