@nocobase/flow-engine 2.2.0-beta.1 → 2.2.0-beta.10

package/lib/utils/openViewRouteState.js

@@ -0,0 +1,125 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var openViewRouteState_exports = {};
+__export(openViewRouteState_exports, {
+  RUNJS_OPEN_VIEW_ROUTE_STATE: () => RUNJS_OPEN_VIEW_ROUTE_STATE,
+  createOpenViewRouteState: () => createOpenViewRouteState,
+  decodeOpenViewRouteState: () => decodeOpenViewRouteState,
+  encodeOpenViewRouteState: () => encodeOpenViewRouteState,
+  isOpenViewRouteStateToken: () => isOpenViewRouteStateToken
+});
+module.exports = __toCommonJS(openViewRouteState_exports);
+const OPEN_VIEW_ROUTE_MODES = ["drawer", "dialog", "embed"];
+const OPEN_VIEW_ROUTE_SIZES = ["small", "medium", "large"];
+const OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+const OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH = 8;
+const RUNJS_OPEN_VIEW_ROUTE_STATE = Symbol.for("nocobase.runjs.openViewRouteState");
+function isOpenViewRouteMode(value) {
+  return typeof value === "string" && OPEN_VIEW_ROUTE_MODES.includes(value);
+}
+__name(isOpenViewRouteMode, "isOpenViewRouteMode");
+function isOpenViewRouteSize(value) {
+  return typeof value === "string" && OPEN_VIEW_ROUTE_SIZES.includes(value);
+}
+__name(isOpenViewRouteSize, "isOpenViewRouteSize");
+function createOpenViewRouteState(input) {
+  const state = {};
+  if (isOpenViewRouteMode(input == null ? void 0 : input.mode)) {
+    state.mode = input.mode;
+  }
+  if (isOpenViewRouteSize(input == null ? void 0 : input.size)) {
+    state.size = input.size;
+  }
+  return state.mode || state.size ? state : void 0;
+}
+__name(createOpenViewRouteState, "createOpenViewRouteState");
+function hashString(value) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return hash >>> 0;
+}
+__name(hashString, "hashString");
+function stateToCode(state) {
+  const modeIndex = state.mode ? OPEN_VIEW_ROUTE_MODES.indexOf(state.mode) + 1 : 0;
+  const sizeIndex = state.size ? OPEN_VIEW_ROUTE_SIZES.indexOf(state.size) + 1 : 0;
+  const code = modeIndex * 4 + sizeIndex;
+  return code > 0 ? code : void 0;
+}
+__name(stateToCode, "stateToCode");
+function codeToState(code) {
+  const modeIndex = Math.floor(code / 4);
+  const sizeIndex = code % 4;
+  return createOpenViewRouteState({
+    mode: modeIndex ? OPEN_VIEW_ROUTE_MODES[modeIndex - 1] : void 0,
+    size: sizeIndex ? OPEN_VIEW_ROUTE_SIZES[sizeIndex - 1] : void 0
+  });
+}
+__name(codeToState, "codeToState");
+function tokenForCode(viewUid, code) {
+  let seed = hashString(`${viewUid}:${code}`);
+  let token = "";
+  for (let i = 0; i < OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH; i++) {
+    seed = Math.imul(seed ^ code + i * 17, 16777619) >>> 0;
+    token += OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET[seed % OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET.length];
+  }
+  return token;
+}
+__name(tokenForCode, "tokenForCode");
+function isOpenViewRouteStateToken(value) {
+  return typeof value === "string" && value.length === OPEN_VIEW_ROUTE_STATE_TOKEN_LENGTH && [...value].every((char) => OPEN_VIEW_ROUTE_STATE_TOKEN_ALPHABET.includes(char));
+}
+__name(isOpenViewRouteStateToken, "isOpenViewRouteStateToken");
+function encodeOpenViewRouteState(viewUid, input) {
+  const state = createOpenViewRouteState(input);
+  const code = state ? stateToCode(state) : void 0;
+  return code ? tokenForCode(viewUid, code) : void 0;
+}
+__name(encodeOpenViewRouteState, "encodeOpenViewRouteState");
+function decodeOpenViewRouteState(viewUid, token) {
+  if (!isOpenViewRouteStateToken(token)) {
+    return void 0;
+  }
+  for (let code = 1; code < 16; code++) {
+    if (tokenForCode(viewUid, code) === token) {
+      return codeToState(code);
+    }
+  }
+  return void 0;
+}
+__name(decodeOpenViewRouteState, "decodeOpenViewRouteState");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RUNJS_OPEN_VIEW_ROUTE_STATE,
+  createOpenViewRouteState,
+  decodeOpenViewRouteState,
+  encodeOpenViewRouteState,
+  isOpenViewRouteStateToken
+});

