@nocobase/flow-engine 2.2.0-beta.3 → 2.2.0-beta.6

package/src/JSRunner.ts

@@ -39,6 +39,117 @@ export function shouldPreprocessRunJSTemplates(
   return options?.version !== 'v2';
 }
 
+const RUNJS_BROWSER_GLOBAL_NAMES = [
+  'fetch',
+  'localStorage',
+  'sessionStorage',
+  'XMLHttpRequest',
+  'WebSocket',
+  'Worker',
+  'SharedWorker',
+  'ServiceWorker',
+  'BroadcastChannel',
+  'EventSource',
+  'indexedDB',
+  'caches',
+  'Function',
+  'eval',
+  'globalThis',
+  'Intl',
+  'Blob',
+  'URL',
+  'location',
+] as const;
+
+export const RUNJS_ALLOWED_BARE_GLOBAL_NAMES = [
+  'ctx',
+  'console',
+  'window',
+  'document',
+  'navigator',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'Array',
+  'ArrayBuffer',
+  'BigInt',
+  'BigInt64Array',
+  'BigUint64Array',
+  'Boolean',
+  'DataView',
+  'Date',
+  'Error',
+  'EvalError',
+  'FinalizationRegistry',
+  'Float32Array',
+  'Float64Array',
+  'Int8Array',
+  'Int16Array',
+  'Int32Array',
+  'Map',
+  'Math',
+  'Number',
+  'Object',
+  'Promise',
+  'Proxy',
+  'RangeError',
+  'ReferenceError',
+  'Reflect',
+  'RegExp',
+  'Set',
+  'String',
+  'Symbol',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Uint16Array',
+  'Uint32Array',
+  'WeakMap',
+  'WeakRef',
+  'WeakSet',
+  'JSON',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'isFinite',
+  'isNaN',
+  'parseFloat',
+  'parseInt',
+  'undefined',
+  'NaN',
+  'Infinity',
+  ...RUNJS_BROWSER_GLOBAL_NAMES,
+] as const;
+
+function collectRunJSBrowserGlobals(providedGlobals: Record<string, unknown> = {}) {
+  const windowGlobal = providedGlobals.window;
+  if (!windowGlobal || typeof windowGlobal !== 'object') {
+    return {};
+  }
+
+  const windowRecord = windowGlobal as Record<string, unknown>;
+  const globals: Record<string, unknown> = {};
+  RUNJS_BROWSER_GLOBAL_NAMES.forEach((name) => {
+    if (Object.prototype.hasOwnProperty.call(providedGlobals, name)) {
+      return;
+    }
+    try {
+      const value = windowRecord[name];
+      if (typeof value === 'undefined') {
+        return;
+      }
+      globals[name] = name === 'fetch' && typeof value === 'function' ? value.bind(windowGlobal) : value;
+    } catch {
+      // Ignore browser globals that cannot be read in the current environment.
+    }
+  });
+  return globals;
+}
+
 // Heuristic: detect likely bare `{{ctx.xxx}}` usage in executable positions (not quoted string literals).
 const BARE_CTX_TEMPLATE_RE = /(^|[=(:,[\s)])(\{\{\s*(ctx(?:\.|\[|\?\.)[^}]*)\s*\}\})/m;
 
@@ -98,31 +209,7 @@ export class JSRunner {
     };
 
     const providedGlobals = options.globals || {};
-    const liftedGlobals: Record<string, any> = {};
-
-    // Auto-lift selected globals from safe window into top-level sandbox globals
-    // so user code can access them directly (e.g. `new Blob(...)`).
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'Blob')) {
-      try {
-        const blobCtor = (providedGlobals as any).window?.Blob;
-        if (typeof blobCtor !== 'undefined') {
-          liftedGlobals.Blob = blobCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
-
-    if (!Object.prototype.hasOwnProperty.call(providedGlobals, 'URL')) {
-      try {
-        const urlCtor = (providedGlobals as any).window?.URL;
-        if (typeof urlCtor !== 'undefined') {
-          liftedGlobals.URL = urlCtor;
-        }
-      } catch {
-        // ignore when window proxy blocks property access
-      }
-    }
+    const liftedGlobals = collectRunJSBrowserGlobals(providedGlobals);
 
