@nocobase/flow-engine 2.0.0-beta.2 → 2.0.0-beta.20

package/src/utils/safeGlobals.ts

@@ -15,6 +15,66 @@
  * - 不允许随意访问未声明的属性，最小权限原则
  */
 
+type RunJSSafeGlobalsRegistry = {
+  windowAllow: Set<string>;
+  documentAllow: Set<string>;
+};
+
+function getRunJSSafeGlobalsRegistry(): RunJSSafeGlobalsRegistry {
+  const g: any = globalThis as any;
+  if (g.__nocobaseRunJSSafeGlobalsRegistry?.windowAllow && g.__nocobaseRunJSSafeGlobalsRegistry?.documentAllow) {
+    return g.__nocobaseRunJSSafeGlobalsRegistry as RunJSSafeGlobalsRegistry;
+  }
+  const reg: RunJSSafeGlobalsRegistry = {
+    windowAllow: new Set<string>(),
+    documentAllow: new Set<string>(),
+  };
+  g.__nocobaseRunJSSafeGlobalsRegistry = reg;
+  return reg;
+}
+
+export function registerRunJSSafeWindowGlobals(keys: Iterable<string> | null | undefined): void {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== 'string') continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.windowAllow.add(key);
+  }
+}
+
+export function registerRunJSSafeDocumentGlobals(keys: Iterable<string> | null | undefined): void {
+  if (!keys) return;
+  const reg = getRunJSSafeGlobalsRegistry();
+  for (const k of keys) {
+    if (typeof k !== 'string') continue;
+    const key = k.trim();
+    if (!key) continue;
+    reg.documentAllow.add(key);
+  }
+}
+
+export function __resetRunJSSafeGlobalsRegistryForTests(): void {
+  const g: any = globalThis as any;
+  if (g.__nocobaseRunJSSafeGlobalsRegistry) {
+    try {
+      g.__nocobaseRunJSSafeGlobalsRegistry.windowAllow?.clear?.();
+      g.__nocobaseRunJSSafeGlobalsRegistry.documentAllow?.clear?.();
+    } catch {
+      // ignore
+    }
+  }
+}
+
+function isAllowedDynamicWindowKey(key: string): boolean {
+  return getRunJSSafeGlobalsRegistry().windowAllow.has(key);
+}
+
+function isAllowedDynamicDocumentKey(key: string): boolean {
+  return getRunJSSafeGlobalsRegistry().documentAllow.has(key);
+}
+
 export function createSafeWindow(extra?: Record<string, any>) {
   // 解析相对 URL 使用脱敏 base（不含 query/hash），避免在解析时泄露敏感信息
   const getSafeBaseHref = () => `${window.location.origin}${window.location.pathname}`;
@@ -160,15 +220,44 @@ export function createSafeWindow(extra?: Record<string, any>) {
     ...(extra || {}),
   };
 
-  return new Proxy(
-    {},
-    {
-      get(_target, prop: string) {
-        if (prop in allowedGlobals) return allowedGlobals[prop];
-        throw new Error(`Access to global property "${prop}" is not allowed.`);
-      },
+  const target: Record<string, any> = Object.create(null);
+
+  return new Proxy(target, {
+    get(t, prop: string | symbol) {
+      if (typeof prop !== 'string') {
+        return Reflect.get(t, prop);
+      }
+
+      if (prop in allowedGlobals) return allowedGlobals[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return (t as any)[prop];
+      if (isAllowedDynamicWindowKey(prop)) {
+        const v = (window as any)[prop];
+        // Bind functions to the real window to avoid Illegal invocation
+        if (typeof v === 'function') return v.bind(window);
+        return v;
+      }
+
+      throw new Error(`Access to global property "${prop}" is not allowed.`);
     },
-  );
+    set(t, prop: string | symbol, value: any) {
+      if (typeof prop !== 'string') {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowedGlobals) {
+        throw new Error(`Mutation of global property "${prop}" is not allowed.`);
+      }
+      (t as any)[prop] = value;
+      return true;
+    },
+    has(t, prop: string | symbol) {
+      if (typeof prop !== 'string') return Reflect.has(t, prop);
+      if (prop in allowedGlobals) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicWindowKey(prop)) return true;
+      return false;
+    },
+  });
 }
 