package/lib/utils/parsePathnameToViewParams.d.ts

@@ -6,6 +6,7 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+import { type OpenViewRouteState } from './openViewRouteState';
 export interface ViewParam {
     /** 视图唯一标识符，一般为某个 Model 实例的 uid */
     viewUid: string;
@@ -15,6 +16,8 @@ export interface ViewParam {
     filterByTk?: string | Record<string, string | number>;
     /** source Id */
     sourceId?: string;
+    /** RunJS ctx.openView runtime display overrides decoded from URL. */
+    openViewRouteState?: OpenViewRouteState;
 }
 export interface ParsePathnameToViewParamsOptions {
     rootPrefix?: string;

package/lib/utils/parsePathnameToViewParams.js

@@ -30,6 +30,7 @@ __export(parsePathnameToViewParams_exports, {
   parsePathnameToViewParams: () => parsePathnameToViewParams
 });
 module.exports = __toCommonJS(parsePathnameToViewParams_exports);
+var import_openViewRouteState = require("./openViewRouteState");
 const normalizePathname = /* @__PURE__ */ __name((pathname) => {
   if (!pathname || pathname === "/") {
     return "/";
@@ -77,7 +78,23 @@ const parsePathnameToViewParams = /* @__PURE__ */ __name((pathname, options = {}
       } else {
         break;
       }
-    } else if (currentView && i + 1 < segments.length) {
+    } else if (currentView) {
+      if (segment === "opts") {
+        if (i + 1 < segments.length) {
+          const routeState = (0, import_openViewRouteState.decodeOpenViewRouteState)(currentView.viewUid, segments[i + 1]);
+          if (routeState) {
+            currentView.openViewRouteState = routeState;
+          }
+          i += 2;
+        } else {
+          i++;
+        }
+        continue;
+      }
+      if (i + 1 >= segments.length) {
+        i++;
+        continue;
+      }
       const rawValue = segments[i + 1];
       let decoded = rawValue;
       try {

package/lib/utils/resolveRunJSObjectValues.js

@@ -31,8 +31,8 @@ __export(resolveRunJSObjectValues_exports, {
 });
 module.exports = __toCommonJS(resolveRunJSObjectValues_exports);
 var import_runjsValue = require("./runjsValue");
-var import_safeGlobals = require("./safeGlobals");
 async function resolveRunJSObjectValues(ctx, raw) {
+  var _a;
   const out = {};
   if (!raw || typeof raw !== "object") return out;
   if (Array.isArray(raw)) return out;
@@ -41,7 +41,8 @@ async function resolveRunJSObjectValues(ctx, raw) {
     if ((0, import_runjsValue.isRunJSValue)(value)) {
       const { code, version } = (0, import_runjsValue.normalizeRunJSValue)(value);
       if (!code.trim()) continue;
-      const ret = await (0, import_safeGlobals.runjsWithSafeGlobals)(ctx, code, { version });
+      const runjsCtx = ctx;
+      const ret = await ((_a = runjsCtx == null ? void 0 : runjsCtx.runjs) == null ? void 0 : _a.call(runjsCtx, code, void 0, { version }));
       if (!(ret == null ? void 0 : ret.success)) {
         throw new Error(`RunJS execution failed for "${key}"`);
       }