     this.globals = {
       console,

package/src/__tests__/JSRunner.test.ts

@@ -9,7 +9,6 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { JSRunner, shouldPreprocessRunJSTemplates } from '../JSRunner';
-import { createSafeWindow } from '../utils';
 
 describe('JSRunner', () => {
   let originalSearch: string;
@@ -68,7 +67,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -84,7 +83,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         Blob: explicitBlob,
       },
     });
@@ -97,7 +96,7 @@ describe('JSRunner', () => {
   it('auto-lifts URL from injected window to top-level globals', async () => {
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
       },
     });
 
@@ -114,7 +113,7 @@ describe('JSRunner', () => {
 
     const runner = new JSRunner({
       globals: {
-        window: createSafeWindow(),
+        window,
         URL: explicitURL,
       },
     });

package/src/__tests__/flowModel.openView.navigation.test.ts

@@ -104,4 +104,32 @@ describe('FlowModelContext.openView - navigation enforcement', () => {
     expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
     expect(child.dispatchEvent.mock.calls[0][0]).toBe('click');
   });
+
+  it('inherits current model input args when opening an external popup', async () => {
+    const { parent, child } = setup();
+    parent['getInputArgs'] = vi.fn(() => ({
+      filterByTk: 2,
+      sourceId: 10,
+      defaultInputKeys: ['filterByTk', 'sourceId'],
+    }));
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog' });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][1]).toMatchObject({
+      mode: 'dialog',
+      filterByTk: 2,
+      sourceId: 10,
+    });
+    expect(child.dispatchEvent.mock.calls[0][1]).not.toHaveProperty('defaultInputKeys');
+  });
+
+  it('does not debounce external popup dispatches', async () => {
+    const { parent, child } = setup();
+
+    await (parent.context as any).openView('child-uid', { mode: 'dialog', filterByTk: 1 });
+
+    expect(child.dispatchEvent).toHaveBeenCalledTimes(1);
+    expect(child.dispatchEvent.mock.calls[0][2]).toBeUndefined();
+  });
 });

package/src/__tests__/flowSettings.test.ts

@@ -557,6 +557,78 @@ describe('FlowSettings', () => {
     });
   });
 
+  describe('Dynamic Flow Source Providers', () => {
+    test('should return current model as the default dynamic flow source', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources).toHaveLength(1);
+      expect(sources[0].key).toBe('self');
+      expect(sources[0].label).toBe('Current block');
+      expect(sources[0].model).toBe(model);
+    });
+
+    test('should register, resolve, and dispose dynamic flow source providers', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+      const target = new FlowModel({ uid: 'target-model', flowEngine: engine });
+
+      const dispose = flowSettings.registerDynamicFlowSourceProvider({
+        key: 'test-provider',
+        visible: (m) => m.uid === model.uid,
+        getSources: () => [{ key: 'target', label: 'Target model', model: target, sort: 10 }],
+      });
+
+      expect(flowSettings.hasDynamicFlowSourceProvider(model)).toBe(true);
+      expect(flowSettings.hasDynamicFlowSourceProvider(target)).toBe(false);
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+      expect(sources.map((source) => source.key)).toEqual(['self', 'target']);
+
+      dispose();
+
+      expect(flowSettings.hasDynamicFlowSourceProvider(model)).toBe(false);
+      await expect(flowSettings.getDynamicFlowSources(model)).resolves.toHaveLength(1);
+    });
+
+    test('should skip duplicate dynamic flow source keys and model uids', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+      const target = new FlowModel({ uid: 'target-model', flowEngine: engine });
+
+      flowSettings.registerDynamicFlowSourceProvider({
+        key: 'test-provider',
+        getSources: () => [
+          { key: 'target', label: 'Target model', model: target },
+          { key: 'target', label: 'Duplicate key', model: new FlowModel({ uid: 'other-model', flowEngine: engine }) },
+          { key: 'duplicate-uid', label: 'Duplicate uid', model: target },
+        ],
+      });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources.map((source) => source.key)).toEqual(['self', 'target']);
+    });
+
+    test('should ignore failing dynamic flow source providers', async () => {
+      const model = new FlowModel({ uid: 'source-model', flowEngine: engine });
+
+      flowSettings.registerDynamicFlowSourceProvider({
+        key: 'failing-provider',
+        getSources: () => {
+          throw new Error('provider failed');
+        },
+      });
+
+      const sources = await flowSettings.getDynamicFlowSources(model);
+
+      expect(sources.map((source) => source.key)).toEqual(['self']);
+      expect(consoleSpy.warn).toHaveBeenCalledWith(
+        "FlowSettings: Dynamic flow source provider 'failing-provider' failed.",
+        expect.any(Error),
+      );
+    });
+  });
+
   describe('Step Settings Dialog', () => {
     test('should call openStepSettingsDialog with correct parameters', async () => {
       const { openStepSettingsDialog } = await import('../components/settings/wrappers/contextual/StepSettingsDialog');