 export function createSafeDocument(extra?: Record<string, any>) {
@@ -178,15 +267,43 @@ export function createSafeDocument(extra?: Record<string, any>) {
     querySelectorAll: document.querySelectorAll.bind(document),
     ...(extra || {}),
   };
-  return new Proxy(
-    {},
-    {
-      get(_target, prop: string) {
-        if (prop in allowed) return allowed[prop];
-        throw new Error(`Access to document property "${prop}" is not allowed.`);
-      },
+  const target: Record<string, any> = Object.create(null);
+  return new Proxy(target, {
+    get(t, prop: string | symbol) {
+      if (typeof prop !== 'string') {
+        return Reflect.get(t, prop);
+      }
+
+      if (prop in allowed) return allowed[prop];
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return (t as any)[prop];
+      if (isAllowedDynamicDocumentKey(prop)) {
+        const v = (document as any)[prop];
+        // Bind functions to the real document to avoid Illegal invocation
+        if (typeof v === 'function') return v.bind(document);
+        return v;
+      }
+
+      throw new Error(`Access to document property "${prop}" is not allowed.`);
     },
-  );
+    set(t, prop: string | symbol, value: any) {
+      if (typeof prop !== 'string') {
+        Reflect.set(t, prop, value);
+        return true;
+      }
+      if (prop in allowed) {
+        throw new Error(`Mutation of document property "${prop}" is not allowed.`);
+      }
+      (t as any)[prop] = value;
+      return true;
+    },
+    has(t, prop: string | symbol) {
+      if (typeof prop !== 'string') return Reflect.has(t, prop);
+      if (prop in allowed) return true;
+      if (Object.prototype.hasOwnProperty.call(t, prop)) return true;
+      if (isAllowedDynamicDocumentKey(prop)) return true;
+      return false;
+    },
+  });
 }
 
 export function createSafeNavigator(extra?: Record<string, any>) {

package/src/views/__tests__/FlowView.usePage.test.tsx

@@ -13,7 +13,7 @@ import { render, act, waitFor, screen } from '@testing-library/react';
 import { FlowEngine } from '../../flowEngine';
 import { FlowEngineProvider } from '../../provider';
 import { FlowViewer } from '../FlowView';
-import { usePage } from '../usePage';
+import { usePage, GLOBAL_EMBED_CONTAINER_ID } from '../usePage';
 import { App, ConfigProvider } from 'antd';
 
 describe('FlowViewer zIndex with usePage', () => {
@@ -130,4 +130,57 @@ describe('FlowViewer zIndex with usePage', () => {
 
     unmount();
   });
+
+  it('replaces previous embed view when using global #nocobase-embed-container target', async () => {
+    let api: { open: (config: any, flowContext: any) => any } | undefined;
+
+    function TestApp({ onReady }: { onReady: (page: any) => void }) {
+      const [page, pageHolder] = usePage() as [{ open: (config: any, flowContext: any) => any }, React.ReactNode];
+
+      React.useEffect(() => {
+        onReady(page);
+      }, [page, onReady]);
+
+      return <>{pageHolder}</>;
+    }
+
+    const Wrapper: React.FC<{ onReady: (page: any) => void }> = ({ onReady }) => (
+      <ConfigProvider>
+        <App>
+          <FlowEngineProvider engine={engine}>
+            <TestApp onReady={onReady} />
+          </FlowEngineProvider>
+        </App>
+      </ConfigProvider>
+    );
+
+    const target = document.createElement('div');
+    target.id = GLOBAL_EMBED_CONTAINER_ID;
+    document.body.appendChild(target);
+
+    const { unmount } = render(
+      <Wrapper
+        onReady={(page) => {
+          api = page;
+        }}
+      />,
+    );
+
+    await waitFor(() => expect(api).toBeDefined());
+
+    await act(async () => {
+      api!.open({ target, content: <div data-testid="page1">Page 1</div> }, engine.context);
+    });
+    await waitFor(() => expect(screen.getByTestId('page1')).toBeInTheDocument());
+
+    // Opening page2 into the global embed container should destroy page1 (replace behavior).
+    await act(async () => {
+      api!.open({ target, content: <div data-testid="page2">Page 2</div> }, engine.context);
+    });
+    await waitFor(() => expect(screen.getByTestId('page2')).toBeInTheDocument());
+    expect(screen.queryByTestId('page1')).not.toBeInTheDocument();
+
+    unmount();
+    document.body.removeChild(target);
+  });
 });