package/lib/utils/runjsModuleLoader.js

@@ -34,27 +34,6 @@ __export(runjsModuleLoader_exports, {
 module.exports = __toCommonJS(runjsModuleLoader_exports);
 var import_runjsLibs = require("../runjsLibs");
 var import_resolveModuleUrl = require("./resolveModuleUrl");
-var import_safeGlobals = require("./safeGlobals");
-function snapshotOwnKeys(obj) {
-  try {
-    if (!obj || typeof obj !== "object" && typeof obj !== "function") return [];
-    return Object.getOwnPropertyNames(obj);
-  } catch (_) {
-    return [];
-  }
-}
-__name(snapshotOwnKeys, "snapshotOwnKeys");
-function diffAddedKeys(afterKeys, beforeKeys) {
-  if (!afterKeys.length) return [];
-  if (!beforeKeys.length) return [...afterKeys];
-  const beforeSet = new Set(beforeKeys);
-  const added = [];
-  for (const k of afterKeys) {
-    if (!beforeSet.has(k)) added.push(k);
-  }
-  return added;
-}
-__name(diffAddedKeys, "diffAddedKeys");
 async function withRunjsModuleLoadLock(task) {
   const g = globalThis;
   g.__nocobaseRunjsModuleLoadLock = (g.__nocobaseRunjsModuleLoadLock || Promise.resolve()).catch(() => {
@@ -222,8 +201,6 @@ async function prefetchEsmModule(url, options) {
 __name(prefetchEsmModule, "prefetchEsmModule");
 async function runjsRequireAsync(requirejs, url) {
   return await withRunjsModuleLoadLock(async () => {
-    const beforeWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-    const beforeDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
     let result;
     let error;
     try {
@@ -242,13 +219,6 @@ async function runjsRequireAsync(requirejs, url) {
       });
     } catch (e) {
       error = e;
-    } finally {
-      const afterWinKeys = typeof window !== "undefined" ? snapshotOwnKeys(window) : [];
-      const afterDocKeys = typeof document !== "undefined" ? snapshotOwnKeys(document) : [];
-      const addedWinKeys = diffAddedKeys(afterWinKeys, beforeWinKeys);
-      const addedDocKeys = diffAddedKeys(afterDocKeys, beforeDocKeys);
-      (0, import_safeGlobals.registerRunJSSafeWindowGlobals)(addedWinKeys);
-      (0, import_safeGlobals.registerRunJSSafeDocumentGlobals)(addedDocKeys);
     }
     if (error) throw error;
     return result;

package/lib/views/ViewNavigation.js

@@ -32,6 +32,7 @@ __export(ViewNavigation_exports, {
 });
 module.exports = __toCommonJS(ViewNavigation_exports);
 var import_reactive = require("../reactive");
+var import_utils = require("../utils");
 function encodeFilterByTk(val) {
   if (val === void 0 || val === null) return "";
   if (val && typeof val === "object" && !Array.isArray(val)) {
@@ -63,6 +64,10 @@ function generatePathnameFromViewParams(viewParams, options = {}) {
       segments.push("view");
     }
     segments.push(viewParam.viewUid);
+    const openViewRouteStateToken = (0, import_utils.encodeOpenViewRouteState)(viewParam.viewUid, viewParam.openViewRouteState);
+    if (openViewRouteStateToken) {
+      segments.push("opts", openViewRouteStateToken);
+    }
     if (viewParam.tabUid) {
       segments.push("tab", viewParam.tabUid);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/flow-engine",
-  "version": "2.2.0-beta.1",
+  "version": "2.2.0-beta.10",
   "private": false,
   "description": "A standalone flow engine for NocoBase, managing workflows, models, and actions.",
   "main": "lib/index.js",
@@ -8,8 +8,8 @@
   "dependencies": {
     "@formily/antd-v5": "1.x",
     "@formily/reactive": "2.x",
-    "@nocobase/sdk": "2.2.0-beta.1",
-    "@nocobase/shared": "2.2.0-beta.1",
+    "@nocobase/sdk": "2.2.0-beta.10",
+    "@nocobase/shared": "2.2.0-beta.10",
     "ahooks": "^3.7.2",
     "axios": "^1.7.0",
     "dayjs": "^1.11.9",
@@ -37,5 +37,5 @@
   ],
   "author": "NocoBase Team",
   "license": "Apache-2.0",
-  "gitHead": "f82fa9d0c3aa8e00e53dd94e404a312483b4866b"
+  "gitHead": "d572beec24de46df948f28db72b25303a63bf62d"
 }