package/src/flowContext.ts

@@ -3139,6 +3139,37 @@ class BaseFlowModelContext extends BaseFlowEngineContext {
   declare makeResource: <T extends FlowResource = FlowResource>(resourceType: ResourceType<T>) => T;
 }
 
+const OPEN_VIEW_INHERITED_INPUT_ARG_KEYS = [
+  'dataSourceKey',
+  'collectionName',
+  'associationName',
+  'filterByTk',
+  'sourceId',
+  'tabUid',
+];
+
+function pickDefinedKeys(source: Record<string, unknown> | null | undefined, keys: string[]) {
+  const res: Record<string, unknown> = {};
+  for (const key of keys) {
+    if (typeof source?.[key] !== 'undefined') {
+      res[key] = source[key];
+    }
+  }
+  return res;
+}
+
+function pickDefinedOpenViewInputArgs(source?: Record<string, unknown> | null) {
+  return pickDefinedKeys(source, OPEN_VIEW_INHERITED_INPUT_ARG_KEYS);
+}
+
+function applyDefinedDefaults(target: Record<string, unknown>, defaults: Record<string, unknown>) {
+  for (const [key, value] of Object.entries(defaults)) {
+    if (typeof target[key] === 'undefined') {
+      target[key] = value;
+    }
+  }
+}
+
 export class FlowEngineContext extends BaseFlowEngineContext {
   // public dataSourceManager: DataSourceManager;
   constructor(public engine: FlowEngine) {
@@ -3561,7 +3592,17 @@ export class FlowEngineContext extends BaseFlowEngineContext {
         doc = {};
       }
       const deprecatedCtx = createRunJSDeprecationProxy(runCtx, { doc });
-      const globals: Record<string, any> = { ctx: deprecatedCtx, ...(options?.globals || {}) };
+      const browserGlobals: Record<string, any> = {};
+      if (typeof window !== 'undefined') {
+        browserGlobals.window = window;
+        if (typeof navigator !== 'undefined') {
+          browserGlobals.navigator = navigator;
+        }
+      }
+      if (typeof document !== 'undefined') {
+        browserGlobals.document = document;
+      }
+      const globals: Record<string, any> = { ctx: deprecatedCtx, ...browserGlobals, ...(options?.globals || {}) };
       const { timeoutMs } = options || {};
       return new JSRunner({ globals, timeoutMs });
     });
@@ -3687,7 +3728,14 @@ export class FlowModelContext extends BaseFlowModelContext {
       },
     });
     this.defineMethod('openView', async function (uid: string, options) {
-      const opts = { ...options };
+      const inheritedInputArgs = {
+        ...(typeof this.model?.['getInputArgs'] === 'function'
+          ? pickDefinedOpenViewInputArgs(this.model['getInputArgs']())
+          : {}),
+        ...pickDefinedOpenViewInputArgs(this.inputArgs),
+      };
+      const opts = { ...(options || {}) };
+      applyDefinedDefaults(opts, inheritedInputArgs);
       // NOTE: when custom context is passed, route navigation must be disabled to avoid losing it after refresh.