package/src/views/__tests__/useDialog.closeDestroy.test.tsx

@@ -14,30 +14,28 @@ import { useDialog } from '../useDialog';
 import { FlowContext } from '../../flowContext';
 
 // Mock dependencies
-vi.mock('../provider', () => ({
+vi.mock('../../provider', () => ({
   FlowEngineProvider: ({ children }) => children,
 }));
 
-vi.mock('../FlowContextProvider', () => ({
+vi.mock('../../FlowContextProvider', () => ({
   FlowViewContextProvider: ({ children }) => children,
 }));
 
-vi.mock('../ViewScopedFlowEngine', () => ({
+vi.mock('../../ViewScopedFlowEngine', () => ({
   createViewScopedEngine: (engine) => ({
     context: new FlowContext(),
     unlinkFromStack: vi.fn(),
+    // mimic real view stack linkage: previousEngine points to the last engine in chain
+    previousEngine: (engine as any)?.nextEngine || engine,
   }),
 }));
 
-vi.mock('../utils/variablesParams', () => ({
+vi.mock('../../utils/variablesParams', () => ({
   createViewRecordResolveOnServer: vi.fn(),
   getViewRecordFromParent: vi.fn(),
 }));
 
-vi.mock('../createViewMeta', () => ({
-  registerPopupVariable: vi.fn(),
-}));
-
 vi.mock('../DialogComponent', () => ({
   default: ({ children }) => <div>{children}</div>,
 }));
@@ -52,8 +50,12 @@ vi.mock('../usePatchElement', () => ({
 describe('useDialog - close/destroy logic', () => {
   const createMockFlowContext = () => {
     const ctx = new FlowContext();
+    ctx.defineMethod('t', (key: string) => key);
     ctx.engine = {
       context: new FlowContext(),
+      emitter: {
+        emit: vi.fn(),
+      },
     };
     return ctx;
   };
@@ -129,4 +131,29 @@ describe('useDialog - close/destroy logic', () => {
     // Should not call destroy directly, let router handle it
     expect(mockCloseFunc).not.toHaveBeenCalled();
   });
+
+  it('should emit view activated event on opener engine', () => {
+    const api = renderUseDialog();
+    const flowContext = createMockFlowContext();
+    const emitSpy = flowContext.engine.emitter.emit;
+
+    const dialog = api.open({ inputArgs: { viewUid: 'child-view' } }, flowContext);
+
+    dialog.close();
+    expect(emitSpy).toHaveBeenCalledWith('view:activated', expect.anything());
+  });
+
+  it('should emit view events on immediate opener engine (previousEngine) when present', () => {
+    const api = renderUseDialog();
+    const flowContext = createMockFlowContext();
+    const rootEmitSpy = flowContext.engine.emitter.emit;
+    const openerEmitSpy = vi.fn();
+    (flowContext.engine as any).nextEngine = { emitter: { emit: openerEmitSpy }, __NOCOBASE_ENGINE_SCOPE__: 'view' };
+
+    const dialog = api.open({ inputArgs: { viewUid: 'child-view' } }, flowContext);
+
+    dialog.close();
+    expect(openerEmitSpy).toHaveBeenCalledWith('view:activated', expect.anything());
+    expect(rootEmitSpy).not.toHaveBeenCalledWith('view:activated', expect.anything());
+  });
 });