package/src/JSRunner.ts

@@ -39,6 +39,117 @@ export function shouldPreprocessRunJSTemplates(
   return options?.version !== 'v2';
 }
 
+const RUNJS_BROWSER_GLOBAL_NAMES = [
+  'fetch',
+  'localStorage',
+  'sessionStorage',
+  'XMLHttpRequest',
+  'WebSocket',
+  'Worker',
+  'SharedWorker',
+  'ServiceWorker',
+  'BroadcastChannel',
+  'EventSource',
+  'indexedDB',
+  'caches',
+  'Function',
+  'eval',
+  'globalThis',
+  'Intl',
+  'Blob',
+  'URL',
+  'location',
+] as const;
+
+export const RUNJS_ALLOWED_BARE_GLOBAL_NAMES = [
+  'ctx',
+  'console',
+  'window',
+  'document',
+  'navigator',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'Array',
+  'ArrayBuffer',
+  'BigInt',
+  'BigInt64Array',
+  'BigUint64Array',
+  'Boolean',
+  'DataView',
+  'Date',
+  'Error',
+  'EvalError',
+  'FinalizationRegistry',
+  'Float32Array',
+  'Float64Array',
+  'Int8Array',
+  'Int16Array',
+  'Int32Array',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'Proxy',
+  'RangeError',
+  'ReferenceError',
+  'Reflect',
+  'RegExp',
+  'Set',
+  'String',
+  'Symbol',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Uint16Array',
+  'Uint32Array',
+  'WeakMap',
+  'WeakRef',
+  'WeakSet',
+  'JSON',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+  'undefined',
+  'NaN',
+  'Infinity',
+  ...RUNJS_BROWSER_GLOBAL_NAMES,
+] as const;
+
+function collectRunJSBrowserGlobals(providedGlobals: Record<string, unknown> = {}) {
+  const windowGlobal = providedGlobals.window;
+  if (!windowGlobal || typeof windowGlobal !== 'object') {
+    return {};
+  }
+
+  const windowRecord = windowGlobal as Record<string, unknown>;
+  const globals: Record<string, unknown> = {};
+  RUNJS_BROWSER_GLOBAL_NAMES.forEach((name) => {
+    if (Object.prototype.hasOwnProperty.call(providedGlobals, name)) {
+      return;
+    }
+    try {
+      const value = windowRecord[name];
+      if (typeof value === 'undefined') {
+        return;
+      }
+      globals[name] = name === 'fetch' && typeof value === 'function' ? value.bind(windowGlobal) : value;
+    } catch {
+      // Ignore browser globals that cannot be read in the current environment.
+    }
+  });
+  return globals;
+}
+
 // Heuristic: detect likely bare `{{ctx.xxx}}` usage in executable positions (not quoted string literals).
 const BARE_CTX_TEMPLATE_RE = /(^|[=(:,[\s)])(\{\{\s*(ctx(?:\.|\[|\?\.)[^}]*)\s*\}\})/m;
 