       if (opts.defineProperties || opts.defineMethods) {
         opts.navigation = false; // 强制不使用路由导航, 避免刷新页面时丢失上下文
@@ -3695,15 +3743,6 @@ export class FlowModelContext extends BaseFlowModelContext {
       let model: FlowModel | null = null;
       model = await this.engine.loadModel({ uid });
       if (!model) {
-        const pickDefined = (src: Record<string, any>, keys: string[]) => {
-          const res: Record<string, any> = {};
-          for (const k of keys) {
-            if (typeof src?.[k] !== 'undefined') {
-              res[k] = src[k];
-            }
-          }
-          return res;
-        };
         model = this.engine.createModel({
           uid, // 注意： 新建的 model 应该使用 ${parentModel.uid}-xxx 形式的 uid
           use: 'PopupActionModel',
@@ -3714,7 +3753,7 @@ export class FlowModelContext extends BaseFlowModelContext {
             popupSettings: {
               openView: {
                 // 仅在创建时持久化一份默认配置；运行时以本次 opts 为准，避免多个 opener 互相覆盖。
-                ...pickDefined(opts, ['dataSourceKey', 'collectionName', 'associationName', 'mode', 'size']),
+                ...pickDefinedKeys(opts, ['dataSourceKey', 'collectionName', 'associationName', 'mode', 'size']),
               },
             },
           },
@@ -3734,8 +3773,6 @@ export class FlowModelContext extends BaseFlowModelContext {
       // 统一语义：为即将打开的外部视图定义一个 PendingView（占位视图）
       const pendingType = (opts?.isMobileLayout ? 'embed' : opts?.mode || 'drawer') as any;
       const pendingInputArgs = { ...opts, viewUid, navigation: opts.navigation };
-      pendingInputArgs.filterByTk = pendingInputArgs.filterByTk || this.inputArgs?.filterByTk;
-      pendingInputArgs.sourceId = pendingInputArgs.sourceId || this.inputArgs?.sourceId;
 
       const pendingView = {
         type: pendingType,
@@ -3754,17 +3791,10 @@ export class FlowModelContext extends BaseFlowModelContext {
       } else if (on && typeof on === 'object' && typeof (on as any).eventName === 'string' && (on as any).eventName) {
         openEventName = (on as any).eventName;
       }
-      await model.dispatchEvent(
-        openEventName,
-        {
-          // navigation: false, // TODO: 路由模式有bug，不支持多层同样viewId的弹窗，因此这里默认先用false
-          // ...this.model?.['getInputArgs']?.(), // 避免部分关系字段信息丢失, 仿照 ClickableCollectionField 做法
-          ...opts,
-        },
-        {
-          debounce: true,
-        },
-      );
+      await model.dispatchEvent(openEventName, {
+        // navigation: false, // TODO: 路由模式有bug，不支持多层同样viewId的弹窗，因此这里默认先用false
+        ...opts,
+      });
     });
     this.defineMethod('getEvents', function (this: BaseFlowModelContext) {
       return this.model.getEvents();