package/src/views/__tests__/viewEvents.resolveOpenerEngine.test.ts

@@ -0,0 +1,28 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { FlowEngine } from '../../flowEngine';
+import { createViewScopedEngine } from '../../ViewScopedFlowEngine';
+import { resolveOpenerEngine } from '../viewEvents';
+
+describe('viewEvents.resolveOpenerEngine', () => {
+  it('prefers the parent view engine even when it is not the stack tail (cached page scenario)', () => {
+    const root = new FlowEngine();
+    const pageA = createViewScopedEngine(root);
+    createViewScopedEngine(root); // pageB appended after pageA
+
+    // Open a dialog from pageA while another kept-alive view exists after it.
+    // view scoped engines always link to the tail, so the dialog's previousEngine will be pageB.
+    const dialog = createViewScopedEngine(pageA);
+
+    const opener = resolveOpenerEngine(pageA, dialog);
+    expect(opener).toBe(pageA);
+  });
+});

package/src/views/createViewMeta.ts

@@ -70,66 +70,6 @@ function makeMetaFromValue(value: any, title?: string, seen?: WeakSet<any>): any
   return { type: 'any', title };
 }
 
-/**
- * Create a meta factory for ctx.view that includes:
- * - buildVariablesParams: { record } via inferRecordRef
- * - properties.record: full collection meta via buildRecordMeta
- * - type/preventClose/inputArgs/navigation fields for better variable selection UX
- */
-export function createViewMeta(ctx: FlowContext): PropertyMetaFactory {
-  const viewTitle = ctx.t('当前视图');
-  const factory: PropertyMetaFactory = async () => {
-    const view = ctx.view;
-    return {
-      type: 'object',
-      title: ctx.t('当前视图'),
-      buildVariablesParams: (c) => {
-        const params = inferViewRecordRef(c);
-        if (params) {
-          return {
-            record: params,
-          };
-        }
-        return undefined;
-      },
-      properties: async () => {
-        const props: Record<string, any> = {};
-        // 仅当能推断到当前记录引用时，才暴露“当前视图记录”，避免出现空子菜单
-        const refNow = inferViewRecordRef(ctx);
-        if (refNow && refNow.collection) {
-          const recordFactory: PropertyMetaFactory = async () => {
-            try {
-              const ref = inferViewRecordRef(ctx);
-              if (!ref?.collection) return null;
-              const dsKey = ref.dataSourceKey || 'main';
-              const ds = ctx.dataSourceManager?.getDataSource?.(dsKey);
-              const col = ds?.collectionManager?.getCollection?.(ref.collection);
-              if (!col) return null;
-              return (await buildRecordMeta(
-                () => col,
-                ctx.t('当前视图记录'),
-                (c) => inferViewRecordRef(c),
-              )) as PropertyMeta;
-            } catch (e) {
-              return null;
-            }
-          };
-          recordFactory.title = ctx.t('当前视图记录');
-          recordFactory.hasChildren = true;
-          props.record = recordFactory;
-        }
-        props.type = { type: 'string', title: ctx.t?.('类型') || '类型' };
-        props.preventClose = { type: 'boolean', title: ctx.t?.('是否允许关闭') || '是否允许关闭' };
-        props.inputArgs = makeMetaFromValue(view?.inputArgs, ctx.t?.('输入参数') || '输入参数');
-        return props;
-      },
-    } as PropertyMeta;
-  };
-  // 设置工厂函数的 title，让未加载前的占位标题就是“当前视图”
-  factory.title = viewTitle;
-  return factory;
-}
-
 /**
  * 为 ctx.popup 构建元信息：
  * - popup.record：当前弹窗记录（服务端解析）
@@ -142,14 +82,16 @@ export function createPopupMeta(ctx: FlowContext, anchorView?: FlowView): Proper
   const isPopupView = (view?: FlowView): boolean => {
     if (!view) return false;
     const stack = Array.isArray(view.navigation?.viewStack) ? view.navigation.viewStack : [];
-    return stack.length >= 2;
+    const openerUids = view?.inputArgs?.openerUids;
+    const hasOpener = Array.isArray(openerUids) && openerUids.length > 0;
+    return stack.length >= 2 || hasOpener;
   };
 
   const hasPopupNow = (): boolean => isPopupView(anchorView ?? ctx.view);
 