@@ -98,31 +209,7 @@ export class JSRunner {
     };
 
     const providedGlobals = options.globals || {};
-    const liftedGlobals: Record<string, any> = {};
-
-    // Auto-lift selected globals from safe window into top-level sandbox globals
-    // so user code can access them directly (e.g. `new Blob(...)`).
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'Blob')) {
-      try {
-        const blobCtor = (providedGlobals as any).window?.Blob;
-        if (typeof blobCtor !== 'undefined') {
-          liftedGlobals.Blob = blobCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'URL')) {
-      try {
-        const urlCtor = (providedGlobals as any).window?.URL;
-        if (typeof urlCtor !== 'undefined') {
-          liftedGlobals.URL = urlCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
+    const liftedGlobals = collectRunJSBrowserGlobals(providedGlobals);
 
     this.globals = {
       console,

package/src/__tests__/JSRunner.test.ts

@@ -9,7 +9,6 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { JSRunner, shouldPreprocessRunJSTemplates } from '../JSRunner';
-import { createSafeWindow } from '../utils';
 
 describe('JSRunner', () => {
   let originalSearch: string;
@@ -68,7 +67,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -84,7 +83,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         Blob: explicitBlob,
       },
     });
@@ -97,7 +96,7 @@ describe('JSRunner', () => {
   it('auto-lifts URL from injected window to top-level globals', async () => {
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -114,7 +113,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         URL: explicitURL,
       },
     });

package/src/__tests__/flowContext.test.ts

@@ -14,6 +14,8 @@ import { FlowEngine } from '../flowEngine';
 import { FlowModel } from '../models/flowModel';
 import { RunJSContextRegistry } from '../runjs-context/registry';
 import { setupRunJSContexts } from '../runjs-context/setup';
+import { createViewScopedEngine } from '../ViewScopedFlowEngine';
+import { DATA_SOURCE_DIRTY_EVENT } from '../views/viewEvents';
 
 describe('FlowContext properties and methods', () => {
   it('should return static property value', () => {
@@ -177,6 +179,49 @@ describe('FlowContext properties and methods', () => {
     });
   });
 
+  it('should expose current role as a top-level variable', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: 'admin' } } });
+
+    expect(ctx.role).toBe('admin');
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toBe('admin');
+
+    const roleNode = ctx.getPropertyMetaTree().find((node) => node.name === 'role');
+    expect(roleNode).toMatchObject({
+      name: 'role',
+      title: '{{t("Current role")}}',
+      paths: ['role'],
+    });
+  });
+
+  it('should expose actual role names for union role mode', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', {
+      value: {
+        roles: [
+          { name: 'admin', title: 'Admin' },
+          { name: 'member', title: 'Member' },
+        ],
+      },
+    });
+
+    expect(ctx.role).toEqual(['admin', 'member']);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual(['admin', 'member']);
+  });
+
+  it('should expose an empty role list for union role mode without user roles', async () => {
+    const engine = new FlowEngine();
+    const ctx = engine.context;
+    ctx.defineProperty('api', { value: { auth: { role: '__union__' } } });
+    ctx.defineProperty('user', { value: {} });
+
+    expect(ctx.role).toEqual([]);
+    await expect(ctx.resolveJsonTemplate('{{ ctx.role }}')).resolves.toEqual([]);
+  });
+
   it('should throw sync error in get', () => {
     const ctx = new FlowContext();
     ctx.defineProperty('error', {
@@ -1386,6 +1431,92 @@ describe('FlowEngine context', () => {
     expect(engine.context.appName).toBe('NocoBase');
   });
 