package/src/flowSettings.ts

@@ -20,7 +20,13 @@ import { FlowRuntimeContext } from './flowContext';
 import { FlowEngine, untracked } from '.';
 import { FlowSettingsContextProvider, useFlowSettingsContext } from './hooks/useFlowSettingsContext';
 import type { FlowModel } from './models';
-import { ParamObject, StepSettingsDialogProps, ToolbarItemConfig } from './types';
+import {
+  DynamicFlowSource,
+  DynamicFlowSourceProvider,
+  ParamObject,
+  StepSettingsDialogProps,
+  ToolbarItemConfig,
+} from './types';
 import {
   compileUiSchema,
   FlowCancelSaveException,
@@ -128,6 +134,7 @@ export class FlowSettings {
   private engine: FlowEngine;
   #forceEnabled = false; // 强制启用状态，主要用于设计模式下的强制启用
   public toolbarItems: ToolbarItemConfig[] = [];
+  private dynamicFlowSourceProviders: DynamicFlowSourceProvider[] = [];
   #emitter: Emitter = new Emitter();
 
   constructor(engine: FlowEngine) {
@@ -463,6 +470,83 @@ export class FlowSettings {
     return [...this.toolbarItems];
   }
 
+  public registerDynamicFlowSourceProvider(provider: DynamicFlowSourceProvider): () => void {
+    const existingIndex = this.dynamicFlowSourceProviders.findIndex((item) => item.key === provider.key);
+    if (existingIndex !== -1) {
+      console.warn(
+        `FlowSettings: Dynamic flow source provider with key '${provider.key}' already exists and will be replaced.`,
+      );
+      this.dynamicFlowSourceProviders[existingIndex] = provider;
+    } else {
+      this.dynamicFlowSourceProviders.push(provider);
+    }
+
+    this.dynamicFlowSourceProviders.sort((a, b) => (a.sort || 0) - (b.sort || 0));
+
+    return () => {
+      const index = this.dynamicFlowSourceProviders.indexOf(provider);
+      if (index !== -1) {
+        this.dynamicFlowSourceProviders.splice(index, 1);
+      }
+    };
+  }
+
+  public hasDynamicFlowSourceProvider(model: FlowModel): boolean {
+    return this.dynamicFlowSourceProviders.some((provider) => {
+      try {
+        return provider.visible ? provider.visible(model) : true;
+      } catch (error) {
+        console.warn(`FlowSettings: Dynamic flow source provider '${provider.key}' visibility check failed.`, error);
+        return false;
+      }
+    });
+  }
+
+  public async getDynamicFlowSources(model: FlowModel): Promise<DynamicFlowSource[]> {
+    const t = getT(model);
+    const selfSource: DynamicFlowSource = {
+      key: 'self',
+      label: t('Current block'),
+      model,
+      sort: -1000,
+    };
+    const sources: DynamicFlowSource[] = [];
+    const seenKeys = new Set<string>(['self']);
+    const seenModelUids = new Set<string>([model.uid]);
+
+    for (const provider of this.dynamicFlowSourceProviders) {
+      try {
+        if (provider.visible && !provider.visible(model)) {
+          continue;
+        }
+
+        const providerSources = await provider.getSources(model);
+        for (const source of providerSources || []) {
+          if (!source?.key || !source.model) {
+            continue;
+          }
+          const key = String(source.key);
+          const uid = source.model.uid;
+          if (seenKeys.has(key) || seenModelUids.has(uid)) {
+            continue;
+          }
+          seenKeys.add(key);
+          seenModelUids.add(uid);
+          sources.push({
+            ...source,
+            key,
+            label: source.label || key,
+            sort: source.sort || 0,
+          });
+        }
+      } catch (error) {
+        console.warn(`FlowSettings: Dynamic flow source provider '${provider.key}' failed.`, error);
+      }
+    }
+
+    return [selfSource, ...sources.sort((a, b) => (a.sort || 0) - (b.sort || 0))];
+  }
+
   /**
    * 清空所有工具栏项目
    * @example