   // 统一解析锚定视图下的 RecordRef，避免在设置弹窗等二级视图中被误导
   const resolveRecordRef = async (flowCtx: FlowContext): Promise<RecordRef | undefined> => {
-    const view = anchorView ?? (flowCtx.view as any);
+    const view = anchorView ?? flowCtx.view;
     if (!view || !isPopupView(view)) return undefined;
 
     const base = await buildPopupRuntime(flowCtx, view);
@@ -353,19 +295,24 @@ export function createPopupMeta(ctx: FlowContext, anchorView?: FlowView): Proper
         const props: Record<string, any> = {};
         // 当前弹窗 UID（纯前端变量）
         props.uid = { type: 'string', title: t('Popup uid') };
-        // 基于锚定视图计算“当前弹窗记录”的集合与 RecordRef
-        const recordFactory: PropertyMetaFactory = async () => {
-          const col = await getCurrentCollection();
-          if (!col) return null;
-          return await buildRecordMeta(
-            () => col,
-            t('Current popup record'),
-            (c) => resolveRecordRef(c),
-          );
-        };
-        recordFactory.title = t('Current popup record');
-        recordFactory.hasChildren = true;
-        props.record = recordFactory;
+        // 仅当存在 filterByTk（可推断具体记录）时才提供“当前弹窗记录”变量；
+        // 对于新增/选择类弹窗（无 filterByTk），不应展示该变量以避免误导。
+        const recordRef = await resolveRecordRef(ctx);
+        if (recordRef) {
+          // 基于锚定视图计算“当前弹窗记录”的集合与 RecordRef
+          const recordFactory: PropertyMetaFactory = async () => {
+            const col = await getCurrentCollection();
+            if (!col) return null;
+            return await buildRecordMeta(
+              () => col,
+              t('Current popup record'),
+              (c) => resolveRecordRef(c),
+            );
+          };
+          recordFactory.title = t('Current popup record');
+          recordFactory.hasChildren = true;
+          props.record = recordFactory;
+        }
         // 当 view.inputArgs 带有 sourceId + associationName 时，提供“上级记录”变量（基于 sourceId 推断）
         try {
           const inputArgs = ctx.view?.inputArgs;

package/src/views/index.tsx

@@ -9,7 +9,6 @@
 
 export { useDialog } from './useDialog';
 export { useDrawer } from './useDrawer';
-export { usePage } from './usePage';
+export { usePage, GLOBAL_EMBED_CONTAINER_ID, EMBED_REPLACING_DATA_KEY } from './usePage';
 export { usePopover } from './usePopover';
 export { ViewNavigation } from './ViewNavigation';
-export { createViewMeta } from './createViewMeta';

package/src/views/useDialog.tsx

@@ -15,6 +15,7 @@ import { FlowViewContextProvider } from '../FlowContextProvider';
 import { registerPopupVariable } from './createViewMeta';
 import DialogComponent from './DialogComponent';
 import usePatchElement from './usePatchElement';
+import { VIEW_ACTIVATED_EVENT, bumpViewActivatedVersion, resolveOpenerEngine } from './viewEvents';
 import { FlowEngineProvider } from '../provider';
 import { createViewScopedEngine } from '../ViewScopedFlowEngine';
 import { createViewRecordResolveOnServer, getViewRecordFromParent } from '../utils/variablesParams';
@@ -25,6 +26,7 @@ export function useDialog() {
   const holderRef = React.useRef(null);
 