+  it('ctx.api should return a dirty-aware wrapper for static api properties', async () => {
+    const engine = new FlowEngine();
+    const update = vi.fn(async () => ({ data: { data: { id: 1 } } }));
+    const api = {
+      auth: { locale: 'zh-CN' },
+      request: vi.fn(async () => ({ data: { ok: true } })),
+      resource: vi.fn(() => ({ update })),
+    };
+    engine.context.defineProperty('api', { value: api });
+
+    await engine.context.api.resource('posts').update({ filterByTk: 1, values: { title: 't' } });
+
+    expect(update).toHaveBeenCalledTimes(1);
+    expect(engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(engine.context.api).toBe(engine.context.api);
+  });
+
+  it('ctx.api should stay dirty-aware when resolved from a scoped context delegate', async () => {
+    const root = new FlowEngine();
+    const scoped = createViewScopedEngine(root);
+    const update = vi.fn(async () => ({ data: { data: { id: 1 } } }));
+    root.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request: vi.fn(async () => ({ data: { ok: true } })),
+        resource: vi.fn(() => ({ update })),
+      },
+    });
+
+    await scoped.context.api.resource('posts').update({ filterByTk: 1, values: { title: 't' } });
+
+    expect(update).toHaveBeenCalledTimes(1);
+    expect(root.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(scoped.context.engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+  });
+
+  it('ctx.request should use the dirty-aware api wrapper', async () => {
+    const engine = new FlowEngine();
+    const request = vi.fn(async () => ({ data: { ok: true } }));
+    engine.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request,
+        resource: vi.fn(),
+      },
+    });
+
+    await engine.context.request({
+      resource: 'posts',
+      action: 'update',
+      headers: { 'X-Data-Source': 'analytics' },
+      params: { filterByTk: 1 },
+    } as any);
+
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(engine.getDataSourceDirtyVersion('analytics', 'posts')).toBe(1);
+  });
+
+  it('ctx.request should use the caller context when resolved through a scoped delegate', async () => {
+    const root = new FlowEngine();
+    const scoped = createViewScopedEngine(root);
+    const callerCtx = new FlowContext();
+    const dirtyEvents: Array<{ dataSourceKey: string; resourceNames: string[] }> = [];
+    const request = vi.fn(async () => ({ data: { ok: true } }));
+    root.context.defineProperty('api', {
+      value: {
+        auth: { locale: 'zh-CN' },
+        request,
+        resource: vi.fn(),
+      },
+    });
+    callerCtx.addDelegate(scoped.context);
+    scoped.context.engine.emitter.on(DATA_SOURCE_DIRTY_EVENT, (event) => dirtyEvents.push(event));
+
+    await callerCtx.request({
+      resource: 'posts',
+      action: 'update',
+      params: { filterByTk: 1 },
+    } as any);
+
+    expect(request).toHaveBeenCalledTimes(1);
+    expect(root.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(scoped.context.engine.getDataSourceDirtyVersion('main', 'posts')).toBe(1);
+    expect(dirtyEvents).toEqual([{ dataSourceKey: 'main', resourceNames: ['posts'] }]);
+  });
+
   it('ctx.sql should resolve template variables from caller context in delegate chain', async () => {
     const engine = new FlowEngine();
     const request = vi.fn(async () => ({ data: { data: [] } }));
@@ -1476,6 +1607,29 @@ describe('FlowEngine context', () => {
     await expect((engine.context as any).getVar('foo.bar')).rejects.toThrow();
   });
 
+  it('model.context.getVar should resolve the latest ctx.auth.user after user changes', async () => {
+    const engine = new FlowEngine();
+    engine.context.defineProperty('api', {
+      value: { auth: { role: 'admin', locale: 'en-US', token: 'token-1' } },
+    });
+    engine.context.defineProperty('user', { value: { id: 1, nickname: 'Alice' } });
+
+    class AuthUserModel extends FlowModel {}
+    engine.registerModels({ AuthUserModel });
+    const model = engine.createModel({ use: 'AuthUserModel' });
+
+    expect(await model.context.getVar('ctx.auth.user.id')).toBe(1);
+    expect(await model.context.getVar('ctx.auth.token')).toBe('token-1');
+
+    engine.context.api.auth.role = 'member';
+    engine.context.api.auth.token = 'token-2';
+    engine.context.defineProperty('user', { value: { id: 2, nickname: 'Bob' } });
+
+    expect(await model.context.getVar('ctx.auth.user.id')).toBe(2);
+    expect(await model.context.getVar('ctx.auth.roleName')).toBe('member');
+    expect(await model.context.getVar('ctx.auth.token')).toBe('token-2');
+  });
+
   it('engine.context.runAction should resolve action from engine.getAction', async () => {
     const engine = new FlowEngine();