package/src/runjs-context/helpers.ts

@@ -46,12 +46,17 @@ export function createJSRunnerWithVersion(this: FlowContext, options?: JSRunnerO
     doc = {};
   }
   const deprecatedCtx = createRunJSDeprecationProxy(runCtx, { doc });
-  const globals: Record<string, any> = { ctx: deprecatedCtx, ...(options?.globals || {}) };
-  // 对字段/区块类上下文，默认注入 window/document 以支持在沙箱中访问 DOM API
-  if (modelClass === 'JSFieldModel' || modelClass === 'JSBlockModel') {
-    if (typeof window !== 'undefined') globals.window = window as any;
-    if (typeof document !== 'undefined') globals.document = document as any;
+  const browserGlobals: Record<string, any> = {};
+  if (typeof window !== 'undefined') {
+    browserGlobals.window = window;
+    if (typeof navigator !== 'undefined') {
+      browserGlobals.navigator = navigator;
+    }
   }
+  if (typeof document !== 'undefined') {
+    browserGlobals.document = document;
+  }
+  const globals: Record<string, any> = { ctx: deprecatedCtx, ...browserGlobals, ...(options?.globals || {}) };
   // 透传 JSRunnerOptions 其余配置（如 timeoutMs）
   const { timeoutMs } = options || {};
   return new JSRunner({ globals, timeoutMs });
@@ -59,7 +64,8 @@ export function createJSRunnerWithVersion(this: FlowContext, options?: JSRunnerO
 
 export function getRunJSScenesForModel(modelClass: string, version: RunJSVersion = 'v1'): string[] {
   const meta = RunJSContextRegistry.getMeta(version, modelClass);
-  return Array.isArray(meta?.scenes) ? [...meta!.scenes!] : [];
+  const scenes = meta?.scenes;
+  return Array.isArray(scenes) ? [...scenes] : [];
 }
 
 export function getRunJSScenesForContext(ctx: FlowContext, { version = 'v1' as RunJSVersion } = {}): string[] {

package/src/types.ts

@@ -612,6 +612,20 @@ export interface ToolbarItemConfig {
   sort?: number;
 }
 
+export interface DynamicFlowSource {
+  key: string;
+  label: React.ReactNode;
+  model: FlowModel;
+  sort?: number;
+}
+
+export interface DynamicFlowSourceProvider {
+  key: string;
+  sort?: number;
+  visible?: (model: FlowModel) => boolean;
+  getSources: (model: FlowModel) => DynamicFlowSource[] | Promise<DynamicFlowSource[]>;
+}
+
 export interface ApplyFlowCacheEntry {
   status: 'pending' | 'resolved' | 'rejected';
   promise: Promise<any>;

package/src/utils/index.ts

@@ -77,15 +77,6 @@ export {
   serializeCtxDateValue,
 } from './dateVariable';
 
-// 安全全局对象（window/document）
-export {
-  createSafeDocument,
-  createSafeWindow,
-  createSafeNavigator,
-  createSafeRunJSGlobals,
-  runjsWithSafeGlobals,
-} from './safeGlobals';
-
 // RunJS value helpers
 export { isRunJSValue, normalizeRunJSValue, extractUsedVariablePathsFromRunJS, type RunJSValue } from './runjsValue';
 

package/src/utils/resolveRunJSObjectValues.ts

@@ -8,7 +8,6 @@
  */
 
 import { isRunJSValue, normalizeRunJSValue } from './runjsValue';
-import { runjsWithSafeGlobals } from './safeGlobals';
 
 /**
  * Resolve an object's values, executing any RunJSValue entries via ctx.runjs.
@@ -29,7 +28,11 @@ export async function resolveRunJSObjectValues(ctx: unknown, raw: unknown): Prom
     if (isRunJSValue(value)) {
       const { code, version } = normalizeRunJSValue(value);
       if (!code.trim()) continue;
-      const ret = await runjsWithSafeGlobals(ctx, code, { version });
+      const runjsCtx = ctx as
+        | { runjs?: (code: string, variables?: Record<string, any>, options?: Record<string, any>) => Promise<any> }
+        | undefined
+        | null;
+      const ret = await runjsCtx?.runjs?.(code, undefined, { version });
       if (!ret?.success) {
         throw new Error(`RunJS execution failed for "${key}"`);
       }