   const open = (config, flowContext) => {
+    const parentEngine = flowContext?.engine;
     uuid += 1;
     const dialogRef = React.createRef<{
       destroy: () => void;
@@ -77,6 +79,8 @@ export function useDialog() {
     const ctx = new FlowContext();
     // 为当前视图创建作用域引擎（隔离实例与缓存）
     const scopedEngine = createViewScopedEngine(flowContext.engine);
+    const openerEngine = resolveOpenerEngine(parentEngine, scopedEngine);
+
     ctx.defineProperty('engine', { value: scopedEngine });
     ctx.addDelegate(scopedEngine.context);
     if (config.inheritContext !== false) {
@@ -95,6 +99,10 @@ export function useDialog() {
         dialogRef.current?.destroy();
         closeFunc?.();
         resolvePromise?.(result);
+        // Notify opener view that it becomes active again.
+        const openerEmitter = openerEngine?.emitter;
+        bumpViewActivatedVersion(openerEmitter);
+        openerEmitter?.emit?.(VIEW_ACTIVATED_EVENT, { type: 'dialog', viewUid: currentDialog?.inputArgs?.viewUid });
         // 关闭时修正 previous/next 指针
         scopedEngine.unlinkFromStack();
       },
@@ -130,7 +138,6 @@ export function useDialog() {
 
     ctx.defineProperty('view', {
       get: () => currentDialog,
-      // meta: createViewMeta(ctx),
       resolveOnServer: createViewRecordResolveOnServer(ctx, () => getViewRecordFromParent(flowContext, ctx)),
     });
     // 顶层 popup 变量：弹窗记录/数据源/上级弹窗链（去重封装）
@@ -164,9 +171,9 @@ export function useDialog() {
             className="nb-dialog-overflow-hidden"
             ref={dialogRef}
             hidden={config.inputArgs?.hidden?.value}
-            {...config}
             footer={currentFooter}
             header={currentHeader}
+            {...config}
             onCancel={() => {
               currentDialog.close(config.result);
             }}

package/src/views/useDrawer.tsx

@@ -15,6 +15,7 @@ import { FlowViewContextProvider } from '../FlowContextProvider';
 import { registerPopupVariable } from './createViewMeta';
 import DrawerComponent from './DrawerComponent';
 import usePatchElement from './usePatchElement';
+import { VIEW_ACTIVATED_EVENT, bumpViewActivatedVersion, resolveOpenerEngine } from './viewEvents';
 import { FlowEngineProvider } from '../provider';
 import { createViewScopedEngine } from '../ViewScopedFlowEngine';
 import { createViewRecordResolveOnServer, getViewRecordFromParent } from '../utils/variablesParams';
@@ -54,6 +55,7 @@ export function useDrawer() {
   RenderNestedDrawer.displayName = 'RenderNestedDrawer';
 
   const open = (config, flowContext: FlowEngineContext) => {
+    const parentEngine = flowContext.engine;
     const drawerRef = React.createRef<{
       destroy: () => void;
       update: (config: any) => void;
@@ -105,6 +107,8 @@ export function useDrawer() {
     const ctx = new FlowContext();
     // 为当前视图创建作用域引擎（隔离实例与缓存）
     const scopedEngine = createViewScopedEngine(flowContext.engine);
+    const openerEngine = resolveOpenerEngine(parentEngine, scopedEngine);
+
     // 先将引擎暴露给视图上下文，再按需继承父上下文
     ctx.defineProperty('engine', { value: scopedEngine });
     ctx.addDelegate(scopedEngine.context);
@@ -124,6 +128,10 @@ export function useDrawer() {
         drawerRef.current?.destroy();
         closeFunc?.();
         resolvePromise?.(result);
+        // Notify opener view that it becomes active again.
+        const openerEmitter = openerEngine?.emitter;
+        bumpViewActivatedVersion(openerEmitter);
+        openerEmitter?.emit?.(VIEW_ACTIVATED_EVENT, { type: 'drawer', viewUid: currentDrawer?.inputArgs?.viewUid });
         // 关闭时修正 previous/next 指针
         scopedEngine.unlinkFromStack();
       },
@@ -159,7 +167,6 @@ export function useDrawer() {
 
     ctx.defineProperty('view', {
       get: () => currentDrawer,
-      // meta: createViewMeta(ctx),
       resolveOnServer: createViewRecordResolveOnServer(ctx, () => getViewRecordFromParent(flowContext, ctx)),
     });
     // 顶层 popup 变量：弹窗记录/数据源/上级弹窗链（去重封装）